Black Box LWN602A User Manual page 113

Class Number—Name
7—Network Control
6—Voice
5—Video
4—Controlled Load
3—Excellent Effort
2—Best Effort 1
1—Best Effort 2
0—Background
The rate limit for network control and voice is 0 kbps because guests are not permitted to run any applications that would
generate network control traffic or use VoIP applications. In this example, guests are expected to use cell phones or other phones
provided for them. (If you want to provide VoIP for guests, then you must enable the SIP ALG, add another rule to the firewall
policy permitting SIP traffic, and set the rate limit for voice at 128 kbps.)
Firewall Policy
You create a firewall policy that permits outgoing HTTP and HTTPS traffic from within the corporate network to the public
network but not to the corporate network itself. When applying the policy to a user profile, you apply a default action that denies
all incoming traffic and all other unspecified types of outgoing traffic.
Address Objects
To make address objects for use in firewall rules to block traffic to private IP address space in the internal network, click
Configuration > Advanced Configuration > Network Objects > IP Objects/Host Names > New, enter the following, and then click
Apply:
Network: (select)
Object Name: 10.0.0.0/8
In the IP Entry field, enter 10.0.0.0 for the IP address, 255.0.0.0 for the netmask, choose Global for the type, enter a useful
description such as Deny RFC 1918 (private addresses), and then click Apply.
To save the address and close the dialog box, click "Save."
Repeat the above to create two more address objects, one for 172.16.0.0/12 (IP address = 172.16.0.0; netmask = 255.240.0.0)
and another for 192.168.0.0/16 (IP address = 192.168.0.0; netmask = 255.255.0.0).
Custom Service
To make a custom service for NAT-T (NAT Traversal) to permit IKE traffic when traversing a NAT device, click Configuration >
Advanced Configuration > Network Objects > Network Services > New, enter the following, and then click Save:
Name: NAT-T
Description: NAT Traversal
IP Protocol: UDP (17)
Table 9-1. QoS rate limiting parameters.
Scheduling Type Scheduling Weight
Strict 0
Strict 0
Weighted Round Robin 60
Weighted Round Robin 50
Weighted Round Robin 40
Weighted Round Robin 30
Weighted Round Robin 20
Weighted Round Robin 10
724-746-5500 | blackbox.com
Chapter 9: Common Configuration Examples
Weight % (Read Policing Rate Limit
Only) (kbps) (8-2.11a/b/g)
0 0
0 0
28 2000
23 2000
19 2000
14 2000
9 2000
4 2000
Policing Rate Limit
(kbps) (802.11n)
0
0
2000
2000
2000
2000
2000
2000
Page 113