User's Guide

Configuring a VNS
hwc_vnsconfiguration.fm
Configuring Policy
9034530-02, March 2010
358 HiPath Wireless Controller, Access Points and Convergence Software V7.11, User Guide
• Default filter – If no matching filter ID was returned from the authentication
server.
6.10.3.2 Authenticated filter examples
Below are two examples of possible filtering rules for authenticated users. The
first example disallows some specific access before allowing everything else.
The second example does the opposite of the first example. It allows some
specific access and denies everything else.
6.10.4 ICMP Type enforcement
ICMP filter rules can now be constrained to ICMP type/range. You can define the
ICMP type/range in the Port field using the TCP/UDP port definition
nomenclature. That is, define the rule as a normal IP/subnet:port signature
(10.0.0.0/24:8), where the ICMP type is entered in the Port field.
This feature allows for tighter granularity over enforcement of ICMP restrictions.
You can allow redirects and DF/MTU indications, and deny ICMP Echo (pings)
for users.
6.10.5 Filtering rules for a default filter
After authentication of the wireless device user, the default filter will apply only
after:
• No match is found for the Exception filter rules.
In Out Allow IP / Port Description
x x *.*.*.*:22-23 SSH and telnet sessions
x x [specific IP address,
range]
Deny all traffic to a specific IP address
or address range
x x x *.*.*.*. Allow everything else
Table 30 Filtering rules example A
In Out Allow IP / Port Description
x x x [specific IP address,
range]
Allow traffic to a specific IP address or
address range.
x x *.*.*.*. Deny everything else.
Table 31 Filtering rules example B