Controller shows unknown 'Known Clients'
Controller shows unknown 'Known Clients'
Hi @Vincent-TP, already since last year my OC200 controller regularly displays unknown clients in the overview of Known Clients. These all have a MAC Address starting with "C0-A8-0x". I posted about this earlier but unfortunately you where not able to further investigate or assess this. Also see Controller shows unknown 'Known Clients'.
My setup:
- 1 x OC200 v1.0 controller (firmware 1.35.7 Build 20250514 Rel.51837)
- 1 x ER605 v2.0 router (firmware 2.2.6 Build 20240718 Rel.82712)
- 2 x SG2210P v5.20 switch (firmware 5.20.10 Build 20250307 Rel.72554)
- 1 x ES205G v1.0 switch (firmware 1.0.3 Build 20250414 Rel.72933)
- 5 x EAP615-Wall(EU) v1.0 access points (firmware 1.5.0 Build 20240830 Rel. 63168)
- 2 x EAP225-Outdoor(EU) v1.0 access points (firmware 5.1.7 Build 20240819 Rel. 44148)
- 2 x EAP230-Wall(EU) v1.0 access points (firmware 3.2.3 Build 20240815 Rel. 33684)
Even though I regularly "forget" these clients, they keep appearing every now and then. My network is properly secured with ACL's, IP-MAC Binding, etc.
None of these MAC Addresses are known to me. All my (30+) wired clients have a fixed IP address using DHCP Reservation, in combination with IP-MAC Binding. My (also 30+) mobile clients all have a dynamic IP address. I disabled random MACs of my known mobile clients to access my home network, as an extra layer of security using MAC Filter to only allow known clients.
What at least is remarkable is that these all have a MAC Address starting with the same range "C0-A8-01". Obviously, I checked if any of my wired and wireless clients have MAC address that looks similar, which is not the case.
The only thing I can think of is that these are "temporary" (or actual?) MAC addresses of the access points, since many of these have a MAC address starting with the same range ("40-ED-00" for all 5 EAP615-Wall access points and "84-D8-1B" for all 2 EAP230-Wall access points). And yes, I checked if there is any MAC address starting with "C0-A8-01" in the wired client list; there is none. That is why I was suspecting the access points.
Do other users have this as well, and does anyone know what is causing this?
- Copy Link
- Subscribe
- Bookmark
- Report Inappropriate Content
- Copy Link
- Report Inappropriate Content
Hi @pustekuchen, meanwhile I shared quite some information including log-files to the TP-Link Support team. As a matter of fact, today I received the following response:
We found that this might be related to your previous blocking of these devices. However, the process of recovering and unblocking them is quite complicated.
There’s a simpler solution: factory resetting your router and switches. Would you be willing to try this?
I am stil in alignment with the TP-Link Support team about both options. I will keep you informed on the outcome.
- Copy Link
- Report Inappropriate Content
I have the exact same issue in my environment where devices with MAC address of C0:A8:01:xx:xx:xx randomly appear and disappear. They seem to show up on random EAP615 access points and present themselves as wired clients. Seems to be related to the access points themselves
I'll also note that my non TPLink firewall/router detects these "devices", assigns them IP addresses via DHCP and then places them in a quarantine group which blocks internet access.
The Omada switch model that all my access points connect to is a SG2210P and all my access points are EAP615. It seems the OP has those same devices in his network as well
- Copy Link
- Report Inappropriate Content
Hi @RF25, this is very interesting to read. I will make the TP-Link Support team aware of this. Hopefully @Vincent-TP can ensure that they will also contact you to analyze your case to find the similarities and hopefully come to a solution for both of us.
- Copy Link
- Report Inappropriate Content
Hi @RF25
Thanks for your feedback.
Did you configure any ACL to block any devices before? Or other similar settings? either on the main router or the Omada controller.
We recommend submitting a support ticket via email for efficient assistance.
Please include the following information in the email:
1. This Forum ID 823600;
2. your community nickname;
3. The topology of your network;
4. The config file of the controller;
RF25 wrote
I have the exact same issue in my environment where devices with MAC address of C0:A8:01:xx:xx:xx randomly appear and disappear. They seem to show up on random EAP615 access points and present themselves as wired clients. Seems to be related to the access points themselves
I'll also note that my non TPLink firewall/router detects these "devices", assigns them IP addresses via DHCP and then places them in a quarantine group which blocks internet access.
The Omada switch model that all my access points connect to is a SG2210P and all my access points are EAP615. It seems the OP has those same devices in his network as well
- Copy Link
- Report Inappropriate Content
- Copy Link
- Report Inappropriate Content
- Copy Link
- Report Inappropriate Content
Hi @RF25
Thanks for the reply.
You may continue the troubleshooting with support team.
If you come across any significant clues or progress, don't hesitate to share them with us here.
- Copy Link
- Report Inappropriate Content
Information
Helpful: 0
Views: 758
Replies: 18
Voters 0
No one has voted for it yet.