Wireless Access

Hi community

I have 8.3 architecture with MM and MDs with some configuration is global on folder level and some local on MD.s.

I have overwritten firewall CP rules on MD level.

But now when I want to remove local firewall CP I cannot remove last IPv6 rule

ipv6 deny any proto 0 ports 0 65535

When I try to remove it says

Invalid data: FW CP ACL not found

I would like to use inherited firewall CP, but this last rule seems to block inheritance

Any idea ? I appreciate any help

Karol

Have you tried a show "configuration effective detail" to see where this line of config is being derived from?

Hi Dustin

Thanks for reply

I have checked it now once more, this ACL rule is local.

Karol

If the controller configuration still can not be removed, I would try turning on disaster recovery with the "disaster-recovery on" command when your in MD connect or ssh directly into the controller, and then try to remove the configuration. When you're done turn disaster recovery off. 

If it still doesn't go away, try a reboot. Next step after that may be a call to TAC. 

Hi Dustin 

From disaster-recovery mode it is the same - cannot delete ACL rule 

It seems it is a kind of default deny any for all protocols and ports

I would call this problem to TAC 

Thanks

K

User roles typically end with an implicit deny all ... so anything not matched and acted on by policies will get dropped if there is no match. That may be what this is.

Where/how are you seeing the rule in question? Is it in the config file, show command output, etc?

Hi

it isn't user policy but in firewall cp 

I see it in CLI and GUI.

In CLI ther is following entry 

firewall cp
    ipv6 deny any proto 0 ports 0 65535

When I try to delete it I have message:

Invalid data: FW CP ACL not found

When I try to delete it from GUI message is a little bit different 

Error: expecting integer from 0 to 254

Karol

Why are you trying to remove control plane firewall policies? That is a default policy. Control plane firewall policies should not be changed without guidance from TAC.

Hi

I use firewall cp policies to control access to controller itself like ssh/https.

I have defined custom policies to allow/deny my custom networks.

As I have written in original post I would like to move those policies from local config to folder config, but it isn't possible it seems even one last rule block inheritance from folder level.

Of course there is solution to write erase and to reconnet MD to MM, but in my case for this moment this is not the case. 

Maybe yes it is kind of defult, but how to avoid problem ?

Karol