Configuring ACLs for Deep Packet Inspection

Select the application categories to which you want to allow or deny access.

Select the applications to which you want to allow or deny access.

Application throttling allows you to set a bandwidth limit for an application and application categories. For example, you can limit the bandwidth rate for video streaming applications such as YouTube or Netflix, or assign a low bandwidth to high risk sites.

To specify a bandwidth limit:

1. Select the Application Throttling check box.

2. Specify the Downstream and Upstream rates in KbpsKilobits per second. per user.

Select one of the following actions:

Destination-NAT—Translation of the destination IP address of a packet entering the network.

Source-NAT—Used by internal users to access the internet.

Allow—Select Allow to allow access users based on the access rule.

Deny—Select Deny to deny access to users based on the access rule.

Select a destination option for the access rules for network services, applications, and application categories. You can allow or deny access to any the following destinations based on your requirements.

To all destinations— Access is allowed or denied to all destinations.

To a particular server—Access is allowed or denied to a particular server. After selecting this option, specify the IP address of the destination server.

Except to a particular server—Access is allowed or denied to servers other than the specified server. After selecting this option, specify the IP address of the destination server.

To a network—Access is allowed or denied to a network. After selecting this option, specify the IP address and netmask for the destination network.

Except to a network—Access is allowed or denied to networks other than the specified network. After selecting this option, specify the IP address and netmask of the destination network.

To a Domain Name—Access is allowed or denied to the specified domains. After selecting this option, specify the domain name in the Domain Name text box.

To AP IP—Traffic to the specified Instant AP is allowed. After selecting this option, specify the domain name in the IP text box.

To AP Network—Traffic to the specified Instant AP network is allowed. After selecting this option, specify the domain name in the IP text box.

To master IP—Traffic to the specified master Instant AP or virtual controller is allowed. After selecting this option, specify the domain name in the IP text box.

Select this check box if you want a log entry to be created when this rule is triggered. Aruba Central supports firewallFirewall is a network security system used for preventing unauthorized access to or from a private network. based logging. Firewall logs on the Instant APs are generated as security logs.

Select the Blacklist check box to blacklist the client when this rule is triggered. The blacklisting lasts for the duration specified as Auth failure blacklist time on the Blacklisting tab of the Security window. For more information, see Blacklisting Instant AP Clients.

Select the Classify Media check box to classify and tag media on https traffic as voice and video packets.

Select Disable Scanning check box to disable ARMAdaptive Radio Management. ARM dynamically monitors and adjusts the network to ensure that all users are allowed ready access. It enables full utilization of the available spectrum to support maximum number of users by intelligently choosing the best RF channel and transmit power for APs in their current RF environment. scanning when this rule is triggered.

The selection of the Disable Scanning applies only if ARM scanning is enabled. For more information, see Configuring ARM and RF Parameters on APs.

Select this check box to add a DSCPDifferentiated Services Code Point. DSCP is a 6-bit packet header value used for traffic classification and priority assignment. tag to the rule. DSCP is an L3 mechanism for classifying and managing network traffic and providing QoSQuality of Service. It refers to the capability of a network to provide better service and performance to a specific network traffic over various technologies. on the network. To assign a higher priority, specify a higher value.

Select this check box to enable 802.1p priority. 802.1p priority is an L2 protocol for traffic prioritization to manage QoS on the network. There are eight levels of priority, 0-7. To assign a higher priority, specify a higher value.