Unable to connect to the SSID of the profile name you created

[Translator]

I cannot connect to the profile name SSID that I created with the following message about the title.
Disabling a Policy or configuring it in 'Enabled' state, will result in loss of connectivity for clients associated with this Policy profile.

Is the ACL setting strange?

Unable to connect to the SSID of the profile name you created. What's the problem with the conf below?

ABCD

interface GigabitEthernet0
mac-address 0000.5e00.0101
ip dhcp client client-id GigabitEthernet0
ip dhcp client broadcast-flag clear
ip address 43.24.49.27 255.255.255.0
ip access-group SLIMS_WEB_ACL in
ip access-group SLIMS_WEB_ACL2 out
no negotiation auto
!
ip http server
ip http authentication local
ip http secure-server
ip http secure-trustpoint CISCO_IDEVID_SUDI
ip http client source-interface GigabitEthernet0
ip forward-protocol nd
ip tftp blocksize 8192
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0 250
ip dns server
!
ip access-list standard SLIMS_WEB_ACL
2 permit 43.24.49.28
!
ip access-list extended SLIMS_WEB_ACL2
9 permit tcp any host 137.153.91.37

ABCD

I would appreciate it if you could help me with your knowledge.

[Rich R]

1. Presume this is EWC on AP? 
What model of AP?
What version of software?

EWC on AP operates like 2 virtual machines on a single AP. The EWC WLC component runs as an IOS-XE process and EWC AP component runs as an AP-COS process.  The AP must be able to join to the EWC to function.  WLC and AP components both need an IP address in the same subnet on access port or the native (untagged) VLAN if it is a trunk port.

2. Normally you should not apply ACLs to your wireless management interface (Gig0) but if you do then the ACLs must allow all communication between EWC WLC and EWC AP (CAPWAP at a minimum) and between EWC WLC and outside world (eg radius, SSH, https etc).  What IP address have you assigned to the AP or is that relying on DHCP?  If DHCP is it in the same subnet as the WLC (43.24.49.0/24)?

First remove the ACLs from Gig0 then make sure your AP can join the WLC (show ap summ)
Then if you feel the need to apply ACLs on Gig0 you must make sure you permit everything that needs to communicate through that interface.
Also remember that outbound ACLs normally do not apply to locally sourced traffic (only routed traffic) so that outbound ACL is more or less pointless because EWC only supports Flexconnect local switching so there should never be any traffic routed through the WLC, only traffic originated by the WLC itself.

[Translator]

Thank you very much for your reply.
Is this concept explained in the manual?
Thanks to you, SSID connection was handled by ACL removal.

Currently, there is no effect of ACL at all, it is very troublesome.

1.1 PCs can only be connected with MAC address
2. One PC only views the WEB server across the AP
Possible

I have created an ACL for the two above requirements, but the ACL has no effect
Any settings will not improve.

----------------------------------
SSID:SGS-FUK-NT
PC MAC Address: 43.24.49.28
PC IP:43.24.49.28
AP Interface IP:43.24.49.27
AP IP::43.24.49.56
WEB ServerIP:137.153.91.37:443
IP ACL:SVR_WEBIP_ACL
----------------------------------
◆ Set IP ACLs
Join Profile
Adding a Profile to FLEX
Add Policy
Add to WLANs
Apply to AP

◆MAC Access Restrictions
→ I didn't know where to set this to be valid.

ACLs that meet the two requirements listed above and
Could you please tell us how to set it up?

※We will attach a simple material.

I've been delayed for a few days in my ACL configuration for the technical staff on the project.
Thank you very much for your kind understanding.

[Rich R]

Main thing to remember is that the wireless management interface is for CONTROL PLANE traffic - not client data so you cannot apply client data ACLs there.

For client IP ACLs refer to the documentation at:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-15/config-guide/b_wl_17_15_cg/m_conf_ipv4_acl_ewlc.html
https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213945-understand-flexconnect-on-9800-wireless.html#toc-hId--2047927279
and Community summary at:
https://community.cisco.com/t5/wireless/catalyst-9800-wlan-ipv4-acl-for-ap-in-flex-mode/td-p/4315424

MAC filtering:
https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213922-configure-mac-authentication-ssid-on-cis.html
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-15/config-guide/b_wl_17_15_cg/m_mab_auth_bypass.html
https://0x2142.com/how-to-catalyst-9800-mac-filtering/
Note: https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-15/config-guide/b_wl_17_15_cg/m-sniffer-cg.html#restrictions-for-flexconnect-specific-details
- MAC filtering is not supported on FlexConnect access points in standalone mode. However, MAC filtering is supported on FlexConnect access points in connected mode with local switching and central authentication. Also, Open SSID, MAC Filtering, and RADIUS NAC for a locally switched WLAN with FlexConnect access points is a valid configuration, where MAC is checked by Cisco ISE. 

And I should add that using MAC filtering as a security mechanism is a bad idea and practically pointless because it is not secure (MAC addresses can easily be changed or spoofed) and most modern devices uses random and rotating "private" MAC addresses by default now.