Planning The Acls Needed To Enforce Designated Traffic Policies; Planning The Acls Needed To Enforce Designated; Traffic Policies - HP ProCurve 6400cl Series Access Security Manual

RADIUS Authentication and Accounting
Configuring a RADIUS Server To Specify Per-Port CoS and Rate-Limiting Services
C a u t i o n
6-34
Begin by defining the policies you want an ACL to enforce for a given client
or group of clients. This includes the type of IP traffic permitted or not
permitted from the client(s) and the areas of the network the client(s) are
authorized or not authorized to use.
What traffic should you permit for the client or group? In some cases
■
you will need to explicitly identify permitted traffic. In other cases,
depending on your policies, you can insert a permit any/any entry at
the end of the ACL so that all IP traffic not specifically matched by
earlier entries in the list will be permitted. This may be the best choice
for an ACL that begins by defining the inbound client IP traffic that
should be dropped.
What traffic must be explicitly blocked for the client or group? This
■
can include requests to access to "off-limits" subnets, unauthorized
access to the internet, access to sensitive data storage or restricted
equipment, and preventing the use of specific TCP or UDP applica­
tions such as Telnet, SSH, and web browser access to the switch.
What traffic can be blocked simply by relying on the implicit deny any/
■
any that is automatically included at the end of every ACL? This can
reduce the number of entries needed in an ACL.
Is it important to keep track of the number of matches for a particular
■
client or ACE? If so, you can use the optional cnt (counter) feature in
ACEs where you want to know this information. This is especially
useful if you want to verify that the switch is denying unwanted client
packets. (Note that configuring a high number of counters can
exhaust the counter resources.)
ACLs can enhance network security by blocking selected IP traffic, and can
serve as one aspect of maintaining network security. However, because ACLs
do not provide user or device authentication, or protection from malicious
manipulation of data carried in IP packet transmissions, they should not
be relied upon for a complete security solution.

Planning the ACLs Needed To Enforce Designated

Traffic Policies

This section can help in understanding how to order the ACEs in a RADIUS-
based ACL and in understanding how clients and the switch operate in this
dynamic environment.
Guidelines for Structuring a RADIUS-Based ACL.