Users Guide

1047| External Services Interface Dell Networking W-Series ArubaOS 6.5.x| User Guide
serverserver_identity
Policies and User Role
The following sections describe how to configure the redirection policies and user role using the WebUI and
CLI.
In the WebUI
1. To configure user roles to redirect the required traffic to the server(s), navigate to the Configuration >
Access Control > User Roles view.
2. To add a new role, click Add.
To change an existing role, click Edit for the firewall policy to be changed. The WebUI displays the User
Roles tab on top.
3. Role Name. Enter the name for the role.
4. To add a policy for the new role, click Add in the Firewall Policies section. The WebUI expands the Firewall
Policies section.
Choose from existing configured policies, create a new policy based on existing policies, or create a new
policy.
a. If you elect to create a new policy, click on the radio button for Create New Policy and then click
Create. The WebUI displays the Policies tab.
b. In the Policies tab:
Policy Name. Provide the policy name and select the IPv4 Session policy type from the drop-down list.
The WebUI expands the Policies tab.
c. In the drop-down lists, choose parameters such as source, destination, service in the same way as other
firewall policy rules. For certain choices, the WebUI expands and adds drop-down lists.
d. In the Action drop-down menu, select the redirect to ESI group option.
e. In the Action drop-down menu, select the appropriate ESI group.
f. Select the traffic direction. Forward refers to the direction of traffic from the (untrusted) client or user
to the (trusted) server (such as the HTTP server or email server).
g. To add this rule to the policy, click Add.
h. Repeat the steps to configure additional rules.
i. Click Done to return to the User Roles tab. The WebUI returns to the User Roles tab.
5. Click Apply.
6. Refer to Roles and Policies on page 370, for directions on how to apply a policy to a user role.
In the CLI
ip access-listsessionpolicy
anyanyanyredirectesi-groupgroupdirectionbothblacklist
//For any incoming traffic, going to any destination,
//redirect the traffic to servers in the specified ESI group.
anyanyanypermit
//For everything else, allow the traffic to flow normally.
user-rolerole
access-list{eth|mac|session}
bandwidth-contractname
captive-portalname
dialername
pool {l2tp|pptp}
reauthentication-intervalminutes
session-aclname