Siemens EF 711 Series Betriebsanweisung PDF herunterladen (Seite 190)

Configuring Policies

Filtering Rules

SCALANCE WLC711

5-6 C79000-G8976-C260-03, 07/2012, User Guide, V8.11

Filtering Rules for a Default Filter

After authentication of the wireless device user, the default filter will apply only after:

• No filter ID attribute value is returned by the authentication server for this user.

• No Policy match is found on the SCALANCE IWLAN Controller for the filter ID value.

The final rule in the default filter should be a catch-all rule for any traffic that did not match a

filter. A final Allow All rule in a default filter will ensure that a packet is not dropped entirely if no

other match can be found. VNS Policy is also applicable for Captive Portal and MAC-based

authorization.

Default Filter Examples

The following are examples of filtering rules for a default filter:

Filtering Rules Between Two Wireless Devices

Traffic from two wireless devices that are on the same VNS and are connected to the same

Wireless AP will pass through the SCALANCE IWLAN Controller and therefore be subject to

filtering policy. You can set up filtering rules that allow each wireless device access to the default

gateway, but also prevent each device from communicating with each other.

Add the following two rules to a filter ID filter, before allowing everything else:

Table 5-7 Default Filter Example A

In Out Allow IP / Port Description

x x Intranet IP, range Deny all access to an IP range

x x Port 80 (HTTP) Deny all access to Web browsing

x x Intranet IP Deny all access to a specific IP

x x x *.*.*.*. Allow everything else

Table 5-8 Default Filter Example B

In Out Allow IP / Port Description

x Port 80 (HTTP) on host IP Deny all incoming wireless devices access to

Web browsing the host

x Intranet IP 10.3.0.20, ports 10-

Deny all traffic from the network to the wireless

devices on the port range, such as telnet (port

23) or FTP (port 21)

x x Intranet IP 10.3.0.20 Allow all other traffic from the wireless devices

to the Intranet network

x x Intranet IP 10.3.0.20 Allow all other traffic from Intranet network to

wireless devices

x x *.*.*.*. Deny everything else

Table 5-9 Rules Between Two Wireless Devices

In Out Allow IP / Port Description

x x x [Intranet IP] Allow access to the Gateway IP address of the VNS only

1 2 ... 185 186 187 188 189 190 191 192 193 194 195 ... 491 492

Keine Kommentare

Siemens EF 711 Series Betriebsanweisung Seite 190