direction (in|out) in dynamic (RADIUS-assigned) access control lists

[mischa_diehm]

Hi,

From the documentation and my tests I realized that it is only possible to filter on direction "in" with dynamic ACLs (dACL). This means only traffic that is originated from the Device behind the switchport that has received the dACl, can be filtered. But my goad is to implement a dACL that achives the following:

Allow any from the Client to the network
Deny any to the client from the network (possibly having some mgmt-systems as exceptions).

I wonder how that could be implemented through dACLs? The idea is that the ACLs are entirely coming through radius so that there is no need for any kind of access on the switch to change or add rules.

For the tests I have used:

Model: ARUBA 2930F 24G 4SFP SWITCH (JL259A)
Version: WC.16.10.0012

config:

eth 3:
aaa port-access mac-based 3 auth-vid 1
aaa port-access mac-based 3 unauth-vid 2

freeradius sends:
(2) NAS-Filter-Rule = "deny in ip from any to 1.1.1.1 cnt"
(2) NAS-Filter-Rule = "permit in ip from any to any cnt"

after successfull auth

nw-aruba-2930f-jl259a(config)# show access-list radius 3

Radius-configured Port-based ACL for
Port 3, Client -- 52453B-C6EBB4

IPv6 ACLs enabled (HP-Nas-Rules-Ipv6): FALSE
deny in ip from any to 1.1.1.1 cnt
Packet Hit Counter 0
permit in ip from any to any cnt
Packet Hit Counter 2

but with an out rule the switch says:
W 02/01/21 16:28:50 00703 idm: ACL error - invalid direction, index 3, client

any hints, ideas, explenations?
Thx 1000,
Mischa

[akg7]

Hello,

We request you to log a case on HPE Support Center portal for further resolution using the link: https://support.hpe.com/hpesc/public/home/

Thanks!