topic Re: To which interfaces (radio or wired) are the user based ip filter options "inbound/outbound" associated (AP 230)? in Aerohive Migrated Content

To which interfaces (radio or wired) are the user based ip filter options "inbound/outbound" associated (AP 230)?

andreas_brueck — Wed, 03 Apr 2019 17:48:48 GMT

Dear all,

we are using the Hivemanager NG (build version 12.8.1.2-NGVAMAY18 ) to configure the user based ip filters. As access points we are using the AP230 (HiveOS 8.3r4 Mayberry build-195604 ).

I do not really understand, to which interfaces the user based ip filter options "inbound/outbound" are linked?

For example: If a packet/frame arrives on the wireless interface (Cient --> AP230), will be the inbound ACL executed? Or will be the inbound ACL executed, when a packet/frame comes for the wired interface (accessswitch --> AP 230)?

And what is with the outbound ACL's? To make it more understandable please take a look on the two following figures:

I am happy if someone can explain it to me 🙂

Regards,

Andreas

Re: To which interfaces (radio or wired) are the user based ip filter options "inbound/outbound" associated (AP 230)?

ashley_finch — Wed, 03 Apr 2019 19:22:27 GMT

Hi Andreas,

Looking at your rule name I'd guess you're trying to block Netflix therefore you'd keep this as an outbound rule. i.e. if the client tries to access Netflix, the AP would usually forward this traffic out to the internet (an outbound rule (Client -> AP)). Thus an inbound rule would be the opposite of this (AP -> Client)

Re: To which interfaces (radio or wired) are the user based ip filter options "inbound/outbound" associated (AP 230)?

andreas_brueck — Tue, 09 Apr 2019 16:20:43 GMT

Hey Ashley,

thank you very much for the explanation.

Could you also answer me the following question please:

If i define a rule for example to block mDNS between wireless clients, which are connected to the same access point, is a inbound rule the right choice?

Re: To which interfaces (radio or wired) are the user based ip filter options "inbound/outbound" associated (AP 230)?

ashley_finch — Tue, 09 Apr 2019 18:33:43 GMT

Hi Andreas,

I believe that would be correct for blocking just wireless clients, but you may need it outbound also if there are other devices on the network (from my understanding!). Depending on what traffic you need between different clients you may be able to disable inter-station traffic from within the Policy optional settings.