Pre-Auth ACL

Location in GUI: Design » Network Settings » Wireless » Security Settings » Pre-Auth ACLs

Diagram

Classes

security_settings (catalyst_center.wireless)

Name	Type	Constraint	Mandatory	Default Value
pre_auth_acls	List	[pre_auth_acls]	No

pre_auth_acls (catalyst_center.wireless.security_settings)

Name	Type	Constraint	Mandatory	Default Value
name	String	max: 32	Yes
acl_name	String	max: 32	No
ipv6_enabled	Boolean	true, false	No	false
include_auto_generated_rules	Boolean	true, false	No	true
walled_garden_urls	List	String	No
rules	List	[rules]	Yes

rules (catalyst_center.wireless.security_settings.pre_auth_acls)

Name	Type	Constraint	Mandatory	Default Value
protocol	Choice	ANY, AHP, ESP, GRE, ICMP, IGMP, IP, IPINIP, NOS, OSPF, PCP, PIM, TCP, UDP, ICMPV6, IPV6, SCTP	Yes
source_address	String		Yes
source_prefix	Integer	min: 0, max: 128	No	32
destination_address	String		Yes
destination_prefix	Integer	min: 0, max: 128	No	32
source_ports	String		No	0-65535
destination_ports	String		No	0-65535

Pre-Auth ACLs define the traffic that is permitted before a wireless client is fully authenticated. They are used by Guest SSIDs with Layer 3 Web Authentication (Central Web Auth / External Web Auth) and by Enterprise Posturing SSIDs to allow limited access (DHCP, DNS, AAA, redirect/walled-garden destinations) while the client is in the pre-auth state. A Pre-Auth ACL is created at the Global level and is then referenced by an SSID through the acl_name field — see SSID.

Note: Pre-Auth ACLs APIs are only supported on Catalyst Center 3.2.x and later.

Important — ports and protocol: source_ports and destination_ports are only meaningful when protocol is TCP or UDP. For every other protocol (IP, ICMP, ANY, IPV6, ICMPV6, etc.) Catalyst Center silently normalizes both ports to the full range 0-65535. Omit source_ports and destination_ports from rules whose protocol is not TCP or UDP — otherwise the state read back from Catalyst Center will not match the configured values and Terraform will report a permanent drift on every plan.

Examples

Example-1: A Pre-Auth ACL with two rules (one IP, one TCP), a Walled Garden URL list, and a Guest SSID that references it via Layer 3 Web Authentication:

catalyst_center:
  wireless:
    security_settings:
      pre_auth_acls:
        - name: PreAuth_ACL
          acl_name: PreAuth_ACL
          ipv6_enabled: false
          include_auto_generated_rules: true
          walled_garden_urls:
            - www.cisco.com
            - www.example.com
            - www.abc.com
          rules:
            # Rules are evaluated in first-match order. Declare them in the order you
            # want Catalyst Center to evaluate them.
            - protocol: TCP
              source_address: 8.8.8.0
              source_prefix: 24
              destination_address: 26.255.25.0
              destination_prefix: 24
              source_ports: "23"
              destination_ports: "443"

            - protocol: IP
              source_address: 7.7.7.0
              source_prefix: 24
              destination_address: 25.255.25.0
              destination_prefix: 24
              # source_ports / destination_ports MUST be omitted when protocol is not TCP or UDP.

    ssids:
      - name: Guest_SSID
        acl_name: PreAuth_ACL
        wlan_type: Guest
        ssid_radio_type: "Triple Band"
        ghz24_policy: dot11-bg-only
        fast_lane: false
        egress_qos: PLATINUM
        ingress_qos: PLATINUM-UP
        enabled: true
        broadcast_ssid: true
        auth_type: OPEN
        fast_transition: ADAPTIVE
        l3_auth_type: web_auth
        auth_server: auth_ise
        auth_servers: ["198.18.133.27"]
        acct_servers: ["198.18.133.27"]
        aaa_override: true
        mac_filtering: true
        random_mac_filter: false
        posturing: false
        mft_client_protection: OPTIONAL
        protected_management_frame: REQUIRED
        neighbor_list: true
        coverage_hole_detection: true
        session_timeout_enable: true
        session_timeout: 28800
        client_exclusion: true
        client_exclusion_timeout: 1800
        basic_service_set_max_idle: true
        basic_service_set_client_idle_timeout: 300
        sleeping_client_timeout: 500
        directed_multicast_service: true
        nas_options: ["System IP Address"]
        client_rate_limit: 1000000

Note: Rules are sent to Catalyst Center in the order they are declared in the YAML. Pre-Auth ACLs are evaluated first-match, so declaration order is the evaluation order — place more-specific rules before broader ones.

Note: Rule identity at the API is the source_address → destination_address pair — Catalyst Center rejects two rules that share the same source and destination.

Note: walled_garden_urls is an unordered set. Reordering entries in the YAML will not produce a Terraform diff.