Extreme Networks Summit WM Series Guía de usuario descargar pdf (Pagina 39)

Filtering at the interface level

Summit WM-Series WLAN Switch and Altitude Access Point Software Version 1.0 User Guide

Port-based exception filters: built-in

On the Summit WM-Series Switch, various port-based exception filters are built in and invoked

automatically. These filters protect the Summit WM-Series Switch from unauthorized access to system

management functions and services via the ports.

For example, on the Summit WM-Series Switch’s data interfaces (both physical interfaces and WM-AD

virtual interfaces), the built-in exception filter prohibits invoking SSH, HTTPS, or SNMP. However, such

traffic is allowed, by default, on the Management port.

To enable SSH, HTTPS, or SNMP access through a data interface, select the interface in the IP Addresses

screen and click the “Management” checkbox on. You can also enable such management traffic in the

WM-AD definition.

If management traffic is explicitly enabled for any interface (physical port or WM-AD), access is

implicitly extended to that interface through any of the other interface. (WM-AD).

Only traffic specifically allowed by the interface’s exception filter is allowed to reach the Summit WM-

Series Switch itself. All other traffic is dropped. Exception filters are dynamically configured, and are

regenerated whenever the system's interface topology changes (a change of IP address for any

interface).

Enabling management traffic on an interface adds additional rules to the exception filter to open up the

well-known IP(TCP/UDP) ports corresponding to the HTTPS, SSH and SNMP applications.

The port-based built-in exception filtering rules, in the case of traffic from WM-AD users, operate only

on traffic that is targeted directly to one of the WM-AD's interfaces. For example, a WM-AD filter may

be generic enough to allow traffic access to the Summit WM-Series Switch's management (Allow All

[*.*.*.*]). The traffic will initially be allowed according to the WM-AD user’s policy, but may then be

denied by the exception filter of the WM-AD interface.

Port-based exception filters: user defined

You can add specific filtering rules at the port level in addition to the built-in rules. Such rules give you

the capability of restricting access to a port, for specific reasons, such as a Denial of Service (DoS) attack.

To define filtering rules that are associated with one of the physical data ports on the Summit WM-

Series Switch rather than with a WM-AD, use the Port Exception Filter screen.

The filtering rules are set up in the same manner as filtering rules defined for a WM-AD — specify an

IP address and then either “Allow” or “Deny” traffic to that address. See “Filtering rules for a WM-AD”

on page 86.

Exception filtering rules that you will define for a WM-AD will apply to the wireless device users after

their authentication, whereas the filtering rules that you define here apply to all traffic on a physical

port.

1 2 ... 34 35 36 37 38 39 40 41 42 43 44 ... 227 228

Sin comentarios

Extreme Networks Summit WM Series Guía de usuario Pagina 39