How many entries can I add to ACLs on SZ100?

There is a 128 MAC address limit on ZD Access Lists

https://support.ruckuswireless.com/answers/000001750

No, it is not possible to have more than 128 MAC-address. 

The MAC filter (ACL) list can have a maximum of 128 MAC addresses per list.  You can create up to 32 lists, but can only apply one list (ACL) per WLAN/SSID.  This is a filter list that blocks or allows clients to pass traffic through the WLAN interface on the AP filtering on each received packet.

Note: Ruckus also offers MAC authentication. This is a different mechanism that involves true authentication using the Zone Director.  MAC authentication checks the MAC address of the clients against a RADIUS server, and allows connection to MAC that is listed.  The MAC address (written without delimiters, spaces, and colons) needs to be set as the login and password in the user data base of the RADIUS server.  The only limit to the number of MAC addresses is the size of the RADIUS data base (essentially unlimited).   Once authenticated the client traffic is allowed to pass.

https://support.ruckuswireless.com/answers/000002460

Layer 2 Access Control Lists (MAC ACLs) filter incoming traffic based on Layer 2 MAC header fields in the Ethernet/IEEE 802.3 frame.

Below are the steps to configure L2 ACL on ZD:

1) Navigate to ZD GUI>>Configure >>Access control.

2) Under L2/MAC Access control, create a new ACL and give it a name.

3) Choose between "Only allow all stations listed below' versus "Only deny all stations listed below" based on your requirement. And then type in all MAC addresses.

Please note that there is a 128 MAC address limitation per ACL.

Mapping the ACL to WLAN :

ZD GUI --> Configure -->WLANs --> Edit the WLAN --> Advanced Options --> Access control --> Choose the L2/MAC ACL from the dropdown (created as per the above procedure).

Important Note:  Make sure that the MAC addresses are correct and be consistent with the mac nomenclature.  In other words, chaging all of the mac addresses to lower case for a customer alleviated the issue.  He had some mac address of clients and some with all caps, changing all to lower case fixed the issue with allowing the whitelist to work.

Hello,
It seams in the first place wrong design of the solution:
1. Mac authentication isn't secure and must be used as a last resort when no other types are supported by equipment (it usually the case with old (>10 years) industrial equipment only).
2. 8k ACL requirement isn't reasonable, as such ACL set is not actually maintainable.
So I would recommend to look in the solution design:
1. Check if really there is need for MAC authentication and if possible replace it with something really secure. If it is industrial installation with outdated devices and not much need for security, you can leave with MAC authentication using Radius server, but if possible - avoid it.
2. If you need to granularly restrict and allow access - use real L7 firewall for it. Any modern UTM device will do. They are cheap today too -- for 1kEur you will get 200-500MB/s UTM device with 3 year subscriptions (you can look on Watchguard, Sophos, Fortigate, there is plenty of them now). This will allow you to limit number of rules to some 20-50, which is realistically supportable, and would in fact provide much better protection, as you can use application based or content based rules. For example, no ACL combination can reliably disable gaming, porn any other illegal content access on network -- if it works for today, it will not work tomorrow anyway, as you would need to update it all the time. AL also doesn't work to disable application, which are designed to avoid limiting (P2P, Skype, TOR, so on). Just put standard UTM device between network and wi-fi and you get much better results.
This ACL requirement may be historical -- some Wi-Fi vendors have embedded firewall inside the WLAN controller, which do ACLs, of cause, this old-fashioned firewall can't be compared with modern UTM devices, but  when you used  it for a long time -- you start to think in this technology terms.
With UTM + Ruckus Wi-Fi you would have much better and secure solution, than any embedded ACLs could ever provide, as UTM is main business for firewall vendors, but not for Wi-Fi vendors, and without any doubt Ruckus has now the best Wi-Fi technology available on market, so combination is a good one...
Hope it helps.. 

Dear Michael Brado thanks for the information for ZD series Controller can you provide any document for SZ100 controller also. My Client have similar requirement as posted above.

how to deny more 128 mac address
i create new ACL but not block it

I have similar case here. Do you have an answer yet?