I manage a network meant for specific people, who in turn illegally share the Wifi SSID logins with friends (and so repeated changing of passwords isn't a good option).

How do I configure the border router to block all client IP addresses except static the IP's I choose to assign them?

To block 192.168.xxx.abd for example, I have tried:

ip access-list standard BLOCK 192.168.xxx.abd
  • You need security well beyond a simple ACL.
    – Ricky
    Mar 5, 2019 at 17:45
  • How do I go about that?
    – Masssly
    Mar 5, 2019 at 17:47
  • 3
    Sounds like you need a few things. 1. Talk to your manager about reprimanding those employees for violation of the company policy and jeopardizing the network security by allowing outsiders to access the infrastructure. 2. Maybe set up 802.1x so you can have the users authenticate against LDAP or another form of central account management, so there isn't a shared PSK.
    – Jesse P.
    Mar 5, 2019 at 18:03
  • 3
    Home network? That's off-topic. Business network? Use RADIUS.
    – Zac67
    Mar 5, 2019 at 18:08
  • Just noticed I had said "shared PSK". Oops. Obviously it's shared, since that's the S in PSK.
    – Jesse P.
    Mar 5, 2019 at 18:49

1 Answer 1


You need to set up 802.1X, that way you can guarantee that users are strongly authenticated before accessing the company Wifi. Use RADIUS or if it's a small network you can get by with the built-in authentication methods that are available in most enterprise grade Wifi-controllers. Also look into limiting access for the Wifi network only to resources that are necessary, not the whole company network.

  • Also, use a single ("static") address per user, so any duplicate logins will break existing connections. (your own connection failing is a good motivator to stop sharing) Set the wireless controller to only allow the assigned address per connection -- this is a bit harder to do.
    – Ricky
    Mar 6, 2019 at 0:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.