Cisco AP 2802i and ACLs

[AMDKKWT]

Hello Guys,

I have a a Cisco AP 2802i with Mobility Express who act as a controller and 10 other Cisco AP 2802i ligthweitght connected. I've managed to configure them and it works perfectly. Here is my question, I've created a second WLAN for my guest and I want them to only have access to the web (http and https), here are my ACLs :

  
                        Source                         Destination               Source Port  Dest Port
Index  Dir       IP Address/Netmask               IP Address/Netmask       Prot    Range        Range   DSCP  Action      Counter


------ --- ------------------------------- ------------------------------- ---- ----------- ----------- ----- ------- -----------


     1 Out       172.0.0.0/255.255.0.0             0.0.0.0/0.0.0.0          Any    80-80       80-80     Any Permit           0


     2  In         0.0.0.0/0.0.0.0               172.0.0.0/255.255.0.0      Any    80-80       80-80     Any Permit           0


     3 Out       172.0.0.0/255.255.0.0             0.0.0.0/0.0.0.0          Any   443-443     443-443    Any Permit           0


     4  In         0.0.0.0/0.0.0.0               172.0.0.0/255.255.0.0      Any   443-443     443-443    Any Permit           0
    
     5  Out       172.0.0.0/255.255.0.0            0.0.0.0/0.0.0.0          Any    0-6665      0-65535    Any Deny

     6  In         0.0.0.0/0.0.0.0               172.0.0.0/255.255.0.0      Any    0-6665      0-65535    Any Deny

 When I apply them to my second WLAN, it does nothing, users still can access to my entire network, can you help me ?

PS : In my web interface, there's no option to configure ACL so I went through CLI.

[felipecostacorreia@hotmail.com]

Hello AMDKKW, 

I have the same AP and my version on ME is 8.5.140.0.

In my case if i need to configure ACL I follow the steps:

Step 1

Step 2

Step 3

[AMDKKWT]

Dear Felipe,

Thank you for your answer, I've created a rule and I applied it but it does nothing. The rule below should deny everything no ? It's just a test.

[AMDKKWT]

Can someone help me please ?

[Sathiyanarayanan Ravindran]

If you check the client details, You can see whether the ACL is getting applied or not.

Just check that once. If possible paste the client logs.

[AMDKKWT]

Dear Sathiyanarayanan Ravindran,

It is applied, as you can see in the screenshot :

Thanks a lot.

[patoberli]

DOH, try mask 255.255.255.255. It's not subnet mask, but ACL mask. That one works the other way around.
https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html

[AMDKKWT]

Dear Patoberli,

Even with 255.255.255.255 mask and the acl applied, I can still access to network.

Thanks.

[patoberli]

Please post another screenshot with the new ACL.

[AMDKKWT]

Here the new screenshot :

[patoberli]

You didn't adjust the destination address!

It should state 0.0.0.0 255.255.255.255 instead of 0.0.0.0 0.0.0.0.

[AMDKKWT]

Dear Patoberli,

I can't adjust the destination address, as you can see below :

Sorry for being such a newbie and thanks a lot for you help, I appreciate !

[patoberli]

I re-read once again the manual (it's for WLC, but should work the same for ME):

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/81733-contr-acls-rle.html



Your first rules should have worked, based on that information.

What authentication type do you use on that SSID? If it's radius, do you have enabled the function AAA Override?

Which version of software is running on the AP?

[AMDKKWT]

Dear Patoberli,

WPA2 Personal authentification type, no radius and 8.5.131.0 version !

Thanks.

[patoberli]

In that case please upgrade to 8.5.140.0, as it fixes some critical security and flash corruption issues.



It also fixes: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj80388

And: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvi85464

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvm10716



Not sure if any of those really affects this, but it's better if those bugs are fixed.