topic Enable Controller Managemet From Wireless Clients in Wireless

Enable Controller Managemet From Wireless Clients

Puneet Gupta — Sun, 04 Jul 2021 06:25:34 GMT

We have three SSID's

CORP SSID

GUEST SSID

MGMT SSID

I want to know ,Client wants the controller access from MGMT SSID where all the IT guys are sitting on their wirless laptop and at the same time they do not to get controller access for other SSID that is for corp and guest users.

If i check this all the SSID are able to get the controller access and if uncheck this , no wireless user is able to get the access of controller.

Is there any way to give the controller access to MGMT wireless users ?

Thanks.....

Enable Controller Managemet From Wireless Clients

Scott Fella — Fri, 25 Jan 2013 16:00:09 GMT

Not really, because if you have another WLC and users are connected to AP's on WLC2, they can access WLC1. The only way is to setup an acl to only allow subnets to access the WLC management ip.

Thanks,

Scott

Help out other by using the rating system and marking answered questions as "Answered"

Enable Controller Managemet From Wireless Clients

Puneet Gupta — Fri, 25 Jan 2013 16:03:21 GMT

Hi Scott

Thanks for the reply

Do i need to craete the ACL on controller or on the core switches where vlans are created.

Enable Controller Managemet From Wireless Clients

Scott Fella — Fri, 25 Jan 2013 16:37:07 GMT

You can do it on either... I prefer on the core thatn on the WLC, but thats up to you.

Thanks,

Scott

Help out other by using the rating system and marking answered questions as "Answered"

Re: Enable Controller Managemet From Wireless Clients

Scott Fella — Fri, 25 Jan 2013 17:51:52 GMT

Here is the other thing I see a lot. What about your corp SSID. Are users on that subnet able to get to your management devices like servers or switches? This is why I prefer to use ACLs on the core. You have a dedicated management vlan in which you have access to everything, but the other subnets in clouding wired needs to have ACLs in place or else wired users can access the WLC also. Makes sense?

Sent from Cisco Technical Support iPhone App

Re: Enable Controller Managemet From Wireless Clients

Puneet Gupta — Fri, 25 Jan 2013 19:34:35 GMT

Hi Scott

No CORP and GUEST are not allowed to get the network device access and we restricted the acces throgh ACL on core switches and applied on VTY .

This is only for Controller access ,every single wireless user is able to get the WLC access irrespective of SSID.

GUEST SSID is using web authenication and CORP is using certificate based authenication.If i make the ACL and put the WLC IP in deny list then WLC GUEST redirect page is not coming on the guest machine.

So want to know which port i need to blocked so that guest should not get the WLC's access?

Enable Controller Managemet From Wireless Clients

Scott Fella — Fri, 25 Jan 2013 20:35:13 GMT

Well if your using a guest anchor, the WLC is in the DMZ so there wouldn't be any routing back. But if your not anchoring the SSID, then maybe look at using a CPU ACL on the WLC.

Thanks,

Scott

Help out other by using the rating system and marking answered questions as "Answered"