Security

last person joined: yesterday 

Enterprise security using ClearPass Policy Management, ClearPass Security Exchange, IntroSpect, VIA, 360 Security Exchange, Extensions and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

client-to-client traffic dropped on the same subnet

Jump to Best Answer
  • 1.  client-to-client traffic dropped on the same subnet

    Posted Nov 04, 2016 07:31 AM

    Hi,

    I configured a policy to allow traffic between clients that are on the same subnet, connected to the same AP, but the controller is dropping the packets! Deny inter user traffic is NOT selected on the VAP or global parameters. Deny inter user bridging is alson NOT selected.

    The policy is configured as follows:

    user network 172.16.90.0 255.255.254.0 any  permit

    Both clients are on the 172.16.90.0  network and the controller is dropping the traffic.

    But if I change the policy to:

    any network 172.16.90.0 255.255.254.0 any  permit, the traffic is allowed as expected!

    Both clients are authenticated, on the same role, with a policy containing the ACL above.

    On the same policy, I have other ACL´s using the "user" name allowing traffic to other subnets and it works.

    Has anyone experienced this? Is this the expected behavour to clients on the same subnet?

    Thanks,

     

    Heraldo.



  • 2.  RE: client-to-client traffic dropped on the same subnet
    Best Answer

    Posted Nov 04, 2016 10:16 AM

    Using the 'user' alias as the source in a rule means that although one client will allow the traffic because it is from them, the other client will drop the traffic as the source is not the authenticated user.

    You either need to use the 'any' alias or have 2 rules as below:

     

    user network 172.16.90.0 255.255.254.0 any  permit

    network 172.16.90.0 255.255.254.0 user any permit



  • 3.  RE: client-to-client traffic dropped on the same subnet

    Posted Nov 07, 2016 09:31 PM

    Hi dave27,

     

    Thanks for the reply. I used the "any" alias to make this work.

    Regards,

     

    Heraldo.