Block Smartphones from accessing Wifi

Question

Hi, 
 Just would like to ask if is it possible to block smartphones (esp. android phones) from accessing wifi. 
 I have plenty of smartphones in the office and my access point is only limited to 30 devices so some important devices including laptops are unable to connect. Hopefully you can help me with this matter. Thanks

DouglasFoster · Accepted Answer

This will not solve your licensing problem, because UTM remembers MAC addresses for a week. The correct solution is to get control of your WPA2 passwords. But since you asked... 
 1) Create or modify a Transparent Web Filter Profile and Enable AD SSO authentication. Apply it to the IP addresses associated with your WiFi. Optionally, use the "Device-Specific Authentication" option to choose a different mode for your Windows devices and AD SSO for Android and IOS. Cell phones will silently fail AD SSO authentication. 
 2) Within that Filter Profile, create a Policy object and check the option for "Apply this policy to unauthenticated users". 
 3) Link that Policy to the "Default Block" Filter Action, or create one of your own that is sufficiently oppressive. 
 For more details on Web Filtering, read the articles in the WiKi for initial information, and the articles pinned to the top of the Web Filtering forum for advanced topics.

DouglasFoster · Answer

Recommended: 
 If you are using password-based WiFi, you need to control the password. Reset the password on the WiFi and reconfigure all of the allowed clients. Then do not give away the password to others. 
 Personal devices should be on a guest WiFi. If you have a guest network, but do not have the licensing to support it, then turn it off. 
 Other options: 
 You could create a web filtering Filter Profile to require AD SSO authentication for Apple and Android operating systems. This should make the phones useless for web access, which will reduce but not eliminate the number of people trying to use your WiFi from their phones. 
 You could switch to 802.1X authentication for WiFi connections, so that only authorized devices can connect. This can be complicated; I have read about it but not implemented it myself. Not sure what support Sophos provides for 802.1x.