205| 802.1X Auth entication DellPowerConnect W- Series ArubaOS 6.2 | User Guide
In theWebUI
1. N avigate to the Configuration > Security > Access Contr ol > Policies page.Select Add to add the student
policy.
2. Fo r Policy Name, enter student.
3. Fo r Policy Type, select IPv4 Session.
4. U nderRules, select Add to add rulesfor the policy .
a. UnderSource, select user.
b. Under Desti nation, select alias.
NOTE:The foll owing step defines an alias representing all internalnetwork addresses. Once defined, you
canuse the alias for other rules and policies.
c. Undert he alias selection, click New. For Destination Name, enter “Internal Network”. Click Add to add a
rule.For Rule Type, select netw ork.For IP Address, enter 10.0.0.0. For Network Mask/Range, enter 255.0.0.0.
Click Add to add the network range.Repeat these steps to add the network range 172.16.0.0 255.25 5.0.0.
Click Done. The alias “Internal Network” appears in the Destinati on menu.This step defines an alias
representingall internal network addresses.Once defined, you can use the alias for other rulesand policies.
d. Under Destinati on, select InternalNet work.
e. UnderService, select serv ice. In the Service scrollinglist , select svc-telnet.
f. Under Action, select drop.
g. Click Add.
5. U nderRules, click Add.
a. UnderSource, select user.
b. Under Desti nation, select alias. Then select InternalNet work.
c. UnderService, select ser vice.In the Service scrolling list, select svc-pop3.
d. Under Actio n,s elect drop.
e. Click Add.
6. R epeat steps 4A-E to create rulesfor t he followingservices: svc-ftp, svc-smtp, svc-snmp, and svc-ssh.
7. Click A pply.
8. Click t he User Roles tab. Click Add to create the student role.
9. Fo r Role Name, enter student.
10. Under Firewall Policies, click Add. In Choose from ConfiguredP olicies, select the student policy you previously
created.Click D one.
11. Click Apply.
In theCL I
(host)(config) #ip access-list session student
user alias “Internal Network” svc-telnet deny
user alias “Internal Network” svc-pop3 deny
user alias “Internal Network” svc-ftp deny
user alias “Internal Network” svc-smtp deny
user alias “Internal Network” svc-snmp deny
user alias “Internal Network” svc-ssh deny
(host)(config) #user-role student
session-acl student
session-acl allowall