Aruba Downloadable Role Enforcement Profile

Aruba Downloadable Role Enforcement Profiles

Policy Manager includes support for centralized policy definition and distribution. When ClearPass Policy Manager successfully authenticates a user, the user is assigned a role by ClearPass Policy Manager. However, if the role is not defined on the Aruba controller or switch, the role attributes can also be downloaded automatically. The following validations are performed for a Aruba Downloadable User Role (DUR):

Standard Mode elements are validated based on schema contents (syntax validation) prior to saving the DUR.

After a schema update, existing DURs remain unchanged until the admin user edits the DUR profile.

When an admin user edits an existing DUR profile, the syntax/configuration is re-validated, and an alert is shown to the admin to verify the changes.

Basic Profile Settings

Use the Profiles tab on the Downloadable Role Enforcement Profile dialog to configure the template, type of the profile, and the device group list, and specify the Role Configuration Mode as either Standard or Advanced.

Standard mode: User-provided options to configure individual components of a role (for example, Policer Profile, Stateless ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. configuration, etc.). The user role is generated based on components added to the configuration.

Advanced mode: You can enter the entire role configuration as a text under a single attribute.

Events are logged in the Audit Viewer for create, update, and delete operations in the Captive Portal, Policy, and Class configurations. Events are also logged for generated user roles and import/export operations in enforcement profiles.

To configure the Aruba Downloadable Role Enforcement Profile:

1. Navigate to Configuration > Enforcement > Profiles. The Enforcement Profiles page opens.

2. Click the Add link. The Add Enforcement Profile page opens.

3. From the Template drop-down, select Aruba Downloadable Role Enforcement.

Figure 1 Aruba Downloadable Role Enforcement > Profile Page (Standard Mode)

4. Specify the Aruba Downloadable Role Enforcement > Profile parameters as described in the following table:

Table 1: Aruba Downloadable Role Enforcement > Profile Parameters
Parameter	Action/Description
Template	Select the Aruba Downloadable Role Enforcement template.
Name	Enter the name of the enforcement profile.
Description	Enter a description of the enforcement profile.
Type	This field is automatically populated with: RADIUS.
Action	Click Accept, Reject, or Drop to define the action taken on the request. The default action is Accept.
Device Group List	Select a device group from the drop-down list. The list displays all configured device groups. All configured device groups are listed in the Configuration > Network > Device Groups page. After adding one or more device group(s), you can select a group and perform one of the following actions: To delete the selected Device Group List entry, click Remove. To see the device group parameters, click View Details. To change the parameters of the selected device group, click Modify. NOTE: To add a new a device group, click the Add New Device Group link and see Adding and Modifying Device Groups.
Role Configuration Mode	Select one of the following modes: Standard (the default) Advanced
Product	Specify one of the following products: ArubaOS-Switch Mobility Access Switch (MAS) Mobility Controller AOS-CX

Role Configuration: Standard Mode

When the Role Configuration Mode setting on the Profile tab is set to Standard (the default), the Role Configuration tab appears. In Standard mode, the Role Configuration tab includes only the options that are appropriate for the selected product.

The fields on the Role Configuration tab vary according to which product you specify. The example below displays the Role Configuration page when you specify the Aruba-OS Switch product. This page provides support for class configuration for the ArubaOS-Switch, and the Role Configuration tab includes a Manage Classes link that does not appear when you configure enforcement profile roles for Mobility Access switch or Mobility Controller Aruba products.

Figure 2 Role Configuration Page: ArubaOS-Switch

The following tables describe the Role Configuration parameters for the Aruba Downloadable Role Enforcement Profile for Mobility Access Switch, Mobility Controller, ArubaOS-Switch and AOS-CX:

Table 2: Mobility Access Switch Role Configuration Parameters
Parameter	Action/Description
Captive PortalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. Profile	Select the captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. profile from the drop-down list if already configured. To add a new captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. profile, click the Add Captive Portal Profile link. For more information, see Captive Portal Profiles.
Policer Profile	This parameter defines a Policer profile to manage the transmission rate of a class of traffic based on user-defined criteria. Select the Policer profile from the drop-down list if already configured. Click Add Policer Profile link to add a new Policer profile. For more information, see Policer Profiles.
QoSQuality of Service. It refers to the capability of a network to provide better service and performance to a specific network traffic over various technologies. Profile	This parameter defines a QoSQuality of Service. It refers to the capability of a network to provide better service and performance to a specific network traffic over various technologies. profile to assign Traffic-Class/Drop-Precedence, Differentiated Services Code Point (DSCPDifferentiated Services Code Point. DSCP is a 6-bit packet header value used for traffic classification and priority assignment. ), and 802.1p values to an interface or Policer profile of a Mobility Access Switch. Select the QoSQuality of Service. It refers to the capability of a network to provide better service and performance to a specific network traffic over various technologies. profile from the drop-down list if already configured. Click Add QoS Profile link to add a new QoSQuality of Service. It refers to the capability of a network to provide better service and performance to a specific network traffic over various technologies. profile. For more information, see QoS Profiles.
VoIPVoice over IP. VoIP allows transmission of voice and multimedia content over an IP network. Profile	This parameter defines a VoIPVoice over IP. VoIP allows transmission of voice and multimedia content over an IP network. profile that can be applied to any interface, interface group, or a port-channel of a Mobility Access Switch. Select the VoIPVoice over IP. VoIP allows transmission of voice and multimedia content over an IP network. profile from the drop-down list if already configured. Click Add VoIP Profile link to add a new VoIPVoice over IP. VoIP allows transmission of voice and multimedia content over an IP network. profile. For more information, see VoIP Profiles.
Reauthentication Interval Time (0-4096)	Enter the number of minutes between reauthentication intervals. You can select the range between 0 to 4096 minutes.
VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. To Be Assigned (1-4904)	Enter a number between 1 and 4094 that defines when the VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. is to be assigned.
NetService Configuration	Select the Manage NetServices link to add, edit, and delete the NetService definitions. For more information, see NetService Profiles.
NetDestination Configuration	Select the Manage NetDestinations link to add, edit, and delete the NetDestinations definitions. For more information, see NetDestination Configuration.
Time Range Configuration	Select the Manage Time Ranges link to add, edit, and delete time range definitions. For more information, see Time Range Profiles.
NATNetwork Address Translation. NAT is a method of remapping one IP address space into another by modifying network address information in Internet Protocol (IP) datagram packet headers while they are in transit across a traffic routing device. Pool Configuration	Select the Manage NAT Pool link to add, edit and delete NATNetwork Address Translation. NAT is a method of remapping one IP address space into another by modifying network address information in Internet Protocol (IP) datagram packet headers while they are in transit across a traffic routing device. Pool definitions. For more information, see NAT Pools.
ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. Type	Select from the following ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. types: Ethertype: Ethertype ACLsAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. filter based on the Ethertype field in the frame header. MAC: MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. ACLsAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. filter traffic on a specific source MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. address or range of MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. addresses. Session: Session ACLsAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. define traffic and firewallFirewall is a network security system used for preventing unauthorized access to or from a private network. policies. Stateless: Stateless ACLsAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. define stateless packet filtering and quality of service (QoSQuality of Service. It refers to the capability of a network to provide better service and performance to a specific network traffic over various technologies.). A stateless ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. statically evaluates packet contents
ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. Name	Click the name of the ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. type. To move the ACL Name to the ACL field, click Add. To modify the order of the names in the ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. list, click Move Up, Move Down. To delete an ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. from the list, click Remove.
User Role Configuration	Check the Summary tab for the generated role configuration.

Table 3: Mobility Controller Role Configuration Parameters
Parameter	Action/Description
Captive PortalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. Profile	Select the captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. profile from the drop-down list if already configured. Click the Add Captive Portal Profile link to add a new captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. profile. For more information, see Captive Portal Profiles.
Reauthentication Interval Time (0-4096)	Enter the number of minutes between reauthentication intervals. You can select the range between 0 to 4096 minutes.
VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN.	Select either ID or Name to identify the VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. to be assigned by VLAN ID (any number from 1 to 4094) or by VLAN Name.
NetService Configuration	Select the Manage NetServices link to add, edit, and delete the NetService definitions. For more information, see NetService Profiles.
NetDestination Configuration	Select the Manage NetDestinations link to add, edit, and delete the NetDestinations definitions. For more information, see NetDestination Profiles.
Time Range Configuration	Select the Manage Time Ranges link to add, edit, and delete time range definitions. For more information, see Time Range Profiles.
NATNetwork Address Translation. NAT is a method of remapping one IP address space into another by modifying network address information in Internet Protocol (IP) datagram packet headers while they are in transit across a traffic routing device. Pool Configuration	Select the Manage NAT Pool link to add, edit and delete NATNetwork Address Translation. NAT is a method of remapping one IP address space into another by modifying network address information in Internet Protocol (IP) datagram packet headers while they are in transit across a traffic routing device. Pool definitions. For more information, see NAT Pools.
ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. Type	Select from the following ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. types: Ethertype: Ethertype ACLsAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. filter based on the Ethertype field in the frame header. MAC: MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. ACLsAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. filter traffic on a specific source MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. address or range of MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. addresses. Session: Session ACLsAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. define traffic and firewallFirewall is a network security system used for preventing unauthorized access to or from a private network. policies. Stateless: Stateless ACLsAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. define stateless packet filtering and quality of service (QoSQuality of Service. It refers to the capability of a network to provide better service and performance to a specific network traffic over various technologies.). A stateless ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. statically evaluates packet contents
ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. Name	Click the name of the ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. type. To move the ACL Name to the ACL field, click Add. To modify the order of the names in the ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. list, click Move Up, Move Down. To delete an ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. from the list, click Remove.
User Role Configuration	Check the Summary tab for the generated role configuration.

Table 4: ArubaOS-Switch Role Configuration Parameters
Parameter	Action/Description
Captive PortalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. Profile	Select the captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. profile from the drop-down list if it is already configured. To add a new captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. profile, click the Add Captive Portal Profile link. For more information, see Captive Portal Profiles.
Policy	Select the Enforcement Policy from the drop-down list if already configured. To add a new enforcement policy, click the Add Policy link. For more information, see Policies.
Secondary Role Type	Specify one of the following secondary role types: None Static: When selected, the Controller Static Role field appears. Dynamic: When selected, the Controller Downloadable Role field appears.
VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN.	Specify one of the following VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. identifiers: None ID: When selected, the VLAN ID Tagged <number> field appears. Enter the VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. ID number. Name: When selected, the VLAN Name field appears. Enter the VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. name.
VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. Tagged	Specify one of the following VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. Tagged identifiers: None ID: When selected, the VLAN ID Tagged <number> field appears. Enter the VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. ID Tagged number. Name: When selected, the VLAN Name Tagged field appears. Enter the VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. tagged name.
Re-Authentication Period	Specify the ArubaOS switch reauthentication period in seconds.
Logoff Period	Enter the Logoff Period in one of the following formats: O (mac-pin): This is the Mac system lock PINPersonal Identification Number. PIN is a numeric password used to authenticate a user to a system. code. In seconds, from 60 to n seconds
Cached Re-Authentication Period	Enter the Cached Re-Authentication Period in seconds from 60 to n. Cached reauthentication allows 802.1X802.1X is an IEEE standard for port-based network access control designed to enhance 802.11 WLAN security. 802.1X provides an authentication framework that allows a user to be authenticated by a central authority., web-based, or MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. reauthentications to succeed when the RADIUSRemote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. server is unavailable. Users already authenticated retain their currently-assigned RADIUSRemote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. attributes. Uninterrupted service is provided for authenticated users with RADIUSRemote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. -assigned VLANsVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. if the RADIUSRemote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. server becomes temporarily unavailable during periodic reauthentications.
Device Configuration	Click the Enable check box to enable device configuration. This option allows you to allocate a PoEPower over Ethernet. PoE is a technology for wired Ethernet LANs to carry electric power required for the device in the data cables. The IEEE 802.3af PoE standard provides up to 15.4 W of power on each port. priority of low, high or critical for the class, and enable the admin edge port or port mode options.
Class Configuration	Select the Manage Classes link to add, edit, or delete Class definitions. For more information, see Classes.
NetService Configuration	Select the Manage NetServices link to add, edit, and delete the NetService definitions. For more information, see NetService Profiles.
NetDestination Configuration	Select the Manage NetDestinations link to add, edit, and delete the NetDestinations definitions. For more information, see NetDestination Profiles.
User Role Configuration	Select the Summary tab to view the generated user role configuration.

Table 5: AOS-CX Role Configuration Parameters
Parameter	Action/Description
Captive PortalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. Profile	Select the captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. profile from the drop-down list if it is already configured. To add a new captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. profile, click the Add Captive Portal Profile link. For more information, see Captive Portal Profiles.
Class Configuration	Select the Manage Classes link to add, edit, or delete class definitions. For more information, see Classes.
Policy	Select the Enforcement Policy from the drop-down list if already configured. To add a new enforcement policy, click the Add Policy link. For more information, see Policies.
Secondary Role Type	Starting with Policy Manager 6.9.4, Policy Manager supports setting a controller Downloadable User Role (DUR) as a Secondary Role in the standard configuration mode for an AOS-CX role. Options are none if you do not want a secondaryrole, or static for a static role.
GatewayGateway is a network node that allows traffic to flow in and out of the network. Zone	If you selected the Static secondary role type, specify the per-role gatewayGateway is a network node that allows traffic to flow in and out of the network. zone needed for user-based tunneling (UBT)
GatewayGateway is a network node that allows traffic to flow in and out of the network. Static Role	If you selected the Static secondary role type, specify the gatewayGateway is a network node that allows traffic to flow in and out of the network. static role.
PoEPower over Ethernet. PoE is a technology for wired Ethernet LANs to carry electric power required for the device in the data cables. The IEEE 802.3af PoE standard provides up to 15.4 W of power on each port. Priority	Select the priority level High, Low or Critical.
Trust Mode	Configures QoSQuality of Service. It refers to the capability of a network to provide better service and performance to a specific network traffic over various technologies. trust mode for the role: None: Do not trust any priority fields. COS: Trust DSCPDifferentiated Services Code Point. DSCP is a 6-bit packet header value used for traffic classification and priority assignment. and preserve the 802.1p priority. DHCP: Trust 802.1p priority and retain DSCPDifferentiated Services Code Point. DSCP is a 6-bit packet header value used for traffic classification and priority assignment. or IP-ToSType of Service. The ToS field is part of the IPv4 header, which specifies datagrams priority and requests a route for low-delay, high-throughput, or a highly reliable service..
Session Timeout	Number of seconds the enforcement profile should assign the role before the device session ends
Authentication Mode	Select an Authentication mode: Client mode: Access control on a per-user basis Device mode: Access only on ports where a 802.1X802.1X is an IEEE standard for port-based network access control designed to enhance 802.11 WLAN security. 802.1X provides an authentication framework that allows a user to be authenticated by a central authority.-capable device has entered authorized user credentials.
MTUMaximum Transmission Unit. MTU is the largest size packet or frame specified in octets (eight-bit bytes) that can be sent in networks such as the Internet.	Sets the MTUMaximum Transmission Unit. MTU is the largest size packet or frame specified in octets (eight-bit bytes) that can be sent in networks such as the Internet. (maximum transmission unit) for an interface. This defines the maximum size of a layer 2 (EthernetEthernet is a network protocol for data transmission over LAN.) frame. Packets larger than the MTUMaximum Transmission Unit. MTU is the largest size packet or frame specified in octets (eight-bit bytes) that can be sent in networks such as the Internet. are dropped and cause an ICMPInternet Control Message Protocol. ICMP is an error reporting protocol. It is used by network devices such as routers, to send error messages and operational information to the source IP address when network problems prevent delivery of IP packets. fragmentation-needed message to be sent back to the originator.
Allowed VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. on Trunk	Assigns a VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. ID to an trunk interface. This VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. ID defines which VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. traffic is allowed across the trunk interface.
Native Trunk VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN.	Assigns a native VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. ID to a trunk interface.
Access VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN.	Creates an access interface and assigns an VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. ID to it.
Cached Reauthentication Period	Cached reauthentication allows 802.1X802.1X is an IEEE standard for port-based network access control designed to enhance 802.11 WLAN security. 802.1X provides an authentication framework that allows a user to be authenticated by a central authority., web-based, or MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. reauthentications to succeed when the RADIUSRemote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. server is unavailable. The supported value for this parameter is 30-4294967295 seconds. NOTE: This feature is not supported in AOS-CX switches running AOS-CX 10.5 or earlier releases.
Reauthentication period	Time, in seconds, after which the device is required to reauthenticate. in Policy Manager 6.9.0-6.9.3, this parameter supports a range of 1-86400 seconds. In Policy Manager 6.9.4 or later, this parameter supports a range of 1-4294967295 seconds
Client Inactivity Timeout	Configures the time the switch waits for client activity before removing an inactive client from the port.
Description	Enter a description of this AOS-CX role.
User Role Configuration	Select the Summary tab to view the generated user role configuration.

The Role Configuration tab also allows you to associate other profile types with your selected user role, or to create these profiles if they are not yet defined. Refer to the following sections for information on creating those profiles.

Captive Portal Profiles

To define the Captive PortalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. Profile for a downloadable Role Enforcement profile for any supported device type:

1. From the Role Configuration tab, click the Add Captive PortalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. Profile link. The Add Captive PortalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. Profile dialog opens:

2. Enter a name of the profile and configure the required attributes. Note that the available parameters for configuring a Captive PortalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. profile vary by device type. The following tables describe the Captive PortalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. Attributes available for Mobility Controller and Mobility Access Switch, ArubaOS-Switch, and AOS-CX.

Table 6: Mobility Controller and Mobility Access Switch Captive Portal Attributes
Parameter	Action/Description
Server Group	Enter the name of a server group to be used for captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. authentication
Default role	Specify the role assigned to the Captive PortalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. user upon login. When both user and guest logon are enabled, the default role applies to the user logon; users logging in using the guest interface are assigned the guest role.
Default Guest Role	Specify the role assigned to a guest.
Redirect Pause	Time, in seconds, that the system remains in the initial welcome page before redirecting the user to the final web URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet.. If set to 0, the welcome page displays until the user clicks on the indicated link.
User Login	Select one of the following options: Yes: Enables Captive PortalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. with authentication of user credentials. No: Disables Captive PortalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. with authentication of user credentials.
Guest Login	Select one of the following options: Yes: Enables Captive PortalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. logon without authentication. No: Disables Captive PortalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. logon without authentication.
Login Popup Window	Enables a pop-up window with the Logout link for the user to log out after logging on . If this is disabled, the user remains logged in until the user timeout period has elapsed or the station reloads.
Use HTTPHypertext Transfer Protocol. The HTTP is an application protocol to transfer data over the web. The HTTP protocol defines how messages are formatted and transmitted, and the actions that the w servers and browsers should take in response to various commands. for Authentication	Use HTTPHypertext Transfer Protocol. The HTTP is an application protocol to transfer data over the web. The HTTP protocol defines how messages are formatted and transmitted, and the actions that the w servers and browsers should take in response to various commands. protocol on redirection to the Captive PortalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. page. If you use this option, modify the captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. policy to allow HTTPHypertext Transfer Protocol. The HTTP is an application protocol to transfer data over the web. The HTTP protocol defines how messages are formatted and transmitted, and the actions that the w servers and browsers should take in response to various commands. traffic.
Logon Wait Minimum Delay	Minimum time, in seconds, the user will have to wait for the logon page to pop up if the CPUCentral Processing Unit. A CPU is an electronic circuitry in a computer for processing instructions. load is high. This works in conjunction with the Logon wait CPUCentral Processing Unit. A CPU is an electronic circuitry in a computer for processing instructions. utilization threshold parameter.
Logon Wait Maximum Delay	Configure parameters for the logon wait interval
Logon Wait CPUCentral Processing Unit. A CPU is an electronic circuitry in a computer for processing instructions. Utilization Threshold (1-100%):	CPUCentral Processing Unit. A CPU is an electronic circuitry in a computer for processing instructions. utilization percentage above which the Logon wait interval is applied when presenting the user with the logon page.
Max Authentication Failures (0-10):	Maximum number of authentication failures before the user is added to a blocked list
Show FQDNFully Qualified Domain Name. FQDN is a complete domain name that identifies a computer or host on the Internet.:	Allows the user to see and select the fully-qualified domain name (FQDNFully Qualified Domain Name. FQDN is a complete domain name that identifies a computer or host on the Internet.) on the login page. The FQDNs shown are specified when configuring individual servers for the server group used with captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. authentication.
Use CHAPChallenge Handshake Authentication Protocol. CHAP is an authentication scheme used by PPP servers to validate the identity of remote clients. (Non-standard):	Select this option to use CHAPChallenge Handshake Authentication Protocol. CHAP is an authentication scheme used by PPP servers to validate the identity of remote clients. authentication. This option is disabled by default and should be enabled only under the supervision of an Aruba support representative.
Login Page:	URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet. of the page that appears before logon. This can be set to any URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet..
Welcome Page:	URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet. of the page that appears after logon and before redirection to the web URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet.. This can be set to any URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet..
Show Welcome Page:	Displays the configured welcome page before the user is redirected to their original URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet.. If this option is disabled, users are redirected to the web URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet. immediately after they log in.
Adding Switch IP Address in Redirection URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet.:	Sends the managed device’s IP address in the redirection URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet. when external captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. servers are used. An external captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. server can determine the managed devices from which a request originated by parsing the ‘switchip’ variable in the URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet..
Allow Only One Active User Session:	Allows only one active user session at a time.
Show the Acceptable Use Policy Page:	Show the acceptable use policy page before the logon page.
Add an IP Interface in the Redirection URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet.:	Sends the interface IP address of the managed device in the redirection URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet. when external captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. servers are used. An external captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. server can determine the managed devices from which a request originated by parsing the ‘switchip’ variable in the URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet..
Add User VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. in Redirection URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet.:	Sends the user’s VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. ID in the redirection URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet. when external captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. servers are used.
White List Net Destinations:	To add a netdestination to the list of allowed captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. netdestinations, enter the destination host or subnetSubnet is the logical division of an IP network., then click Add. The netdestination will be added to the allowed list. To remove a netdestination from the allowed list, select it in this field, then click Delete.

Table 7: ArubaOS-Switch Captive Portal Profile Attributes
Parameter	Action/Description
Name	Name of the Captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. Configuration
URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet.	URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet. of the page that appears for the user logon. This can be set to any URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet..
URL-hash-key (Plain Text) / URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet. Hash-Key (Cipher Text) CP-37268	You can optionally configure a URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet. hash key to provide some security for the Captive PortalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. exchange with CPPM. The key is a shared secret between Policy Manager and ArubaOS-Switch or AOS-CX switch. When configured, the switch generates a HMAC-SHA1 hash of the entire redirect URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet., and appends the hash to the URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet. to be sent to Policy Manager as part of the HTTPHypertext Transfer Protocol. The HTTP is an application protocol to transfer data over the web. The HTTP protocol defines how messages are formatted and transmitted, and the actions that the w servers and browsers should take in response to various commands. redirect. If Policy Manager is configured to check the hash, it will generate the hash of the URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet. using its version of the URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet. hash key and compare against the value provided by the switch. The action taken by CPPM upon a match or mismatch is determined by what is configured on Policy Manager.

Table 8: AOS-CX Captive Portal Profile Attributes
Parameter	Action/Description
Name	Name of the Captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. Configuration
URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet.	URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet. of the page that appears for the user logon. This can be set to any URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet..
URL-hash-key (Plain Text) / URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet. Hash-Key (Cipher Text) CP-37268	NOTE: URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet. hash keys are not allowed in Aruba Downloadable User Roles (DUR) for the AOS-CX switch. If they are configured for the switch, it causes command executions to fail. To successfully enforce the captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. configurations, leave the URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet. Hash‑Key (PlainText) and URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet. Hash‑Key (CipherText) fields empty when you configure the AOS-CX captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users.. These fields appear in Policy Manager 6.9.3 and earlier releases.

Policer Profiles

This profile limits inbound transmission rate of a class of traffic on the basis of user-defined criteria. To define a Policer Profile for an Aruba Mobility Access Switch:

1. From the Role Configuration tab, click the Add Policer Profile link. The Add Policer Profile dialog opens:

Figure 3 Add Policer Configuration Profile

2. Enter a name of the profile and configure the required attributes.

Table 9: Policer Profile Attributes
Parameter	Action/Description
CBS (bytes)	Specify the Committed Burst Size (CBS) for this enforcement policy. Traffic rates below CIR or bursts below CBS limits are considered “conforming” and are allowed to pass through.
CIR (KbpsKilobits per second.)	Specify the Committed Information Rate (CIR) for this enforcement policy. Traffic rates below CIR or bursts below CBS limits are considered “conforming” and are allowed to pass through.
EBS (bytes)	Specify the burst size, in bytes, considered to be an Excessive Burst Size (EBS)
Exceed Action	Select an action for traffic rate exceeding CIR and CBS, yet bursting below the EBS limit. (permit, drop, remark). By default, this traffic is permitted
Exceed QoSQuality of Service. It refers to the capability of a network to provide better service and performance to a specific network traffic over various technologies. Profile	Select a QoSQuality of Service. It refers to the capability of a network to provide better service and performance to a specific network traffic over various technologies. profile to be assigned to traffic that exceeds CIR and CBS, yet bursts below the EBS limit.
Violate Action	Select an action for traffic rate exceeding CIR and CBS, and also bursting above the EBS limit. (permit, drop, remark). By default, this traffic is dropped.
Violate QoSQuality of Service. It refers to the capability of a network to provide better service and performance to a specific network traffic over various technologies. Profile	Select a QoSQuality of Service. It refers to the capability of a network to provide better service and performance to a specific network traffic over various technologies. profile to be assigned to traffic that exceeds CIR and CBS and also bursts above the EBS limit.

QoS Profiles

To define a QoSQuality of Service. It refers to the capability of a network to provide better service and performance to a specific network traffic over various technologies. Profile for an Aruba Mobility Access Switch:

1. Click the Add QoSQuality of Service. It refers to the capability of a network to provide better service and performance to a specific network traffic over various technologies. Profile link. The Add QoSQuality of Service. It refers to the capability of a network to provide better service and performance to a specific network traffic over various technologies. Profile opens:

Figure 4 Add QoS Profile Configuration Profile

2. Enter a name of the profile and configure the required attributes.

Table 10: QoS Profile Attributes
Parameter	Action/Description
Traffic Class (0-7)	Enter a value from 0 to 7 to specify which of the eight traffic classes (TCs), map to the corresponding queue.
Drop Precedence	Select Low or High to select the drop precedence for controlling tail-drop. Traffic that is at a lower precedence will encounter a higher drop rate, and is more likely to be throttled.
DSCPDifferentiated Services Code Point. DSCP is a 6-bit packet header value used for traffic classification and priority assignment. (0-63)	DSCPDifferentiated Services Code Point. DSCP is a 6-bit packet header value used for traffic classification and priority assignment. value mapped to traffic matching this enforcement profile.
802.1p (0-7)	Value of the 802.1p priority for trafic this matching this enforcement profile.

VoIP Profiles

To define a VoIPVoice over IP. VoIP allows transmission of voice and multimedia content over an IP network. Profile for an Aruba Mobility Access Switch:

1. From the Role Configuration tab, click the Add VoIPVoice over IP. VoIP allows transmission of voice and multimedia content over an IP network. Profile link. The Add VoIPVoice over IP. VoIP allows transmission of voice and multimedia content over an IP network. Profile dialog opens:

Figure 5 Add VoIP Configuration Profile

2. Enter a name for the profile and configure the required attributes.

Table 11: VoIP Profile Attributes
Parameter	Action/Description
VoIPVoice over IP. VoIP allows transmission of voice and multimedia content over an IP network. VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN.	VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. to be assigned to VoIPVoice over IP. VoIP allows transmission of voice and multimedia content over an IP network. traffic matching this enforcement profile.
DSCPDifferentiated Services Code Point. DSCP is a 6-bit packet header value used for traffic classification and priority assignment. (0-63)	DSCPDifferentiated Services Code Point. DSCP is a 6-bit packet header value used for traffic classification and priority assignment. value mapped to traffic matching this enforcement profile.
802.1p (0-7)	Value of the 802.1p priority for this matching this enforcement profile.

NetService Profiles

The NetService settings in a Downloadable Enforcement Profile vary, dependng upon whether you are definingNetService settings for an ArubaOS-Switch, or for a Mobiilty Controller or Mobiity Access Switch. To define a NetService Configuration profile for an Aruba Mobility Access Switch or ArubaOS-Switch:

1. From the Role Configuration tab, click the Manage NetServices link. The NetService dialog opens:

Figure 6 NetService Configuration Profile

2. Enter a name for the profile and configure the required attributes.

NetServices Attributes
Protocol	Action/Description
Protocol	Select a protocol: IP TCPTransmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. UDPUser Datagram Protocol. UDP is a part of the TCP/IP family of protocols used for data transfer. UDP is typically used for streaming media. UDP is a stateless protocol, which means it does not acknowledge that the packets being sent have been received.
IP Protocol Number	If you selected IP in the Protocol field, enter an IP protocol number (0-255)
Port Selection	If you selected UDPUser Datagram Protocol. UDP is a part of the TCP/IP family of protocols used for data transfer. UDP is typically used for streaming media. UDP is a stateless protocol, which means it does not acknowledge that the packets being sent have been received. or TCPTransmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. in the Protocol field, click this drop-down menu and select List or Range to identify how you will select the ports for that protocol.
Port List	If you selected List in the Port Selection field, enter a comma-separated list of ports. NOTE: Starting with Policy Manager 6.9.5, if you are defining NetService settings for an ArubaOS-Switch, the Port List field is in sync with the maximum number of ports supported by the switch, and only accepts six entries. An error message is displayed if more than six ports are entered.
Port (1-65535) Max Port (1-65535)	If you selected Range in the Port Selection field, enter the starting port in the range in the Port field, and the ending port in the range in the Max Port field.
Application Level GatewayGateway is a network node that allows traffic to flow in and out of the network.	Click this drop-down menu and select one of the following options: DHCPDynamic Host Configuration Protocol. A network protocol that enables a server to automatically assign an IP address to an IP-enabled device from a defined range of numbers configured for a given network. DNSDomain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. FTPFile Transfer Protocol. A standard network protocol used for transferring files between a client and server on a computer network. NOENew Office Environment. NOE is a proprietary VoIP protocol designed by Alcatel-Lucent Enterprise. RTSPReal Time Streaming Protocol. RTSP is a network control protocol designed for use in entertainment and communications systems to control streaming media servers. SCCP SIPSession Initiation Protocol. SIP is used for signaling and controlling multimedia communication session such as voice and video calls. SIPS SVPSpectraLink Voice Priority. SVP is an open, straightforward QoS approach that has been adopted by most leading vendors of WLAN APs. SVP favors isochronous voice packets over asynchronous data packets when contending for the wireless medium and when transmitting packets onto the wired LAN. TFTPTrivial File Transfer Protocol. The TFTP is a software utility for transferring files from or to a remote host. Vocera

NetDestination Profiles

To define a NetDestination Configuration profile for an Aruba Mobility Access Switch or ArubaOS-Switch:

1. Click the Manage NetDestinations link. The NetDestinations dialog opens:

Figure 7 Net Destinations Configuration Profile

2. Enter a name for the profile and configure the required attributes then click Save Rule.

Table 12: NetDestination Attributes
Parameter	Action/Description
Invert	Specifies that the inverse of the network addresses configured are used. For example, if a network of 172.16.0.0 is configured, this parameter specifies that the alias matches everything except this IP address.
Rule type	Select whether this netdestination rule type is defined by a name (identified by hostname or domain), a host (identified by an IPv4 or Ipv6 address) a network (identified by an IPv4 or IPv6 address and a netmaskNetmask is a 32-bit mask used for segregating IP address into subnets. Netmask defines the class and range of IP addresses.) or a range (identified by starting and ending IPv4/IPv6 addresses.)
Host Name or Domain	If you selected the name option in the Rule Type field, enter a host or domain name. Starting with Policy Manager 6.9.2, this field supports a single wildcard character (*) at the beginning of a host or domain name for an Aruba Mobility Access Switch or controller.
IP address	If you selected the host, network or range option in the Rule Type field, enter the IP address of the host or network, or the starting IP address of the IP range.
NetmaskNetmask is a 32-bit mask used for segregating IP address into subnets. Netmask defines the class and range of IP addresses.	If you selected the network option in the Rule Type field, enter the subnetwork netmaskNetmask is a 32-bit mask used for segregating IP address into subnets. Netmask defines the class and range of IP addresses..
End IP address	If you selected the range option in the Rule Type field, enter the end of an IP range.

Time Range Profiles

To define a Time Range Configuration profile for an Aruba Mobility Controller or Mobility Access Switch:

1. From the Role Configuration tab, click the Manage Time Ranges link. The Time Range Configuration dialog opens:

Figure 8 Time Range Configuration Profile

2. Enter a name for the profile and configure the required attributes.

Table 13: Time Range Attributes
Parameter	Action/Description
Type	Select the type of time range profile. Periodic— When configured, the enforcement policy role changes based on the time range configured in the profile. Absolute—When configured, the enforcement policy role changes during a specific date / day and time.
Absolute Time Range Parameters
Start Date (mm/dd/yyyy)	Enter the start date in mm/dd/yyyy format, or use the calendar function to browse to and select a date.
Start Time (HH:mm):	Enter the start time in HH:mm format, or use the time dropdown menu to select a time.
End Date (mm/dd/yyyy)	Enter the end date in mm/dd/yyyy format, or use the calendar function to browse to and select a date.
End Time (HH:mm):	Enter the end time in HH:mm format, or use the time dropdown menu to select a time.
Periodic Time Range Parameters
Start Day	Click the dropdown menu and select any of the Start Day options: daily weekend weekday Sunday Monday Tuesday Wednesday Thursday Friday Saturday
Start Time (HH:mm)	Enter the start time date in HH:mm format, or use the time dropdown menu to select a time.
End Time (HH:mm)	Enter the end time in HH:mm format, or use the time dropdown menu to select a time.

NAT Pools

You can create a NATNetwork Address Translation. NAT is a method of remapping one IP address space into another by modifying network address information in Internet Protocol (IP) datagram packet headers while they are in transit across a traffic routing device. pool associated with source NATSource NAT changes the source address of the packets passing through the router. Source NAT is typically used when an internal (private) host initiates a session to an external (public) host. option or dual NATNetwork Address Translation. NAT is a method of remapping one IP address space into another by modifying network address information in Internet Protocol (IP) datagram packet headers while they are in transit across a traffic routing device. option. When a pool is created with dual NATNetwork Address Translation. NAT is a method of remapping one IP address space into another by modifying network address information in Internet Protocol (IP) datagram packet headers while they are in transit across a traffic routing device. option, both source IP and destination IP of the packet are changed. To define a NATNetwork Address Translation. NAT is a method of remapping one IP address space into another by modifying network address information in Internet Protocol (IP) datagram packet headers while they are in transit across a traffic routing device. (Network Address Translation) Pool Configuration profile for an Aruba Mobility Controller or Mobility Access Switch:

1. From the Role Configuration tab, click the Manage NATNetwork Address Translation. NAT is a method of remapping one IP address space into another by modifying network address information in Internet Protocol (IP) datagram packet headers while they are in transit across a traffic routing device. Pool Configuration link. The NATNetwork Address Translation. NAT is a method of remapping one IP address space into another by modifying network address information in Internet Protocol (IP) datagram packet headers while they are in transit across a traffic routing device. Pool Configuration dialog opens:

Figure 9 NAT Pool Configuration Profile

2. Enter a name for the profile and configure the required attributes.

Table 14: Nat Pool Attributes
Parameter	Action/Description
Start of source NATSource NAT changes the source address of the packets passing through the router. Source NAT is typically used when an internal (private) host initiates a session to an external (public) host. range	IP address at the start of the NATNetwork Address Translation. NAT is a method of remapping one IP address space into another by modifying network address information in Internet Protocol (IP) datagram packet headers while they are in transit across a traffic routing device. range
End of source NATSource NAT changes the source address of the packets passing through the router. Source NAT is typically used when an internal (private) host initiates a session to an external (public) host. range	IP address at the end of the NATNetwork Address Translation. NAT is a method of remapping one IP address space into another by modifying network address information in Internet Protocol (IP) datagram packet headers while they are in transit across a traffic routing device. range
Destination IP address	If this parameter is configured, the destination IP changes to the IP from the NATNetwork Address Translation. NAT is a method of remapping one IP address space into another by modifying network address information in Internet Protocol (IP) datagram packet headers while they are in transit across a traffic routing device. pool.

Policies

This setting appears on the Role Configuration tab when you configure an enforcement profile for an ArubaOS-Switch or AOS-CX device. When you select the Add Policy link on the Role Configuration tab, the following configuration dialog opens:

Figure 10 Policy Configuration Page

Enter the appropriate values for each of the fields in the Policy Configuration > Rule Configuration dialog, then click Save Rule. Table 15 describes the parameters for an ArubaOS Switch, and Table 16 describes the parameters for AOS-CX.

Table 15: Policy Configuration Page: ArubaOS-Switch Parameters
Parameter	Action/Description
Number	Enter a number.
Class	Select one of the following: IPv4 IPv6
Class Name	Specify the appropriate class name from the drop-down menu.
Action	Select the desired action from the drop-down list.
IP DSCPDifferentiated Services Code Point. DSCP is a 6-bit packet header value used for traffic classification and priority assignment. <0-63>	Enter a number from 0 to 63 to indicate the IP DSCPDifferentiated Services Code Point. DSCP is a 6-bit packet header value used for traffic classification and priority assignment. (Differentiated Services Code Point).
IP Precedence <0-7>	Specify the IP precedence by entering a number from 0 to 7.
Priority	Enter a number from 0 to 7 to indicate QoSQuality of Service. It refers to the capability of a network to provide better service and performance to a specific network traffic over various technologies. priority.
Rate Limit Kpbs	Specify the rate limit in kilobits per second.

Table 16: Policy Configuration Page: AOS-CX Parameters
Parameter	Action/Description
Number	Enter a number.
Class	Select one of the following: IPv4 IPv6
Class Name	Specify the appropriate class name from the drop-down menu.
Action	Select the desired action from the drop-down list.
IP Precedence <0-7>	Specify the IP precedence by entering a number from 0 to 7.
DSCPDifferentiated Services Code Point. DSCP is a 6-bit packet header value used for traffic classification and priority assignment. <0-63>	Enter a number from 0 to 63 to indicate the IP DSCPDifferentiated Services Code Point. DSCP is a 6-bit packet header value used for traffic classification and priority assignment. (Differentiated Services Code Point).
Committed Information Rate <1-4294967295>	Specify the Committed Information Rate (CIR) for this policy. Traffic rates below CIR or bursts below CBS limits are considered “conforming” and are allowed to pass through.
Committed Burst Size <1-4294967295>	Specify the Committed Burst Size (CBS) in bytes for this enforcement policy. Traffic rates below CIR or bursts below CBS limits are considered “conforming” and are allowed to pass through
Local Priority	Enter a number from 0 to 7 to indicate QoSQuality of Service. It refers to the capability of a network to provide better service and performance to a specific network traffic over various technologies. priority.
Priority Code Point	Priority Code Point (PCP) value for traffic matching this policy.

Classes

The Manage Classes link appears on the Role Configuration tab when you configure an enforcement profile for an ArubaOS-Switch or AOS-CX device. You can create and configure traffic classes and you can map the enforcement policy to the traffic classes.

1. Select the Manage Classes link on the Role Configuration tab. The following configuration dialog opens:

Figure 11 Class Configuration Dialog

2. Specify the Class Configuration parameters as described in the following table.

Table 17: Class Configuration Page
Parameter	Action/Description
Select Class Name	Select the class name from the drop-down list if it is already configured.
Name	Enter the Class name.
Traffic	Specify one of the following traffic types: IPv4 IPv6

3. Click the Rule Configuration tab. The rule configuration dialog opens. The parameters displayed this dialog vary, depending upon whether you are creating a rule for ArubaOS-Switch or an AOS-CX device.

4. Specify the Rule Configuration parameters to create a rule for traffic that matches the selected conditions. The following tables describe the class rule parameters available for ArubaOS-Switch and AOS-CX.

Table 18: ArubaOS-Switch Class Rule Configuration Parameters
Parameter	Action/Description
Number	(Optional) Specify a sequence number for the rule in the access control list.
Packet Match	Select whether the rule should match or ignore the specified packet characteristics in this rule.
Protocol	Specify the appropriate traffic protocol from the drop-down.
Source	Select Any as the source option supported by ArubaOS.
Source Port	Select one of the following options: Equal to Port Greater than Port Less than Port Except Port Port Range <1-65535>
Source Port Value	Specify the source port value.
Destination	Select one of the following destinations: Any Host IP Subnet. When you select IP Subnet, you are prompted for the Source Value (the IP subnetSubnet is the logical division of an IP network. address).
Destination Port	Select one of the following options: Equal to Port Greater than Port Less than Port Except Port Port Range <1-65535>
Destination Port Value	Specify the destination port value.
IP DSCPDifferentiated Services Code Point. DSCP is a 6-bit packet header value used for traffic classification and priority assignment.	Specify the Differentiated Services Code Point (DSCPDifferentiated Services Code Point. DSCP is a 6-bit packet header value used for traffic classification and priority assignment. ) value.
VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. ID	Specify the VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. ID
IP Precedence	Specify the IP precedence: Routine Priority Immediate Flash Flash Override Critical Internet Network
IP Type of Service	Specify one of the following for the type of service: Normal Max Reliability Max Throughput Minimum Delay
TCPTransmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. Packets Bit Sets	Select one of the following: Established Fin: The FIN flag indicates the end of data transmission to finish a TCPTransmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. connection. Rst: Sets the Reset flag. Syn: The SYN flag synchronizes sequence numbers to initiate a TCPTransmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. connection.

Table 19: AOS-CX Rule Configuration Parameters
Parameter	Action/Description
Number	(Optional) Specify a sequence number for the rule in the access control list.
Packet Match	Select whether the rule should match or ignore the specified packet characteristics in this rule.
Protocol	Specify the appropriate traffic protocol from the drop-down.
Protocol Number	Enter a protocol number from 0-255 to apply the rule to the traffic class using that protocol.
Source IP	Specify if the traffic to which the rule is applied will come from a specific IP address, or from any IP address. If you select the IP option, specify the IPv4 or IPv6 source IP address in the Source IP Address field.
Source Port	Specify an option to determine the source port of the traffic to which the rule is applied. Equal to Port Less than Port Greater than Port Port Range
Source port value	Specify the source port value for the Source Port setting above. To specify a port range, enter the beginning and ending port numbers separated by a space.
Destination	Specify if the traffic to which the rule is applied will be sent to a specific IP address or host, or from any IP address or host. If you select the IP Subnet or Host option, specify the IPv4 or IPv6 destination IP address in the Destination IP Address field.
Destination Port	Specify an option to determine the destination port of the traffic to which the rule is applied. Equal to Port Less than Port Greater than Port Port Range
Destination port value	Specify the destination port value for the Destination Port setting above. To specify a port range, enter the beginning and ending port numbers separated by a space.
DSCPDifferentiated Services Code Point. DSCP is a 6-bit packet header value used for traffic classification and priority assignment.	Specify the differentiated services code point (DSCPDifferentiated Services Code Point. DSCP is a 6-bit packet header value used for traffic classification and priority assignment. ) value for the traffic.
VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. ID	Specify the VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. ID.
ECN	Specify an Explicit Congestion Notification (ECN) value.
IP Precedence	Specify the IP precedence: Routine Priority Immediate Flash Flash Override Critical Internet Network
IP Type of Service	Specify the value of the ToSType of Service. The ToS field is part of the IPv4 header, which specifies datagrams priority and requests a route for low-delay, high-throughput, or a highly reliable service. header. (0-31)
Fragment	This option in the header means that packet can fragmented into smaller packets and later reassembled later if part of that packet's route cannot manage the size of the packet.
Count Packet	If enabled, the AOS-CX switch keeps the hit counts of the number of packets matching this ACEAccess Control Entry. ACE is an element in an ACL that includes access control information..
TCPTransmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. Flags	Specify matching TCPTransmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. flags. crw: Specifies matching on the TCPTransmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. Flag the Congestion Window Reduced (RFC3168). ece: Specifies matching on the TCPTransmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. Flag ECN-Echo (RFC3168). urg: Specifies matching on the TCPTransmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. Flag Urgent. ack: Specifies matching on the TCPTransmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. Flag Acknowledgment. psh: Specifies matching on the TCPTransmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. Flag: Push buffered data to receiving application. rst: Specifies matching on the TCPTransmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. Flag Reset the connection. syn: Specifies matching on the TCPTransmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. Flag: Synchronize sequence numbers. fin: Specifies matching on the TCPTransmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. Flag Finish connection. established: Specifies matching on the TCPTransmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. Flag Established connection.
ICMPInternet Control Message Protocol. ICMP is an error reporting protocol. It is used by network devices such as routers, to send error messages and operational information to the source IP address when network problems prevent delivery of IP packets. Type	Specify if the rule should match ICMPInternet Control Message Protocol. ICMP is an error reporting protocol. It is used by network devices such as routers, to send error messages and operational information to the source IP address when network problems prevent delivery of IP packets. echo or echo-reply traffic, or a specific value in the ICMPInternet Control Message Protocol. ICMP is an error reporting protocol. It is used by network devices such as routers, to send error messages and operational information to the source IP address when network problems prevent delivery of IP packets. code field (<0-255>).
ICMPInternet Control Message Protocol. ICMP is an error reporting protocol. It is used by network devices such as routers, to send error messages and operational information to the source IP address when network problems prevent delivery of IP packets. Code	Specify the ICMPInternet Control Message Protocol. ICMP is an error reporting protocol. It is used by network devices such as routers, to send error messages and operational information to the source IP address when network problems prevent delivery of IP packets. code.

Stateless Access Control Lists

Stateless Access Control Lists (ACLsAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port.) are used to define stateless packet filtering and quality of service (QoSQuality of Service. It refers to the capability of a network to provide better service and performance to a specific network traffic over various technologies.). A stateless ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. statically evaluates packet contents. The traffic in the reverse direction will be allowed unconditionally. To add a Stateless Access Control List to a Mobility Access Controller:

1. From the Role Configuration tab, click the Add Stateless Access Control List link. The Stateless Access Control List Configuration dialog opens:

Figure 12 Stateless Access Control List Configuration Profile

2. On the General tab, enter a name for the Stateless ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port..

3. Click the Add Rule link. The Rule Configuration dialog opens.

4. Specify the rule attributes as described in the table below, then click Save Rule.

Table 20: Stateless Access Control List Configuration
Parameter	Action/Description
Source Traffic Match	Select one of the following options: alias: Match an IP network resource any: Match any source traffic host: Match a single host address network: Match an IP subnetSubnet is the logical division of an IP network.
Source IP address	IP address of the source host or network.
Source NetmaskNetmask is a 32-bit mask used for segregating IP address into subnets. Netmask defines the class and range of IP addresses.	If you selected the network option in the Source Traffic Match field, enter the netmaskNetmask is a 32-bit mask used for segregating IP address into subnets. Netmask defines the class and range of IP addresses. of the source network.
Destination Traffic Match	Select one of the following options: alias: Match an IP network resource any: Match any source traffic host: Match a single host address network: Match an IP subnetSubnet is the logical division of an IP network.
Destination IP address	IP address of the destination host or network.
Destination NetmaskNetmask is a 32-bit mask used for segregating IP address into subnets. Netmask defines the class and range of IP addresses.	If you selected the network option in the Destination Traffic Match field, enter the netmaskNetmask is a 32-bit mask used for segregating IP address into subnets. Netmask defines the class and range of IP addresses. of the destination network.
Service Type	Specify the name of the service to match the rule. any: Match any traffic arp: Match ARPAddress Resolution Protocol. ARP is used for mapping IP network address to the hardware MAC address of a device. traffic service: Match a service defined by a Policy Manager NetService Profiles tcp Match TCPTransmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. traffic udp Match UDPUser Datagram Protocol. UDP is a part of the TCP/IP family of protocols used for data transfer. UDP is typically used for streaming media. UDP is a stateless protocol, which means it does not acknowledge that the packets being sent have been received. traffic
Action	Choose one of the following actions to take on matching traffic: deny: Reject packets. permit: Forward packets. redirect: Specify the location to which packets are redirected. If you select this option, you are prompted to specify one of the following redirect types: ipsec: Specify the name of an IPSec map to redirect matching traffic over a VPNVirtual Private Network. VPN enables secure access to a corporate network when located remotely. It enables a computer to send and receive data across shared or public networks as if it were directly connected to the private network, while benefiting from the functionality, security, and management policies of the private network. This is done by establishing a virtual point-to-point connection through the use of dedicated connections, encryption, or a combination of the two. tunnel. tunnel: Specify a tunnel ID to redirect packets over an L3 GREGeneric Routing Encapsulation. GRE is an IP encapsulation protocol that is used to transport packets over a network. tunnel.
Blacklist user if ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. gets applied	If the ACEAccess Control Entry. ACE is an element in an ACL that includes access control information. entry is matched, the traffic from that particular user is denied and the user is added to a blocked list for 3600 seconds.
Log if ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. is applied	If enabled, log information is displayed when the ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. is applied.
Position (1-2000)	Manages the position of the rule within the Acces Control List (ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port.).
Policer Profile	This parameter defines a policer profile to manage the transmission rate of a class of traffic based on user-defined criteria. For more information, see Policer Profiles.
QoSQuality of Service. It refers to the capability of a network to provide better service and performance to a specific network traffic over various technologies. Profile	Click the QoSQuality of Service. It refers to the capability of a network to provide better service and performance to a specific network traffic over various technologies. profile dropdown menu to select a set of Traffic-Class/Drop-Precedence, DSCPDifferentiated Services Code Point. DSCP is a 6-bit packet header value used for traffic classification and priority assignment. , and 802.1p values for a Mobility Access Switch. For more information, see QoS Profiles.
Time Range	Select the Time Ranges dropdown menu to create a rule matching time range definitions. For more information, see Time Range Profiles.

Session Access Control Lists

To add a Session Access Control List to a downloadable role enforcement profile for a mobility controller or mobility access switch:

1. From the Role Configuration tab, click the Add Session Access Control List link. The Session Access Control List Configuration dialog opens.

2. Enter a name for the Session ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port..

3. On the General tab, click the Add Rule link. The Rule Configuration dialog opens.

Figure 13 Session Access Control List Rule Configuration Profile

4. Enter the required attributes in the Rule Configuration dialog then click Save Rule. Note that this dialog can display different fields depending on the selected options. For example, if you select the dual-nat action type, you can view the Dual NAT Pool field to specify the action.

Table 21: Session Access Control List Rule Attributes
Parameter	Action/Description
Source Traffic Match:	Source of the traffic, which can be one of the following: alias: Refers to using an alias for a host or network. You configure the alias by navigating to the Configuration > Roles & Policies > Policies tab. Select a policy created and click + to create a Rule. Select the Access Control option in the Rule Type. Select Alias from the Destination drop-down list and the alias name from the Destination alias drop-down list. Select a Source from the traffic Source drop-down list. any: Acts as a wildcard and applies to any source address. host: Refers to traffic from a specific host. When this option is chosen, you must configure the IP address of the host. network: Refers to a traffic that has a source IP from a subnetSubnet is the logical division of an IP network. of IP addresses. When this option is chosen, you must configure the IP address and network mask of the subnetSubnet is the logical division of an IP network.. user: Refers to traffic from the wireless client.
Destination Traffic Match:	Destination of the traffic, which can be configured in the same manner as Source Traffic Match.
Service Type:	Type of traffic, which can be one of the following: any: This option specifies that this rule applies to any type of traffic. protocol: Enter a protocol number (0-255) to apply this rule to a specific protocol. service: Select a Netservice configuration. tcp: Using this option, you configure a range of TCPTransmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. port(s) to match for the rule to be applied. udp: Using this option, you configure a range of UDPUser Datagram Protocol. UDP is a part of the TCP/IP family of protocols used for data transfer. UDP is typically used for streaming media. UDP is a stateless protocol, which means it does not acknowledge that the packets being sent have been received. port(s) to match for the rule to be applied.
Action:	The action that you want to perform on a packet that matches the specified criteria. This can be one of the following: deny: Drops packets matching this rule. dst-nat: This option redirects traffic to the IP address and destination port defined in the Destination NAT IP Address and Destination NAT Port fields. dual-nat: This option performs both source and destination NATNetwork Address Translation. NAT is a method of remapping one IP address space into another by modifying network address information in Internet Protocol (IP) datagram packet headers while they are in transit across a traffic routing device. on packets matching the rule. If you select this option, you are prompted to select a NATNetwork Address Translation. NAT is a method of remapping one IP address space into another by modifying network address information in Internet Protocol (IP) datagram packet headers while they are in transit across a traffic routing device. pool in the Dual NAT Pool field. For more information, see NAT Pools permit: Permits traffic matching this rule. redirect: This option redirects traffic into a GREGeneric Routing Encapsulation. GRE is an IP encapsulation protocol that is used to transport packets over a network. tunnel specified in the Tunnel ID field. src-nat: Performs NATNetwork Address Translation. NAT is a method of remapping one IP address space into another by modifying network address information in Internet Protocol (IP) datagram packet headers while they are in transit across a traffic routing device. on packets matching the rule. When this option is selected, you need to select a NATNetwork Address Translation. NAT is a method of remapping one IP address space into another by modifying network address information in Internet Protocol (IP) datagram packet headers while they are in transit across a traffic routing device. pool in the Source NAT Pool field. For more information, see NAT Pools permit: Permits traffic matching this rule.
Blacklist user if ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. gets applied	Automatically adds to a blocked list any client that is the source or destination of traffic matching this rule. This option is recommended for rules that indicate a security breach where the option to add to a blocked list can be used to prevent access to clients that are attempting to breach the security.
802.1p Priority (0-7)	When this parameter is enabled, the value of 802.1p priority bits are marked in the frame of a packet matching this rule when it leaves the managed device. 0 is the lowest priority (background traffic) and 7 is the highest (network control).
Log if ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. is applied	Logs a match to this rule. This is recommended when a rule indicates a security breach, such as a data packet on a policy that is meant only to be used for voice calls.
Mirror	Mirrors session packets to datapath or remote destination.
Position (1-2000):	Use this field to select a position for this rule in the Session Access Control List. The rule in position 1 is executed first.
Queue Priority	Select the queue in which a packet matching this rule should be placed. Select High for higher priority data, such as voice, and Low for lower priority traffic.
Time Range	Click the dropdown menu and select a time range. You can create an absolute time range with a single fixed start and end date and time, or create a periodic (recurring) time range that starts and ends at a specified time on a weekday, weekend, or selected day. For more information, see Time Range Profiles
TOS (0-63)	Select the value of the TOS bits in the IP header of a packet,

Ethertype/MAC Access Control Lists

Ethertype ACLsAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. are used to filter based on the Ethertype field in the frame header. These ACLsAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. can be used to permit IP while blocking other non-IP protocols, such as IPX or AppleTalk. To add an EthernetEthernet is a network protocol for data transmission over LAN./MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. Access Control List to a downloadable role enforcement profile for a mobility controller or mobility access switch:

1. From the Role Configuration tab, click the Add Ethertype/MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. Access Control List link. The Access Control List Configuration dialog opens. The ACLAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port. Type is set to Ethertype.

Figure 14 Ethertype/MAC Access Control List Configuration Profile

2. Enter a name for the Ethertype/MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. Access Control List.

3. Enter the required attributes in the Rules section of the page and click Reset, then click Save Rule.

4. When finished, click Save.

Table 22: Ethertype/MAC Access Control List Attributes
Parameter	Action/Description
Action	The action that you want to perform on a packet that matches the specified criteria. This can be one of the following: deny: Drops packets matching this rule. permit: Permits traffic matching this rule.
Ethertype number	Select Any to apply the access control list to any Ethertype value, or select Enter Value to specify a ethernet value (0-65535) and subnetSubnet is the logical division of an IP network. bits (0-65535)

Role Configuration: Advanced Mode

When you set Role Configuration Mode to Advanced, the Enforcement Profile page displays the Attributes tab (see Figure 15 below).

In Advanced mode, a validation check is not available for downloadable role names that are greater than 64 characters. This is due to a limitation on the switch. Thus, if a downloadable role name configured on the Policy Manager server exceeds 64 characters, the enforcement profile may fail on the switch.

In Advanced mode, the Aruba Downloadable Role Enforcement profile provides two dictionaries and two attributes.

Mobility Controllers, and Mobility Access Switches and AOS-CX devices use the Aruba dictionary and the Aruba-CPPM-Role attribute.

ArubaOS-Switch devices use the Hewlett-Packard-Enterprise dictionary and the HPE-CPPM-Role and HPE-CPPM-Secondary-Role attributes. The HPE-CPPM-Secondary-Role attribute adds support for a downloadable secondary role that can be used with Per User Tunneled Node (PUTN). When the attribute is added to the enforcement profile, Policy Manager can send the controller role for the ArubaOS switch.

You can use only one of the Advanced mode dictionaries at any given time; these dictionaries can't both be used at the same time.

To configure the Aruba Downloadable Role Enforcement > Advanced attributes:

1. Navigate to Configuration > Enforcement > Profiles > Add.

2. Select Aruba Downloadable Role Enforcement from the Template drop-down list.

3. Configure the settings on the Profile tab as described in Role Configuration: Standard Mode, but select the Advanced option for the Role Configuration Mode setting.

Figure 15 Downloadable Role Enforcement > Profile Tab (Advanced Mode)

4. Next, select the Attributes tab. The appropriate RADIUSRemote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. dictionary for the selected device type is enabled by default

Figure 16 Configuring HPE-CPPM-Role Attribute

5. In the Value field, enter the appropriate commands.

a. Type: Hewlett-Packard Enterprise

b. Name: Select HPE-CPPM-Role (27) or HPE-CPPM-Secondary-Role (28).

c. Value:

6. Click Save.

Summary Information

For a profile in Standard Role configuration mode, the Summary tab summarizes the parameters configured in the Profile and Role Configuration tabs. For a profile in Advanced role configuration mode, the Summary tab summarizes the parameters configured in the Profile and Attribute tabs.