C9800 non-management SVI security and reachability

[Johannes Luther]

Hi wireless professionals,

quick question regarding SVI (interface vlan <VLAN-ID>) on the Catalyst 9800 WLC (non SDA)

So normally a SVI is not needed, except the DHCP relay or mDNS gateway functionality is required on the WLC.

If - for any case an SVI is created, I wonder how this SVI shall be secured and how the platform actually works.

The WLC has "ip routing" enabled and has a static default route towards the gateway in the management VLAN. Local SVI interfaces are displayed as locally connected in the routing table. However, the SVI interfaces are not ping'able outside their own network. I wonder why - is there some kind of black magic involved?

I wonder whether there is some kind of best practice regarding SVI in the wireless client VLANs like infrastructure ACLs. Or are the interface "somehow" protected by default?

[Arshad Safrulla]

I was having the same doubts and approached our local cisco TCE. Response was very simple "Do not consider your 9800 as a router". 

Please update here if you find any information on the same. Meanwhile I will test this out in my LAB and provide my inputs as well.

[Rich R]

There is NO security by default, you MUST secure it using ACLs.

If they are not pingable then that is likely just because you don't have the right routing in place or maybe you're trying to ping through the mgmt interface in a separate VRF eg GigabitEthernet0 which is in Mgmt-intf VRF by default.

The traffic follows the routing table.

Yes, you should not consider it to be a router but it is built on IOS-XE and the base routing is the same as any other device running IOS-XE.

PS: apply the ACL to the wireless profile policy (ipv4 acl) not the SVI interface.

[Johannes Luther]

Thanks for the response,

I'm thinking the same way (" it is built on IOS-XE and the base routing is the same as any other device running IOS-XE").
However my routing is correct. Of course it will be asymmetric, because the way to the WLC will follow towards the WLC client SVI IPv4.

Once the traffic reaches the WLC, the traffic follows the WLC default route (which is typically the wireless management interface).

But one additional question:

PS: apply the ACL to the wireless profile policy (ipv4 acl) not the SVI interface.

Question: Why?

[Rich R]

We tried on SVI, it didn't work (can't remember exactly what).

TAC confirmed that's by design - it must go on the wireless policy profile to work correctly not the SVI.

That's one of the differences in the WLC.

[Rich R · Accepted solution]

This is what TAC said:

"This is happening because 9800 is based on ASR architecture and routers are only applying ACLs attached on SVI when packet is routed between interfaces. Since WLC is not doing any form of routing those ACLs are transparent for WLAN traffic and have no effect. Hence,
• Use ACL under policy profile for client policy enforcement
• Use ACL under SVI if you want to limit MGMT traffic to the box.

I must admit that documentation on that subject is very poor and existing doc listing features that are not applicable to platform:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/b_wl_16_10_cg/ipv4-acls.html#concept_6CF08D950DFD417F89E13193DBD943C4

I have opened internal documentation bug - CSCvx94311 to track this issue and get documentation updated with relevant information."

That bug is hidden so not sure about status but doesn't look like they've updated the docs yet even on 17.6.1