A role refers to one or more policies composed of ordered match/action rules. Place an explicit deny for protected internal subnets before an otherwise permissive internet-access entry, while permitting infrastructure services needed for DHCP, DNS and captive portal as appropriate. A final default allow can be valid only when the earlier internal-deny rules reliably match the protected networks. Validate the applied role, destination address objects and rule counters; the rule set is ineffective if bound to the wrong SSID or enforcement point. For example, a policy can deny guest access to 10.0.0.0/8 and 172.16.0.0/12 before a general internet permit. It must still allow the required DNS and DHCP services for a usable guest session.
With first-match rules, adding a deny after an earlier broad permit can make it ineffective. Setting the entire default policy to allow-all without an early internal-networks deny violates the restriction. Match specific protected prefixes first, then permit the required public destinations.
Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit