topic 9800 ACL implementation per SSID or per User session in Wireless

9800 ACL implementation per SSID or per User session

nareh84 — Mon, 05 Jul 2021 20:19:48 GMT

hi,

currently we have 9800 vwlc integrated with ISE. the requirement is that when mobile connects to SSID ((flexconnect SSID with Layer2 WPA2 and 802.1x), it can access only internet and should connect to internal resources except for dns and dhcp purpose.

i tried following but nothing is working.

1.configured acl (for testing acl is permit ip any any) on 9800vwlc and called this ACL using airspace-acl as well as filter id but after i apply it to authorization policy, user is not able to connect to SSID .

2. configured acl (for testing acl is permit ip any any) on 9800 and configure WLAN ACL (Configuration > Policy > Policy Profile > Access Policies (tab)> WLAN ACL) and point it to ACL configured on same WLC. and i am getting incorrect ACL error.

is it possible to configure ACL per SSID or per user session when user is authenticated via 802.1x.

Regards

Naray

Re: 9800 ACL implementation per SSID or per User session

Rich R — Fri, 21 May 2021 13:43:05 GMT

What version of code are you using?

WLAN ACL is working fine for us on 17.5.1 - applied to the policy profile - WLAN IPv4 ACL on Access Policies tab on the GUI.

On CLI:
wireless profile policy <policyname>
ipv4 acl <acl-name>

Re: 9800 ACL implementation per SSID or per User session

nareh84 — Fri, 21 May 2021 14:18:42 GMT

hi,

version is 17.03.01

Re: 9800 ACL implementation per SSID or per User session

Rich R — Fri, 21 May 2021 15:07:40 GMT

Can't remember if we tried it on 17.3.1.

You could try 17.5.1 or at least 17.3.3.