Limiting Management Access to AP

[wies_hays]

Hello,

I'm using 12.8.2.2-NGVASEP18.

I'd like to learn about management access to my AP and how to limit it.

https://thehivecommunity.aerohive.com/s/article/How-to-Connect-to-an-AP-using-SSH describes how to connect to an AP via SSH.

But there's also an HTTP/HTTPS web user interface.

I don't want to expose those to anyone but the management systems.

"Device SSH Availability" in the docs (http://docs.aerohive.com/330000/docs/help/english/ng/Content/gui/configuration/configuring-device-ssh-availability.htm) tells me that I have to eneable SSH before I can use it... well, on my device it is not enabled, nor did I enable the WUI. Still I can log in via both.

My questions are:

• What is the idea behind the "Device SSH Availability" setting?
• How can I limit management (SSH / WUI / whatever there might be) by an ACL?

Probably I can create a firewall policy, but I believe that management access should be handeled by an ACL at first.... how can this be done?

Thank you!

Best regards,

Armin

[michael_bernard]

The setting for SSH availability in the Global Settings of the HiveManager is intended to enable to Proxy SSH connections through HiveManager to a target AP. Once this option is enabled in the HiveManager, Going into the device configuration of any Aerohive device will show "SSH" under "Additional Device Settings".

The physical Aerohive devices have SSH enabled by default. Regarding restricting SSH access, ideally, Aerohive devices would be placed in their our management VLAN. Client traffic would be segmented off in their own VLAN, with firewall rules preventing clients from access devices in the Aerohive management