Aruba Instant & Cloud Wi-Fi

Reply
Aruba
Posts: 1,283
Registered: ‎08-29-2007

Instant firewall rules blocking DNS even though it is allowed

Hi,

 

I had a situation with some instants where the DNS requests were blocked, even though I had explicitly allowed them.  It is for guest traffic, that is using a corp DNS on 192.168.0.0 network.

 

The rules were as such,

 

svc-dhcp any allow
svc-dns any allow
any network 192.168.0.0/16 deny
any any permit

 No response from the DNS server on 192.168.100.250.  Unless I've misunderstood the firewall rule, this should have worked?

 

The clients are also on a 192.168.154.0 subnet as well, so maybe that has something to do with it.


If my post is helpful please give kudos, or mark as solved if it answers your post.

ACCP, ACMP, ACMX #294
mclarke@arubanetworks.com
MVP
Posts: 2,908
Registered: ‎10-25-2011

Re: Instant firewall rules blocking DNS even though it is allowed

[ Edited ]

Is that an instant rule?

instant aps rules looks more like this

 

wlan access-rule Casa 
index 2 
rule any any match any any any permit log

 

That looks more like a Controller firewall rule what you got in there though or did you type it like that because it was easier for the forum users to read?

 

Cheers

Carlos

----------------------------------------------------
Product Manager - Aruba Networks
Alternetworks Corp
Aruba
Posts: 1,283
Registered: ‎08-29-2007

Re: Instant firewall rules blocking DNS even though it is allowed

Carlos, actually it is for Instants, but I was writing the rule off the top of my head.  The actual rules are

 

rule any any match udp 67 68 permit
rule any any match udp 53 53 permit
rule 192.168.0.0 255.255.0.0 match any any any deny
rule any any match any any any permit

 but even if I put 'rule 192.168.101.250 255.255.255.255 match any any any permit' above the deny rule, it still doesn't get DNS.

 

AP225s version 4.0.0.1


If my post is helpful please give kudos, or mark as solved if it answers your post.

ACCP, ACMP, ACMX #294
mclarke@arubanetworks.com
Search Airheads
Showing results for 
Search instead for 
Did you mean: