Manualshelf

Users Guide

ManualsBrandsDell ManualsAccess PlatformsW-Series Controller AOS
801802803804805806807808809810
Table Of Contents
(host) (config-sess-acl) #source destination proto-port/service/app/app-group <name> webcc-
category <ctgry> webcc-reputation <score> action [log | mirror | time-range]
The following actions are supported when web category/reputation is selected:
l Deny
l Permit
l Blacklist
l Classify-media
l Disable-scanning
l Dot1q-priority
l Log
l Mirror
l Queue
l Time-range
l TOS
Example for WebCC policy configuration is as follows:
ip access-list session url-filter
any any web-cc-category educational-institutions permit
any any web-cc-reputation suspicious deny
any any any deny
Assuming that webcc categorization was done only for http traffic running on TCP 80, the above ACL is
converted as follows in datapath for pre-classification ACL scan:
ip access-list session url-filter
any any tcp {80} permit
any any tcp {80} deny
any any any deny
Post-classification, ACL look-up will have the ACL as follows:
ip access-list session url-filter
any any tcp {80} WebCCCtgID 40 WebCCRep 1-100 permit
any any tcp {80} WebCCRep 1-100 deny
any any any deny
In case there exists an ACL rule to deny/permit a specific web category but is required to make an exception to
allow/deny a specific URL or website, then this can be accomplished by configuring in the following manner:
1. First define a netdestination with one or more URLs to whitelist or blacklist
(config) #netdestination search
(config-dest) #name www.google.com
(config-dest) #name www.bing.com
(config-dest) #exit
2. Apply this netdestination to an ACL
(config) #ip access-list session whitelist
(config-sess-whitelist)#any alias search tcp 80 permit
(config-sess-whitelist)#any alias search tcp 443 permit
3. Apply this ACL to an user-role. The position of this ACL should be at the top. However, with global or role-
specific default ACLs this wouldn’t be possible.
(config) #user-role guest2
(config-role) #access-list session whitelist
If there a web-cc/app rule that is applicable globally across user-roles, then there is no way to override such
behavior. This is a limitation.
Dell Networking W-Series ArubaOS 6.5.x | User Guide Dashboard Monitoring | 803