Omada ACL configuration

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.

Omada ACL configuration

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Omada ACL configuration
Omada ACL configuration
2023-11-29 11:46:20 - last edited 2023-12-25 09:48:36
Tags: #ACL
Model: OC300  
Hardware Version: V1
Firmware Version: 1.19.3 Build 20230906 Rel.38429

Good morning, I am having difficulty in creating an ACL setting.


I have two subnets:
- 10.10.0.1/16 (VLAN 1)
- 192.168.18.1/24 (VLAN 18)

 

I have created two LANs (one for the default lan, the other for VLAN 18), two SSIDs (one for the default lan, the other for VLAN 18) and now I would like to create an ACL rule (switch ACL) to keep the two subnets from interacting.

 

In creating it, I get this error:
"This ACL rule cannot take effect because some switches did not respond to the configurations."

All devices are connected (green).


What can I do?
Thanks for anyone who would like to answer me

  0      
  0      
#1
Options
1 Accepted Solution
Re:Omada ACL configuration-Solution
2023-11-30 07:28:58 - last edited 2023-12-25 09:48:36

  @d0ugmac1 

 

Just tested: I removed the SG2008P switch but I still can't create the ACL rule. For now I solve with the "Guest VLAN"

TNX ;)

Recommended Solution
  0  
  0  
#9
Options
8 Reply
Re:Omada ACL configuration
2023-11-29 15:26:39

  @MaGiDeL 

 

Paste your network topology (Controller->Maps->Topology, click the Show Labels before taking the screen shot).

 

I suspect you have stacked switches and you've managed to lockout the lower switch with the ACL that was applied to the uppers switch.  By lower and upper, I mean you have modem-->Router-->UpperSwitch-->LowerSwitch, as opposed to having both switches connected directly to router.

 

If this is the case, you just need to look at the order of priority of the ACLs you are applying and the PortConfigs applied to the switch ports that are connected to each other.

<< Paying it forward, one juicy problem at a time... >>
  0  
  0  
#2
Options
Re:Omada ACL configuration
2023-11-29 21:10:11 - last edited 2023-11-29 21:10:58

  @d0ugmac1 

 

 

  0  
  0  
#3
Options
Re:Omada ACL configuration
2023-11-29 21:32:31

  @MaGiDeL 

 

Ok, I believe the issue is due to the stacked switch architecture and the fact that VLAN1 is always untagged.  Any chance all 4 of your switches can just plug directly into the ER707 (actually, just replace the wire+SG2008 with wire+ER707 and connect each of the 3 downstream switches directly to LAN ports on the ER707?  If not, and this is a bit of a cheater move, just 'unmanage' the SG2008 (ie default it and don't re-adopt with controller and basically make it a dumb switch) things may just work at that.

 

If VLAN18 devices don't need to talk to each other, just make it a 'Guest VLAN', that will prevent those IP's from going anywhere but to the internet and you don't need ACLs.

 

 

<< Paying it forward, one juicy problem at a time... >>
  0  
  0  
#4
Options
Re:Omada ACL configuration
2023-11-29 21:43:22

  @d0ugmac1 

 

...the thing is that my house is made of 3 floors. Each floor has a switch (TL-SG2016P, TL-SG2428P and TL-SG3452P).

All three switches converge at the star center in the TL-SG2008P switch, to which perhaps I should attach the ER707-M2 and the OC300 controller.

 

Maybe this way the topology would be more correct?

  0  
  0  
#5
Options
Re:Omada ACL configuration
2023-11-29 22:20:08

  @MaGiDeL 

 

The ER707 has 7 ports, you are only using 1 for the WAN.  I would relocate the ER707 to the physical centre of the 'star' configuration (where all cables terminate) and plug all switches directly into LAN ports on it.  You can plug the controller into any available port on any device.  

 

Worst case you have to run a new cable back to the ISP modem area to relocate the SG2008 there for any local wired clients....but I doubt that's a requirement.

<< Paying it forward, one juicy problem at a time... >>
  0  
  0  
#6
Options
Re:Omada ACL configuration
2023-11-29 22:49:45

  @d0ugmac1 

 

..for now by setting VLAN18 in "guest vlan" I have solved the problem temporarily... but it's strange that you can't do what I have in mind!

  0  
  0  
#7
Options
Re:Omada ACL configuration
2023-11-29 22:57:18

  @MaGiDeL 

 

I think the issue is that Omada is pretty simple, it expects 1 router - switch - APs - Meshed APs.

 

I would be interested to see if making the SG2008P a dumb switch by temporarily unmanaging it, if your solution then works.  You can re-adopt after the test.

<< Paying it forward, one juicy problem at a time... >>
  0  
  0  
#8
Options
Re:Omada ACL configuration-Solution
2023-11-30 07:28:58 - last edited 2023-12-25 09:48:36

  @d0ugmac1 

 

Just tested: I removed the SG2008P switch but I still can't create the ACL rule. For now I solve with the "Guest VLAN"

TNX ;)

Recommended Solution
  0  
  0  
#9
Options