Fraud Device showing in Cisco when having devices hit Wifi with Private Wi-Fi Address set

Question

Level 1

4 points

Fraud Device showing in Cisco when having devices hit Wifi with Private Wi-Fi Address set

We are seeing devices fail to connect to wifi when they have the Private Wi-Fi address set to random or fixed. This is in a cisco environment across multiple sites. We have users switching between Off or Fixed setting but not using the random setting as that causes issues the most. We are also having to clear MAC and IP's in order to get devices back on the network. Any thoughts or experiences with this?

iPad, iPadOS 18

Posted on Sep 12, 2025 09:45 AM

Reply

Answer 1

Camelot

Level 9

57,885 points

Sep 12, 2025 11:23 AM in response to SC-Toast

Why? because that's exactly how Private WiFi addresses work.

The device will use a private MAC address when connecting to the network, not the actual hardware address of the interface.

If using rotating addresses, your system will periodically (I don't know the cadence off-hand) rotate the MAC address to foil MAC address trackers and spoofers.

Your network management system is (arguably, correctly) reacting to that change, noting that an unregistered/unknown MAC address has joined the network. In reality, it's an existing device that just rotated its MAC address, but the system doesn't know that.

The solution depends a lot on the system you have in place and the degree of security/control you have/need.

If you are absolutely locking your network down by MAC address then you cannot use rotating Private WiFi addresses. You can use private Wi-Fi addresses and register the private addresses for each device.

Reply