magagement connection to WLC

[interfacedy]

HI we have wlc 3504. Its management interface ip add is 10.10.10.10. Via CPU-ACL, if we deny all traffic except port 12124-12125, 12134-12135

and port 443 for ip address 10.10.10.10.

the config can cause blocking access to the WLC?

Thanks

[ammahend]

Yes I think so, it’s simple to test,  I am assuming you did not mean OOB management service port, because ACL does not effect this port.

Your management interface is also your AP Manager interface so AP won’t be joining wlc,

you can read on ACL limitations here 

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/71978-acl-wlc.html#common

hope this helps

[MHM Cisco World]

Access via ssh? If yes you need allow port

Access via http? If yes are wlc behind nat, check http port nat

[Flavio Miranda]

Hi

  If you worry about user traffic, you dont need to. This the right way to control WLC manageability and no user traffic will be denied and RRM functionality will be preserved. 

What the WLC CPU ACL can't block:
CAPWAP traffic to and from access points.

Traffic to and from other WLCs in Mobility Group.

Traffic to and from RADIUS/TACACS servers.

Traffic to and from LDAP servers.

Traffic to and from DHCP servers.

What the WLC CPU ACL will block:
HTTP/HTTPS traffic towards the WLC management IP address.

SSH/Telnet traffic towards the WLC management IP address.

SNMP traffic towards the WLC management IP address.

FTP/TFTP/SFTP traffic towards the WLC management IP address.

ICMP traffic (like ping) towards the WLC management IP address and all dynamic interfaces (client interfaces).

[interfacedy]

Thank you all for your reply.

@Flavio Miranda 

  "-- What the WLC CPU ACL will block:
      HTTP/HTTPS traffic towards the WLC management IP address. --- "

The CPU ACL includes permit port 443. so that we will not lose the connection to the WLC via GUI, right? 

[Flavio Miranda]

Rigth.  

[MHM Cisco World]

Can I see acl?

Source will any destiantion will be managment interface with port 443 (if  you not nat this port)

[interfacedy]

@MHM Cisco World Please see the below where 10.0.100.66 is wlc management interface. In addtion, the port12124-12125, 12134-12135 should be permited. Any suggestion? Thanks

[MHM Cisco World]

check the cisco note about the CPU ACL