Configuring Management Subnets - Aruba IAP-335 User Manual

Table 40: Inbound Firewall Rule Configuration Parameters
Parameter
Log
Blacklist
Classify media
Disable scanning
DSCP tag
802.1p priority
4. Click OK and then click Finish.
In the CLI
To configure inbound firewall rules:
(Instant AP)(config)# inbound-firewall
(Instant AP)(inbound-firewall)# rule <subnet> <smask> <dest> <mask> <protocol> <sport> <eport>
{permit|deny|src-nat|dst-nat <IP-address> <port>} [<option1....option9>]
(Instant AP)(inbound-firewall)# end
(Instant AP)# commit apply
Example
(Instant AP)(config)# inbound-firewall
(Instant AP)(inbound-firewall)# rule 192.0.2.1 255.255.255.255 any any match 6 631 631 permit
(Instant AP)(inbound-firewall)# end
(Instant AP)# commit apply

Configuring Management Subnets

You can configure subnets to ensure that the IAP management is carried out only from these subnets. When
the management subnets are configured, access through Telnet, SSH, and UI is restricted to these subnets
only.
You can configure management subnets by using the Instant UI or the CLI.
193 | Roles and Policies
Description
Select the Log check box if you want a log entry to be created when this rule is triggered.
Instant supports firewall-based logging function. Firewall logs on the IAPs are generated as
security logs.
Select the Blacklist check box to blacklist the client when this rule is triggered. The
blacklisting lasts for the duration specified in the Auth failure blacklist time on the
Blacklisting tab of the Security window. For more information, see
page 176.
Select the Classify media check box to prioritize video and voice traffic. When enabled, a
packet inspection is performed on all non-NAT traffic and the traffic is marked as follows:
Video: Priority 5 (Critical)
l
Voice: Priority 6 (Internetwork Control)
l
Select Disable scanning check box to disable ARM scanning when this rule is triggered.
The selection of Disable scanning applies only if ARM scanning is enabled. For more
information, see Configuring Radio Settings on page
Select the DSCP tag check box to specify a DSCP value to prioritize traffic when this rule is
triggered. Specify a value within the range of 0–63. To assign a higher priority, specify a
higher value.
Select the 802.1p priority check box to specify an 802.1p priority. Specify a value between
0 and 7. To assign a higher priority, specify a higher value.
Blacklisting Clients on
260.
Aruba Instant 6.5.0.0-4.3.0.0 | User Guide