Users Guide

395| Roles and Policies Dell Networking W-Series ArubaOS 6.5.x| User Guide
The string "apprf" is added to the beginning and "sacl" to the end of a role’s name to form a controllerunique
name for role default session ACL. This session ACL is in position two of the given user role after the global
session ACL and takes the next higher priority after global policy rules.
The predefined role session ACL has the following properties:
l It cannot be deleted through the WebUI or CLI. It is only deleted automatically when the corresponding role
is deleted.
l It always remains at position 2 in every role and its position cannot be modified.
l It contains only application rules.
l It can be modified using the WebUI, CLI, or dashboard on a master controller, however any modification
results in the regeneration of ACE’s for that role.
l It cannot be applied to any other role.
Each application has an implicit set of ports that are used for communication. In phase 1, if an application ACE
entry is hit, the traffic matching this application’s implicit port is allowed (as governed by the application ACE).
The DPI engine can monitor the exchange on these ports and determine the application. Once the application
is determined, phase 2 occurs when an evaluation is done to determine the final outcome for the session.
Example
This example shows a DPI rule along with a L3/L4 rule with forwarding action in the same ACL. Both
ACLpolicies can be applied to a single user role.
ACL Policy "AppRules", Policy Type: Session
l Rule 1
n source: any
n destination: any
n service/application: application facebook
n action: permit
n TOS value: 45
l Rule 2:
n source: any
n destination: any
n service/application: application YouTube
n action: deny
l Rule 3:
n source: any
n destination: any
n service/application: application category peer-to-peer
n action: deny
l Rule 4:
n source: any
n destination: any
n service/application: TCP 23
n action: permit
l Rule 5:
n source: network 40.1.0.0/16
n destination: any