Wireless Access

Hi. I'm having some trouble figuring out how to allow WhatsApp video calls through our Aruba 7220 controllers and was hoping someone might be able to point me in the right direction. I've exhausted pretty much anything I can find on the community or on Google and have probably done 50+ test calls over the past week.

Here's our setup
Internet > Palo Alto Firewall (NAT) > Aruba 7200 (ACLs) > APs via tunnel

Our ACLs consist of
any any any dhcp permit
any any any bootp permit
any any any udp-3478 permit
any any 172.18.0.0/255.255.0.0 any deny
any any any any permit

Pretty much DHCP, 3478 (STUN), and anything external. Nothing internal.

Show datapath session is showing denies and I'm not sure why as 3478 UDP is allowed any/any/any. Am I missing something here? I've also tried udcp 3478 which gave some of our NAT'ed external IPs on datapath, presumably from STUN resolution.

The only way I can seem to get it to work is if I add a rule above the deny "any/any/MY-PHONE-IP/any/permit" allowing all traffic. Is there anywhere else I can look to see specifically what's triggering the denies?

To add more to the puzzle, I'm told (though I cannot verify myself) that WhatsApp calling worked perfectly fine 6 months ago.

Thanks

Depending on how/where the ACL is applied, it may be in specific directions, as well the uplink port if not trusted and uplink VLANs not trusted may result in traffic being blocked. You could put a log statement on the deny rule and see in the logs what is dropped, where I think it's return traffic.

Getting ACLs, roles, trusted/untrusted VLAN/ports clear may take some time (or training), working with your Aruba partner or Aruba support may be the quickest path to a solution.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------