Random MAC Address

[WaveSPAN]

Setting up firewall to secure large network that will handle traffic for square terminals owned by vendors coming on site. On Square's Troubleshooting Terminal page  https://squareup.com/help/us/en/article/6537-square-terminal-troubleshooting

They list every thing a network admin would need to know about Square terminals connections and ports. I found the MAC OUI Base 44:59:25 which I was going to use to assign a certain IP range and classify traffic.

Using our test terminal I found it uses a random MAC address which makes using MAC based Auth and assigning certain IP's useless. 

Is there a way to disable random MAC on Square terminals ?

[Donnie-M]

@WaveSPAN I only know to find the mac address in the general settings under about, but I haven't paid attention to see if this is a truly randomized mac address or just the one assigned to the terminal.  

I am thinking though that you are inviting a ton of network administration with vendors to keep a super secure network.  Have you thought about just setting up a guest network that is separate from your company network?  A walled garden so to speak, where all of the vendor terminals can access the internet separately? The real security of a terminal is the encryption between it and square servers and not necessarily your network.

[WaveSPAN]

This is a separate network only for Square and Clover Terminals. Problem is we have a WPA2 Password that has to be entered by us to keep users from using this network for anything other than CC Terminals in the case the WPA2 Password got out we are securing it further by MAC address, Firewall Rules and Bandwidth Shaping. Having a MAC address that randomly changes is not very helpful.

[Donnie-M]

@WaveSPAN IT might be easier to follow the whitelisting for the networks for square communications to prevent the network from even being functional outside of payment processing.  Another could be changing the password periodically to eliminate the sharing much like a hotel/campground.  What specifically are you trying to prevent happening on the guest network?

I am just trying to figure out a way to accomplish what you are wanting in a different way.  I am also thinking about what level of security you are trying to go for versus what is acceptable.

[WaveSPAN]

We have a separate network that is just like a hotel network, open but brings up a splash page to login. Obviously this is not a option for CC Terminals so another SSID was created just for CC Terminals with minimal bandwidth and the hopes of using the mac address as an authenticator then the WPA2 password really wouldn't matter if it was shared. Using the whitelisting option would help to lock it down a bit more. I would be hesitant on even trusting the information Square supplied since the MAC OUI doesn't hold true.

Most vendors assume there going to use cellular service with there own hotspot instead of paying us for WiFi. Then it turns into a scramble to add all these terminals to the WiFi when they realize the carriers cant support 200k patrons and there cellular service doesn't work.

It all comes down to limitations on not being able to authenticate CC Terminals of any brand using Radius or now MAC address.

[Donnie-M]

@WaveSPAN Understand better now, this is a scale issue that isn't just a large group but a very large group and you are correct about cell provider density issues.  I'll see if I can come across any other ideas.

My gut reaction would be to just change the password each day/week/event and blacklist all the important domains like amazonia, fb, yahooooo, etc. so that it wouldn't be used for say utube vids etc.  This should keep it plenty  locked  down and would be easier in some ways.