I configured a policy to allow traffic between clients that are on the same subnet, connected to the same AP, but the controller is dropping the packets! Deny inter user traffic is NOT selected on the VAP or global parameters. Deny inter user bridging is alson NOT selected.
The policy is configured as follows:
user network 172.16.90.0 255.255.254.0 any permit
Both clients are on the 172.16.90.0 network and the controller is dropping the traffic.
But if I change the policy to:
any network 172.16.90.0 255.255.254.0 any permit, the traffic is allowed as expected!
Both clients are authenticated, on the same role, with a policy containing the ACL above.
On the same policy, I have other ACL´s using the "user" name allowing traffic to other subnets and it works.
Has anyone experienced this? Is this the expected behavour to clients on the same subnet?
Using the 'user' alias as the source in a rule means that although one client will allow the traffic because it is from them, the other client will drop the traffic as the source is not the authenticated user.
You either need to use the 'any' alias or have 2 rules as below:
network 172.16.90.0 255.255.254.0 user any permit
Thanks for the reply. I used the "any" alias to make this work.
At Aruba, we believe that the most dynamic customer experiences happen at the Edge. Our mission is to deliver innovative solutions that harness data at the Edge to drive powerful business outcomes.
© Copyright 2020 Hewlett Packard Enterprise Development LPAll Rights Reserved.