Manualshelf

Users Guide

ManualsBrandsDell ManualsAccess PlatformsW-Series Controller AOS
1091109210931094109510961097109810991100
Table Of Contents
Predefined Policy Description
ipv6 access-list session v6-http-acl
any any svc-http permit
Permits all IPv6
HTTP traffic.
ipv6 access-list session v6-tftp-acl
any any svc-tftp permit
Permits all IPv6
TFTP traffic.
ipv6 access-list session v6-logon-control
user any udp 68 deny
any any svc-v6-icmp permit
any any svc-v6-dhcp permit
any any svc-dns permit
Provides
equivalent
functionality to
the "logon-
control" policy,
but for IPv6
clients.
Validuser and Logon-control ACLs
Default firewall rules for both the validuser and logon-control ACLs prevent malicious users from ip spoofing
source addresses the default firewall rule in the validuser ACL causes the packet to be dropped.
A client with the correct source address can send traffic to the below networks as a destination IP address. To
deny traffic, the default firewall rule added to logon-control ACL denies traffic to the reserved addresses from
user with the logon role.
The following networks can be blocked by the default firewall rules in both the validuser and logon-control
ACLs:
l Network packets where the source address of the network packet is defined as being on a broadcast
network (source address == 255.255.255.255)
l Network packets where the source address of the network packet is defined as being on a multicast
network (source address = 224.0.0.0 – 239.255.255.255)
l Network packets where the source address of the network packet is defined as being a loopback address
(127.0.0.1 through 127.255.255.254)
l Network packets where the source or destination address of the network packet is a link-local address
(169.254.0.0/16)
l Network packets where the source or destination address of the network packet is defined as being an
address “reserved for future use” as specified in RFC 5735 for IPv4; (240.0.0.0/4)
l Network packets where the source or destination address of the network packet is defined as an
“unspecified address”(::/128) or an address “reserved for future definition and use”(addresses other than
2000::/3) as specified in RFC 3513 for IPv6. The IPv6 “an unspecified address”(::/128) is currently being
checked in datapath and the packet is dropped. This is the default behavior and you can view the logs by
enabling firewall enable-per-packet-logging configuration.
Roles
The following are predefined roles.
If you upgrade from a previous ArubaOS release, your existing configuration may have additional or different
predefined roles. The information in this section only describes the predefined roles for this release.
Dell Networking W-Series ArubaOS 6.5.x | User Guide Behavior and Defaults | 1092