Troubleshooting Meraki and MAC Address Randomization

Troubleshooting iOS 14 MAC randomization

Apple released iOS 14 on September 16, 2020, which included some changes to how MAC addresses are handled on iOS devices. iOS 14 introduced the MAC randomization feature which means that for each SSID, devices running iOS 14 will present a distinct randomized MAC address. This randomized MAC address for each network will not change over time, upon reconnecting to the same SSID, or when the SSID is “forgotten” in the device settings and re-joined later on. Also, toggling ‘Private Address’ on and off on an iOS 14 device will switch between the real MAC and the randomized MAC for that Wi-Fi network, but that the randomized MAC won’t change as a result of the toggle either. 

Possible causes 

• MAC randomization is enabled by default on iOS devices 
• The device reconnects using a randomized MAC address instead of the hardware MAC address. 
• Users toggling the Private Address option

Troubleshooting Android MAC randomization 

Android 10+ devices support MAC randomization by default. Devices may use either persistent or non-persistent MAC randomization when connecting to wireless networks. 

Possible causes 

• MAC randomization is enabled on Android devices 
• Persistent randomization generating SSID-specific MAC addresses 
• Non-persistent randomization generating new MAC addresses periodically 

Troubleshooting duplicate client IP address reporting 

Depending on the DHCP lease duration, dashboard may report IP conflicts if an iOS 14 client switches its MAC address but retains the same IP address. For example, a client device may request the same IP address using a different MAC address immediately after an upgrade. 

This behavior may trigger false-positive duplicate IP assignment alerts. 

Under certain conditions, iOS 14 may also send malformed Address Resolution Protocol (ARP) responses carrying the hardware MAC address instead of the randomized MAC address. 

Possible causes 

• Devices reconnecting with randomized MAC addresses 
• DHCP lease still active for previous MAC address 
• Malformed ARP responses from iOS devices 

Troubleshooting DHCP pool exhaustion 

Apple devices using randomized MAC addresses send DHCP requests using different MAC addresses. Because many Meraki DHCP assignments are based on MAC addresses, MX WAN appliances or MS layer 3 switches acting as DHCP servers may assign new IP addresses to the same physical device. 

MX devices may therefore account for multiple IP addresses for a single iOS 14 device using MAC randomization on different SSIDs in bridge mode. 

This behavior may contribute to DHCP pool exhaustion issues.  Lowering the DHCP lease duration may help mitigate this issue.  

Possible causes 

• Devices requesting new IP addresses using randomized MAC addresses 
• Multiple SSIDs assigning separate randomized MAC addresses 
• Long DHCP lease durations 

Troubleshooting location analytics reporting 

You may notice a decrease in connected clients as devices transition to randomized MAC addresses because dashboard filters randomized MAC addresses by default. 

You may also notice a decrease in Passerby and Visitor counts because dashboard filters randomized MAC addresses for these categories as well. 

Apple devices used randomized MAC addresses for probe requests even before the iOS 14 release. 

Loyalty and engagement graphs may also be affected but should stabilize over time. 

In some situations, devices may not correctly set the locally administered bit that is commonly used to identify randomized MAC addresses. 

To classify a device as Passerby, dashboard must detect a unique non-randomized MAC address for more than one minute. When devices use MAC randomization, the MAC address used for probe requests may change multiple times within that interval. 

Dashboard excludes these MAC addresses from Location Analytics calculations and Scanning APIv2 output. 

 Possible causes 

• Devices using randomized MAC addresses 
• MAC addresses changing during probe requests 
• Dashboard filtering randomized MAC addresses from analytics 

Troubleshooting Meraki health reporting 

Meraki health reports use MAC addresses for client tracking. When client devices use different randomized MAC addresses across SSIDs, tracking connectivity or performance issues consistently across the network or within a specific SSID may become difficult. 

Possible causes 

• Meraki Health uses MAC addresses for client tracking 
• Devices presenting different randomized MAC addresses across SSIDs 
• Inability to correlate client history across networks

Troubleshooting network-wide clients page 

Devices using randomized MAC addresses may appear as new clients in dashboard. This behavior may increase the reported client count in wireless networks. 

Dashboard displays these additional entries on the Network-wide > Clients page and in Summary reports. 

Possible causes 

• Dashboard interprets randomized MAC addresses as separate devices 
• Devices reconnecting with multiple randomized MAC addresses 
• iOS and Android MAC randomization enabled by default 

Troubleshooting Systems Manager Sentry policy 

Systems Manager sentry policies apply group policies based on device MAC addresses and Systems Manager tags. 

When devices use randomized MAC addresses, the MAC address available through MDM differs from the MAC address reported to the MX appliance during wireless association. 

Because of this mismatch, Sentry Policies may not apply correctly to Systems Manager devices on MX networks configured with Sentry Policies. 

Possible causes 

• Devices using randomized MAC addresses 
• Sentry Policies relying on hardware MAC addresses 
• Mismatch between MDM-reported MAC and SSID association MAC 

Troubleshooting Systems Manager Sentry enrollment 

Systems Manager Sentry enrollment uses the device hardware MAC address received through MDM to determine whether a device is enrolled with Systems manager when connecting to an MR access point. 

When devices use randomized MAC addresses, the randomized MAC address reported during SSID association does not match the hardware MAC address available through Systems Manager. 

Because of this mismatch, dashboard may not identify the device as already enrolled. As a result, devices may repeatedly prompt users to re-enroll during association. 

Possible causes 

• Randomized MAC address differs from the registered hardware MAC address 
• Systems Manager cannot validate enrollment status correctly 
• Devices reconnect using different MAC addresses

How to identify randomized iOS MAC addresses 

If the second character of the MAC address is 2, 6, A, or E, the MAC address is randomized: 

• x2-xx-xx-xx-xx-xx 
• x6-xx-xx-xx-xx-xx 
• xA-xx-xx-xx-xx-xx 
• xE-xx-xx-xx-xx-xx 

How iOS MAC randomization impacts networks 

If an Apple user upgrades to iOS 14 and connects to the network, the device uses a randomized MAC address. This MAC address differs from the device hardware MAC address, is SSID-specific, and remains consistent for a given SSID.\n\n> Apple has stated that MAC address rotation within a single SSID may be implemented in the future.\n\n>  

This change may affect Wi-Fi features and services across multiple products in the industry. It may also increase network load and cause operational anomalies. Meraki continues to monitor the impact of these changes and take proactive steps where possible. 

Android 10+ MAC randomization 

Similar to iOS devices, Android devices support MAC randomization when connecting to Wi-Fi networks. On Android 10+ devices, MAC randomization is enabled by default and can be enabled or disabled from the network details settings page.  

Android devices use one of two MAC randomization methods: 

• Persistent randomization 

• Non-persistent randomization 

The Android device determines which method to use when connecting to a Wi-Fi network.