bureaucraten, interfacemoderatoren, Beheerders (Semantic MediaWiki), Curatoren (Semantic MediaWiki), Redacteuren (Semantic MediaWiki), toezichthouders, beheerders
205
bewerkingen
Geen bewerkingssamenvatting |
|||
Regel 121: | Regel 121: | ||
**vlan 1336 (dhcp-server) | **vlan 1336 (dhcp-server) | ||
**vlan 1337 (dhcp-server) | **vlan 1337 (dhcp-server) | ||
== Firewall == | |||
Reject traffic from guest VLANs (villanova & HSN) to management VLAN: | |||
* Firewall/NAT -> Firewall/NAT Groups -> create "management" group, then Actions -> Config and set network "10.138.64.0/24" and save | |||
* Firewall Policies -> Add ruleset "GUEST_NET_LOCAL" : | |||
** Description "Guest to router" | |||
** Default action DROP | |||
** add rule 1 "allow DNS" action Accept protocol TCP+UDP destination port 53 | |||
** add rule 2 "allow DHCP" action Accept protocol UDP destination port 67 | |||
** go to Interfaces and add switch0.1336 direction local, and switch0.1337 direction local | |||
* Firewall Policies -> Add ruleset "GUEST_NET_IN" | |||
** Description "From villanova/HSN nets" | |||
** Default action ACCEPT | |||
** add rule 1 "drop guestnet to mgmt" action Drop protocol All protocols destination network group Management subnet | |||
** go to Interfaces and add switch0.1336 direction In, and switch0.1337 direction In | |||
Now, hosts on villanova & HSN nets can use DHCP and DNS, but nothing else on the router; also, they can't access the management subnet at all. | |||
=Aruba Accesspoints= | =Aruba Accesspoints= |