Aruba Networks AirOS v2.3, User Manual

Page: 61 / 254

Configuring Firewall Roles and Policies 51
Chapter 5
C
HAPTER
5
Configuring Firewall Roles
and Policies
This chapter discusses configuring firewall roles and policies in an Aruba network. The
firewall roles and policies form the cornerstone of all functionality in an Aruba WLAN
Switch. Every
“user” in the system is associated with a “role” and this role determines the
privileges associated with the “user” .
Every user in an Aruba network is associated with a user role. The user role is defined as a set
of network privileges permitted to a user associated with the user role. This concept of users
and user-roles is central to the entire functioning of the Aruba network.
In a practical scenario, the administrator can configure firewall policies by creating a new
firewall policy and adding rules to the policy or by editing existing pre-defined firewall
policies. The administrator can then associate a set of these firewall policies with a user role to
define the network privileges associated with a user role.
Every user that associates to the Aruba network is placed in an initial pre-defined role called
“logon” role having enough privileges to use one of the authentication methods to authenticate
the user and be placed in a user role accordingly. The role of an authenticated user can be
derived from the following mechanisms:
1 Server derivation rules: The administrator can configure these rules to match
attributes returned by the authentication server (such as the RADIUS attributes)
in different ways to values to derive a role for the authenticated user.
As an example, consider a user abc authenticated using a RADIUS server. The adminis-
trator can create a rule that says if attribute x contains the string “xyz” , the user shall
derive a role called “Authenticated-user-role1” . Refer to “Configuring AAA Servers” on
page 67 for more explanation on how to configure these rules.