Per-WLAN ACLs at the AP — filter wireless client traffic

Services & wireless
Advanced
12 min
1 steps
Cisco IOS-XE-style

The policy profile's aclIn / aclOut fields, previously stored as inert references, now actually filter wireless client traffic. Build a guest WLAN with aclIn: GUEST_BLOCK_INTERNAL that denies traffic from clients toward 10.0.0.0/8; PHONE's attempt to reach a corporate IP gets dropped at the AP (PacketDropped tagged with the ACL name) while public-internet traffic flows.

Open this lab in your browser →

Free · no install · no account

Scenario

Real Cisco wireless deployments enforce per-WLAN ACLs. Voice phones get an ACL that permits SIP/RTP and denies general TCP. Guest clients get an ACL that permits HTTP/HTTPS to public ranges and denies internal-network access. The ACLs are referenced from the policy profile and apply to the data plane: - aclIn: traffic FROM the wireless client TO the wired side (uplink). Evaluated at AP encap time. - aclOut: traffic FROM the wired side TO the wireless client (downlink). Evaluated at WLC encap time before sending into the tunnel. Slice M wires the existing aclIn/aclOut IR fields into the actual datapath. Resolution flow: 1. Wireless client emits a packet (or downlink arrives at WLC). 2. Find the joined AP → joined controller → policy tag → first WLAN/policy entry → policy profile → aclIn (uplink) or aclOut (downlink) name. 3. Look up the named ACL on the controller's accessLists. 4. Evaluate the inner packet against the ACL's entries. 5. Permit → continue (encap and forward). Deny → emit PacketDropped with the reason wlan-acl: '<NAME>' denied …, skip encap. What's deferred: - FlexConnect-only enforcement: Real APs in central-switching mode enforce on the WLC; FlexConnect APs enforce locally. The simulator collapses both into "evaluate once at emission time" — the verdict is the same. - Stateful matching: TCP established works (the ACL evaluator already supports it), but full conntrack-aware filtering is the next layer. - Time-based ACLs: time-range references work (existing IR), but mid-flow re-evaluation isn't modeled.

Topology

2 × router, 1 × wireless controller, 1 × switch, 1 × access point, 1 × wifi client · Cisco IOS-XE-style

ROUTER — router
WLC1 — wireless controller
HUB — switch
AP1 — access point
GUEST_PHONE — wifi client
INTERNAL — router

What you will do

Try engine.emitWirelessClientPacket({ deviceId: 'GUEST_PHONE', dst: parseIPv4('10.40.0.5') }). The destination 10.40.0.5 falls inside the deny ip any 10.0.0.0/8 rule, so the ACL fires at the AP and the packet never reaches the wire. Pcap should show no CAPWAP-Data uplink frame; a PacketDropped event tagged at AP1 carries reason: "wlan-acl: 'GUEST_BLOCK_INTERNAL' denied …".

Open this lab in your browser →

More labs on this topic

This lab in other languages

Pro-WLAN-ACLs am AP – filtern den Datenverkehr von drahtlosen Clients ACL por WLAN en el AP: filtra el tráfico de clientes inalámbricos ACLs por WLAN no AP — filtre o tráfego do cliente sem fio ACL par WLAN au niveau du point d'accès: filtre le trafic des clients sans fil एपी पर प्रति-डब्ल्यूएलएएन एसीएल - वायरलेस क्लाइंट ट्रैफ़िक को फ़िल्टर करें AP 处的每 WLAN ACL — 过滤无线客户端流量 ACL per WLAN sull'AP: filtrano il traffico dei client wireless AP での WLAN ごとの ACL — ワイヤレスクライアントトラフィックをフィルタリングします AP의 WLAN별 ACL — 무선 클라이언트 트래픽 필터링 ACL для каждой WLAN на точке доступа — фильтрация трафика беспроводных клиентов.AP'deki WLAN başına ACL'ler — kablosuz istemci trafiğini filtreleyin ACL trên mỗi mạng WLAN tại AP - lọc lưu lượng máy khách không dây