Wireless Access

last person joined: yesterday 

Access network design for branch, remote, outdoor, and campus locations with HPE Aruba Networking access points and mobility controllers.
Back to discussions
Expand all | Collapse all

Is it possible to apply firewall rules in AP bridge mode

This thread has been viewed 0 times

  • 1.  Is it possible to apply firewall rules in AP bridge mode

    Posted Oct 16, 2017 02:30 PM

    Hi!

     

    I have a simple question. If I would like to use my APs in bridge mode, is it possible to apply firewall, application a webcc rules for the user traffic?

     

    The reason why I would like to use bridge mode is I have many sites with 1 AP each on them, and would like to sent the traffic directly out to the internet, not through the controller.

     

    Thanks!



  • 2.  RE: Is it possible to apply firewall rules in AP bridge mode

    Posted Oct 16, 2017 09:18 PM
    Webcc is not supported in bridge forwarding mode

    Get Outlook for iOS


  • 3.  RE: Is it possible to apply firewall rules in AP bridge mode
    Best Answer

    Posted Oct 17, 2017 04:16 AM

    despite the fact that advanced datapath/inspection based features are not available (e.g. webcc, airgroup etc., see "Behavior and Defaults" in the ArubaOS User Guide), you can still use firewall roles and things like src-nat.

     

    a typical location may look like

     

       [ internet ] --- +[ RG ] ---- [ local lan ] ---- [ AP ]

     

    where RG is some sort of residential gateway, cable modem or dsl modem etc, which provides src-nat functionality to the internet (denoted by +) and DHCP to the local lan.

     

    In this model, the AP will get an IP from the RG and in bridge mode the clients will also get their IP from the RG and be subject to a role and its firewall rules.

     

    If you want to allow local-lan based services to be able to initiate connectivity back into clients on the AP, you need to open up the ACL known as "ap-uplink-acl" which you can see applied on the AP system profile (of the ap-group)

     

    You have the option to also src-nat at the AP interface to the local-lan, likely however in the case of a single AP per site that is not needed.