484 Configuring and managing security ACLs
NN47250-500 (Version 03.01)

Order in which ACLs are applied to traffic

WSS Software provides different scopes (levels of granularity) for ACLs. You can apply an ACL to any of the following
scopes:
•User
•VLAN
• Virtual port (physical ports plus specific VLAN tags)
• Physical Port (network ports or Distributed APs)
WSS Software begins comparing traffic to ACLs in the order the scopes are listed above. If an ACL is mapped to more
than one of these scopes, the first ACL that matches the packet is applied and WSS Software does not compare the
packet to any more ACLs. For example, if different ACLs are mapped to both a user and a VLAN, and a user’s traffic
can match both ACLs, only the ACL mapped to the user is applied.

Traffic direction

An ACL can be mapped at any scope to either the inbound traffic direction or the outbound traffic direction. It is
therefore possible for two ACLs to be applied to the same traffic as it traverses the system: one ACL is applied on the
inbound direction and the other is applied on the outbound direction. When you map an ACL to one of the scopes listed
above, you also specify the traffic direction to which the ACL applies.

Selection of user ACLs

Identity-based ACLs (ACLs mapped to users) take precedence over location-based ACLs (ACLs mapped to VLANs,
ports, virtual ports, or Distributed APs).
ACLs can be mapped to a user in the following ways:
• Location policy (inacl or outacl is configured on the location policy)
• User group (attr filter-id acl-name.in or attr filter-id acl-name.out is configured on the user group)
• Individual user attribute (attr filter-id acl-name.in or attr filter-id acl-name.out is configured on the individual
user)
• SSID default (attr filter-id acl-name.in or attr filter-id acl-name.out is configured on the SSID’s service profile)
The user’s ACL comes from only one of these sources. The sources are listed in order from highest precedence to lowest
precedence. For example, if a user associates with an SSID that has a default ACL configured, but a location policy is
also applicable to the user, the ACL configured on the location policy is used.

Creating and committing a security ACL

The security ACLs you create can filter packets by source address, IP protocol, port type, and other characteristics.
When you configure an ACE for a security ACL, WSS Software stores the ACE in the edit buffer until you commit the
ACL to be saved to the permanent configuration. You must commit a security ACL before you can apply it to an authen-
ticated user’s session or map it to a port, VLAN, virtual port, or Distributed AP. Every security ACL must have a name.