78073 packets output, 532095123 bytes, 0 underruns 8 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier 0 output buffer failures, 0 output buffers swapped out MAC Address Filtering One of the simplest ways to lock down a WAP is by filtering which MAC addresses are allowed to associate with it. The downside of this approach is the administrative over- head, since any new devices that will be using the wireless network must be manually added to the list in the WAP. If you have multiple WAPs and are not using a wireless controller, this method will require you to make these changes to each WAP. For a small home or office, though, it's much simpler than building and maintaining a RA- DIUS server. It is, however, a pretty weak system, since MAC addresses can be spoofed and many wireless devices have their MAC addresses printed on them. To create the access list, I went to all the wireless devices and collected their MAC addresses. I now need to add them to an access list on the WAP. Standard MAC address access lists use the range 700-799: Cisco-WAP(config)#access-list ? <1-99> IP standard access list <100-199> IP extended access list <1100-1199> Extended 48-bit MAC address access list <1300-1999> IP standard access list (expanded range) <200-299> Protocol type-code access list <2000-2699> IP extended access list (expanded range) <700-799> 48-bit MAC address access list dynamic-extended Extend the dynamic ACL absolute timer Now I enter all my collected MAC addresses into access list 701: Cisco-WAP(config)#access-list 701 permit 0025.0046.3f26 0000.0000.0000 Cisco-WAP(config)#access-list 701 permit 0014.a524.5b7a 0000.0000.0000 Cisco-WAP(config)#access-list 701 permit 001d.a231.6568 0000.0000.0000 Cisco-WAP(config)#access-list 701 permit 7c6d.62a4.6aad 0000.0000.0000 Cisco-WAP(config)#access-list 701 permit 001e.a98b.0018 0000.0000.0000 With the MAC address filter in place, I can apply it to the WAP with the dot11 asso ciation mac-list access-list command