Extreme Networks EPICenter 5.0, Руководство пользователя

Страница: 107 / 208

Network Access Security
EPICenter Concepts and Solutions Guide 107
See Chapter 5 “Managing VLANs” for more information about how EPICenter can help you manage the
VLANs on your network.
Using IP Access Lists
IP access lists (ACLs) determine what traffic is allowed on your network. ACLs use a set of access rules
you create to determine if each packet received on a switch port is allowed to pass through the switch,
and if so, at what priority and with how much bandwidth, or is denied (dropped) at the ingress port.
ACLs can be use to regulate both the type of traffic, the priority and minimum and maximum
bandwidth (via a QoS profile), and the source or destination of the traffic allowed on your network.
This is done by setting up access lists for the traffic, and determining if the traffic is allowed or denied
on the network, and if allowed, what QoS Profile applies. The access list controls can be set based on
the source or destination addresses. Refer to the
ExtremeWare Software User Guide for complete
description and syntax for ACLs.
You should use access lists to provide basic controls on what kind of traffic you will allow on your
network. Without access lists, any traffic from anywhere can traverse your entire network. For example,
you use access lists to allow HTTP traffic across your network, but deny online gaming traffic.
Designing IP Access Lists Through Policies
Access lists are configured based on policies created through EPICenter. Before creating these policies,
you need to translate your security requirements into appropriate IP or security policies. To design your
access list requirements, follow these steps:
1 Determine what traffic types you want to allow and deny on your network. Be sure to include both
protocol types and source or destination addresses you need to allow or block. This should be based
on your corporate security guidelines and the acceptable use guidelines for the hosts on your
network.
2 Set your access control requirements in order of precedence. Traffic will be checked against access
lists in order, using the first matching access list as the control for that traffic pattern.
3 Verify there is an appropriate “fall-through” control in your access list design. This default control is
what will be used when all other access lists do not match the traffic pattern. Typically, this default
control is a “deny-all” access list to block all traffic that does not match any security policy in place.
Using EPICenter to Create Access Lists
You use the optional Policy Manager feature in EPICenter to configure and monitor access lists. The
Policy Manager has a set of predefined services that you can configure to control network traffic
between users, devices or groups of users and devices. You create a set of policies to match the traffic
controls you want in place on your network. You must also set up the order in which these policies will
be applied. EPICenter uses these high-level policies to automatically create a set of access lists in each of
the network devices affected by the policy. When traffic comes into your network, the Extreme
Networks ingress switch port compares the traffic pattern (protocol, source and destination addresses
and ports) with the set of configured access lists. The access list is traversed in order until a match
occurs. If the traffic pattern matches an access list, that access list controls what happens to the traffic
(allowing it to continue on the network, or denying it and dropping the packets at the ingress port).
You need to have the appropriate license to use the optional Policy Manager feature in EPICenter.
Selecting the Policy Manager from the navigation bar in EPICenter displays the list of configured
policies. To create a new policy for IP Access Lists, follow these steps: