topic Re: Wirless management restriction using ACL in Wireless

Wirless management restriction using ACL

ejlbarcelon — Mon, 05 Jul 2021 17:28:51 GMT

Hi, I have a WLC that I need to restriction over the management GUI but do not want to block anything else.

Is there a safe way to block other wireless client to the WLC GUI, while keeping a whitelist of those who can access?

I am planning to enable "management via wireless" as lobby admin is connected to wireless.

Re: Wirless management restriction using ACL

patoberli — Wed, 29 May 2019 08:59:16 GMT

Never done this, but it should work like the following:
permit client-ip virtual-interface-ip tcp 443
permit client-ip virtual-interface-ip tcp 22
deny every-other-client-ip virtual-interface-ip tcp 443
deny every-other-client-ip virtual-interface-ip tcp 80
deny every-other-client-ip virtual-interface-ip tcp 22
permit any any

Re: Wirless management restriction using ACL

ejlbarcelon — Wed, 29 May 2019 22:34:11 GMT

Hi patoberli,

What is port 22 for? is this required to block GUI?

Also why do we need a "permit any any"?

Re: Wirless management restriction using ACL

patoberli — Fri, 31 May 2019 06:33:01 GMT

22 is SSH, which is typically also accessible if management over wireless is enabled. Port 23 too, if you have enabled Telnet.

The permit any any is to allow all other access, like internet.