Jonathan, I was thinking the same thing about possibility of multiple macs onto a single unique certificate for Airwave.
I am curious though. Does anyone happen to know the maximum number of "unique/randomized mac addresses" that can be allotted? Christopher Johnson Wireless Network Engineer Office of Technology Solutions | Illinois State University (309) 438-8444 Stay connected with ISU IT news and tips with @ISU IT Help on Facebook and Twitter -----Original Message----- From: The EDUCAUSE Wireless Issues Community Group Listserv <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> On Behalf Of Jonathan Waldrep Sent: Monday, July 20, 2020 12:46 PM To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU Subject: Re: [WIRELESS-LAN] MAC Randomization, a step further... [This message came from an external source. If suspicious, report to ab...@ilstu.edu<mailto:ab...@ilstu.edu>] For .1x connections, per device certs seems to be the way to go. I'm not sure if Airwave and other monitoring tools have a way to consolidate multiple macs to a single device based on the cert, though. For guests, I've been tossing around the idea of an open network. No .1x, no PSK, no captive portal. Affiliates would be encouraged to use eduroam via SSO nag. Columbia University had a presentation on how they are doing the open network side of this. I suspect the most difficult part will be getting legal on board. Who has an open network? What have your experiences been? This is only tangentially related, so feel free to split it into a new thread. On 2020-07-20 15:18:46, Johnson, Christopher wrote: > Default behavior matters indeed. Got a preview of what to expect over the > weekend. > > Found one individual that was in Aruba Airwave “12 Times” for their iPhone > 14.0 over past couple of weeks and another “6 times”. It appears that as long > as the device remains “connected” to the network beyond the 24 hours, the MAC > Address will remain the same. Although if they’re fully de-authenticated or > move say into an elevator or outside (or a class phone reboot occurs in the > pocket) – then the MAC Address will update upon establishing a new connection > – that is just the initial observation I saw. > Christopher Johnson > Wireless Network Engineer > Office of Technology Solutions | Illinois State University > (309) 438-8444 > > Stay connected with ISU IT news and tips with @ISU IT Help on > Facebook<https://www.facebook.com/ISUITHelp/> and > Twitter<https://twitter.com/ISUITHelp> > From: The EDUCAUSE Wireless Issues Community Group Listserv > <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> On Behalf Of Enfield, Chuck > Sent: Tuesday, July 14, 2020 12:36 PM > To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU > Subject: Re: [WIRELESS-LAN] MAC Randomization, a step further... > > [This message came from an external source. If suspicious, report to > ab...@ilstu.edu<mailto:ab...@ilstu.edu>] > True, but default behavior matters. > > From: The EDUCAUSE Wireless Issues Community Group Listserv > <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCA > USE.EDU>> On Behalf Of Rios, Hector J > Sent: Tuesday, July 14, 2020 1:12 PM > To: > WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAU > SE.EDU> > Subject: Re: [WIRELESS-LAN] MAC Randomization, a step further... > > Please note that MAC randomization is not just a feature of Android and iOS. > It is supported across other operating systems. > > Hector Rios, Wireless Network Architect The University of Texas at > Austin > > > > From: The EDUCAUSE Wireless Issues Community Group Listserv > <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCA > USE.EDU>> On Behalf Of Jonathan Miller > Sent: Tuesday, July 14, 2020 11:32 AM > To: > WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAU > SE.EDU> > Subject: Re: [WIRELESS-LAN] MAC Randomization, a step further... > > For those of us using ClearPass to authenticate users to eduroam, does this > mean that every iOS device will get registered as a new endpoint every day? > For others, does your NAC store a client's MAC persistently? I'm assuming > that the answer to both is yes. > > How can we plan for the impact of that on our databases? Should we delete > all iOS and Android devices after 48 hours? Am I missing something obvious? > > Jonathan Miller > Senior Network Analyst > Franklin and Marshall College > > > On Fri, Jul 10, 2020 at 4:37 PM Enfield, Chuck > <cae...@psu.edu<mailto:cae...@psu.edu>> wrote: > PS – My plan for supporting our guest network will be to tell any user who > contacts us with an Apple device that the network is fine and they should > contact Apple for device support. I can’t get away with that for our > enterprise network, but Apple is going to own the guest problem. > > From: The EDUCAUSE Wireless Issues Community Group Listserv > <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCA > USE.EDU>> On Behalf Of Enfield, Chuck > Sent: Friday, July 10, 2020 4:34 PM > To: > WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAU > SE.EDU> > Subject: Re: [WIRELESS-LAN] MAC Randomization, a step further... > > My point wasn’t to debate Passpoint either. I’m wondering if Apple actually > has a plan, and if so, if they’ve bothered to tell anybody. > > From: The EDUCAUSE Wireless Issues Community Group Listserv > <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCA > USE.EDU>> On Behalf Of Tim Cappalli > Sent: Friday, July 10, 2020 4:22 PM > To: > WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAU > SE.EDU> > Subject: Re: [WIRELESS-LAN] MAC Randomization, a step further... > > Passpoint is not just about mobile network operators. Any identity provider > can provision a Passpoint profile. That is the whole drive behind > OpenRoaming. The industry goal is that every user has at least 2 Passpoint > profiles on their devices: one tied to their enterprise/school identity and > the other tied to a personal identity. The traditional enterprise/school > onboarding process stays largely the same, except some additional Passpoint > logic is added. > > Mobile network operators / cell providers are only one (optional) piece of > the puzzle. > > Probably should start a separate thread for anything deeper on Passpoint > beyond it being a solution for network access. Don’t want to take away from > the OG conversation. > > tim > > From: The EDUCAUSE Wireless Issues Community Group Listserv > <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCA > USE.EDU>> > Date: Friday, July 10, 2020 at 16:17 > To: > WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAU > SE.EDU> > <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCA > USE.EDU>> > Subject: Re: [WIRELESS-LAN] MAC Randomization, a step further... > Understood, but few Wi-Fi operators actually support Passpoint on their > networks. Since Apple is eliminating the alternatives, they either must be > idiots (my bet) or have a proposal for what we should all being doing instead. > > I still get really confused looks when I try to discuss Passpoint with my > contacts at the major cellular providers, so it can’t possibly be a realistic > option for most of us. > > From: The EDUCAUSE Wireless Issues Community Group Listserv > <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCA > USE.EDU>> On Behalf Of Tim Cappalli > Sent: Friday, July 10, 2020 4:07 PM > To: > WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAU > SE.EDU> > Subject: Re: [WIRELESS-LAN] MAC Randomization, a step further... > > Not sure I follow. Passpoint is an industry-wide solution for secure Wi-Fi > roaming. Passpoint has been supported on iOS and macOS (along with Windows > and Android) for a number of years. > > I definitely don’t follow this comment: “you can’t onboard your Apple to > enable identity-based auth.” > > tim > > > From: The EDUCAUSE Wireless Issues Community Group Listserv > <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCA > USE.EDU>> > Date: Friday, July 10, 2020 at 16:04 > To: > WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAU > SE.EDU> > <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCA > USE.EDU>> > Subject: Re: [WIRELESS-LAN] MAC Randomization, a step further... > So you can’t use an Apple MAC address for guest auth, and you can’t onboard > your Apple to enable identity-based auth. Apple must be thinking that they > can drag the entire world, kicking and screaming, into federated > authentication that Apple products ship knowing how to do (Passpoint, > openroaming, etc.). Do they have a proposal for this that I missed? > > From: The EDUCAUSE Wireless Issues Community Group Listserv > <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCA > USE.EDU>> On Behalf Of Rios, Hector J > Sent: Friday, July 10, 2020 2:56 PM > To: > WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAU > SE.EDU> > Subject: [WIRELESS-LAN] MAC Randomization, a step further... > > Apple is moving forward with their privacy efforts. The next step is to > randomize MAC addresses when connecting to an AP, not just when probing. This > is coming soon. > > https://globalreachtech.com/blog-mac-randomisation-apple/<https://nam0 > 1.safelinks.protection.outlook.com/?url=https%3A%2F%2Fglobalreachtech. > com%2Fblog-mac-randomisation-apple%2F&data=02%7C01%7Ccae104%40PSU.EDU% > 7C415ae85abe5b47f468c008d82818ff37%7C7cf48d453ddb4389a9c1c115526eb52e% > 7C0%7C0%7C637303435123896631&sdata=JCUJ5x0dtP2tE%2FdtyI6BL%2BnEkWbzdPT > 9GfbhlsHxaGs%3D&reserved=0> > > This is from Apple. Luckily, there is a way to disable private addresses. I > just don’t know if it will be ON by default. > https://support.apple.com/en-qa/HT211227<https://nam01.safelinks.prote > ction.outlook.com/?url=https%3A%2F%2Fsupport.apple.com%2Fen-qa%2FHT211 > 227&data=02%7C01%7Ccae104%40PSU.EDU%7C415ae85abe5b47f468c008d82818ff37 > %7C7cf48d453ddb4389a9c1c115526eb52e%7C0%7C0%7C637303435123896631&sdata > =5ha1jGINKGYfKjiELQ1NMmeepv34HT0ibQTe%2Bi2c5IU%3D&reserved=0> > > Happy Friday! > > Hector Rios, Wireless Network Architect The University of Texas at > Austin > > > ********** > Replies to EDUCAUSE Community Group emails are sent to the entire > community list. If you want to reply only to the person who sent the > message, copy and paste their email address and forward the email > reply. Additional participation and subscription information can be > found at > https://www.educause.edu/community<https://nam01.safelinks.protection. > outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity&data=02%7C > 01%7Ccae104%40PSU.EDU%7C415ae85abe5b47f468c008d82818ff37%7C7cf48d453dd > b4389a9c1c115526eb52e%7C0%7C0%7C637303435123906588&sdata=wMhPBTQsGIk9A > anfCKMF0rbI%2BvM8vs2HL3prNvGixAQ%3D&reserved=0> > > ********** > Replies to EDUCAUSE Community Group emails are sent to the entire > community list. If you want to reply only to the person who sent the > message, copy and paste their email address and forward the email > reply. Additional participation and subscription information can be > found at > https://www.educause.edu/community<https://nam01.safelinks.protection. > outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity&data=02%7C > 01%7Ccae104%40PSU.EDU%7C415ae85abe5b47f468c008d82818ff37%7C7cf48d453dd > b4389a9c1c115526eb52e%7C0%7C0%7C637303435123906588&sdata=wMhPBTQsGIk9A > anfCKMF0rbI%2BvM8vs2HL3prNvGixAQ%3D&reserved=0> > > ********** > Replies to EDUCAUSE Community Group emails are sent to the entire > community list. If you want to reply only to the person who sent the > message, copy and paste their email address and forward the email > reply. Additional participation and subscription information can be > found at > https://www.educause.edu/community<https://nam01.safelinks.protection. > outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity&data=02%7C > 01%7Ccae104%40PSU.EDU%7C415ae85abe5b47f468c008d82818ff37%7C7cf48d453dd > b4389a9c1c115526eb52e%7C0%7C0%7C637303435123916548&sdata=wq855AoCon41N > yEKBXZvpIXGc5wJhzGs62OLqzbwDVc%3D&reserved=0> > > ********** > Replies to EDUCAUSE Community Group emails are sent to the entire > community list. If you want to reply only to the person who sent the > message, copy and paste their email address and forward the email > reply. Additional participation and subscription information can be > found at > https://www.educause.edu/community<https://nam01.safelinks.protection. > outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity&data=02%7C > 01%7Ccae104%40PSU.EDU%7C415ae85abe5b47f468c008d82818ff37%7C7cf48d453dd > b4389a9c1c115526eb52e%7C0%7C0%7C637303435123916548&sdata=wq855AoCon41N > yEKBXZvpIXGc5wJhzGs62OLqzbwDVc%3D&reserved=0> > > ********** > Replies to EDUCAUSE Community Group emails are sent to the entire > community list. If you want to reply only to the person who sent the > message, copy and paste their email address and forward the email > reply. Additional participation and subscription information can be > found at > https://www.educause.edu/community<https://nam01.safelinks.protection. > outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity&data=02%7C > 01%7Ccae104%40PSU.EDU%7C415ae85abe5b47f468c008d82818ff37%7C7cf48d453dd > b4389a9c1c115526eb52e%7C0%7C0%7C637303435123926506&sdata=vdETrPxboAI3H > ywAy1L%2BFllt%2Ft37M1bgobsAldAcACY%3D&reserved=0> > > ********** > Replies to EDUCAUSE Community Group emails are sent to the entire > community list. If you want to reply only to the person who sent the > message, copy and paste their email address and forward the email > reply. Additional participation and subscription information can be > found at > https://www.educause.edu/community<https://nam01.safelinks.protection. > outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity&data=02%7C > 01%7Ccae104%40PSU.EDU%7C415ae85abe5b47f468c008d82818ff37%7C7cf48d453dd > b4389a9c1c115526eb52e%7C0%7C0%7C637303435123926506&sdata=vdETrPxboAI3H > ywAy1L%2BFllt%2Ft37M1bgobsAldAcACY%3D&reserved=0> > > ********** > Replies to EDUCAUSE Community Group emails are sent to the entire > community list. If you want to reply only to the person who sent the > message, copy and paste their email address and forward the email > reply. Additional participation and subscription information can be > found at > https://www.educause.edu/community<https://nam01.safelinks.protection. > outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity&data=02%7C > 01%7Ccae104%40PSU.EDU%7C415ae85abe5b47f468c008d82818ff37%7C7cf48d453dd > b4389a9c1c115526eb52e%7C0%7C0%7C637303435123936461&sdata=7J0VwlCLSZ6KJ > Jozx9FNyRk2Dlf5XDTPfPqvxmszkOY%3D&reserved=0> > > ********** > Replies to EDUCAUSE Community Group emails are sent to the entire > community list. If you want to reply only to the person who sent the > message, copy and paste their email address and forward the email > reply. Additional participation and subscription information can be > found at > https://www.educause.edu/community<https://nam01.safelinks.protection. > outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity&data=02%7C > 01%7Ccae104%40PSU.EDU%7C415ae85abe5b47f468c008d82818ff37%7C7cf48d453dd > b4389a9c1c115526eb52e%7C0%7C0%7C637303435123936461&sdata=7J0VwlCLSZ6KJ > Jozx9FNyRk2Dlf5XDTPfPqvxmszkOY%3D&reserved=0> > > This message is from an external sender. Learn more about why this > matters.<https://nam01.safelinks.protection.outlook.com/?url=https%3A% > 2F%2Fut.service-now.com%2Fsp%3Fid%3Dkb_article%26number%3DKB0011401&da > ta=02%7C01%7Ccae104%40PSU.EDU%7C415ae85abe5b47f468c008d82818ff37%7C7cf > 48d453ddb4389a9c1c115526eb52e%7C0%7C0%7C637303435123946417&sdata=nxeBA > 6kfrcWHs1rgsBwksxNq6Sd4zNpQOO1SPF1N%2BzI%3D&reserved=0> > > > ********** > Replies to EDUCAUSE Community Group emails are sent to the entire > community list. If you want to reply only to the person who sent the > message, copy and paste their email address and forward the email > reply. Additional participation and subscription information can be > found at > https://www.educause.edu/community<https://nam01.safelinks.protection. > outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity&data=02%7C > 01%7Ccae104%40PSU.EDU%7C415ae85abe5b47f468c008d82818ff37%7C7cf48d453dd > b4389a9c1c115526eb52e%7C0%7C0%7C637303435123946417&sdata=Nycy7xePhAhUE > LpAs8eiZyzJfwS7HTQjcurCtSCMThk%3D&reserved=0> > > ********** > Replies to EDUCAUSE Community Group emails are sent to the entire > community list. If you want to reply only to the person who sent the > message, copy and paste their email address and forward the email > reply. Additional participation and subscription information can be > found at https://www.educause.edu/community > > ********** > Replies to EDUCAUSE Community Group emails are sent to the entire > community list. If you want to reply only to the person who sent the > message, copy and paste their email address and forward the email > reply. Additional participation and subscription information can be > found at https://www.educause.edu/community -- Jonathan Waldrep Network Engineer Network Infrastructure and Services Virginia Tech ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community
