This concept explains how wireless clients use random (locally administered) MAC addresses, why they improve privacy, and how Cisco controllers control their use within networks.

A random MAC address is a locally administered hardware address that

is generated by a device (instead of assigned by the manufacturer),
helps protect user privacy by making device tracking more difficult, and
can be permitted or denied on wireless networks through controller settings.

Random MAC address denial

Wireless clients traditionally use manufacturer-assigned, globally unique MAC addresses (burn-in addresses) for network association. Devices may also use locally administered, random MAC addresses for Wi-Fi operations to improve privacy. Network administrators can deny access to these clients using this feature.

Beginning with Cisco IOS XE 17.5.1, access controllers can block clients with random MAC addresses using the local-admin-mac deny feature. This feature is disabled by default.

Note

This feature is not supported on Cisco Wave 1 access points.

Example: Denying Random MAC Address Clients

When the local-admin-mac deny knob is enabled on the controller, a client attempting to join the network with a random MAC address is rejected, preventing unauthorized or untraceable devices from accessing the wireless network.

For example, a phone may use a new random MAC address whenever it joins a public Wi-Fi network, which prevents tracking by Wi-Fi infrastructure or third parties.

Configure random MAC address denial (CLI)

Prevent unauthorized or random MAC devices from associating with your WLAN by enabling the random MAC address denial feature on your wireless controller through the CLI.

To stop the entry of clients with random MAC addresses from joining a wireless network, enable the random MAC address deny knob by following these steps.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure the WLAN policy profile. Example: `Device(config)# wlan wlan-profile-name <1-4096> SSID-network-name`
	3.	Shut down the WLAN. Example: `Device(config-wlan)# shutdown`
	4.	Enable the random MAC address deny knob. Example: `Device(config-wlan)# local-admin-mac deny` Use the no form of this command to disable the feature.
	5.	Enable the WLAN. Example: `Device(config-wlan)# no shutdown`
	6.	Save the configuration, exit the configuration mode, and return to privileged EXEC mode. Example: `Device(config-wlan)# end`

Devices using randomized MAC addresses are prevented from joining the specified wireless SSID.

Verify denial of clients with a random MAC address

To verify the denial of a client with a random MAC address, run the show wlan name wlan-profile-name | begin locally command:

Device# show wlan name laa | begin locally
Locally Administered Address Configuration
Deny LAA clients                           : Enabled

To verify if a client address is a random MAC address, run the show wireless client mac-address MAC-address detail command:

Device# show wireless client mac-address 72xx.38xx.2axx detail  
Client MAC Address	: 72xx.38xx.2axx
Client MAC Type	   : Locally Administered Address
Client IPv4 Address      : 192.0.2.1
Client IPv6 Addresses    : 2001:DB8::71xx:27xx:a7xx:efxx
Client Username          : 72xx.38xx.2axx

To verify how many random MAC clients are present in the system, run the show wireless stats client detail command:

Device# show wireless stats client detail 
Client Summary
-----------------------------
Current Clients : 1
Excluded Clients: 0
Disabled Clients: 0
Foreign Clients : 0
Anchor Clients  : 0
Local Clients   : 1
Idle Clients    : 0
Locally Administered MAC Clients: 1

To display the statistics of a specific client, run the show wlan id <1-4096> client stats command:

Device# show wlan id 8 client stats
Wlan Profile Name: wlan-profile, Wlan Id: 8
Current client state statistics:
-----------------------------------------------------------------------------
  Authenticating         : 0
  Mobility               : 0
  IP Learn               : 0
  WebAuth Pending        : 0
  Run                    : 1
Locally Administered MAC Clients         : 1

Note

Run the show configuration wlan wlan-name command on an AP, to view the status of the locally administered address (LAA) on the WLAN.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.