Wireless Access

last person joined: 18 hours ago 

Access network design for branch, remote, outdoor, and campus locations with HPE Aruba Networking access points and mobility controllers.
Back to discussions
Expand all | Collapse all

How can I check if the a firewall rule is blocking traffic on a Remote AP

This thread has been viewed 1 times

  • 1.  How can I check if the a firewall rule is blocking traffic on a Remote AP

    Posted Nov 04, 2015 04:14 AM

    Hi all

     

    I have an SSID configured and all the access points that use it are set as Remote AP's and the SSID is bridged onto the local LAN.

    I am having trouble getting traffic on the lan to talk to the wirless clients and so i need to see if the firewall on the Aruba is blocking the traffic.

    For my normal tunnel'd ssid's I can check this on the controller, however for bridged traffic onto the local LAN I do not see this.

    How can I check?

    cheers

    Carl



  • 2.  RE: How can I check if the a firewall rule is blocking traffic on a Remote AP

    EMPLOYEE
    Posted Nov 04, 2015 08:02 AM

    "show datapath session ap-name <name of ap> table"

     

    With a remote AP, very little unsolicited traffic can get to the AP that did not first originate from the AP, the "session-acl" parameter in the AP system profile determines what unsolicited traffic can be sent to a RAP:  http://www.arubanetworks.com/techdocs/ArubaOS_64x_WebHelp/Web_Help_Index.htm#ArubaFrameStyles/1CommandList/ap_system_profile.htm

     

    By default it is the ap-uplink-acl, which has the following parameters:

     

    ip access-list session ap-uplink-acl

      any any udp 68  permit

      any any svc-icmp  permit

      any host 224.0.0.251 udp 5353  permit

     

    That allows the AP to receive DHCP, allows ping and allows MDNS traffic.  You would make that ACL and allowall acl to allow more traffic unsolicited to your clients on a RAP.  If your client's traffic is being source-natted from the RAP, local clients cannot reach your clients on a RAP, however.