At any moment, if ACL is misconfigured and locks the administrators out, it can be disabled via netdiag with
remove_acl. More details
here.
The first option,
"Allow all IP addresses in the same subnet as the appliance" will allow devices on the
same subnet of the SMA, which would be with the IP setup on Network Settings. If any Proxy/VPN/Load Balancer is used, this may limit the ability of the SMA to detect that the device is on the same network and work intermittently or not work at all.
On the Allow List section, Network addresses are meant to be used, not individual IPs, although they can still be used, provided the Subnet Mask or CIDR reflect that it's meant for that host only (255.255.255.255 or 32).
"Range" notation should NEVER be used and could possibly break the ACL.
BAD examples:
- 10.0.0.1-254
- 10.0.0.1-10.0.0.254
- 10.0.0
- 10.0.0.
Below are some examples of which type of syntax can be used.
Good examples:
| IP Address | Subnet Mas/CIDR/Prefix Lenght | IPs that will actually be allowed |
|---|
| 192.168.0.0 | 24 | 192.168.0.1 to 192.168.0.254 |
| 192.168.0.0 | 255.255.255.0 | 192.168.0.1 to 192.168.0.254 |
| 192.168.0.0 | 255.255.0.0 | 192.168.0.1 to 192.168.255.254 |
| 192.168.1.50 | 255.255.255.255 | 192.168.1.50 only |
Reference sites:
IP Address, CIDR, and Subnetting.
IP Subnet Calculator
