Filtering Rules For A Filter Id Group - Siemens HiPath C10 User Manual

If you place URLs in the header and footer of the Captive Portal page, you must explicitly allow
access to any URLs mentioned in the authentication's server page, such as:
Internal captive portal – URLs referenced in a header or footer
●
External CP – URLs mentioned in the page definition
●
Here is another example of a non-authenticated filter that adds two more filtering rules. The two
additional rules do the following:
Deny access to a specific IP address.
●
Allows only HTTP traffic.
●
In Out Allow IP / Port
x x x
x x x
x x
x x
x x
Table 8 Non-authenticated filter example B
Once a wireless device user has logged in on the Captive Portal page, and has been
authenticated by the RADIUS server, then the following filters will apply:
Filter ID – If a filter ID associated with this user was returned by the authentication server.
●
Default filter – If no matching filter ID was returned from the authentication server
●
7.6.3

Filtering rules for a filter ID group

When the wireless device user provides the identification credentials, identification is sent by
the HiPath Wireless Controller to the RADIUS server, or other authentication server, through a
sequence of exchanges depending on the type of authentication protocol used.
When the server allows this request for authentication—the server sends an access-accept
message, the RADIUS server may also send back to the HiPath Wireless Controller a filter ID
attribute value associated with the user. For an AAA VNS, a Login-LAT-Group identifier for the
user may also be returned. VNS Policy is also applicable for Captive Portal and MAC-based
authorization.
A31003-W1040-U101-1-7619, July 2006 DRAFT
HiPath Wireless Controller, Access Points and Convergence Software V4.0, C10/C100/C1000 User Guide
IP address of the default
gateway
IP address of the DNS
Server
[a specific IP address, or
address plus range]
*.*.*.*:80
*.*.*.*
Virtual Network configuration
Configuring filtering rules for a VNS
Description
Allow all incoming wireless devices access
to the default gateway of the VNS.
Allow all incoming wireless devices access
to the DNS server of the VNS.
Deny all traffic to a specific IP address, or to
a specific IP address range (such as:0/24).
Deny all port 80 (HTTP) traffic.
Deny everything else.
hwc_vnsconfiguration.fm
159