Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-1
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-2
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
A role is composed of firewall rules or policies, combined with other attributes such as bandwidth contracts, VPN dialers, and VPN IP pools, to create a set of rules and rights that is bound to user(s) or device(s). Examples of roles include employee, guest, and voice (device). Role types include user roles and system roles. Every client in an Aruba user-centric network is associated with a user role, which determines the client’s network privileges, how often it must re-authenticate, and which bandwidth contracts are applicable. A policy is a set of rules that applies to traffic that passes through the Aruba controller. One or more policies may be assigned to a user role and policies may be copied to more than one role. Finally, Roles are assigned pre-authentication and postauthentication. Roles use firewall policies which in turn determine user access rights: Each role has one or more firewall policies applied. Firewall policies are executed in order. The final implicit policy is always “deny all.” Roles can be determined through different methods: User-derived (from ESSID, MAC or encryption type for example) Server-derived (through RADIUS or LDAP attributes) Default based on access method (i.e., 802.1X, VPN, WEP, etc.)
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-3
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-4
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
The User Roles tab is WebUI location to create roles. It launches the role editor. Multiple firewall policies can be added to the role that you create
If there are multiple policies for this role, policies can be re-ordered by the using the up and down buttons provided for each policy
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-5
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
The firewall policy “split-tunnel” will be applied only to the users who connect to an AP in the AP group RAP, other traffic coming from users connecting to any other AP in different AP groups will not be evaluated against the split-tunnel firewall policy
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-6
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-7
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
These two roles are not the same because policies within roles are evaluated sequentially. In the case of Role1, all traffic will be captured by the policy explicitDeny and will never be evaluated against the internetOnly policy which follows. Role2 has a more likely sequence where the explicitDeny is the last policy and therefore will evaluate any traffic not caught by the first policy.
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-8
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
Initial Role:
y l n O e s U l a n r e t In
This role is assigned to every user before authentication. Aruba provides a template for an initial role but the administrator may modify or create alternative initial roles and rules. User-Derived Roles:
The user role can be derived from attributes from client attributes or the AP the client uses for network entry. For example a role or VLAN may be assigned to a client depending upon the BSS of the AP the client is using. Server Derived Roles: If different users and devices have different access privileges based on security policy, a single ESSID can be used and the users put into different roles based on attributes that the back end server returns. This is typically done by sending a RADIUS attribute back to the Aruba controller with either the name of the desired role, or another value that can be pattern matched on the controller so that the user is placed into the proper role. This can be done with LDAP as well as RADIUS.
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-9
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
VSA-Derived Roles: Many Network Address Server (NAS) vendors, including Aruba, use Vendor Specific Attributes to provide features not supported in standard RADIUS attributes. For Aruba systems, VSAs can be employed to provide the user role and VLAN for RADIUS-authenticated clients, however the VSAs must be present on your RADIUS server. This involves defining the vendor (Aruba) and/or the vendor-specific code (14823), vendor-assigned attribute number, attribute format (such as string or integer), and attribute value in the RADIUS dictionary file. VSAs supported on controllers conform to the format recommended in RFC 2865, “Remote Authentication Dial In User Service (RADIUS)”. There is a RADIUS vendor specific attribute (VSA) named “Aruba-No-DHCPFingerprint,” value 14. This attribute signals the RADIUS Client (controller) to ignore the DHCP Fingerprint user role and VLAN change post L2 authentication Dictionary files that contain Aruba VSAs are available on the Aruba support website for various RADIUS servers. Log into the Aruba support website to download a dictionary file from the Tools folder. Default Roles: Each authentication method has a configurable default role. Roles can be derived from any of the
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-10
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-11
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
The Aruba firewall assigns an initial role when the device associates to the 802.11 network, and prior to authentication. The logon role (template) allows the user/device to obtain an IP address from a server, issue DNS queries, hit the captive portal and open a VPN connection. You may want to modify the logon role or create a new role for the initial role assignment based upon the network’s mission.
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-12
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
Rule Type options DHCP option 77 Encryption ESSID Location Mac Address
y l n O e s U l a n r e t In
DHCP option 77 is used by a Dynamic Host Configuration Protocol (DHCP) client to optionally identify the type or category of user or applications it represents. There is a field that indicates the user class which the client is a member. Based on this class, the DHCP server selects the appropriate address pool to assign an address to the client and other appropriate networking parameters. This option should be configurable by an administrator. A number of optional triggers can be used to further assign roles. These roles are triggered by Device Specific Attributes as listed on the above. Usually these are considered transient roles and will be overridden by server assigned or default roles described on the subsequent pages.
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-13
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
The rule created in the User Rules type is then assigned under user derivation rules in the AAA profiles
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-14
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
When you configure a server group, you can set the VLAN or role for clients based on attributes returned for the client by the server during authentication. The server derivation rules apply to all servers in the group. The user role or VLAN assigned through server derivation rules takes precedence over the default role and VLAN configured for the authentication method. The first rule that is applicable for the server and the attribute returned is applied to the client and would be the only rule applied from the server rules. Named VLANs can be configured under user rule, server derivation, user derivation, and VSA. auth-server "Radius01" position 1 set role condition "Filter-Id" value-of position In this example the controller is provisioned to look at the Radius attribute called Filter-ID and to then assign the user/device to whatever role is contained within. This is considered to be an authoritative assignment and the default role will not be used in this case.
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-15
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
In this example the controller is provisioned to look at the Radius attribute called Filter-ID and if the server comes back with attribute emp then set the role to authenticated.
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-16
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
If the authentication server does not return any role assignment, then the controller assigns the user/device to the default role. The default role may be considered the assignment of last resort and is assigned based upon the authentication method. In this example, any element successfully authenticated via 802.1X will be assigned to the authenticated role. Default roles for other authentication methods are provisioned using the appropriate drop down boxes.
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-17
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
In CLI
y l n O e s U l a n r e t In
aaa bandwidth-contract "guest-BW-contract" kbits "512”
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-18
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
You can assign different bandwidth contracts to upstream and downstream traffic for the same user role. You can also assign a bandwidth contract for only upstream or only downstream traffic for a user role; if there is no bandwidth contract specified for a traffic direction, unlimited bandwidth is allowed. By default, all users that belong to the same role share a configured bandwidth rate for upstream or downstream traffic. You can optionally apply a bandwidth contract on a per-user basis; each user who belongs to the role is allowed the configured bandwidth rate. An administrator can set a hard limit on Over the Air (OTA) bandwidth for a specific Service Set Identifier (SSID). Currently, the bandwidth allocation process is activated, when the bandwidth is completely saturated. The new enhancement allows you to limit an SSID to consume more bandwidth, when some unused bandwidth is available from other SSIDs. You can limit the bandwidth allocation to low priority SSIDs and allot the bandwidth to other high priority SSIDs.
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-19
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
Bandwidth contracts on a VLAN can limit broadcast and multicast traffic. To remove per-vlan bandwidth contract limits on an additional broadcast or multicast protocol, add the MAC address for that broadcast/multicast protocol to the VLAN Bandwidth Contracts MAC Exception List (Aruba3200) (config) #show vlan-bwcontract-explist internal VLAN Bw Contracts Internal Mac Exception List --------------------------------------------Mac address ----------01:80:C2:00:00:00 01:00:0C:CC:CC:CD 01:80:C2:00:00:02 01:00:5E:00:82:11
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-20
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
Problems may occur when clients cannot connect to the network resource they need. Besides IP connectivity, those clients need to have roles that allow them access. Above is one menu that can tell you the role that has been assigned a client.
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-21
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
In addition to the previous page, this page displays the established firewall sessions.
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-22
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
Once the clients role is known, to further troubleshoot a problem it will be important to know the rights or policies that have been assigned to that role.
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-23
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-24
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
The show rights command will show all the roles and the associated firewall policies
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-25
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
To troubleshoot a role, use the show rights CLI command to view the firewall policies and their associated rule set.
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-26
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
From the Web UI Go to: Monitoring -> Controller -> Firewall Hits From there, Firewall hits are summarized by: User Role Hits
Port Based Session ACL Hits Port ACL Hits
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-27
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-28
Aruba Bootcamp – Roles
y l n O l Use
a n r e t In
y l n O e s U l a n r e t In
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved
8-29
