topic Re: Policy Manager XMC in ExtremeCloud IQ- Site Engine Management Center

Policy Manager XMC

Giuseppe_Montan — Thu, 20 Feb 2020 18:38:18 GMT

Good Morning, a Customer ask if is possible to use XMC Policy Manager without NAC and radius.

At the moment is necessary check the OUI and put on a correct VLAN.

I configured X440 in CLI and it works, now we want to do the same with XMC.

Thanks

Giuseppe

Re: Policy Manager XMC

Zdeněk_Pala — Fri, 21 Feb 2020 06:45:09 GMT

Hi Giuseppe

You can create a policy by CLI.

You can create a policy by XMC.

You can assign policy statically to the port (by CLI or by XMC)

You can assign policy statically to the VLAN (by CLI or by XMC)

You can assign policy dynamically to the authenticated entity by external radius (can be FreeRadius, NPS, ExtremeControl,...)

You can use UPM scripting to assign the policy to the port based on any event detected by the switch = some scripting is necessary, I do not like this approach but doable.

By policy, I mean policy profile and policy rules.

Re: Policy Manager XMC

Rahman_Duran — Thu, 05 Mar 2020 19:40:49 GMT

Hi,

Can we also use XMC Policy Manager without NAC, for L3 ACLs? I am configuring ACLs by CLI and appling them to a VLAN interface on S series and C5. I also do it on X460-G2. So is it possible with Policy Manager? If it is possible I want to use Policy Manager instead of CLI.

Here is what I want on EOS:

ip access-list extended cctv-camera
 permit ip 10.242.2.0 0.0.0.255 10.1.1.0 0.0.0.255
 permit ip 192.168.10.0 0.0.0.255 10.1.1.0 0.0.0.255
 permit ip host 192.168.1.44 10.1.1.0 0.0.0.255
 permit ip 10.110.100.0 0.0.0.255 10.1.1.0 0.0.0.255
 permit ip 10.111.100.0 0.0.0.255 10.1.1.0 0.0.0.255
 permit ip 10.120.100.0 0.0.0.255 10.1.1.0 0.0.0.255
 deny ip any any log


 interface vlan.0.33
 ip address 10.1.1.1 255.255.255.0 primary
 ip access-group cctv-camera out
 ip helper-address 192.168.10.96
 no shutdown
 exit

And on EXOS:

create access-list santral-pbx-110 " source-address 10.150.101.0/24 ; destination-address 10.150.101.0/24 ;" " permit ; count santral-pbx-allow-110 ;" application "Cli"
create access-list santral-pbx-120 " source-address 10.160.101.0/24 ; destination-address 10.150.101.0/24 ;" " permit ; count santral-pbx-allow-120 ;" application "Cli"
create access-list santral-pbx-130 " source-address 10.111.101.0/24 ; destination-address 10.150.101.0/24 ;" " permit ; count santral-pbx-allow-130 ;" application "Cli"
create access-list santral-pbx-deny " source-address 0.0.0.0/0 ; destination-address 10.150.101.0/24 ;" " deny ; count santral-pbx-deny ;" application "Cli"


configure access-list add santral-pbx-110 last priority 0 zone SYSTEM vlan Santral-PBX egress
configure access-list add santral-pbx-120 last priority 0 zone SYSTEM vlan Santral-PBX egress
configure access-list add santral-pbx-130 last priority 0 zone SYSTEM vlan Santral-PBX egress
configure access-list add santral-pbx-deny last priority 0 zone SYSTEM vlan Santral-PBX egress

Regards,

Rahman

Re: Policy Manager XMC

Zdeněk_Pala — Fri, 06 Mar 2020 23:13:56 GMT

Hi,

Policy and ACLs are two different tools, used differently.

Short answer is: You will not create ACLs with Policy Manager in XMC 8.4 and older.

Re: Policy Manager XMC

Rahman_Duran — Mon, 09 Mar 2020 12:09:56 GMT

Hi,

I know they are different tools but can I do what I am trying to do with Policy instead of ACLs? Can “Policy” resctrict which IP subnets access to a whole VLAN?

“Short answer is: You will not create ACLs with Policy Manager in XMC 8.4 and older.”. Does this mean there will be changes in XMC 8.5 🙂

Regards,

Rahman

Re: Policy Manager XMC

Zdeněk_Pala — Mon, 09 Mar 2020 14:44:06 GMT

Hi,

With policy, you can assign the policy to vlan, port.

With policy, you can assign the policy to a subnet on N/S/K/PV-FC series only, not currently on EXOS.

In current policy implementation, you can not combine source and destination in the same filtering rule.

The future features and roadmap can not be discussed in public, contact a local representative for details.