Controller Based WLANs

Environment : Granular Application based ACL to be part of user role and application category to be used to create ACLs.

AppRF is Deep packet inspection mechanism with Application level intelligence introduced by Aruba.


ACLs can include both individual applications like Skype and can also have application categories like "Instant messaging". Below is the way to check the available application Categories.

(Abilash-Lab-Cont-master-6.4) #show dpi application category all

Application Categories
----------------------
Name                 App Category ID  Applied
----                 ---------------  -------
antivirus            1                0
application-service  2                0
audio-video          3                0
authentication       4                0
compression          5                0
database             6                0
encrypted            8                0
erp                  7                0
file-server          9                0
file-transfer        10               0
forum                11               0
game                 12               0
instant-messaging    13               1
mail                 14               0
microsoft-office     15               0
middleware           16               0
network-management   17               0
network-service      18               0
peer-to-peer         19               0
printer              20               0
routing              21               0
security-service     22               0
standard             23               0
telephony            24               0
terminal             25               0
thin-client          26               0
tunneling            27               0
wap                  28               0
web                  29               0
webmail              30               0

Total application groups = 30

(Abilash-Lab-Cont-master-6.4) (config) #ip access-list session "Instant-msg-block"
(Abilash-Lab-Cont-master-6.4) (config-sess-Instant-msg-block)#any any app-?

(Abilash-Lab-Cont-master-6.4) (config-sess-Instant-msg-block)#any any app?
app                     Application Name
appcategory             Application Category Name

(Abilash-Lab-Cont-master-6.4) (config-sess-Instant-msg-block)#any any appcategory instant-messaging deny
(Abilash-Lab-Cont-master-6.4) (config-sess-Instant-msg-block)#exit
(Abilash-Lab-Cont-master-6.4) (config) #exit
(Abilash-Lab-Cont-master-6.4) #show ip access-list Instant-msg-block

ip access-list session Instant-msg-block
Instant-msg-block
-----------------
Priority  Source  Destination  Service  Application                    Action  TimeRange  Log  Expired  Queue  TOS  8021P  Blacklist  Mirror  DisScan  ClassifyMedia  IPv4/6  Contract
--------  ------  -----------  -------  -----------                    ------  ---------  ---  -------  -----  ---  -----  ---------  ------  -------  -------------  ------  --------
1         any     any                   appcategory instant-messaging  deny                             Low                                                           4        

(Abilash-Lab-Cont-master-6.4) #