Wireless/Redundant Edge Services xl Module Management and Configuration Guide WS.02.xx and greater

1-15
Introduction
ProCurve Wireless Edge Services xl Module
3. The module assigns the traffic to the VLAN specified in that station’s
association.
4. The module determines whether it is acting as the router for this traffic
and takes action accordingly:
a. If the module is acting as router (that is, the frame’s destination MAC
address belongs to the module), the module looks up the route for the
packet’s destination.
However, before forwarding the traffic, the module applies any con-
trols, such as manual IP ACLs, configured on the VLAN on which the
traffic arrived. (See “ACLs” on page 1-38.)
The Wireless Edge Services xl Module’s firewall also filters the traffic
as it is routed from its original VLAN. (See “Wireless Edge Services xl
Module Firewall” on page 1-37.)
If the packet passes all checks, the module forwards the traffic to the
gateway device listed in the route. The gateway device’s VLAN must
be tagged on the module’s internal uplink port.
b. If the source station is sending the traffic to a destination in its own
VLAN, the module forwards the traffic at Layer 2.
Typically, the module forwards the traffic on the uplink port toward
a device in the Ethernet network. If you have not enabled the uplink
port to carry tagged traffic for the uplink VLAN, then the module drops
the traffic.
Sometimes a wireless station attempts to communicate with another
wireless station. In this case—given that you allow such inter-station
traffic—the module forwards the traffic on the downlink port toward
the RP listed in the 802.11 association with the destination device.
When the module forwards traffic at Layer 2, IP ACLs applied to the
incoming VLAN interface do not filter the traffic, nor does the firewall.
5. The wireless services-enabled switch forwards the traffic toward its
destination.
The Wireless Edge Services xl Module follows a similar process to forward
traffic from the Ethernet network to wireless stations:
1. The module receives the traffic on its uplink port in an uplink VLAN.
2. The module applies controls to the traffic, if any are configured. The
controls can include:
• a user-based ACL or rate-limit assigned by ProCurve IDM
• a manual IP or MAC extended ACL applied to the uplink port
• a manual IP ACL applied to the VLAN interface