Filtering Sequence - Siemens HiPath C10 User Manual

6.6.2

Filtering sequence

The filtering sequence depends on the type of authentication used:
No authentication (network assignment by SSID)
●
Only the default filter will apply. Specific network access can be defined.
Authentication by captive portal (network assignment by SSID)
●
The non-authenticated filter will apply before authentication. Specific network access can
be defined. The filter should also include a rule to allow all users to get as far as the Captive
Portal Web page where the user can enter login identification for authentication. When
authentication is returned, the filter ID group filters are applied. If no filter ID matches are
found, then the default filter is applied. The filter ID group is an optional behavior
specification. If a filter ID is not returned, or an invalid one is returned, the default filter
group is applied.
Authentication by AAA (802.1x)
●
AAA assignment requires that user authentication is completed using the 802.1x/EAP
protocol before a user is granted access to a network resource. Therefor, the enforcement
of non-authenticated traffic rules is not applicable. When authentication is returned, then
the filter ID group filters are applied. A VNS can have a subgoup with Login-LAT-Group ID
that has its own filtering rules. The Login-LAT-Group indicates that a user session should
be associated with a more specific VNS (a child VNS). The sub-VNS provides a different
topology definition than the parent VNS, as well as having its own set of filter definitions.
filter IDs returned in association with a Login-LAT-Group definition are applied to the user,
in relation to the sub-VNS indicated by the Login-LAT-Group specification. If no filter ID
matches are found, then the default filter is applied.
The following is a high-level description of how HiPath Wireless Controller filters traffic:
Step One – The HiPath Wireless Controller attempts to match each packet of a VNS to the
filtering rules that apply to the wireless device user.
Step Two – If a filtering rule is matched, the operation to allow or deny is executed.
Step Three – The next packet is fetched for filtering.
A31003-W1040-U101-1-7619, July 2006 DRAFT
HiPath Wireless Controller, Access Points and Convergence Software V4.0, C10/C100/C1000 User Guide
hwc_vnsintro.fm
Virtual Network Services
Filtering for a VNS
115