Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

guest access list

i have controller 5508

i configure vlan 10 for guest and name guest-inter

ip 10.0.10.2/24

default gateway 10.0.10.254 ( ip address fo core switch)

dhcp server ( 10.20.10.10/24) ( ip dhcp server is the same ip for DNS server )

i create ssid name gest and choose interface guest-inter and choose web authentication

also there is blue coast proxy for internet 10.30.10.10/24

i need guest user to access internet only

what the access list need to apply for guest in the WLC to permite internet only

i configured the access list in the controller and applied in the guest-inter interface

1- permit any any  udp  (source port dns)  ( destination port  any)    (direction any )

2-permite any any udp   ( any )                 ( dns)                             (any)

3- permite any  10.20.10.10   ip   any  any               any

4-permite  10.20.10.10   any  ip     any any                 any

5-permite any 10.30.10.10   ip    any  any                   any

6- permite 10.30.10.10  any  ip   any    any                  any

i put user name and password for guest and disply page access sucessful and stop

after that i can not access internet

please advice me

5 REPLIES

guest access list

I would rather put an ACL to block the inside access, as given below

permit ip  any 10.30.10.10 ( here you can give a mask of 255.255.255.255 and specificallly the proxy port)

permit ip  any 10.20.10.10/24 ( ( here you can give a mask of 255.255.255.255 and the DNS port )

deny ip  10.0.10.2/24

permit ip any

What is the image that you are using in the WLC, if the build is above 7.0.116.0 enable "WebAuth Proxy Redirection Mode" from the Controller page

Thanks

NikhiL

guest access list

I worked by the same things you mentioned but unfortunately the same thing ther is no changing .
Please if you have practical technical document for guest access-list send to me

or advice me .

thanks

Re: guest access list

Whatever you allow out, you need to explicitly allow back in as well. Unlike applying the acl to a svi where you only need one way.

That being said. I'd put the acl on the gateway svi instead if on the WLC.

Steve

Sent from Cisco Technical Support iPhone App

HTH, Steve ------------------------------------------------------------------------------------------------ Please remember to rate useful posts, and mark questions as answered

Re: guest access list

I applied the access list in two directions, even before the possible but i  forget to mentioned in my previous letter
I will try to apply in the layer 3 core switch and i will tell you the result .

guest access list

You need to identifiy your interfaces in the WLC as inbound and outbound. I just did a number id ACLs on the WLC for ISE and I had the same problem. Once I added the inbound and outbound life was good. Give that a shot.

__________________________________________________________________________________________ "Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin ___________________________________________________________
1272
Views
0
Helpful
5
Replies