Wireless Access

Good afternoon all,

We're dealing with an University owned computer that has authenticated successfully and thus been successfully assigned an Aruba role within our AOS8.10 Controller environment. The role has been configured to deny traffic to a couple of subnets and then allow all. All of that said, I'm seeing traffic from this client to our domain controller getting denied (see datapath output below). Since the role should allow this traffic I'm at a loss as to why it would still get denied. 

Client IP = 10.124.35.58
Domain Contoller IP = 10.2.0.63
Second DC IP = 10.2.0.62

---------------------------------------------------------------------------------------------------------------------------------------------------

(MC1) [MDC] *#show datapath session table 10.124.35.58 | include 10.2.0.6
10.124.35.58      10.2.0.63       17   63905 389    0/0     0    0   0   tunnel 6209 9    3          756        FDC             20       
10.2.0.63         10.124.35.58    17   389   63905  0/0     0    0   1   tunnel 6209 9    0          0          FDY             20       
10.124.35.58      10.2.0.62       6    50458 445    0/0     0    0   1   tunnel 6209 221  68         17214      Ci              20       
10.2.0.62         10.124.35.58    6    445   50458  0/0     0    0   1   tunnel 6209 221  64         9636       i               28       
10.2.0.62         10.124.35.58    17   389   63907  0/0     0    0   0   tunnel 6209 8    0          0          FDY             20       
10.124.35.58      10.2.0.62       17   63907 389    0/0     0    0   0   tunnel 6209 8    3          756        FDC             20  

Brad,

Yes sir, I've checked and rechecked. Attached are a pics of the policies in use and their order.

Hi Mat.

Just an idea. Can it be, that 10.2.0.0 subnet is embedded in one of the deny aliases?

Other reason can be that client get a wrong role.

Try to see what is returned for  client role with "show rights <role>". This should show all active rules for the role.

Best, Gorazd

------------------------------
Gorazd Kikelj
MVP Guru 2025
------------------------------

All,

After opening a TAC case and walking through some troubleshooting steps I decided to create a new security policy entry that specifically allows the traffic that was originally getting blocked, that seem to have fixed my issue. TAC was unable to explain why the traffic was getting blocked in the first place and I to be honest, I was tired of spending so much time watching them run the same four commands over and over again.

Hi Matt.

Glad that you resolve the issue. To me it looks like some implicit Deny somewhere in rules chain.

Best, Gorazd