Controllerless Networks

last person joined: yesterday 

Instant Mode - the controllerless Wi-Fi solution that's easy to set up, is loaded with security and smarts, and won't break your budget
Back to discussions
Expand all | Collapse all

block client-to-client and allow external to initiate sessions

This thread has been viewed 0 times

  • 1.  block client-to-client and allow external to initiate sessions

    Posted Dec 03, 2014 05:26 AM

    Hi,

     

    Im trying to block client-to-client traffic and at the same time allow some external networks to initiate sessions with wirless clients. Ive tried to add the following rules, which deny clients-to-clients traffic but also block external networks to contact clients.

     

    allow any on server 10.95.0.1(gateway)

    deny any to network 10.95.0.0/24(wireless subnet)

    allow any to all destination 

     

    Whats the best practice in this situation? 

     

     



  • 2.  RE: block client-to-client and allow external to initiate sessions

    EMPLOYEE


  • 3.  RE: block client-to-client and allow external to initiate sessions

    Posted Dec 03, 2014 05:56 AM

    Deny inter user bridging is enabled.

     

    Currently im running acl in the switches that the IAPs are connected to to allow/deny traffic between clients that are on different IAPs. I would like to skip this and manage everything from the IAP controller.



  • 4.  RE: block client-to-client and allow external to initiate sessions

    EMPLOYEE
    Posted Dec 03, 2014 06:10 AM

    If that is the case, use what you mentioned in your first post.  You would configure a role for your users, then rules within it:  http://www.arubanetworks.com/techdocs/Instant_41_WebHelp/InstantWebHelp.htm#UG_files/Roles_and_policies/ConfACLRule.htm

     

    The rules below that you mentioned in your first post would work:

     

    deny any to network 10.95.0.0/24(wireless subnet)
allow any to all destination

     You do not have to allow traffic to your default gateway.  Hopefully you have no server resources like DNS or anything on 10.95.0.0/24



  • 5.  RE: block client-to-client and allow external to initiate sessions

    Posted Dec 03, 2014 06:36 AM

    The problem is that the external network 192.168.10.0/24 needs to initiate sessions with the wireless clients. And the deny any to network 10.95.0.0/24 rule will block this, right?



  • 6.  RE: block client-to-client and allow external to initiate sessions

    EMPLOYEE
    Posted Dec 03, 2014 07:23 AM

    Unfortunately, I think that is the case..