Extreme Networks EPICenter 4.1, Software Installation Manual

Page: 413 / 546

Policies View
EPICenter Software Installation and User Guide 413
Figure 201: Policy definition page for an Access-based Security policy
The policy name and optional description are displayed at the top of the page.
The Policy Traffic section, shows the elements that define the traffic flow:
• The Policy Type radio buttons determine the type of rules that will be generated from the policy
description, and thus affect how the policy endpoints are specified.
• The rest of this area shows the network resources that define the traffic flow for the policy.
— In the Access-based Security policy example shown in Figure 201, the policy traffic specification
includes two lists of resources that define the “network resources” or left-side endpoints for the
policy, and the “users” or right-side endpoints. These resources are defined in the EPICenter
Inventory or Grouping applets, and may include hosts, custom applications, users, devices, and
ports, or groups of any of those resources.
For example, the resource shown in the Network Resources list in Figure 201 is a single host. The
resource in the Users list is a User group. If you have Administrator or Manager access, you can
use the Edit button to access the resources list and view the definition of the resource groups. You
can also view their definitions through the Grouping applet. For the Network Resources side, the
resources are mapped to specific IP addresses and ports, but for the Users side, the IP addresses
are determined dynamically at network login.
If you are entering a new IP policy, the left-side endpoints will be “servers” and the right-side
endpoints will be “clients.” For the purpose of generating access list rules, those resources are
mapped to specific IP addresses and ports for use as source and destination endpoints. These lists
may also show IP addresses that have been entered directly.
— The traffic specification for an Access-based Security policy includes a flow direction (network
resources to user, user to network resources, or bidirectional). This is used by the EPICenter
policy server to determine the source and destination for each traffic flow. In the example, the
traffic is unidirectional, from user to network resource, which is the default for Security policies.