cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
336
Views
10
Helpful
3
Replies

WLC 9800 per WLAN East-West ACLs

Is it possible to apply an East-West ACL on clients joining a specific WLAN? If so, what is the best way to go about that? We have a few public WLANs that we would like to implement peer-to-peer ACLs on for protection/inoculation from potentially infected devices.

1 Accepted Solution

Accepted Solutions

Arshad Safrulla
VIP Advocate VIP Advocate
VIP Advocate

I would do the below;

If AP's in Local Mode - Block P2P in WLAN, and use a VACL in upstream device where WLC is connected.

if AP's in Flex mode - Block P2P in WLAN and apply VACL as required in the upstream devices. read the documentation related to the platform and the code running in your production as there certain limitations of P2P when AP's in Flex mode.

Another option is Per User ACL's using Radius server, this will give you more granular control on what you want to acheive. However you have the option of deploying an post-auth acl if you have LWA or EWA.

 

View solution in original post

3 Replies 3

Flavio Miranda
Advisor
Advisor

Hi

 For East-West the better option is apply P2P blocking. However, this is not conditional. Once enable, no traffic will travel East-West inside the same WLAN.

 If you wan to filter some ports only, I dont believe is possible on the same wlan.

Arshad Safrulla
VIP Advocate VIP Advocate
VIP Advocate

I would do the below;

If AP's in Local Mode - Block P2P in WLAN, and use a VACL in upstream device where WLC is connected.

if AP's in Flex mode - Block P2P in WLAN and apply VACL as required in the upstream devices. read the documentation related to the platform and the code running in your production as there certain limitations of P2P when AP's in Flex mode.

Another option is Per User ACL's using Radius server, this will give you more granular control on what you want to acheive. However you have the option of deploying an post-auth acl if you have LWA or EWA.

 

Thanks for the helpful feedback, this confirms what we suspected. We are currently using RADIUS for our per-user ACLs in some of the WLANS and were just wondering if it were possible to do the guest WLANs without RADIUS but it sounds like RADIUS is the right way to go moving forward.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: