Blocking a user from a particular SSID

[clayton_taverni]

We have an SSID that needs authentication and another SSID that just needs a password.  All on the same VLAN.

Is there a way to block a user via MAC address or whatever from using the non-authenticated SSID and forcing them to use the SSID that requires authentication?

I don't want to block the user from the network, I just want them to have to authenticate to connect to the wireless.

And it's just a small set of users, I can't remove or change the password on the non-authentication SSID.

[michael_brado]

Yes, you can create an L2-L7 Access Control List containing the client MAC addresses you want to Deny.
Then under your non-authenticated WLAN, Advanced Options, apply the L2-L7 ACL.

[clayton_taverni]

This is perfect.  Thanks.