Wireless/Redundant Edge Services xl Module Management and Configuration Guide WS.02.xx and greater

1-37
Introduction
ProCurve Wireless Edge Services xl Module
Wireless Edge Services xl Module Firewall
The section above introduced you to the idea of controlling traffic with
policies. The Wireless Edge Services xl Module’s firewall is one of the compo-
nents that helps you to do so.
The module’s firewall examines routed packets. It checks for and drops:
■ packets with invalid TCP flags
■ corrupted packets
■ packets symptomatic of several common Denial of Service (DoS) attacks
When the firewall drops a packet, the Wireless Edge Services xl Module
creates a log with the name and time of the attack.
Enabling Attack Checking. The firewall is always on; however, it only
affects packets that are routed from one VLAN interface to another VLAN
interface. When the Wireless Edge Services xl Module repackages an 802.11
frame from a WLAN as an Ethernet frame in a VLAN, the module is acting as
a bridge, not a router. The attack checks do not occur at this point. However,
if the module then routes the traffic to a different VLAN, the firewall can check
the traffic.
You should take these steps to ensure that a firewall screens traffic in between
a WLAN and your private, wired network:
1. Map the WLAN to a VLAN ID that exists only on the Wireless Edge Services
xl Module (or possibly on this module and other modules that support the
same WLAN).
2. Enable routing on the Wireless Edge Services xl Module.
The module should route all wireless traffic destined to the private
network. You can add static routes to the module’s route table, but the
simplest configuration uses a single route through a default gateway.
Choose a default gateway that knows how to reach all destinations to
which wireless stations need access.
3. Assign the Wireless Edge Services xl Module an IP address on the VLAN
created for the WLAN.
4. On this VLAN, configure the module’s internal DHCP server to assign IP
addresses to wireless stations. In the DHCP configuration, specify the
module as the default router.
5. Configure NAT to translate the source addresses for wireless traffic to one
of the module’s IP addresses.