Meraki Switching ACLs

[RobertOcampo]

Greetings, 

We are are using our MS425 Switch for ACLs, we have an instance where our Staff VLAN on WIFI is allowed to printer to our Printer VLAN, however when we use ethernet the endpoint is no longer able to send print jobs to the Printer VLAN.

We have assess our Switching ACLs in the Meraki Dashboard. We are deny all ports in the Staff VLAN except for Port, 80, 443, 53, 67, 68, 515, 554, 631, 5353. 

Not sure as to why we are able to print via windows/Apple on WIFI and not using Ethernet. Shouldn't the ACLs apply to both WIFI and Ethernet?

Any thoughts, would be appreciated?

Rob

[rhbirkelund · Accepted solution]

ACLs configured on the Switching page, are only applied to Switches. Not Wifi per se. They may impact ports that have APs connected. 

[RobertOcampo]

Hi Rhbirkelund,

I appreciate the reply, my apologies I forgot to mention that all of our switching is MS Switches, from 425 aggregation switch to 390 Access Switch. we use MR APs that directly connect to the 390s. 

[alemabrahao]

That depends, who is the gateway for the network?

Can you send a screenshot of the settings?

[PhilipDAth]

Take a packet capture for WiFi and Ethernet.  Compare them.  Find the difference.  🙂

[RobertOcampo]

Hi PhilipDAth,

Thanks for the suggestions, I will give that a shot. 

[JonoM]

Hi @RobertOcampo ,

@PhilipDAth's suggestion is excellent and will certainly help to see why WiFi traffic is being allowed on WiFi but not ethernet.

Since you are using all Meraki Switches, you can take packet captures directly from the dashboard.

I would recommend taking these captures on the switch port that your WiFi/Ethernet end client is connected to. You can filter the traffic captured using a filter expression 'host X.X.X.X' where X.X.X.X is the IP address of your end client. 

Example of what you packet capture might look like

If you need any help reviewing the packet capture, you can reach out to the Meraki Support team and we will be happy to help!

[RobertOcampo]

Hi JonoM,

That is super helpful, I will try that out.  Thanks