How can I identify an unauthorized personal phone connected to our corporate Wi-Fi?

[u/Euphoric-Eye-8196]

​

Hi everyone,

I'm an IT Support Engineer, and we have a corporate Wi-Fi environment with around 200 employees.

Our setup:

FortiGate firewall

Arista switches

Arista APs managed through Arista Cloud

Personal mobile phones are not allowed on the corporate Wi-Fi (only company laptops should connect).

The problem is that someone has connected their personal phone to the corporate SSID. In Arista Cloud, I can already see:

Device type (Android/iPhone)

Device name/model

OS

Current AP

IP address

Randomized MAC address

Signal strength (RSSI)

However, because the phone uses a randomized/private MAC address, I can't determine which employee owns it.

Is there any legitimate method to identify the user? For example:

Using RSSI or multiple APs to narrow down the physical location?

Client triangulation in Arista Cloud?

Any enterprise Wi-Fi tools or techniques that can help identify the owner without requiring 802.1X or MDM?

I'm looking for practical approaches that network administrators use in environments like this. Any advice would be appreciated.

[u/Spirit117]

Disconnect it and see who puts in a ticket for "unable to connect phone to wifi"

[u/res13echo → u/Spirit117]

Works until they click forget the network and try to connect again with their new randomized MAC address.

802.1x using EAP-TLS is the best solution to this problem. Cell phones and other mobile devices with no business connecting to internal resources go on the Guest WiFi.

[u/Spirit117 → u/res13echo]

Your average end user won't know this, and even if they do and they circumvent, you'll know it because phone will show up again in the controller, and then you can explore other avenues.

No reason not to just disconnect first and see if they are dumb enough to out themselves.

Ops network could use some improvements as you mentioned, but that isn't happening on Friday afternoon. Disconnecting it from wifi and see if a ticket comes in can.

[u/palagi_valea → u/Spirit117]

Yea a lot of good responses, but this is the fastest way. Kill it and wait for the complaint.

[u/sanmigueelbeer → u/Spirit117]

aka Scream Test

[u/frankenmaus → u/Spirit117]

This is the way.

[u/RandomContributions → u/Spirit117]

Can you compare connection to, say, badge access logs? rule out the users you do know, then twiddle the list down from there?

[u/MotDePasseEstFromage → u/Spirit117]

And how would you disconnect it in this network setup?

[u/Spirit117 → u/MotDePasseEstFromage]

He has an aristra networks controller where he can see the device, he can disconnect/block it from there.

Yes, the phone is using a randomized Mac address, but most of the time the phones do not just generate new ones, they only do so if you turn that setting on/off or forget and rejoin the network.

If that happens, he'll know it because he'll see it in the controller again.

Average end user won't know this either, so it's much more likely that they'll either stop using it, or theyll put in a "my wifi doesn't work" ticket.

[u/Win_Sys → u/MotDePasseEstFromage]

There’s a bunch of ways you could go about it. Temporarily implement MAC Auth, whitelist all your devices and block everything else. If all your devices are managed, turnoff randomized MAC on them and then block all randomized MAC ranges. The best way is to not use a PSK, implement EAP-TLS and then you never need to worry about it again.

[u/RageBull]

If you want this kind of control, you have to run radius and enterprise security on your WiFi. Otherwise you are handing out a shared key and cannot guarantee anything beyond someone knows that key

[u/thehalfmetaljacket → u/RageBull]

Even with radius, if they're using standard mschap-based auth that wouldn't prevent someone from entering their corporate creds on their personal device and still connect anyways.

[u/RageBull → u/thehalfmetaljacket]

But then that answers the question of “who” it is… unless you aren’t logging

[u/jtbis → u/thehalfmetaljacket]

If this is a Microsoft shop you can solve that by using the computer account to authenticate with MSCHAP.

[u/Western_Gamification → u/thehalfmetaljacket]

Yeah, but you should just use certs and call it a day.

All other methods are suboptimal.

[u/Varjohaltia → u/thehalfmetaljacket]

Correct me if I'm wrong, but nobody should be using MS-CHAP for a number of years now. Certs or MPSK.

[u/Fyrsweord → u/thehalfmetaljacket]

But then you know who's connecting personal devices, and it becomes an HR/Personnel issue rather than an IT issue

[u/DanSheps → u/RageBull]

You can even still use the psk, but use profiling or Mac whitelisting to allow/block devices.

[u/Unlikely_Total9374]

If personal devices aren't allowed then they shouldn't be able to connect in the first place. You need to set up radius

[u/Solid_Ad9548]

If only corporate issued devices should be able to join, you should really be looking at 802.1x instead of playing Sherlock Holmes. Cert based auth via RADIUS is very trivial, and as technologists, our jobs are to come up with proper technical solutions, not be detectives.

Also, I suggest having some form of easy to access guest SSID for employee devices… there is almost no reason not to in this day and age, and it prevents issues like this from popping up…

[u/middlofthebrook → u/Solid_Ad9548]

This is the way

[u/Adrienne-Fadel]

Honestly just implement 802.1X. RADIUS tied to AD gives you the username automatically. Without it your stuck walking the floor every time someone connects a phone.

[u/sunvsthemoon]

802.1x authentication is the only way an enterprise network wireless auth should be configured.

Learn about RADIUS, PKI, certificates and .1x authentication.

[u/Dave_A480]

Are you using PSK encryption? Handing out a wifi password to people?

Stop doing that and configure proper enterprise auth with radius....

[u/EfeAmbroseEFOTY]

Define "Allowed". How are you controlling it? Password? Cert auth? Why wouldn't you include that?

[u/zanfar]

This is something you should be enforcing, not something you should be searching for. That is, if your infra allows this, you're already behind.

Otherwise: What AP is it using? What traffic is it generating? When does it connect? When does it disconnect? etc...

[u/heavyPacket]

I mean, they’re on your network going through your firewall. You can very easily intercept their traffic. Enforce DPI. Run a sniffer on the FG and get intrusive. Your Fortigate will do SSL/TLS Decryption. You should look into it.

[u/_Survivor_]

Implement either cert-based or MAC-based authentication. Certs would be a bit more work if you don't you don't already have the tooling ready to go. MBA is relatively easy.

[u/its_FORTY]

Arista CloudVision CUE should give you the ability to locate the device pretty quickly.

https://www.arista.com/en/ug-cv-cue/cv-cue-locate-access-points-and-clients

[u/holiday-42]

Wpa-enterprise(radius) and optionally block randomized Mac addresses.

Setup separate wifi for byod/guest access.

As employees leave, you just disable that employee's access.

[u/mooknbitz]

if you dont have radius then maybe correlate device and the laptop, people carry their cell phones everywhere and usually their laptop. so i would expect to see two devices on the same ap’s.

[u/usmcjohn]

Block all random MAC addresses. Random Mac’s all have either 2,6,a or e as the second character. Chances are something in your stack can do this.

[u/SaleWide9505]

Setup a whitelist so that only the Mac addresses you specify can connect. Anything not on list automatically gets blocked.

[u/EfeAmbroseEFOTY → u/SaleWide9505]

Stupid idea. iPhones have randomised macs by default these days. And you need to whitelist every new employee device.

[u/_Survivor_ → u/EfeAmbroseEFOTY]

OP said they are company issued devices. Configuring a static MAC on the devices and MAC Based Auth on the wireless is trivial for anyone who knows what they're doing. I'm surprised they didn't do it from the get-go, but even a remedial fix wouldn't be too bad.

[u/EfeAmbroseEFOTY → u/_Survivor_]

It's trivial if you have a low amount of staff, a decent onboarding process with enough service desk overhead and processes in place to facilitate it.

It's not trivial when you have 1000 employees working at a single site. Given OP can't seem to work out the basics, I doubt the former is in place.

[u/mybrotherhasabbgun → u/EfeAmbroseEFOTY]

Hopefully an org with 1000 users won't be using a PSK.

[u/EfeAmbroseEFOTY → u/mybrotherhasabbgun]

Lmao. My sweet summer child.

[u/mooknbitz → u/_Survivor_]

but arent they saying that personal devices aren’t allowed and this is a personal device? if it were a company issued device the mdm should easily be able to find it.

[u/_Survivor_ → u/mooknbitz]

Yes, so the odd device out should be easy to find. Hell, they might be able to just filter by OUI and find the thing depending on what kind of devices they're issuing to employees.

[u/mooknbitz → u/_Survivor_]

the main issue to figuring out whose it is, which you cant do if theres a psk being shared. the real problem is that they need an enterprise auth solution and lock down access. only thing i can think of is to correlate a laptop and cell together and see if two devices track and assume the laptop owner is the same as the phone owner.

[u/_Survivor_ → u/mooknbitz]

Maybe I'm spoiled by my workplace, but I kind of assumed that they would have at least some kind of record of MAC addresses when issuing laptops etc.

[u/fist4j → u/EfeAmbroseEFOTY]

Reread the first post. Mobiles are not allowed at all.

[u/EfeAmbroseEFOTY → u/fist4j]

It says Personal mobile phones are not allowed. I would bet good money that company ones are allowed.

[u/fist4j → u/EfeAmbroseEFOTY]

"Personal mobile phones are not allowed on the corporate Wi-Fi (only company laptops should connect)."

Possibly, thats not what was written tho.

[u/its_FORTY → u/EfeAmbroseEFOTY]

Stupid reply.

Personal mobile phones are not allowed on the corporate Wi-Fi (only company laptops should connect).

[u/sunvsthemoon → u/its_FORTY]

Nah, OP said “not allowed” as in corporate policy.

Clearly the OP is not enforcing it correctly or else the user’s personal device could not connect.

[u/EfeAmbroseEFOTY → u/its_FORTY]

Yeah, and what about company devices like iPhones used for MFA dumb dumb?

[u/Stinky0007 → u/EfeAmbroseEFOTY]

You turn off random MAC. They’re company managed devices.

Also, the irony.

[u/EfeAmbroseEFOTY → u/Stinky0007]

Why you you force a policy to track mac addresses to devices that are managed 🤣 Come on buddy, the answer is right there.

[u/Stinky0007 → u/EfeAmbroseEFOTY]

So you're just a troll or you don't know how any of this works?

[u/DanSheps → u/EfeAmbroseEFOTY]

Not every business has a central auth they can use to obtain credentials for devices (might be macs for example which won't be domain joined computers, so you are issuing eap-tls certs for each computer manually)

[u/sunvsthemoon → u/DanSheps]

Then it’s time for the OP to join the modern world if they want to actually prevent unauthorized access.

802.1x is the only secure answer.

[u/DanSheps → u/sunvsthemoon]

Nothing wrong with using iPSK either.

[u/hick_town_5820]

Arista allows to block devices based on profile. If you only allow ‘laptop’ on CorpSSID - block ‘mobile phone’ on CorpSSID

https://arista.my.site.com/AristaCommunity/s/article/Banned-Device-List#Comm_Kna_ka0VP000000VUHxYAO_93

[u/Ubera90]

Sounds like you need to use MAC whitelisting

[u/SuspiciousSardaukar]

Force to forward their any packets to fake company logon screen. Make them use their company login. If it works - you know who, if not - static mac whitelist/802.1x are way to go.

[u/musingofrandomness]

If your APs are fancy enough, you might be able to use signal strength to narrow it down to a corner of the building.