topic Re: Guest Wifi - restricted subnet access in ZoneDirector

Guest Wifi - restricted subnet access

wayne_eaton_4wn — Thu, 26 Apr 2018 20:15:27 GMT

ZD1100 (I know EOL). firmware 9.9.1.0 build 52

I've set up GuestWifi and activation and it works very nicely. I want to restrict users from other subnets so I configured Restricted Subnet Access, however, I can still get to anything on these subnets...ping, file shares, web portals, etc. Not sure what else I'm doing wrong?9.9.1.0 build 52

Re: Guest Wifi - restricted subnet access

igor_tunakin — Fri, 27 Apr 2018 10:02:05 GMT

Hi,it because the ACL is wrong. What subnet are you going to block?

You cannot block a subnet and allow some part of it.
Ex.
deny 172.16.0.0/12 means all packets with destination IP from 172.16.0.0 to 172.31.255.255 will be denied.And then you write: allow 172.17.10.3/32
If an ACL has so kind of mistakes it cannot be activated.

Re: Guest Wifi - restricted subnet access

wayne_eaton_4wn — Fri, 27 Apr 2018 12:09:23 GMT

Thank you, I can see that now. However, if this was working, than probably nothing would be working and my subnets that I'm intending to block would already be blocked by the 172.16.0.0/12. So this is still not working as I can get to IP's on 172.17.10.0...172.17.40.0...etc. Is there anything else I need to enable anywhere?

Re: Guest Wifi - restricted subnet access

igor_tunakin — Fri, 27 Apr 2018 12:14:04 GMT

Could you show your new ACL?

Re: Guest Wifi - restricted subnet access

wayne_eaton_4wn — Fri, 27 Apr 2018 12:25:21 GMT

Sure...here it is...

Re: Guest Wifi - restricted subnet access

igor_tunakin — Fri, 27 Apr 2018 13:08:27 GMT

looks good. Hmm... it has to work. I just tested a similar config and it is working well.
Try to create a new Guest Access Service and config new ACL. But this time step by step. Block one subnet and test it. Then a next one..

Re: Guest Wifi - restricted subnet access

wayne_eaton_4wn — Fri, 27 Apr 2018 14:06:41 GMT

Good idea...will do and let you know results. Thanks.

Re: Guest Wifi - restricted subnet access

wayne_eaton_4wn — Fri, 27 Apr 2018 14:44:30 GMT

Well that seemed to do the trick! When I created a new Guest Access Service, it put the four 'Deny' policies in place on it's own. However, I've added the 'allow' policy at the top so that users can get to a Crestron Mercury conferencing device for AirMedia and I can't get to that IP address. Thoughts?

Re: Guest Wifi - restricted subnet access

wayne_eaton_4wn — Fri, 27 Apr 2018 15:06:56 GMT

Disregard that last note about the Allow rule. I waited 10 minutes after setting this rule to test it, but I guess it took a little longer for it to work. I'm all set. Thanks Igor!