ACL / Access Lists on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

How to create extended ACLs on HPE Aruba ArubaOS-Switch and apply them to a VLAN interface. This example restricts a guest wireless network from accessing any internal address space while allowing internet access.

Scenario #

Guest network subnet: 192.168.0.0/23. Guests must reach the internet but must not reach any RFC1918 internal ranges.

Create the ACL #

cli

ip access-list extended "GUEST-ACL"
 10 permit ip 192.168.0.0 0.0.1.255 192.168.0.0 0.0.1.255
 20 deny ip 192.168.0.0 0.0.1.255 10.0.0.0 0.255.255.255 log
 30 deny ip 192.168.0.0 0.0.1.255 172.16.0.0 0.15.255.255 log
 40 deny ip 192.168.0.0 0.0.1.255 192.168.0.0 0.0.255.255 log
 50 permit ip 192.168.0.0 0.0.1.255 0.0.0.0 255.255.255.255 log
 exit

Line 10 — permits intra-subnet traffic (required for hosts on the /23 to communicate with each other)
Lines 20, 30, 40 — deny RFC1918 ranges
Line 50 — permit all other destinations (internet)

Apply to the VLAN interface #

cli

vlan 10
 name "Guest Network"
 ip access-group "GUEST-ACL" in
 ip address 192.168.0.1 255.255.254.0
exit

The ACL is applied inbound (in) — it inspects traffic as it arrives from guest clients.

Guest-Network on vlan51

ACL / Access Lists on HPE Aruba ArubaOS-Switch

Scenario #

Create the ACL #

Apply to the VLAN interface #