topic Re: How can I block more than 128 users in zd1200 in ZoneDirector

How can I block more than 128 users in zd1200

kelvin_rodrigue — Thu, 07 Oct 2021 18:44:48 GMT

Good afternoon, my query is the following: in the director zone I can only block 128 users, I work in a school and students should not be able to connect their cell phones to the network, all access lists by L2 or L3 only allow me to create up to 128 mac, is there any way to block more? Thanks in advance

Re: How can I block more than 128 users in zd1200

syamantakomer — Thu, 07 Oct 2021 19:25:01 GMT

Hi Kelvin,

You can use radius attributes to allow/deny the access.

Within ZD there is no way to go beyond 128 entries to block clients using an ACL.

Re: How can I block more than 128 users in zd1200

kelvin_rodrigue — Thu, 07 Oct 2021 19:59:08 GMT

thanks a lot

Re: How can I block more than 128 users in zd1200

david_black_594 — Thu, 07 Oct 2021 23:08:52 GMT

I'd recommend using a device policy that has deny rules for ios and android. That approach works for any wlan (open, psk, 802.1x...) regardless of authentication method. Alternatively, you could define the policy to allow only certain devices (eg, windows laptops and chromebooks) and block everything else.

Re: How can I block more than 128 users in zd1200

syamantakomer — Fri, 08 Oct 2021 21:25:40 GMT

@david_black_5940365 that is also a good way to block the clients, however, what if teachers/staff also using cell phones and admin wants to allow them?

If that is the case, they have to crated a new dedicated SSID just for staff/teachers. On the student WLAN, we can use the device policy and block android and iOS.

Re: How can I block more than 128 users in zd1200

itdept_head_me — Mon, 11 Oct 2021 09:02:06 GMT

It won't work reliably, since the "fingerprinting" used by ruckus seems out of date.

there are many other device types like "speakers" that don't fall into any group.

so you cannot allow or block them reliably.

it's always a bad idea to have computers/phones on the same SSID

specifically because i have recently seen Russians, coming in on the mobile phone via other network mappings then using the phones to "leverage" the internal network by using the phone as a bridge, between networks.

They also use the phone as a way to DDOS the DHCP into using all the leases.

Re: How can I block more than 128 users in zd1200

david_black_594 — Mon, 11 Oct 2021 11:58:12 GMT

@itdept_head_me

All the OP wanted to do is block cell phones for students - that’s all. It will work fine for that. You’re over complicating things by adding speakers, etc that were not asked for.