nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

System L2ACL Issues - R510

Mouse6213

Hi folks--

I'm having issues with my Unleashed R510 and L2ACL. Up until earlier today I had an L2ACL (we'll call it Deny) assigned to a specific SSID. At a particular point I unblocked a device that was going to be used again (that was not on the Deny L2ACL) via the Unleashed app, and then noticed every entry in the Deny L2ACL was now being blocked on each SSID.

I then logged into the web UI to check the config, and removed the ACL within the UI, yet the devices were still being shown as blocked in the client list. I've power-cycled the unit, upgraded and downgraded, seemingly everything but a factory reset.

To the subject, though: After getting a chance to log into the AP via the CLI, I've confirmed that all of the entries in the Deny L2ACL are now in the System L2ACL, and I have not been able to edit the System L2ACL via CLI or otherwise.

Does anyone know how to edit the System L2ACL? Or how to resolve this issue otherwise? (I would obviously prefer not to do a factory reset.)

Find more posts tagged with

l2acl

Heartbeat

Accepted answers

syamantakomer

Hi @Mouse6213,

If you block a client directly from the web UI under clients, it will become the part of global L2ACL block list and blocked users cannot connect to any SSID. This is as per design.

Try below online doc which has CLI command to unblock a client, see if that helps.

https://docs.commscope.com/bundle/unleashed-200.13-commandref/page/GUID-B2B99E07-ACEA-4DA2-9649-94E88EB950D0.html

All comments

Mouse6213

Hi folks--

Anyone have any ideas on this? I've asked some folks offline tied to Ruckus/Commscope, and they, too, have been stumped.

This is what I see via terminal (MAC addresses removed). I still have not found a way to remove items from the L2ACL, which really does strike me as an odd situation to have. Happens with most recent firmware and a step down.

sanjay_kumar

Hi @Mouse6213

Can you try the below steps from the CLI:

To delete the ACL policy:
ruckus(config)# no l2acl <ACL name>
Example: ruckus(config)# no l2acl ACL
ruckus(config-l2acl)# end

To delete just the MAC entries and not the ACL policy:

ruckus# config
ruckus(config)# l2acl <Enter the L2 MAC ACL name>
ruckus(config-l2acl)# del-mac <MAC> -----> Deletes a MAC address from the L2 ACL.
ruckus(config-l2acl)# end

Let me know if this works.

syamantakomer

Hi @Mouse6213,

If you block a client directly from the web UI under clients, it will become the part of global L2ACL block list and blocked users cannot connect to any SSID. This is as per design.

Try below online doc which has CLI command to unblock a client, see if that helps.

https://docs.commscope.com/bundle/unleashed-200.13-commandref/page/GUID-B2B99E07-ACEA-4DA2-9649-94E88EB950D0.html

Mouse6213

Hi @sanjay_kumar --

Unfortunately, since these were somehow added to the System L2ACL, I'm not able to update that policy even in privileged.

Mouse6213

@syamantakomer --

This was it, thank you so much for the assist!

I had set these up as an L2ACL List within the Web UI (and blocked that way to a particular SSID), but not via the 'block' option of the client list. Since I kept seeing them on the System L2ACL Deny list, I never even thought to look at Hotspot Redirect Settings in the manual. Could this have possibly happened due to me removing a client that HAD been blocked via the Web UI, causing this list to suddenly populate the Global block list instead of the particular one I had created?

syamantakomer

Glad to hear that I was able to assist.

Yes, if you block a connected client from the web UI, the client MAC will land on the global block L2ACL.

syamantakomer

Hi @Mouse6213,

Command listed in this thread should help you. If not working, please confirm what is the output of the command.

sanjay_kumar

Hi @Mouse6213
If you go to Clients Tab >> You can see the list of clients, do you also see the clients here which you can see from the CLI System L2acl?

If yes, you can select it >> Click on More >> Click on Unblock.
This will remove the entry from the System L2acl. I just tried and it worked.

Please check and let me know.

If it is not working, please let me know the exact steps to reproduce the issue so that I can try.