topic Applying ACL on WLC for admin logon and AP's only in Wireless

Applying ACL on WLC for admin logon and AP's only

usman_safdar — Wed, 02 Nov 2022 05:05:45 GMT

Hi,

I intend to apply ACL on WLC to achieve following

- Only admin should be able to logon into WLC from his IP

- Only AP's should be able to join WLC from their specific IP pool 10.202.x.x/24 (no other IP pool should be allowed from where AP can join WLC).

- Existing traffic flow shouldn't get disturbed. This may include end users internet/usual lan access, snmp monitoring etc.

Any help shall be highly appreciated.

Regards

Re: Applying ACL on WLC for admin logon and AP's only

balaji.bandi — Wed, 02 Nov 2022 05:52:52 GMT

- Only admin should be able to logon into WLC from his IP - This you may configured WLC GUI, I also prefer to have ACL where WLC Layer 3 interface connected.

- Only AP's should be able to join WLC from their specific IP pool 10.202.x.x/24 (no other IP pool should be allowed from where AP can join WLC). - Same as Above ACL on the Interface, or add only Option 43 for that pool, Make sure AP connected port belongs to the same VLAN in the access port.

- Existing traffic flow shouldn't get disturbed. This may include end users' internet/usual can access, SNMP monitoring etc. - You can also use ACL, but suggest having FW in the network is always a good option (ACL hard to manage).

Re: Applying ACL on WLC for admin logon and AP's only

Arshad Safrulla — Wed, 02 Nov 2022 17:30:12 GMT

What is the WLC model you have?

Do you have a dedicated management (service) port configured?

Do you have an upstream firewall?

Re: Applying ACL on WLC for admin logon and AP's only

usman_safdar — Thu, 03 Nov 2022 08:17:43 GMT

2504

not dedicated (its a trunk port used for 2 more vlans as well)

yes we have for a particular vlan (rest of the vlans are not routed vlans, being used for internet only)

Re: Applying ACL on WLC for admin logon and AP's only

Arshad Safrulla — Thu, 03 Nov 2022 11:14:48 GMT

You need to use CPU ACL.

Cisco WLC CPU ACL — WIRES AND WI.FI

Cisco Wireless Controller Configuration Guide, Release 8.5 - Access Control Lists [Cisco Wireless LAN Controller Software] - Cisco

Make sure that you read the nuances before configuring, otherwise you may end up locking the WLC.