Extreme Networks EPICenter 4.1, Software Installation Manual

Page: 417 / 546

Creating a New Policy
EPICenter Software Installation and User Guide 417
Figure 204: Example of a schedul
e
5 Select the type of policy you want to create. The type of policy you choose will determine the type of
information you need to provide.
The policy type acts as a sort of template, requiring definition only of the components relevant to the
particular policy type.
Select the appropriate Policy Type as follows:
— select Type to generate access list rules for implementation on the devices in the policy scope.
— Select Security to specify the components of a policy for traffic between resources and
dynamically obtained user endpoints. A policy of this type will generate access list rules for
implementation of the devices in the access domain. These rules are generated whenever an
authorized user logs on and will be deleted when that user logs off.
— Select IP to specify the components of a policy for traffic between endpoints, such as a server and
specific clients or a particular service and server.
— Select VLAN to specify the components (VLANs) of a policy for traffic originating from the
member ports of one or more VLANs. A policy of this type will generate VLAN QoS rules for
implementation on the devices in the policy scope.
— Select Source Port to specify the components of a policy for traffic originating from specific
ingress ports. A policy of this type generates source physical port QoS rules for implementation
on the devices in the policy scope.
6 Specify the endpoints that will define the traffic flows to which this policy will apply.
For a Security policy: You must specify two sets of endpoints for a Security policy, which are
classified as network resources and users. The resources you select are typically hosts or users, but
do not need to be in a conventional “client-server” relationship. They simply represent the endpoints
(source and destination, translated to an IP address and port) of the traffic flow. You can specify
individual endpoints, or groups that contain the endpoints. The user end of the specification does
not need to have a specific IP address assigned to it, although it may.
You must also specify the traffic direction to which the policy should apply. The default for an
Access-based Security policy is user to resource.
For an IP policy: You must specify two sets of endpoints for an IP policy, which are classified as
servers and clients. The resources you select are typically hosts or users, but do not need to be in a
conventional “client-server” relationship. They simply represent the endpoints (source and
destination, translated to an IP address and port) of the traffic flow. You can specify individual
endpoints, or groups that contain the endpoints. You can also specify a subnet address or the “Any”
wildcard as an endpoint.