Wireless Access

Hi,

I've recently found that i can only access the webgui of the Aruba MM from the same subnet as the server. Is this by design? I've been through the hardening guide and the config on the server and can't see any config that is locking it down and wondered if there is a way to open it to an IP outside of its subnet?

I thought there might be a Web lockdown acl or setting like on clearpass, but can't seem to find it. maybe i'm missing something.

thanks,

Could be that something is configured on internal Firewall.

Do a "show firewall-cp" to investigate
Reference - https://www.arubanetworks.com/techdocs/CLI-Bank/Content/aos8/firewall-cp.htm

Hi,

I've recently found that i can only access the webgui of the Aruba MM from the same subnet as the server. Is this by design? I've been through the hardening guide and the config on the server and can't see any config that is locking it down and wondered if there is a way to open it to an IP outside of its subnet?

I thought there might be a Web lockdown acl or setting like on clearpass, but can't seem to find it. maybe i'm missing something.

thanks,

Nothing that i can see. Port 4343 appears to be set to any.

ipv4        any                     6         4343        4343      Permit            1140205    cpbwc-ipv4-http

Could be that something is configured on internal Firewall.

Do a "show firewall-cp" to investigate
Reference - https://www.arubanetworks.com/techdocs/CLI-Bank/Content/aos8/firewall-cp.htm

Hi,

I've recently found that i can only access the webgui of the Aruba MM from the same subnet as the server. Is this by design? I've been through the hardening guide and the config on the server and can't see any config that is locking it down and wondered if there is a way to open it to an IP outside of its subnet?

I thought there might be a Web lockdown acl or setting like on clearpass, but can't seem to find it. maybe i'm missing something.

thanks,

Hi,

I've recently found that i can only access the webgui of the Aruba MM from the same subnet as the server. Is this by design? I've been through the hardening guide and the config on the server and can't see any config that is locking it down and wondered if there is a way to open it to an IP outside of its subnet?

I thought there might be a Web lockdown acl or setting like on clearpass, but can't seem to find it. maybe i'm missing something.

thanks,

If you can reach the WebUI from the same subnet but not from another subnet, it may be as simple as routing; either to the MM or back to your client.

It's not by design IMHO. I connect to multiple MM WebUIs from a different subnet and never had issues (except for firewalls blocking or routing not in place).

Hi,

I've recently found that i can only access the webgui of the Aruba MM from the same subnet as the server. Is this by design? I've been through the hardening guide and the config on the server and can't see any config that is locking it down and wondered if there is a way to open it to an IP outside of its subnet?

I thought there might be a Web lockdown acl or setting like on clearpass, but can't seem to find it. maybe i'm missing something.

thanks,

Its strange. I can ping it and i can get as far as it showing me its an untrusted cert (self-gen) and if i hit refresh a load of times quickly i get the logon box, but i can't logon.

If you can reach the WebUI from the same subnet but not from another subnet, it may be as simple as routing; either to the MM or back to your client.

It's not by design IMHO. I connect to multiple MM WebUIs from a different subnet and never had issues (except for firewalls blocking or routing not in place).

Hi,

I've recently found that i can only access the webgui of the Aruba MM from the same subnet as the server. Is this by design? I've been through the hardening guide and the config on the server and can't see any config that is locking it down and wondered if there is a way to open it to an IP outside of its subnet?

I thought there might be a Web lockdown acl or setting like on clearpass, but can't seem to find it. maybe i'm missing something.

thanks,

Is your IP traffic passing through a firewall before reaching the MCr? Perhaps blocking 4343?

Its strange. I can ping it and i can get as far as it showing me its an untrusted cert (self-gen) and if i hit refresh a load of times quickly i get the logon box, but i can't logon.

If you can reach the WebUI from the same subnet but not from another subnet, it may be as simple as routing; either to the MM or back to your client.

It's not by design IMHO. I connect to multiple MM WebUIs from a different subnet and never had issues (except for firewalls blocking or routing not in place).

Hi,

I've recently found that i can only access the webgui of the Aruba MM from the same subnet as the server. Is this by design? I've been through the hardening guide and the config on the server and can't see any config that is locking it down and wondered if there is a way to open it to an IP outside of its subnet?

I thought there might be a Web lockdown acl or setting like on clearpass, but can't seem to find it. maybe i'm missing something.

thanks,

No direct. Subnet to subnet , No acl.

Is your IP traffic passing through a firewall before reaching the MCr? Perhaps blocking 4343?

Its strange. I can ping it and i can get as far as it showing me its an untrusted cert (self-gen) and if i hit refresh a load of times quickly i get the logon box, but i can't logon.

If you can reach the WebUI from the same subnet but not from another subnet, it may be as simple as routing; either to the MM or back to your client.

It's not by design IMHO. I connect to multiple MM WebUIs from a different subnet and never had issues (except for firewalls blocking or routing not in place).

Hi,

I've recently found that i can only access the webgui of the Aruba MM from the same subnet as the server. Is this by design? I've been through the hardening guide and the config on the server and can't see any config that is locking it down and wondered if there is a way to open it to an IP outside of its subnet?

I thought there might be a Web lockdown acl or setting like on clearpass, but can't seem to find it. maybe i'm missing something.

thanks,

Can you SSH to the MM from the other subnet?

What about accessing a different device on the same subnet as the MM from the other subnet?

Have you tried different browsers?

No direct. Subnet to subnet , No acl.

Is your IP traffic passing through a firewall before reaching the MCr? Perhaps blocking 4343?

Its strange. I can ping it and i can get as far as it showing me its an untrusted cert (self-gen) and if i hit refresh a load of times quickly i get the logon box, but i can't logon.

If you can reach the WebUI from the same subnet but not from another subnet, it may be as simple as routing; either to the MM or back to your client.

It's not by design IMHO. I connect to multiple MM WebUIs from a different subnet and never had issues (except for firewalls blocking or routing not in place).

Hi,

I've recently found that i can only access the webgui of the Aruba MM from the same subnet as the server. Is this by design? I've been through the hardening guide and the config on the server and can't see any config that is locking it down and wondered if there is a way to open it to an IP outside of its subnet?

I thought there might be a Web lockdown acl or setting like on clearpass, but can't seem to find it. maybe i'm missing something.

thanks,

Yes, SSH works fine and is stable.  Can ping from both sides. Tried Chrome, Edge and Firefox. Just had a two hour TAC sessions and they can't work it out either and have taken a diagnostic log.

Can you SSH to the MM from the other subnet?

What about accessing a different device on the same subnet as the MM from the other subnet?

Have you tried different browsers?

No direct. Subnet to subnet , No acl.

Is your IP traffic passing through a firewall before reaching the MCr? Perhaps blocking 4343?

Its strange. I can ping it and i can get as far as it showing me its an untrusted cert (self-gen) and if i hit refresh a load of times quickly i get the logon box, but i can't logon.

If you can reach the WebUI from the same subnet but not from another subnet, it may be as simple as routing; either to the MM or back to your client.

It's not by design IMHO. I connect to multiple MM WebUIs from a different subnet and never had issues (except for firewalls blocking or routing not in place).

Hi,

I've recently found that i can only access the webgui of the Aruba MM from the same subnet as the server. Is this by design? I've been through the hardening guide and the config on the server and can't see any config that is locking it down and wondered if there is a way to open it to an IP outside of its subnet?

I thought there might be a Web lockdown acl or setting like on clearpass, but can't seem to find it. maybe i'm missing something.

thanks,

What version is on the MCr?

Yes, SSH works fine and is stable.  Can ping from both sides. Tried Chrome, Edge and Firefox. Just had a two hour TAC sessions and they can't work it out either and have taken a diagnostic log.

Can you SSH to the MM from the other subnet?

What about accessing a different device on the same subnet as the MM from the other subnet?

Have you tried different browsers?

No direct. Subnet to subnet , No acl.

Is your IP traffic passing through a firewall before reaching the MCr? Perhaps blocking 4343?

Its strange. I can ping it and i can get as far as it showing me its an untrusted cert (self-gen) and if i hit refresh a load of times quickly i get the logon box, but i can't logon.

If you can reach the WebUI from the same subnet but not from another subnet, it may be as simple as routing; either to the MM or back to your client.

It's not by design IMHO. I connect to multiple MM WebUIs from a different subnet and never had issues (except for firewalls blocking or routing not in place).

Hi,

I've recently found that i can only access the webgui of the Aruba MM from the same subnet as the server. Is this by design? I've been through the hardening guide and the config on the server and can't see any config that is locking it down and wondered if there is a way to open it to an IP outside of its subnet?

I thought there might be a Web lockdown acl or setting like on clearpass, but can't seem to find it. maybe i'm missing something.

thanks,

8.10.0.11

What version is on the MCr?

Yes, SSH works fine and is stable.  Can ping from both sides. Tried Chrome, Edge and Firefox. Just had a two hour TAC sessions and they can't work it out either and have taken a diagnostic log.

Can you SSH to the MM from the other subnet?

What about accessing a different device on the same subnet as the MM from the other subnet?

Have you tried different browsers?

No direct. Subnet to subnet , No acl.

Is your IP traffic passing through a firewall before reaching the MCr? Perhaps blocking 4343?

Its strange. I can ping it and i can get as far as it showing me its an untrusted cert (self-gen) and if i hit refresh a load of times quickly i get the logon box, but i can't logon.

If you can reach the WebUI from the same subnet but not from another subnet, it may be as simple as routing; either to the MM or back to your client.

It's not by design IMHO. I connect to multiple MM WebUIs from a different subnet and never had issues (except for firewalls blocking or routing not in place).

Hi,

I've recently found that i can only access the webgui of the Aruba MM from the same subnet as the server. Is this by design? I've been through the hardening guide and the config on the server and can't see any config that is locking it down and wondered if there is a way to open it to an IP outside of its subnet?

I thought there might be a Web lockdown acl or setting like on clearpass, but can't seem to find it. maybe i'm missing something.

thanks,