ACL / Access Lists on HPE Aruba ArubaOS-Switch

How to create extended ACLs on HPE Aruba ArubaOS-Switch and apply them to a VLAN interface. This example restricts a guest wireless network from accessing any internal address space while allowing internet access.

Scenario #

Guest network subnet: 192.168.0.0/23. Guests must reach the internet but must not reach any RFC1918 internal ranges.

Create the ACL #

cli

ip access-list extended "GUEST-ACL"
     10 permit ip 192.168.0.0 0.0.1.255 192.168.0.0 0.0.1.255
     20 deny ip 192.168.0.0 0.0.1.255 10.0.0.0 0.255.255.255 log
     30 deny ip 192.168.0.0 0.0.1.255 172.16.0.0 0.15.255.255 log
     40 deny ip 192.168.0.0 0.0.1.255 192.168.0.0 0.0.255.255 log
     50 permit ip 192.168.0.0 0.0.1.255 0.0.0.0 255.255.255.255 log
   exit

Line 10 — permits intra-subnet traffic (required for hosts on the /23 to communicate with each other)
Lines 20, 30, 40 — deny RFC1918 ranges
Line 50 — permit all other destinations (internet)

Apply to the VLAN interface #

cli

vlan 10
   name "Guest Network"
   ip access-group "GUEST-ACL" in
   ip address 192.168.0.1 255.255.254.0
exit

The ACL is applied inbound (in) — it inspects traffic as it arrives from guest clients.