Find a device from IP...?

[Koldov]

We have a rather legacy system here, but those in this area who had BSF funding to upgrade the network infrastructure should know it well (as I presume all schools had similar networks put in)....

 

Cisco Core & Edge switches, a few VLANS (Curriculum Wi-Fi & Wired, Admin Wi-Fi & Wired, Servers & Printers) and a WLC split into 2 x SSID (Curriculum & Admin).

 

It's always worked OK and although we've had a few changes over the years (re-IP-ing for LGfL, Guest SSID added etc.) it's basically the same. The thing is it was set-up so that the switches do the DHCP and we have DNS on our server...

 

Bearing that in mind, we've had a request from the Governors for details about our filtering (gearing up to get us DfE/KCSIE compliant I guess) so I was going through the reports and found a few concerns...

 

We filter based on IP and each child has a device recorded every time they use it, but I've now found that for some reason iPads don't seem to appear at all in our DNS (I thought it might be a Wi-Fi 'thing' but all the laptops DO appear in our DNS... anyway I thought in that case they might appear in the WLC so I logged in and went to 'Clients' and filtered on the particular SSID the device should have connected to and there are hundreds of devices, but there are no IP addresses only MAC...

 

A little research has uncovered that the Firmware on the Cisco 5508 WLC is at '7.4.150.0' but according to this "If you want a display which shows the client's MAC address, IP address, username, etc (see image below), then the controller firmware version will not support this. The feature was enabled in 8.0.X.X."

 

So, it appears I'm stuck now without a definitive way to find out which iPad has a particular IP address, we have a 'support' contract for the network but it is only break/fix and config is going to cost (no I am not risking downloading and flashing our WLC and APs)...

 

Any other reasonable ideas ?

 

I can see a big change coming...

[hallb15]

What MDM do you use? It should show you the SN, MAC and IP addr of the managed iPads.

[CHiLL]

Newer iOS/iPadOS and Android devices have private MAC addresses enabled by default, which are temporary and randomised MAC addresses. This means it can be extremely difficult to identify a device from it's MAC address. If you aren't using an MDM and can't do the method @hallb15 is suggesting, I'd try and find out why your devices aren't appearing in DNS. I'd get hold of one of the devices and try and find out. I previously didn't have devices showing in DNS, because they were on a /21 subnet, which spans 4 "subnets", but only the first subnet was defined as a DNS scope. For example, for the subnet 10.1.20/29 - only 10.1.20.0 was showing as a scope in DNS. I had to manually add the extra three scopes (10.1.21.0, 10.1.22.0 and 10.1.23.0) and configure replication/failover for IP addresses to start showing those too. Edited April 29, 2024 by CHiLL

[Koldov]

What MDM do you use? It should show you the SN, MAC and IP addr of the managed iPads.

 

We use Cisco Meraki, but hardly any of them are displaying the 'LAN IP'...

 

Must be a setting somewhere as there are a few that are showing.

[Koldov]

As usual, opened up a can of worms...

 

I found the setting on the iPad 'Private Wi-Fi Address' is this the same as MAC Address Randomisation'...?

 

"About private Wi-Fi addresses

Starting with iOS 14, iPadOS 14 and watchOS 7, your device will improve privacy by using a different MAC address for each Wi-Fi network. This unique MAC address is your device's private Wi-Fi address, which it will only use for that network"

 

If so, in the Wi-Fi settings in Meraki I have "Disable MAC address randomization (iOS 14 or later)" ticked...

 

But on the iPad Wi-Fi settings it only mentions 'Private Wi-Fi Address'...

 

There is mention of 'whilst joining the network' here:

 

"If enabled, MAC address randomization is turned off while joining this wireless network. A warning will appear in the device's settings indicating that the network has reduced privacy."

 

So I turned off Wi-Fi and turned it back on... nothing changed. So I 'Forgot' the network and waited for auto-join... nothing happened!

 

Definitely shows in 'General > VPN & Device Management > Meraki Systems Manager > More Details > WiFi Settings... both have Auto-join 'Yes' and MAC Randomisation Disabled 'Yes'...

 

So I go to join the network and it asks for a password...? That's not auto-join is it...

 

Anyway, joined manually and... it still has 'Private Wi-Fi Address' enabled!

Edited April 29, 2024 by Koldov