cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2670
Views
6
Helpful
6
Replies

Catalyst 9800 vWLC ACL

filip.nikolic
Frequent Visitor
Frequent Visitor

I'm trying to configure an ACL on Catalyst 9800 vWLC GUI but I can't figure out why there isnt'a a 'any' option for ports and protocols in extended ACLs? Default value for protocol field is adp and for source or destination port is None. Will None work instead any and how I can set the protocol to any? Maybe is there a image bug? I'm using 17.6.4 right now

6 Replies 6

Mark Elsen
Hall of Fame
Hall of Fame

 

 -  A possible way to go forward is to examine the running config after you define an (extended) ACL in the GUI ; (t)(w)hen reviewing the resulting  ACL statements in the running config and 'staying' on the CLI you might be able to achieve what you want  and or check if you can include option 'any' when defining or completing an ACL through querying command completion with ? (e.g.)

 M.



-- Let everything happen to you  
       Beauty and terror
      Just keep going    
       No feeling is final
Reiner Maria Rilke (1899)

Rich R
VIP
VIP

I must admit I had *never* looked at ACLs in the GUI before now!

But now I have and it looks normal to me. Configuration -> Security -> ACL
There's all the normal options there.  I see "ahp" (not adp) at the top of the protocol list.  If you're not seeing the full list on the drop-down then that's probably a browser problem.  Try different browsers, different version of browser and make sure you're not blocking cookies etc.  It sometimes also helps to clear all cookies and history then close and re-start your browser.  Personally I'd recommend CLI for ACLs.

------------------------------
Please click Helpful if this post helped you and Accept as Solution (drop down menu at top right of this reply) if this answered your query.
------------------------------
TAC recommended codes for AireOS WLC's   and   TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's,   Best Practices for 9800 WLC's   and   Cisco Wireless compatibility matrix
Check your 9800 WLC config with Wireless Config Analyzer using "show tech wireless" output or "config paging disable" then "show run-config" output on AireOS and use Wireless Debug Analyzer to analyze your WLC client debugs
Field Notice: FN63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN72524 IOS APs stuck in downloading state after 4 Dec 2022 due to Certificate Expired
- Fixed in 8.10.196.0, latest 9800 releases, 8.5.182.12 (8.5.182.13 for 3504) and 8.5.182.109 (IRCM, 8.5.182.111 for 3504)
Field Notice: FN70479 AP Fails to Join or Joins with 1 Radio due to Country Mismatch, RMA needed
Field Notice: FN74383 APs Running 17.12.4/5/6/6a May Run Out of Flash Space Preventing Upgrades
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
Leo's list of bugs affecting 2800/3800/4800/1560 APs
Default AP console baud rate from 17.12.x is 115200 - introduced by CSCwe88390

You need to choose "ip" as the protocol. This implies any ip based protocols and also all ports for udp/tcp:

KarstenIwen_0-1677946138690.png

 

--
If you found this post helpful, please give it Kudos. If my answer solves your problem, please click Accept as Solution so others can benefit from it.

Thank you but if I choose ip as a destination protocol how should I block lets say ICMP? Should I create a new ACE just for ICMP?

Yes, you need one ACE for everything that you want to allow and deny.

--
If you found this post helpful, please give it Kudos. If my answer solves your problem, please click Accept as Solution so others can benefit from it.

Yes - it sounds like you need to familiarise yourself with the basics of ACLs:
https://community.cisco.com/t5/networking-knowledge-base/access-control-lists-acl-explained/ta-p/4182349
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/xe-16-9/sec-data-acl-xe-16-9-book/sec-access-list-ov.html
https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html

------------------------------
Please click Helpful if this post helped you and Accept as Solution (drop down menu at top right of this reply) if this answered your query.
------------------------------
TAC recommended codes for AireOS WLC's   and   TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's,   Best Practices for 9800 WLC's   and   Cisco Wireless compatibility matrix
Check your 9800 WLC config with Wireless Config Analyzer using "show tech wireless" output or "config paging disable" then "show run-config" output on AireOS and use Wireless Debug Analyzer to analyze your WLC client debugs
Field Notice: FN63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN72524 IOS APs stuck in downloading state after 4 Dec 2022 due to Certificate Expired
- Fixed in 8.10.196.0, latest 9800 releases, 8.5.182.12 (8.5.182.13 for 3504) and 8.5.182.109 (IRCM, 8.5.182.111 for 3504)
Field Notice: FN70479 AP Fails to Join or Joins with 1 Radio due to Country Mismatch, RMA needed
Field Notice: FN74383 APs Running 17.12.4/5/6/6a May Run Out of Flash Space Preventing Upgrades
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
Leo's list of bugs affecting 2800/3800/4800/1560 APs
Default AP console baud rate from 17.12.x is 115200 - introduced by CSCwe88390
Review Cisco Networking for a $25 gift card