Dell W-Series 207 Instant 6.5.1.0-4.3.1.0 User Guide - Page 178

Chapter 14 Roles and Policies This chapter describes the procedures for configuring user roles, role assignment, and firewall policies. l Firewall Policies on page 178 l Content Filtering on page 191 l Configuring User Roles on page 195 l Configuring Derivation Rules on page 197 l Using Advanced Expressions in Role and VLAN Derivation Rules on page 203 Firewall Policies Instant firewall provides identity-based controls to enforce application-layer security, prioritization, traffic forwarding, and network performance policies for wired and wireless networks. Using Instant firewall, you can enforce network access policies that define access to the network, areas of the network that users may access, and the performance thresholds of various applications. Instant supports a role-based stateful firewall. Instant firewall recognizes flows in a network and keeps track of the state of sessions. Instant firewall manages packets according to the first rule that matches the packet. The firewall logs on the W-IAPs are generated as syslog messages. Access Control List Rules You can use Access Control List (ACL) rules to either permit or deny data packets passing through the W-IAP. You can also limit packets or bandwidth available to a set of user roles by defining access rules. By adding custom rules, you can block or allow access based on the service or application, source or destination IP addresses. You can create access rules to allow or block data packets that match the criteria defined in an access rule. You can create rules for either inbound traffic or outbound traffic. Inbound rules explicitly allow or block the inbound network traffic that matches the criteria in the rule. Outbound rules explicitly allow or block the network traffic that matches the criteria in the rule. For example, you can configure a rule to explicitly block outbound traffic to an IP address through the firewall. The W-IAP clients are associated with user roles, that determine the client's network privileges and the frequency at which clients re-authenticate. Instant supports the following types of ACLs: l ACLs that permit or deny traffic based on the source IP address of the packet. l ACLs that permit or deny traffic based on the source or destination IP address, and the source or destination port number. l ACLs that permit or deny traffic based on network services, application, application categories, web categories, and security ratings. You can configure up to 128 access control entries in an ACL for a user role. The maximum configurable universal role is 4096. Configuring ACL Rules for Network Services This section describes the procedure for configuring ACLs to control access to network services. Dell Networking W-Series Instant 6.5.1.0-4.3.1.0 | User Guide Roles and Policies | 178