MAJOR iOS 14, iPadOS 14 and watchOS 7 mac address/network changes!!!

[Cazale]

Sorry if this has been mentioned before. I had a quick look but couldn't see anything:

 

Apple has introduced a feature called "private address" feature in IOS14, iPadOS 14 and watchOS 7, this is ENABLED by default!

 

This feature effectively creates a virtual MAC address and, instead of using the hardware MAC, uses the this new fake MAC address to connect to WiFi networks. As this is enabled by default (unless you limit it with MDM), this means the MAC addresses of ALL of your devices have changed!

 

There is some conflicting stories out there that say these MAC addresses change every 24 hours (with some very limited testing: that's not something I can see on our network).

 

However, this does still seriously affect DHCP (effectively every Apple device is going to get, at least, a second DHCP lease, that can have serious effects if your pool isn't big enough!), BYOD, IP whitelisting and of course, MAC address filtering.

 

To provide a real world example: if you've created an IP space for a set of iPads so they can print without authentication, or so teachers can bypass a filter (etc), all of those iPads now have a different MAC address, so will now also have different IP addresses.

 

Of course, it also means that if you manage multiple WiFI networks, the same device will have different MAC addresses/IPs/etc across the networks.

 

This is quite a major change that anyone with IOS devices needs to know about!

[Cazale]

Some more info on the potential impact on WiFi networks here.

[FN-GM]

There is a topic about this somewhere.

 

I haven’t found the pool needs anymore up addresses.

 

In addition we shouldn’t really be authenticating against IP our MAC Address. It isn’t secure.

 

I can understand needing firewall rules etc for an entire subnet but one specific device?

 

As far as I am aware if the device roams to a different network with the same config on the SSID it retains the same Mac.

[CHiLL]

We were effected by this. We use a MAC address deny filter on our DHCP scopes for our open (captive portal) WiFi networks, to prevent the iPads from joining it. They're configured to join a specific WiFi via the MDM, though they'll just not connect sometimes, maybe when traversing through the school, hopping from AP to AP. On disconnected iPads, the students browse the list of available WiFis and select one they can connect to, usually the open WiFi. Once joined, the iPad remembers the connection and join it automatically if it sees it first. When joined to this WiFi, the captive portal kicks in and the user has to log in. The issue is that the user doesn't log out, so it remembers them for 6 days (based on Smoothwall login time)...and when the next user uses the iPad (as they're bookable resources), they're effectively browsing the Internet as the first user. Because the user has selected the open network, the iPad will remember it, so now has two known networks in it's list and it will connect to the first one it sees, which is often the open network.

 

So we implemented the MAC filtering to deny the iPads from getting DHCP addresses from that VLAN, so it'd fall back to the configured WiFi.

Edited November 13, 2020 by CHiLL

[Brimstone]

Here...

 

http://www.edugeek.net/forums/netbooks-pda-phones/217611-ios14-private-wifi-addressing.html

[chazzy2501]

This is the default on Android 11 as well, my Pixel2 XL is doing this also. My iphone SE was having trouble with guest access but it can be turned off. Fine for personal devices but what a pain for managed! Edited November 13, 2020 by chazzy2501