Concept Guide

Dell Networking W-Series Instant 6.5.1.0-4.3.1.0 | User Guide Roles and Policies | 178
Chapter 14
Roles and Policies
This chapter describes the procedures for configuring user roles, role assignment, and firewall policies.
l Firewall Policies on page 178
l Content Filtering on page 191
l Configuring User Roles on page 195
l Configuring Derivation Rules on page 197
l Using Advanced Expressions in Role and VLAN Derivation Rules on page 203
Firewall Policies
Instant firewall provides identity-based controls to enforce application-layer security, prioritization, traffic
forwarding, and network performance policies for wired and wireless networks. Using Instant firewall, you can
enforce network access policies that define access to the network, areas of the network that users may access,
and the performance thresholds of various applications.
Instant supports a role-based stateful firewall. Instant firewall recognizes flows in a network and keeps track of
the state of sessions. Instant firewall manages packets according to the first rule that matches the packet. The
firewall logs on the W-IAPs are generated as syslog messages.
Access Control List Rules
You can use Access Control List (ACL) rules to either permit or deny data packets passing through the W-IAP.
You can also limit packets or bandwidth available to a set of user roles by defining access rules. By adding
custom rules, you can block or allow access based on the service or application, source or destination IP
addresses.
You can create access rules to allow or block data packets that match the criteria defined in an access rule. You
can create rules for either inbound traffic or outbound traffic. Inbound rules explicitly allow or block the
inbound network traffic that matches the criteria in the rule. Outbound rules explicitly allow or block the
network traffic that matches the criteria in the rule. For example, you can configure a rule to explicitly block
outbound traffic to an IP address through the firewall.
The W-IAP clients are associated with user roles, that determine the client’s network privileges and the
frequency at which clients re-authenticate.
Instant supports the following types of ACLs:
l ACLs that permit or deny traffic based on the source IP address of the packet.
l ACLs that permit or deny traffic based on the source or destination IP address, and the source or
destination port number.
l ACLs that permit or deny traffic based on network services, application, application categories, web
categories, and security ratings.
You can configure up to 128 access control entries in an ACL for a user role.
The maximum configurable universal role is 4096.
Configuring ACL Rules for Network Services
This section describes the procedure for configuring ACLs to control access to network services.