Solved: Re: Cisco 9800 ACL rule for access WLC via HTTP

rajat00011 · ‎03-04-2024

i make acl rule for access wlc but its not working please help us

Extended IP access list access-WLC
1 permit tcp host 10.135.2.56 host 10.135.54.36 eq www
2 permit tcp host 10.135.2.142 host 10.135.54.36 eq www
3 permit tcp host 10.135.2.145 host 10.135.54.36 eq www
4 permit tcp host 10.135.2.162 host 10.135.54.36 eq www
5 permit tcp host 10.135.2.173 host 10.135.54.36 eq www
6 permit tcp host 10.135.2.207 host 10.135.54.36 eq www
7 permit tcp host 10.135.2.208 host 10.135.54.36 eq www
8 permit tcp host 10.135.2.211 host 10.135.54.36 eq www
9 permit tcp host 10.135.2.216 host 10.135.54.36 eq www
10 permit tcp host 10.135.2.241 host 10.135.54.36 eq www
11 permit tcp host 10.135.2.242 host 10.135.54.36 eq www
12 permit tcp host 10.135.2.244 host 10.135.54.36 eq www
13 permit tcp host 10.135.2.245 host 10.135.54.36 eq www
14 permit tcp host 10.135.2.247 host 10.135.54.36 eq www
15 permit tcp host 10.135.2.248 host 10.135.54.36 eq www
16 permit tcp host 10.135.2.250 host 10.135.54.36 eq www
17 permit tcp host 10.135.2.251 host 10.135.54.36 eq www
18 permit tcp host 10.135.36.175 host 10.135.54.36 eq www
19 permit tcp host 10.135.36.62 host 10.135.54.36 eq www
20 permit tcp host 10.135.36.65 host 10.135.54.36 eq www
21 permit tcp host 10.135.36.58 host 10.135.54.36 eq www
22 permit tcp host 10.135.2.56 host 10.135.54.36 eq 22
23 permit tcp host 10.135.47.167 host 10.135.54.36 eq www

Rich R · ‎03-05-2024

> where you apply this ACL ?
>> associate with interface
That doesn't actually answer the question that was asked!

1. Regardless of where you're applying this ACL it seems like a really bad way of trying to restrict access to the GUI!
2. Notably your ACL is only permitting http (port 80) - what about http (port 443)?
3. Access to the GUI should be controlled by using "ip http access-class"
4. SSH access should be controller by using "access-class <acl-name> in" on the "line vty"
5 You should be using something like TACACS to provide strong, secure authentication for access to SSH and GUI.

------------------------------
Please click Helpful if this post helped you and Select as Solution (drop down menu at top right of this reply) if this answered your query.
------------------------------
TAC recommended codes for AireOS WLC's and TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's, Best Practices for 9800 WLC's and Cisco Wireless compatibility matrix
Check your 9800 WLC config with Wireless Config Analyzer using "show tech wireless" output or "config paging disable" then "show run-config" output on AireOS and use Wireless Debug Analyzer to analyze your WLC client debugs
Field Notice: FN63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN72524 IOS APs stuck in downloading state after 4 Dec 2022 due to Certificate Expired
- Fixed in 8.10.196.0, latest 9800 releases, 8.5.182.12 (8.5.182.13 for 3504) and 8.5.182.109 (IRCM, 8.5.182.111 for 3504)
Field Notice: FN70479 AP Fails to Join or Joins with 1 Radio due to Country Mismatch, RMA needed
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
Leo's list of bugs affecting 2800/3800/4800/1560 APs
Default AP console baud rate from 17.12.x is 115200 - introduced by CSCwe88390

View solution in original post

MHM Cisco World · ‎03-04-2024

where you apply this ACL ?

MHM

rajat00011 · ‎03-04-2024

associate with interface

Rich R · ‎03-05-2024

> where you apply this ACL ?
>> associate with interface
That doesn't actually answer the question that was asked!

1. Regardless of where you're applying this ACL it seems like a really bad way of trying to restrict access to the GUI!
2. Notably your ACL is only permitting http (port 80) - what about http (port 443)?
3. Access to the GUI should be controlled by using "ip http access-class"
4. SSH access should be controller by using "access-class <acl-name> in" on the "line vty"
5 You should be using something like TACACS to provide strong, secure authentication for access to SSH and GUI.

------------------------------
Please click Helpful if this post helped you and Select as Solution (drop down menu at top right of this reply) if this answered your query.
------------------------------
TAC recommended codes for AireOS WLC's and TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's, Best Practices for 9800 WLC's and Cisco Wireless compatibility matrix
Check your 9800 WLC config with Wireless Config Analyzer using "show tech wireless" output or "config paging disable" then "show run-config" output on AireOS and use Wireless Debug Analyzer to analyze your WLC client debugs
Field Notice: FN63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN72524 IOS APs stuck in downloading state after 4 Dec 2022 due to Certificate Expired
- Fixed in 8.10.196.0, latest 9800 releases, 8.5.182.12 (8.5.182.13 for 3504) and 8.5.182.109 (IRCM, 8.5.182.111 for 3504)
Field Notice: FN70479 AP Fails to Join or Joins with 1 Radio due to Country Mismatch, RMA needed
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
Leo's list of bugs affecting 2800/3800/4800/1560 APs
Default AP console baud rate from 17.12.x is 115200 - introduced by CSCwe88390

rajat00011 · ‎03-06-2024

thank u sir now its work

MHM Cisco World · ‎03-06-2024

I will update you tonight for more info

Thanks for waiting

MHM