Colubris Networks CN3000 Administrator's Manual page 154

Chapter 7 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Customizing CN3000 and customer settings - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Chapter 7
Within each access list, traffic cascades through the list rules in a similar manner.
How traffic flows through the access list rules.
Rules are numbered according to the order in which they are added. Only data that is
not accepted or denied by a rule is available to the next rule in the list.
Accounting support
Each rule in an access list can be configured with an account name for billing purposes.
The CN3000 will send billing information based on the amount of traffic matched by the
rule.
This lets you create rules to track and bill traffic to particular destinations.
Tips on using the access list
With certificates
• If you replaced the default SSL certificate on the CN3000 with one signed by a well-
• Customers may have configured their web browsers to check all SSL certificates
Remote login page
If you are using the remote login page feature, make sure that access to the web server
hosting the page must is granted to all unauthenticated customers.
SMTP redirect
If an unauthenticated customer establishes a connection to their email server, the SMTP
redirect feature will not work once the customer logs in. The customer's email will still be
sent to the original email server.
To avoid this, do not use an access list to open TCP port 25 for unauthenticated
customers.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 154 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Incoming traffic
Rule 1
DENY NO MATCH
Rule 2
DENY NO MATCH
Rule 3
DENY NO MATCH
DENY NO MATCH
known CA, you should define the access list to permit access to the CA certificate for
all non-authenticated customers. This enables the customer's browser to verify that
the certificate is valid without displaying any warning messages.
against the Certificate Revocation List (CRL) maintained by the CA that issued the
certificate. The location of the CRL may be configured in the browser, or embedded in
the certificate. The access list should be configured to permit access to the CRL,
otherwise the customer's browser will time out before displaying the login page.
ACCEPT
ACCEPT
ACCEPT
ACCEPT