https://community.cisco.com/t5/wireless/wlc-and-acl/m-p/4483932#M234293 <P>ACL is wrong, it is allowing any HTTP, HTTPS, DNS to any IP.</P><P>Example can be found here</P><P><A href="https://community.cisco.com/t5/security-documents/configuring-posture-services-with-the-cisco-identity-services/ta-p/3154278#:~:text=Name%20%3A%20ACL-POSTURE-REDIRECT" target="_blank">https://community.cisco.com/t5/security-documents/configuring-posture-services-with-the-cisco-identity-services/ta-p/3154278#:~:text=Name%20%3A%20ACL-POSTURE-REDIRECT</A></P><P>&nbsp;</P> Mon, 11 Oct 2021 21:07:17 GMT Arshad Safrulla 2021-10-11T21:07:17Z https://community.cisco.com/t5/wireless/wlc-and-acl/m-p/4482877#M234226 <P>I've been tasked to allow a certain AD account to logon and enable a automated ipad enrolment proof of concept.</P><P>ISE will force the user on to a certain vlan that will have restricted access to the internet, but I also wanted it to stop that vlan being able to connect to any thing else on the network.</P><P>The reason I want to block it,&nbsp; is if the account gets out, don't want them to have access to the internal network</P><P>&nbsp;</P><P>So was looking at ACL (don't use often)</P><P>Allow UDP DNS ANY ANY ANY</P><P>Allow UDP ANY DNS ANY ANY</P><P>Allow TCP HTTP ANY ANY ANY</P><P>Allow TCP ANY HTTP ANY ANY</P><P>Allow TCP HTTPs ANY ANY ANY</P><P>Allow TCP ANY HTTPs ANY ANY&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; so this should allow to use internal DNS I'm</P><P>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; guessing should be able to go to the internet.</P><P>Allow IP Subnet&nbsp; 0.0.0.0 ANY ANY ANY</P><P>Allow 0.0.0.0 IP Subnet&nbsp; ANY ANY ANY</P><P>Deny 0.0.0.0 0.0.0.0 any any any any any</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="ACL.JPG" style="width: 400px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/133814i555B9271AB4BD9E2/image-size/medium?v=v2&amp;px=400" role="button" title="ACL.JPG" alt="ACL.JPG" /></span></P><P> </P> Fri, 08 Oct 2021 22:08:55 GMT https://community.cisco.com/t5/wireless/wlc-and-acl/m-p/4482877#M234226 craiglebutt 2021-10-08T22:08:55Z https://community.cisco.com/t5/wireless/wlc-and-acl/m-p/4483932#M234293 <P>ACL is wrong, it is allowing any HTTP, HTTPS, DNS to any IP.</P><P>Example can be found here</P><P><A href="https://community.cisco.com/t5/security-documents/configuring-posture-services-with-the-cisco-identity-services/ta-p/3154278#:~:text=Name%20%3A%20ACL-POSTURE-REDIRECT" target="_blank">https://community.cisco.com/t5/security-documents/configuring-posture-services-with-the-cisco-identity-services/ta-p/3154278#:~:text=Name%20%3A%20ACL-POSTURE-REDIRECT</A></P><P>&nbsp;</P> Mon, 11 Oct 2021 21:07:17 GMT https://community.cisco.com/t5/wireless/wlc-and-acl/m-p/4483932#M234293 Arshad Safrulla 2021-10-11T21:07:17Z