iOS 14 Per-Network MAC Addresses

Quote:

---

Originally Posted by jcoehoorn

I have four SSIDs, each covering a separate area/zone of the campus (North, South, East, and West).

We're just big enough I don't want everyone in the same subnet/wireless broadcast domain, but not big enough I've been able to afford equipment capable doing 802.1x to split users into separate vlans for a single SSID in a user-friendly way. The good onboarding solutions for 802.1x are super expensive, and we're rural enough I can't count on campus visitors having cell service (curse you, AT&T. Your coverage map here is LIES.) which is key to how several of them work.

---

But you can do 802.1x with Unifi Gen 1 switches and WAPs... that stuff is CHEAP. Cheap enough that I don't even bother with unmanaged switches anymore. And if you've already got Unifi WAPs it's just a matter of using WPA2-Enterprise, and slapping in a RADIUS server somewhere. But you don't even have to go that far, just let the SSID's be your VLAN designation point and have your SSID's run campus wide! So you can chunk up the campus by group of human, instead of building proximity.

I'm slowly converting to Unifi, but I have nearly 200 APs, so it's gonna take a couple more years. And what I have now can do 802.1x. Most anything can do it. But a good onboarding experience to support the variety of devices... that's another issue.

Well, I guess that's the part that confuses me, because 802.1x via most wireless gear is just radius enabled WPA into a VLAN.

So I suppose the larger issue is figuring out how to get your multi-vendor stack to associate the correct VLANs with the correct SSIDs campus wide.

It's not just Apple. I have some Android devices with incomplete mac randomization implementations that can't be disabled at all. Here's one example from a Wahoo Fitness ELEMNT Roam. Every time it turns on, it connects to the network with a new mac address.

Attachment 10539

Yes, Android started playing with this in version 8, but didn't enable it for general connectivity until version 10. But, I believe in version 9 you could manually turn it on.

Anyway, on Android 10 all of this is baked into the WiFI UI, under advanced.

If you've got 8-9 or one of the dot levels between you need to enable Developer Mode, then open developer options and scroll down to networking, it's in there. You CAN turn it off for devices you control... if it's a full version of Android.

Regarding the above: https://support.wahoofitness.com/hc/...T-ROAM-to-WiFi

Quote:

---

ELEMNT/BOLT/ROAM use dynamic, randomized MAC addresses for privacy and security purposes as prescribed in Android documentation, making them incompatible with networks utilizing MAC address filters or whitelists.

---

So if you can't get into developer mode to turn it off... that device is designed to behave this way, and yes... those devices are going to be a problem if they show up on device limited Untangle protected networks, AKA the normal subscriptions. But only for a short period... I don't know when Untangle decides a host isn't active, but known devices is not the same thing as maximum active devices!