Extreme Networks Summit WM Series Guía de usuario descargar pdf (Pagina 65)

Filtering for a WM-AD

Summit WM-Series WLAN Switch and Altitude Access Point Software Version 1.0 User Guide

Four types of filters are applied by the Summit WM-Series Switch in the following order:

1 Exception filter, to provide the administrator optional additional flexibility in securing the system

and blocking Denial of Service (DoS) attacks, on any type of WM-AD.

2 Non-Authenticated filter, with filtering rules that apply before authentication, to control network

access and to direct users to a Captive Portal web page for login.

3 Group filters (by Filter ID) for designated user groups, to control access to certain areas of the

network, with values that match the values defined for the RADIUS Filter ID attribute.

4 Default filter, to control access if there is no matching Filter ID for a user.

Within each type of filter, you define a sequence of filtering rules. This sequence must be carefully

planned and arranged in the order that you want them to take effect. You define each rule to either

allow or deny traffic in either direction:

● “In”: from a wireless device in to the network

● “Out”: from the network out to the wireless device

The final rule in any filter should be a catch-all for any traffic that did not match a filter. This final rule

should either “allow all” or “deny all” traffic, depending on the requirements for network access. For

example, the final rule in a Non-Authenticated Filter for Captive Portal is typically “deny all”. A final

“allow all” rule in a Default Filter will ensure that a packet is not dropped entirely if no other match

can be found.

Each rule can be based on any one of the following:

● destination IP address, or any IP address within a specified range that is on the network subnet (as a

wildcard)

● destination ports, by number and range

● protocols (UDP, TCP, etc.)

This is how the Summit WM-Series Switch software filters traffic:

1 The Summit WM-Series Switch software attempts to match each packet of a WM-AD to the filtering

rules that apply to the wireless device user.

2 If a filtering rule is matched, the operation (allow or deny) is executed.

3 The next packet is fetched for filtering.

The filtering sequence depends on the type of authentication:

● No authentication (network assignment by SSID)

Only the Non-Authenticated filter will apply. Specific network access can be defined. Since there will

be no authentication, the final rule should be “deny all”.

● Authentication by captive portal (network assignment by SSID)

The Non-Authenticated filter will apply before authentication. Specific network access can be

defined. The filter should also include a rule to allow all users to get as far as the Captive Portal

webpage where the user can enter login identification for authentication. When authentication is

returned, then the Filter ID group filters are applied. If no Filter ID matches are found, then the

Default filter is applied.

1 2 ... 60 61 62 63 64 65 66 67 68 69 70 ... 227 228

Sin comentarios

Extreme Networks Summit WM Series Guía de usuario Pagina 65