iOS14 Private WiFi Addressing

[Brimstone]

Be aware...

 

If your network identification or web filtering relies on MAC addresses and you have up to date iPads you may need to look at this.

 

https://support.apple.com/en-gb/HT211227

[StevieM]

Thanks for the information, @Brimstone. We use reserved addresses in a specific range to identify and apply different web filtering to student and staff devices, and that new feature could have caused us some real problems.

 

I've now updated the Wi-Fi Authorisation profile on Mosyle Manager to Disable Association MAC Randomization.

[Davit2005]

It also can play havoc where you have captive portal or BYOD/Guest WiFi access systems that relies on MAC addresses. Especially when the devices per person are limited.

 

Windows 10 home had this feature a few years ago and I think Andriod phones may well of done too.

 

It is a bit confusing calling it Private addresses they should of used the term Random MAC addresses or MAC randomisation maybe in brackets, nearly everyone is going to have Private IP addresses, oh well Apple for you.

Edited September 25, 2020 by Davit2005

[Jamman960]

Thanks for the heads up

 

This could make tracking down iPads interesting assuming the MDM is likely to only show the actual mac address, we occasionally end up trawling through logs to find when a certain iPad last connected to prove its been taken off site by a pupil. We also use it to spot ipads that are on the wifi using the wrong login but pairing with iPads will be a nightmare now

 

had hoped this would be MDM configurable but its not appearing as an option in JamF school

[Net-Ctrl]

I think this will be the case from Android v10 as well.

 

There has actually just been a blog post about this released here if you want to read further about it:

 

https://www.commscope.com/blog/2020/so-whats-the-big-deal-about-mac-randomization/

https://www.commscope.com/blog/2020/so-whats-the-big-deal-about-mac-randomization-part-2/

 

The second post does touch on some Ruckus technologies, but for the most part it's just an overview of MAC randomisation.

[Brimstone]

Thanks for the heads up

 

This could make tracking down iPads interesting assuming the MDM is likely to only show the actual mac address, we occasionally end up trawling through logs to find when a certain iPad last connected to prove its been taken off site by a pupil. We also use it to spot ipads that are on the wifi using the wrong login but pairing with iPads will be a nightmare now

 

had hoped this would be MDM configurable but its not appearing as an option in JamF school

If they are shared iPads just create a naming convention, use that same naming convention for "users" in the MDM and restrict renaming of the iPads, trying to track them by serial or MAC is unworkable.

[caffrey]

Bit of a pain, IOS 14 devices come in and we have to switch of Private Wifi Addresses (It's on by default) to get them on the wifi (Radius based) Devices just say no internet connection otherwise

[RLR]

We have students join the wifi during the iPad setup. We don't push the wifi profile out as they sign in via radius to get filtering. This setting seems to be per wifi rather then a general iPad setting. I guess the only way for us to turn this off would be to push out the wifi profile but this doesn't make sense as they can't get this profile until they connect to the internet which is whilst they set the ipad up.

[FN-GM]

Does the MAC address randomise multiple times on the same SSID? Or does the same Mac Address stay static on a particular SSID?

 

The Apple website says it’s per network. But that could be subnet rather than SSID?

Edited October 8, 2020 by FN-GM

[atcoates]

Our MDM wifi payload has this so will hopefully solve the issue.