Configure Media Access Control (MAC) Address Filtering on a Wireless Access Point (WAP)

Available Languages

Download Options

PDF (804.8 KB)
View with Adobe Reader on a variety of devices
ePub (940.9 KB)
View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
Mobi (Kindle) (713.1 KB)
View on Kindle device or Kindle app on multiple devices

Updated:December 11, 2018

Document ID:SMB5081

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Objective

Media Access Control (MAC) Address filtering lets you list down the MAC addresses of the wireless clients connected to your network, effectively creating a known-only devices list. You can then grant or deny permission for these devices on the list to connect to the network and its resources, depending on your requirement.

MAC address filtering can be enabled or disabled per Virtual Access Point (VAP) on a wireless router and a wireless access point (WAP). In addition, a VAP can be configured to look at a MAC filter list on an external Remote Authentication Dial-In User Service (RADIUS) server.

In this scenario, a list of MAC addresses will be denied permission to connect to the network and its resources. This means that even if these devices have the correct password, they still cannot establish a connection to the WAP and its wireless network.

This article aims to show you how to configure MAC address filtering on a WAP.

Applicable Devices

WAP131
WAP351
WAP371

Software Version

1.0.2.14 - WAP131, WAP351
1.3.0.4 - WAP371

Configure MAC Address Filtering

Add a MAC Address to the List

Step 1. Log in to the web-based utility of the access point and choose Wireless > MAC Filtering.

Step 2. Choose the appropriate filter to be deployed in the Filter area. The options are:

Allow only stations in list - This option only lets devices with its MAC address included in the filter list to connect to the network. All others will be blocked.
Block all stations in list - This option denies connection requests from devices whose MAC addresses are in the filter list. All others will be allowed.

Note: In this example, Block all stations in list is chosen.

Step 3. In the MAC Address fields, enter the MAC Address you want to add to the list.

Note: In this example, a device that has the MAC address 28:f0:76:2a:21:92 is added to the list.

Step 4. Click the Add button.

Step 5. Verify that the MAC address you added appears inside the Stations List box and then, click Save.

You now have successfully added a MAC Address to the MAC Filter list.

Apply the MAC Filter List to a VAP

Step 1. Choose Wireless > Networks.

Step 2. Choose the Radio for the VAP where the filter list needs to be applied to.

Note: In this example, Radio 1 (5 GHz) is chosen.

Step 3. Choose the SSID where the filter list needs to be applied to.

Note: In this example, the filter will be applied to the ForMAC network.

Step 4. Click the Edit button.

Step 5. Choose the source of the filter from the MAC Filter drop-down list. The options are:

Disabled - This option deactivates MAC Filtering on the chosen VAP.
Local - This option uses the list created in the Access point.
RADIUS - This option makes use of a RADIUS server for the MAC filter.

Note: In this example, Local is chosen.

Step 6. Click Save.

You should now have applied MAC filtering to the chosen VAP. The device whose MAC address is listed will not be able to establish a connection to the network even if the correct password is entered.