Siemens SCALANCE W1750D UI, Руководство по настройке

Страница: 243 / 570

SCALANCE W1750D UI
Configuration Manual, 02/2018, C79000-G8976-C451-02
243
Roles and Policies
15
15.1 Firewall Policies
SCALANCE W firewall provides identity-based controls to enforce application-layer security,
prioritization, traffic forwarding, and network performance policies for wired and wireless
networks. Using SCALANCE W firewall, you can enforce network access policies that define
access to the network, areas of the network that users may access, and the performance
thresholds of various applications.
SCALANCE W supports a role-based stateful firewall. SCALANCE W firewall recognizes
flows in a network and keeps track of the state of sessions. SCALANCE W firewall manages
packets according to the first rule that matches the packet. The firewall logs on the APs are
generated as syslog messages.
15.1.1 Access Control List Rules
You can use Access Control List (ACL) rules to either permit or deny data packets passing
through the AP. You can also limit packets or bandwidth available to a set of user roles by
defining access rules. By adding custom rules, you can block or allow access based on the
service or application, source or destination IP addresses.
You can create access rules to allow or block data packets that match the criteria defined in
an access rule. You can create rules for either inbound traffic or outbound traffic. Inbound
rules explicitly allow or block the inbound network traffic that matches the criteria in the rule.
Outbound rules explicitly allow or block the network traffic that matches the criteria in the
rule. For example, you can configure a rule to explicitly block outbound traffic to an IP
address through the firewall.
The AP clients are associated with user roles, that determine the client’s network privileges
and the frequency at which clients re-authenticate.
SCALANCE W supports the following types of ACLs:
● ACLs that permit or deny traffic based on the source IP address of the packet.
● ACLs that permit or deny traffic based on the source or destination IP address, and the
source or destination port number.
● ACLs that permit or deny traffic based on network services, application, application
categories, web categories, and security ratings.
Note
You can configure up to 128 access control entries in an ACL for a user role.
Note
The maximum configurable universal role is 4096.