Extreme Networks EPICenter Guide Manual page 121

3 Verify there is an appropriate "fall-through" control in your access list design. This default control is
what will be used when all other access lists do not match the traffic pattern. Typically, this default
control is a "deny-all" access list to block all traffic that does not match any security policy in place.
Using EPICenter to Create Access Lists
You use the optional Policy Manager feature in EPICenter to configure and monitor access lists. The
Policy Manager has a set of predefined services that you can configure to control network traffic
between users, devices or groups of users and devices. You create a set of policies to match the traffic
controls you want in place on your network. You must also set up the order in which these policies will
be applied. EPICenter uses these high-level policies to automatically create a set of access lists in each of
the network devices affected by the policy. When traffic comes into your network, the Extreme
Networks ingress switch port compares the traffic pattern (protocol, source and destination addresses
and ports) with the set of configured access lists. The access list is traversed in order until a match
occurs. If the traffic pattern matches an access list, that access list controls what happens to the traffic
(allowing it to continue on the network, or denying it and dropping the packets at the ingress port).
You need to have the appropriate license to use the optional Policy Manager feature in EPICenter.
Selecting the Policy Manager from the navigation bar in EPICenter displays the list of configured
policies. To create a new policy for IP Access Lists, follow these steps:
1 Select the "New" button to create a new policy within the Policy Manager.
2 Define the new policy based on network resources (groups, devices), users (hosts or groups of
hosts), and the predefined list of network resource services (protocols, allowed or denied).
3 Save your new policy.
4 Click the "Order" button to set the order of precedence for your policies. This must match the order
you determined while designing your access lists.
5 Verify your policies match your access list requirements using the ACL Viewer option in the Policy
Manager.
Figure 54 shows an example of an IP based policy that will block TCP SYN packets from the network.
EPICenter Concepts and Solutions Guide
Network Access Security
121