Security

Hi

We have setup a 'guest' wireless network for a customer using Instant 'guest' setup.  We are using the default VLAN (3333?) and using the internal DHCP / NATing, etc.

Internet connectivity works fine but users can not access e-mail on thier devices.

We have the following on the Aruba firewall

DNS Allow

DHCP Allow

HTTP Allow

HTTPS Allow

POP3 Allow

SMTP Allow

PP2P Allow

Allow Application Category Mail Protocols

Allow Application Category Webmail Protocols

Deny Everything Else

Any ideas?

Thanks

David

What role are the users in?

Can you post the output of the following command?

show rights <role>

Where <role> is the role that the guest users have.

Thanks

James

Hi Victor

Currently running 6.4.2.3 on Instant 135.

Regards

David

Hi James

Sorry I maybe missing something but when I try running CLI and entering

show rights guest

It reports back a parse error. Show rights does not show when running

Show ?

Regards

David

Apologies I gave you a controller command... 

Run the "show clients" command and post the output of the user who is having this issue.

Try: "show access-rule guest"

...assuming the user is in the guest role and post back the result.

Cheers

James

Hi James

No problem.  Please see below:

login as: admin
admin@192.168.6.102's password:

24:de:c6:c6:bc:00# show clients

Client List
-----------
Name           IP Address     MAC Address        OS  Network  Access Point                             Channel  Type  Role   Signal    Speed (mbps)
----           ----------     -----------        --  -------  ------------                             -------  ----  ----   ------    ------------
Davids-iPhone  172.31.99.224  a4:5e:60:72:95:d1      guest    24:de:c6:c6:bc:00                        124+     AN    guest  42(good)  135(good)
Number of Clients   :1
Info timestamp      :72248
24:de:c6:c6:bc:00# show access-rule guest

Access Rules
------------
Dest IP  Dest Mask  Dest Match  Protocol (id:sport:eport)  Application                 Action  Log  TOS  802.1P  Blacklist  App Throttle (Up:Down)  Mirror  DisScan  ClassifyMedia
-------  ---------  ----------  -------------------------  -----------                 ------  ---  ---  ------  ---------  ----------------------  ------  -------  -------------
any      any        match       dhcp                                                   permit         
any      any        match       dns                                                    permit         
any      any        match       https                                                  permit         
any      any        match       http                                                   permit         
any      any        match       smtp                                                   permit         
any      any        match       pop3                                                   permit         
any      any        match                                  appcategory webmail         permit         
any      any        match                                  appcategory mail-protocols  permit         
any      any        match       pptp                                                   permit         
any      any        match       any                                                    deny           
Vlan Id           :0
ACL Captive Portal:disable
ACL ECP Profile   :default
CALEA             :disable
Bandwidth Limit   :upstream disable
24:de:c6:c6:bc:00#

Hi James

We have added the follwoing ports onto the allow list and it is working

With SSLProtocol Type Port

Thanks for looking it this

Regards

David

Hi James,

Where can I input these ports for IMAP, POP3 and SMTP on Aruba Instant version 6.5.0.0-4.3.0.0_56428?

If you edit the SSID, in the last tab, there are security rules that determine if you have any rules, and what they are.

Hi Colin,

Here is the configuration I set allowed to the IMAP, POP3 and SMTP to all destination but I still can get the emails.  Any assistance will be greatly appreciated.

rule any any match tcp 110 110 permit
rule any any match tcp 25 25 permit
rule any any match app imap permit
rule any any match app pop3 permit
rule any any match app pop3s permit
rule any any match app smtp permit
rule any any match app smtps permit
rule any any match appcategory webmail permit
rule any any match any any any permit

There are other ports involved, especially for secure email:  https://www.lifewire.com/what-are-the-gmail-smtp-settings-1170854

Hi Colin,

I inputted this settings on my iPhone and still not working.  On this version of Aruba Instant i don't see where to input the port# for the email server settings.

Try Less secure apps

Log in to your Gmail account through a web browser and enable access through less secure apps . Less secure apps can make your account more vulnerable, Google will automatically turn this setting off if it's not being used. However, bypass this security setting with a configuration tweak within your Google Email Account .

How "more secure apps" help to protect your account?

Which level of access you're giving the client before you connect your Account.
Client access only a relevant part of your Account, like your email or calendar.
Connect your Google Account to the client without exposing your password.
Disconnect your Google Account from the client at any time.