Wireless Access

Hi gurus,

I am trying limit ingress/egress traffic on my controller through specific IPs, ports and interfaces. I have found the "firewall cp" command, but it seems this is only for ingress traffic o traffic being forwarded to the controller, and also you can't specify the interface. Then I thought of creating extended ACLs and applying them to the interface I want to limit the traffic.

For example, if I want my controller only accepts traffic UDP 500 and 4500 from network 10.80.83.0/24 through GE0/0/0 interface (IP 10.80.83.21) I would do:

ip access-list extended test

  permit udp 500 10.80.83.0 255.255.255.0 host 10.80.83.21

  permit udp 4500 10.80.83.0 255.255.255.0 host 10.80.83.21

  deny any any any

interface gigabitethernet 0/0/0

  ip access-group in test

Similar for egress traffic. Will it work? Please your help. Thanks in advance.

Regards,

Julián

The controller is designed around the user, and not about the mobility controller, per se.  You would put those permit and deny rules in user roles to decide what users do and do not have access to.  Since a controller typically does not have a public ip address, traffic that goes through a controller is usually initiated by a user, and the response would then be delivered back to the user.  That is why your focus should be on allowing and denying traffic in the user role acls...

Hi Colin,

Thanks for your interest. I understand what you say, but:

1. The command "firewall cp" can allow or deny traffic from being forwarded to the controller. This command applies to non-user traffic, is that right?
2. My customer is concerned about security and wants to limit ingress/egress traffic to the controller, and there is no firewall, and asked if there is the possibility to limit this traffic on the controller itself. My previous "ip access-list" and "ip access-group" command won't work?

Regards,

Julián

If that is what your customer is concerned about, he/she should consult the latest ArubaOS Hardening Guide here:  https://support.arubanetworks.com/Documentation/tabid/77/EntryId/16036/DMXModule/512/Default.aspx

Hi Colin,

Thanks for the link. Then, should I assume I can't limit the ingress/egress traffic on the controller with "ip access-list" and "ip access-group" commands? And I can only limit the ingress traffic to the controller through the "service ACL" or "firewall cp", which is in the ArubaOS Hardening Guide?

Regards,

Julián

fjulianom:

What is the destination of the traffic?  If the destination is not the controller itself, you should use ip access-list  and apply it to an interface.

If the destination is the controller, use firewall cp.  Please see page 16 in the hardening guide for more information.