Users Guide

290 | Roles and Policies Dell PowerConnect ArubaOS 5.0 | [User Guide
Monitor TCP SYN Attack rate Number of TCP SYN messages per second, which if exceeded, can indicate a denial of
service attack. Valid range is 1-255 messages per second. Recommended value is 32.
Default: No default
Monitor IP Session Attack Number of TCP or UDP connection requests per second, which if exceeded, can
indicate a denial of service attack. Valid range is 1-255 requests per second.
Recommended value is 32.
Default: No default
Monitor/Police CP Attack rate (per
sec)
Rate of misbehaving user’s inbound traffic, which if exceeded, can indicate a denial or
service attack.
Recommended value is 100 frames per second.
Deny Inter User Bridging Prevents the forwarding of Layer-2 traffic between wired or wireless users. You can
configure user role policies that prevent Layer-3 traffic between users or networks but
this does not block Layer-2 traffic. This option can be used to prevent traffic, such as
Appletalk or IPX, from being forwarded.
Default: Disabled
Deny All IP Fragments Drops all IP fragments.
NOTE: Do not enable this option unless instructed to do so by an Dell representative.
Default: Disabled
Prevent L2 Bridging between
Wireless users
Prevents the forwarding of Layer-2 traffic between wired or wireless users. You can
configure user role policies that prevent Layer-3 traffic between users or networks but
this does not block Layer-2 traffic. This option can be used to prevent traffic, such as
Appletalk or IPX, from being forwarded.
Default: Disabled
Enforce TCP Handshake Before
Allowing Data
Prevents data from passing between two clients until the three-way TCP handshake has
been performed. This option should be disabled when you have mobile clients on the
network as enabling this option will cause mobility to fail. You can enable this option if
there are no mobile clients on the network.
Default: Disabled
Prohibit IP Spoofing Enables detection of IP spoofing (where an intruder sends messages using the IP
address of a trusted client). When this option is enabled, IP and MAC addresses are
checked for each ARP request/response. Traffic from a second MAC address using a
specific IP address is denied, and the entry is not added to the user table. Possible IP
spoofing attacks are logged and an SNMP trap is sent.
Default: Disabled
Prohibit RST Replay Attack When enabled, closes a TCP connection in both directions if a TCP RST is received from
either direction. You should not enable this option unless instructed to do so by an Dell
representative.
Default: Disabled
Log ICMP Errors Enables logging of received ICMP errors. You should not enable this option unless
instructed to do so by an Dell representative.
Default: Disabled
Disable stateful SIP Processing Disables monitoring of exchanges between a voice over IP or voice over WLAN device
and a SIP server. This option should be enabled only when there is no VoIP or VoWLAN
traffic on the network.
Default: Disabled (stateful SIP processing is enabled)
Allow Tri-session with DNAT Allows three-way session when performing destination NAT. This option should be
enabled when the controller is not the default gateway for wireless clients and the
default gateway is behind the controller. This option is typically used for captive portal
configuration.
Default: Disabled.
Table 58 IPv4 Firewall Parameters (Continued)
Parameter Description