Users Guide

Dell PowerConnect ArubaOS 5.0 | User Guide IPv6 Client Support | 539
To configure firewall functions using the command line interface, issue the following commands in config mode:
ipv6 firewall attack-rate ping 15
ipv6 firewall attack-rate session 25
ipv6 firewall session-idle-timeout 60
Firewall Policies
A user role, which determines a client’s network privileges, is defined by one or more firewall policies. A firewall
policy consists of one or more rules that define the source, destination, and service type for specific traffic and
whether you want the controller to permit or deny traffic that matches the rule.
You can configure firewall policies for IPv4 traffic or for IPv6 traffic and apply IPv4 and IPv6 firewall policies to
the same user role. For example, if you have employees that are using both IPv4 and IPv6 clients you can
configure both IPv4 and IPv6 firewall policies and apply them both to the “employee” user role.
The procedure to configure an IPv6 firewall policy rule is similar to configuring a firewall policy rule for IPv4
traffic, but with some differences. Table 117 describes required and optional parameters for an IPv6 firewall
policy rule.
Table 117 IPv6 Firewall Policy Rule Parameters
Field Description
Source (required) Source of the traffic, which can be one of the following:
z any: Acts as a wildcard and applies to any source address.
z user: This refers to traffic from the wireless client.
z host: This refers to traffic from a specific host. When this option is chosen, you must configure the IPv6
address of the host. For example, 2002:d81f:f9f0:1000:c7e:5d61:585c:3ab.
z network: This refers to a traffic that has a source IP from a subnet of IP addresses. When this option is
chosen, you must configure the IPv6 address and network mask of the subnet. For example,
2002:ac10:fe:: ffff:ffff:ffff::.
z alias: This refers to using an alias for a host or network.
NOTE: This release does not support IPv6 aliases. You cannot configure an alias for an IPv6 host or network.
Destination
(required)
Destination of the traffic, which can be configured in the same manner as Source.
Service (required) NOTE: Voice over IP services are not available for IPv6 policies.
Type of traffic, which can be one of the following:
z any: This option specifies that this rule applies to any type of traffic.
z tcp: Using this option, you configure a range of TCP port(s) to match for the rule to be applied.
z udp: Using this option, you configure a range of UDP port(s) to match for the rule to be applied.
z service: Using this option, you use one of the pre-defined services (common protocols such as HTTPS,
HTTP, and others) as the protocol to match for the rule to be applied. You can also specify a network
service that you configure by navigating to the Configuration > Advanced Services > Stateful Firewall >
Network Services page.
z protocol: Using this option, you specify a different layer 4 protocol (other than TCP/UDP) by configuring
the IP protocol value.
Action (required) The action that you want the controller to perform on a packet that matches the specified criteria. This can
be one of the following:
NOTE: The only actions for IPv6 policy rules are permit or deny; in this release, the controller cannot
perform network address translation (NAT) or redirection on IPv6 packets. You can specify options such as
logging, mirroring, or blacklisting (described below).
z permit: Permits traffic matching this rule.
z drop: Drops packets matching this rule without any notification.
Log (optional) Logs a match to this rule. This is recommended when a rule indicates a security breach, such as a data
packet on a policy that is meant only to be used for voice calls.