Wireless Access

Reply
Frequent Contributor I

Application Works on Wired Network but not on Wireless Network

We have an application that works on the wired network, but not on our controller based wireless network. It uses UDP port 7700. The wired and wireless networks are on two different VLANs. But, tagging through the wireless VLAN to a wired port gets the app working, indicating our egress firewall configuration is probably not the issue. Do you have any suggestions on how this might be debugged?

Thanks,
Robert

 

Guru Elite

Re: Application Works on Wired Network but not on Wireless Network

Does it require multicast discovery? (SSDP/DLNA/mDNS)


Thanks, 
Tim

Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
Frequent Contributor I

Re: Application Works on Wired Network but not on Wireless Network

Looking at the wired packet capture shows unicast UDP. Looking at show datapath session seems to imply it is being denied. The device is in the right role and the IPv4 policy is any any any permit.

 

10.61.251.81 109.123.157.210 17 51995 7700 0/0 0 0 0 tunnel 1230 9 0 0 FDYC

Any ideas?

Thanks,

Robert

 

Guru Elite

Re: Application Works on Wired Network but not on Wireless Network

What role is the user in?  What is the output of "show rights <role>"?



Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

Frequent Contributor I

Re: Application Works on Wired Network but not on Wireless Network

show rights EmployeeComputer

 

Derived Role = 'EmployeeComputer'

Up BW:No Limit   Down BW:No Limit 

L2TP Pool = default-l2tp-pool

PPTP Pool = default-pptp-pool

Assigned VLAN = 250

Periodic reauthentication: Disabled

DPI Classification: Enabled

Web Content Classification: Enabled

ACL Number = 90/0

Max Sessions = 65535

 

Check CP Profile for Accounting = TRUE

 

Application Exception List

--------------------------

Name  Type

----  ----

 

Application BW-Contract List

----------------------------

Name  Type  BW Contract  Id  Direction

----  ----  -----------  --  ---------

 

access-list List

----------------

Position  Name                         Type     Location

--------  ----                         ----     --------

1         global-sacl                  session 

2         apprf-EmployeeComputer-sacl  session 

3         allowall                     session 

 

global-sacl

-----------

Priority  Source  Destination  Service  Application  Action  TimeRange  Log  Expired  Queue  TOS  8021P  Blacklist  Mirror  DisScan  ClassifyMedia  IPv4/6  Contract

--------  ------  -----------  -------  -----------  ------  ---------  ---  -------  -----  ---  -----  ---------  ------  -------  -------------  ------  --------

apprf-EmployeeComputer-sacl

---------------------------

Priority  Source  Destination  Service  Application  Action  TimeRange  Log  Expired  Queue  TOS  8021P  Blacklist  Mirror  DisScan  ClassifyMedia  IPv4/6  Contract

--------  ------  -----------  -------  -----------  ------  ---------  ---  -------  -----  ---  -----  ---------  ------  -------  -------------  ------  --------

allowall

--------

Priority  Source  Destination  Service  Application  Action  TimeRange  Log  Expired  Queue  TOS  8021P  Blacklist  Mirror  DisScan  ClassifyMedia  IPv4/6  Contract

--------  ------  -----------  -------  -----------  ------  ---------  ---  -------  -----  ---  -----  ---------  ------  -------  -------------  ------  --------

1         any     any          any                   permit                           Low                                                           4        

2         any     any          any-v6                permit                           Low                                                           6        

 

Expired Policies (due to time constraints) = 0

Guru Elite

Re: Application Works on Wired Network but not on Wireless Network

You should open a TAC case in parallel.  You could have an ACL on a port or enabled filtering on the AppRF dashboard...

 



Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

Frequent Contributor I

Re: Application Works on Wired Network but not on Wireless Network

Opened ticket. 

Frequent Contributor I

Re: Application Works on Wired Network but not on Wireless Network

I've been working with TAC and have made some progress. But, the engineer had to get on another call. What we were able to see is the device we are trying to connect with on UDP 7700 is behind an IAP and for whatever reason, the device's Internet facing IP address has the logon role on the contoller which is denying access. How could that be?

Guru Elite

Re: Application Works on Wired Network but not on Wireless Network

That usually means AAA is enabled on that interface/VLAN and/or the interface/VLAN is untrusted. 


Thanks, 
Tim

Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
Frequent Contributor I

Re: Application Works on Wired Network but not on Wireless Network

I worked with TAC a bit more today and have more info. I also found this page that explains the roles an IAP setup gets. http://community.arubanetworks.com/t5/Controller-less-WLANs/What-are-the-roles-that-IAP-gets-when-configured-as-IAP-VPN/ta-p/185738

 

We are trying to access a service behind the outer IP used to connect an IAP. I think because the outer IP entry has the logon role on the controller, traffic is being denied. TAC is looking into this more.

 

Does anyone have any suggestions based on this new info?

Thanks,
Robert

 

Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: