Users Guide

326 | Roles and Policies Dell PowerConnect W-Series ArubaOS 6.1 | User Guide
7. (Optional) Click the White list Bandwidth Contract drop-down list and specify the name of a bandwidth
contract to apply to the session traffic. For further information on creating Bandwidth Contracts, see
“Configuring a Bandwidth Contract in the WebUI” on page328
8. Click Done. The ACL displays on the white list section.
9. To delete an entry, click Delete next to the entry you want to delete.
10. Click Apply to save changes.
Configuring the White List Bandwidth Contract in the CLI
cp-bandwidth-contract <name> {mbits <1..2000>}|{kbits <256..2000000>}
Configuring the ACL White List in the CLI
Use the following CLI command to create ACL White Lists.
(host) (config) #firewall cp {deny|permit} proto <IP protocol number> ports <start port
number> <last port number> [bandwidth-contract <name>]
To create a whitelist ACL entry that permits traffic using protocol 6 on ports 5000 through 6000 to be forwarded
to the controller:
(host) (config-fw-cp) #firewall cp permit proto 6 ports 5000 6000
To create a whitelist ACL entry that denies traffic using protocol 2 on port 5000 from being forwarded to the
controller:
(host) (config-fw-cp) #firewall cp deny proto 2 ports 5000 5000
User Roles
This section describes how to create a new user role. When you create a user role, you specify one or more policies
for the role.
Table 60 describes the different parameters you can configure for the user role.
Table 60 User Role Parameters
Field Description
Firewall Policies
(required)
One or more policies that define the privileges of a wireless client in this role. There are three ways to add
a firewall policy to a user role:
 Choose from configured policies (see “Creating a Firewall Policy” on page 322): Select a policy from
the list of configured policies and click the “Done” button to add the policy to the list of policies in the
user role. If this policy is to be applied to this user role only for specific AP groups, you can specify the
applicable AP group.
 Create a new policy from a configured policy: This option can be used to create a new policy that is
derived from an existing policy.
 Create a new policy: The rules for the policy can be added as explained in “Creating a Firewall Policy”
on page 322.
Re-authentication
Interval (optional)
Time, in minutes, after which the client is required to reauthenticate. Enter a value between 0-4096. 0
disables reauthentication.
Default: 0 (disabled)
Role VLAN ID
(optional)
By default, a client is assigned a VLAN on the basis of the ingress VLAN for the client to the controller. You
can override this assignment and configure the VLAN ID that is to be assigned to the user role. You
configure a VLAN by navigating to the Configuration > Network > VLANs page.
Bandwidth Contract
(optional)
You can assign a bandwidth contract to provide an upper limit to upstream or downstream bandwidth
utilized by clients in this role. You can select the Per User option to apply the bandwidth contracts on a per-
user basis instead of to all clients in the role.
For more information, see “Bandwidth Contracts” on page 328.