Solved: Invalid mask for the entered IP - 140AC Access Point ACL

EvanC75 · ‎10-06-2022

I am running into a very strange issue. Trying to setup and ACL rule under Advanced > Security Settings on the 140AC web interface. For some reason it will not accept the mask for the IP I entered. I don't see the problem. Did I miss something or is this a bug? I am running the latest firmware on the AP.

I attached screenshot showing the issue. I tried different IP ranges, class A and class C. It rejects every subnet I specify, even 255.255.255.0 for IP 192.168.1.2. So that is not network or broadcast.

Regards.

EvanC75 · ‎10-20-2022

Ok so after talking with TAC, we determined it is a bug in the firmware. So ACLs don't work for what I was trying to achieve after support tried multiple optionss.

Regards.

View solution in original post

Rich R · ‎10-08-2022

Only guessing here (never used the product) but did you try 192.168.1.0 and 255.255.255.0 ?
I can imagine a developer assuming the mask 0 octet should correspond to "subnet zero" portion of the IP.

------------------------------
Please click Helpful if this post helped you and Select as Solution (drop down menu at top right of this reply) if this answered your query.
------------------------------
TAC recommended codes for AireOS WLC's and TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's, Best Practices for 9800 WLC's and Cisco Wireless compatibility matrix
Check your 9800 WLC config with Wireless Config Analyzer using "show tech wireless" output or "config paging disable" then "show run-config" output on AireOS and use Wireless Debug Analyzer to analyze your WLC client debugs
Field Notice: FN63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN72524 IOS APs stuck in downloading state after 4 Dec 2022 due to Certificate Expired
- Fixed in 8.10.190.0, latest 9800 releases, 8.5.182.11 (8.5 mainline) and 8.5.182.108 (8.5 IRCM)
Field Notice: FN70479 AP Fails to Join or Joins with 1 Radio due to Country Mismatch, RMA needed
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
Leo's list of bugs affecting 2800/3800/4800/1560 APs

EvanC75 · ‎10-08-2022

Yeah I did that and it worked but I was trying to set it for an individual host. I figured out that in order to do that, the subnet has to be /32 or 255.255.255.255. However even with that the ACL doesn’t work. I was trying to restrict a host from accessing the web portal for the AP. Instead it blocked all https traffic from that host so no internet.

Regards.

EvanC75 · ‎10-20-2022

Ok so after talking with TAC, we determined it is a bug in the firmware. So ACLs don't work for what I was trying to achieve after support tried multiple optionss.

Regards.