Wireless Access

I have a public facing vlan that my guest vlan source nats through. Since this vlan is public, how do I block all management access to the public facing ip addrss on the vlan?

You can associate a session acl to the VLAN.  MAKE SURE you leave the port trusted!  If you enable no trust, then your user table will fill up with internet traffic!

See here:

Here is an example of this policy...tailor it to what you require:

I cannot seem to add an acl in the gui or the comand line. I do not have PEF licenses on my 3400 controler.

You could try using the control plane ACL. 

You can show the current entires with the following command:

#show firewall-cp internal

 You can add entries in global config mode:

(config) #firewall cp

That does not seem to be what I am looking for either. I was able to create a new seesion acl, but i cannot add rules to the acl. I simply want to block access to the public ip adress on the public vlan.

All of my vlans are assigned to port channel. Arubaos 6.3 on 3400 controller no PEF licenses. 

What i am looking for is an acl like:

ipv4 any <public ip> any deny     If this takes, will this break my source nt trough this vlan?

You can't modify session ACLs without a PEF license. You may want to block the traffic upstream of the controller.

Hello Seth

Is Natt, ESP and ike rally needed?

I mean if im not using any rap or anything on that interface.   I mean that interface is just for guest to go to internet.

Cheers

Carlos