Dell 6.2 Chapte r 19

DellPowerConnect W- Series ArubaOS 6.2 | User Guide Rolesand Policies | 296
Chapte r 19
Roles and Po licies
The client in a Dell user-centric network is associated with a userr ole , which determines the client’s network
privileges,how o ften it must re-authenticate, and which bandwidth contracts are applicable.A policy is a set of rules
that applies to traffict hatpasses through the Dell controller. Youspecify one or more policies for a userrole.
Finally,you can assign a user role to clientsbefore or after they authenticate to the system.
This chapter describes assigningand creating roles and policies using the ArubaOS CLI or WebUI. Roles and
policies can also be configuredfor WLANs associ ated with the “default” ap-groupvia the WLAN Wizard:
Configuration > Wizards > WLAN Wizard. Follow the steps in the workflow pane within the wizard andrefer to
the helpt ab for assistance.
Topics in this chapter include:
l"ConfiguringFirewall Policies" on page 29 6
l"Creatinga FirewallP olicy" on page 297
l"Creatinga Network Service Alias" on page 300
l"Creatingan A CL White List" on page 300
l"CreatingUser R oles"o n page 302
l"Assigning User Roles" on page 305
l"UnderstandingGlobal Firewall Parameters" on page 310
NOTE:Thi s chapter describes configuring firewal l policies and parameters that relate toIPv4 traffic. See IPv6 Support on page 128
forinformation about configuring IPv6 firewall policiesand param eters.
Configuring Firew all Policies
A firewall policy identifies specific characteristics about a data packet passing through the Dell controller and takes
some action based on that identificatio n.I n a Dell controller, that action can be a firewall-type action such as
permitting or denying the packet, an administrative action such as logging the packet, or a quality of service (QoS)
action such as setting 802 .1p bits or placing the packet into a prio rity queue.You can apply firewallpolicies to user
rolest o givedi fferentialtreatment to different userso nthe same network, or to physical ports to apply thesame
policy to all traffic through the port.
Firewallpolicies differ from access control lists (ACLs) in the following ways:
lFirewallpolicies are stateful , meaningthat they recognize flows in a network and keep track of the state of
sessions. For example,if a firewall policy permits telnet traffic from a client,t hepolicy also recognizes that
inboundt rafficass ociated with that session should be allowed.
lFirewallpolicies are bi-directional , meaningthat they keep track of data connections traveling into or out of the
network.A CLs are normallyapplied to eit hert raffici nboundto an interface or outbound from ani nterface.
lFirewallpolicies are dynamic , meaningthat address information in the policy rules can change as the policies are
appliedt o users. For example,the alias user in a policy automaticallyapplies to the IP address assigned to a
particularuser. ACLs ty pically requirestati c IP addresses in the rule.