In AOS 10. which session-based ACL below will only allow ping from any wired station to wireless clients but will not allow ping from wireless…

This session ACL is applied to wireless clients. The alias user represents the wireless client's IP address. In ArubaOS, ACL rules are processed sequentially from top to bottom.

The goal is to allow ICMP (ping) from a wired source (any) to the wireless client (user) but deny ICMP initiated by the wireless client (user) to any wired destination (any).

The correct ACL structure is:

1. user any svc-icmp deny: This first rule explicitly denies any ICMP traffic originating from the wireless client (user) to any destination. This satisfies the requirement to block pings from wireless to wired.

2. any any svc-icmp permit: Any ICMP traffic that does not match the first rule is processed by this second rule. A ping from a wired host (any) to the wireless client (user) will not match the first rule and will be permitted by this rule.

Because the firewall is stateful, the return ICMP echo-reply for the allowed session is automatically permitted.

A. ip access-list session pingFromWired any user any permit

This rule is incorrect because it permits all protocols (any), not just ICMP, from any source to the user, making it overly permissive.

C. ip access-list session pingFromWired any any svc-icmp permit user any svc-icmp deny

The order is wrong. The first rule, any any svc-icmp permit, would match and allow all ICMP traffic, including pings from wireless to wired, so the second deny rule would never be processed.

D. ip access-list session pingFromWired any any svc-icmp deny any user svc-icmp permit

The order is wrong. The first rule, any any svc-icmp deny, would block all ICMP traffic. The second, more specific permit rule would never be reached, thus blocking the intended wired-to-wireless pings.

---

1. ArubaOS 10.4 User Guide

Page 380

"Configuring Firewall Policies".

Quote/Paraphrase: This document confirms that "Rules in a policy are processed sequentially until a match is found. When a match is found

the corresponding action is taken and no further rules are processed." This supports the reasoning for why options C and D are incorrect due to the order of their rules.

2. ArubaOS 10.4 User Guide

Page 382

"Policy Rule Parameters"

Table 103 "Policy Rule Parameters".

Quote/Paraphrase: This table defines the aliases used in ACLs. It specifies user as an "Alias for the user to whom this policy is applied" and any as matching "any IP address". This confirms the interpretation of the source and destination in the provided ACL options.

3. Aruba Networks

"ArubaOS 8.6.0.0 User Guide" (Fundamental principles are consistent with AOS 10)

Page 688

"Understanding the Stateful Firewall".

Quote/Paraphrase: "The stateful firewall monitors the state of all connections and traffic flows through the managed device... If a session is permitted by a firewall policy

all traffic belonging to that session is permitted." This supports the explanation that only the initial ping request needs to be permitted

and the reply will be allowed automatically.