Users Guide

Dell Networking W-Series ArubaOS 6.5.x | User Guide External Firewall Configuration | 669
Chapter 29
External Firewall Configuration
In many deployment scenarios, an external firewall is situated between Dell devices. This chapter describes the
network ports that need to be configured on the external firewall to allow proper operation of the Dell
network. You can also use this information to configure session ACLs to apply to physical ports on the
controller for enhanced security. However, this chapter does not describe requirements for allowing specific
types of user traffic on the network.
A controller uses both its loopback address and VLAN addresses for communications with other network elements. If
the firewall uses host-specific ACLs, those ACLs must specify all IP addresses used on the controller.
Topics in this chapter include:
l Understanding Firewall Port Configuration Among Dell Devices on page 669
l Enabling Network Access on page 670
l Ports Used for Virtual Internet Access (VIA) on page 670
l Configuring Ports to Allow Other Traffic Types on page 670
Understanding Firewall Port Configuration Among Dell Devices
This section describes the network ports that need to be configured on the firewall to allow proper operation
of the network.
Communication Between Controllers
Configure the following ports to enable communication between any two controllers:
l IPSec (UDP ports 500 and 4500) and ESP (protocol 50). PAPI between a master and a local controller is
encapsulated in IPSec.
l IP-IP (protocol 94) and UDP port 443 if Layer-3 mobility is enabled
l GRE (protocol 47) if tunneling guest traffic over GRE to DMZ controller
l IKE (UDP 500)
l ESP (protocol 50)
l NAT-T (UDP 4500)
Communication Between APs and the Controller
APs use Trivial File Transfer Protocol (TFTP) during their initial boot to grab their software image and
configuration from the controller. After the initial boot, the APs use FTP to retrieve their software images and
configurations from the controller. In many deployment scenarios, an external firewall is situated between
various Dell devices.
Configure the following ports to enable communication between an AP and the controller:
l PAPI (UDP port 8211). If the AP uses DNS to discover the LMS controller, the AP first attempts to connect
to the master controller. (Also allow DNS (UDP port 53) traffic from the AP to the DNS server.)
l PAPI (UDP port 8211). All APs running as Air Monitors (AMs) require a permanent PAPI connection to the
master controller.
l FTP (TCP port 21)