Is it possible to assign MAC-address-specific passphrases for a WiFi network?

Question

Private network access security can be defined by a unique WPA2 passphrase to grant access to devices and MAC address filtering to control authorized devices. Nowadays mobile devices are legion, so if one is stolen, the WPA2 passphrase is easily recoverable. So the router admin has to change the passprase and ask all users to change their connection on devices. Not so simple with family users whose skills are limited.

Would it not be useful to put one specific passphrase for each MAC address? With that option, if a mobile device is stolen, the admin just have to revoke the device and the associated passphrase, without changing anything to others.

Answer 1

The ability to revoke client access on a device-by-device basis is a feature of Enterprise WPA, which uses a RADIUS server for authentication purposes. Authentication is achieved using variants of the EAP protocol.

In this set up you issue certificates for each client, which can be revoked by your CA in the event the client's private key is compromised.

Answer 2

Ruckus wireless has done exactly that. It is called DPSK and works great. I created a spreadsheet with each of our asset tags in it with the ruckus director, created a different WPA2 code for each unit and entry it when we join the device to the wireless. The MAC then gets associated with the DPSK.

It includes other options like placing a time limit on the DPSK, etc.

It works great, Bib

Answer 3

Best approach will be to use 802.1X authentication along with WPA2. By this, you will be able to uniquely identify an user and can apply different policies on different users. This will also help in uniquely identifying an user on the wireless controller.

Coming back to your question, the feature you are asking differs (and depends) on OEM.
Cisco doesn't support MAC-specific passphrase in its wireless products.
As @Williamson points out, Ruckus supports this feature.

Hope it helps !!!