Port Security in WLAN scenario

[dervodebayern]

Hi,

i could use help in configuring port security on OS-2220 in a hotel scenario.

Basicallly:

VLAN 1 -> Management
VLAN 2 -> Guest

My idea:

Configuring Port security on the Ports where APs are connected (in my case 1221). with static MAC-Adress of Accesspoint.

When f.ex. a guest unplugs the AP and plugs in his client via LAN, the guest should be denied access to management vlan and be positioned in guest vlan or even be denied access at all.

I tried to configure it that way, but when i connect to SSID of the AP (Guest VLAN) i am denied access since my client MAC is not statically configured.

But in my understandment, when i allow dynamic mac-adresses on the port, i can connect with clients over WLAN but then the whole portsecurity is gone since a guest could also just plug his notebook in and be dynamically allowed.

Any suggestions here or is this possible in general?

regards