Wireless Access

I am trying to limit a subset of clients to only associate to 1 particular SSID and never associate to any of the other 3 SSIDs.  Has anyone had any experience in achieving this?  These clients are specific Apple IPhones and are only used by certain employees, so it is not an issue of "Guest" access.

You could put them in a role that denies all layer 3 access if they connect to the other SSIDS, but there is really no way to stop them from associating to the SSID. It's a client decision.

You might want to check the latest Profile Manager from Apple and see if a configuration profile can block certain networks. I know Windows can do this via Group Policy or netsh scripts.

If you have Clearpass, AND you can get a list of MAC addresses, you can limit the access using clearpass's logic using the MAC address and SSID names in the services.

Unfortunately, we do not have Clear Pass.

Creating a separate role for these guys may be the answer.  The Apple phones were configured to only associate to the proper SSID, but apparently someone knows how to override that, and connect to an Internet facing SSID.  Thanks for the suggestion!!

You could use dhcp fingerprinting to give them a block-all role when they connect to an unauthorized ssid.

This'll block all devices with that fingerprint though so no way do discern allowed iphones vs disallowed ones for example.