Applying ACL on WLC for admin logon and AP's only

[usman_safdar]

Hi,

       I intend to apply ACL on WLC to achieve following

- Only admin should be able to logon into WLC from his IP

- Only AP's should be able to join WLC from their specific IP pool 10.202.x.x/24 (no other IP pool should be allowed from where AP can join WLC).

- Existing traffic flow shouldn't get disturbed. This may include end users internet/usual lan access, snmp monitoring etc.

Any help shall be highly appreciated.

Regards

[balaji.bandi]

- Only admin should be able to logon into WLC from his IP  - This you may configured WLC GUI, I also prefer to have ACL where WLC Layer 3 interface connected.

- Only AP's should be able to join WLC from their specific IP pool 10.202.x.x/24 (no other IP pool should be allowed from where AP can join WLC).  - Same as Above ACL on the Interface, or  add only Option 43 for that pool, Make sure AP connected port belongs to the same VLAN in the access port.

- Existing traffic flow shouldn't get disturbed. This may include end users' internet/usual can access, SNMP monitoring etc.  - You can also use ACL, but suggest having FW in the network is always a good option (ACL hard to manage).

[Arshad Safrulla]

What is the WLC model you have?

Do you have a dedicated management (service) port configured?

Do you have an upstream firewall?

[usman_safdar]

2504

not dedicated (its a trunk port used for 2 more vlans as well)

yes we have for a particular vlan (rest of the vlans are not routed vlans, being used for internet only)

[Arshad Safrulla]

You need to use CPU ACL. 

Cisco WLC CPU ACL — WIRES AND WI.FI

Cisco Wireless Controller Configuration Guide, Release 8.5 - Access Control Lists [Cisco Wireless LAN Controller Software] - Cisco

Make sure that you read the nuances before configuring, otherwise you may end up locking the WLC.