topic Honestly.....I'd put the ACL in Wireless

how to Isolate Guest without Anchor WLC

Freemen — Mon, 05 Jul 2021 10:00:47 GMT

My environment have 1 WLC 7.6, and Cisco ISE 1.3, but guest needed to be Isolated.

Problem now is even I apply ACL_INTERNET_ONLY. when run the scanning tools still able to discover the network segment.

how I can achieve to not allow guest to attempt scanning my network?

if you can use host discovery

Saurav Lodh — Thu, 23 Apr 2015 07:19:41 GMT

if you can use host discovery scanner which uses icmp ,tcp, udp probes , I think you should check the ACL on WLC once. I will also suggest you to do some packet captures and drill down if any probes present the guest scanner to the subnets.

Honestly.....I'd put the ACL

Stephen Rodriguez — Thu, 23 Apr 2015 13:50:45 GMT

Honestly.....I'd put the ACL at L3 instead of on the WLC.

For ACL on the WLC you have to remember to put your entries in bidirectionally. Allow and disallow in both inbound and outbound directions.

HTH,

Steve

TQ, let me try out deny the

Freemen — Fri, 24 Apr 2015 02:45:03 GMT

TQ, let me try out deny the outbound from Private segment

Hi,check this configuration

abwahid — Wed, 24 Jun 2015 08:49:53 GMT

Hi,

check this configuration example as well.

http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/117620-configure-ISE-00.html