Hello,
Considering this has been posted in the ExtremControl board I'm assuming you're looking for some assistance using Extreme Control to assign this policy to a port dynamically, or possibly using static policy on a port to provide guest access.
Using Extreme Policy you can create a policy that would assign a VLAN, deny internal networks and allow internet connectivity.
There is a canned policy with the Policy Manager domain called "Guest Access":
This default example of a policy is a deny all policy, that performs opens up ARP, DNS, DHCP for basic access, permits access to mail protocols, and allows HTTP/HTTPS.
You can use this as a base for your policy and add into it rules to deny internal ranges.
In XIQ-SE go to Control --> policy --> Open the appropriate policy domain --> Under Roles/Services scroll down to Service Repository --> Right click "Services" under the "Local Services" tree --> Create Service --> Name is "Deny Internal Networks" --> Right Click the new Service --> Add Rule --> Name the rule "Deny 10.x.x.x" or however appropriately --> Click the new rule --> Edit the traffic description --> Set Traffic Classification Type to IP address Destination --> For the value put in 10.0.0.0/8 or whatever is appropriate for you internal network range --> Click "OK" --> Set the Access Control to "Deny"
Repeat for all internal networks.
Once you have complete the rules in the service make sure to add the new service to the Role to start denying all internal networks.
The rule should look something like this:
Another way you can manage this type of configuration is through the automated services.
In Policy click on the "Network Resources" tab and create a Network Resource object. Once created, assign your IP ranges on the very bottom field:
Once you have created your network resource, go back to the Roles/Services section and create a new service, this time create an "Automated" service.
Assign your Traffic Description type to "IP Address Destination" and set it for your Internal Networks Resource object.
Set the Access Control to "Deny"
Add the automated service to your Role:
Add your switches into the Devices/Port groups tab and enforce policy.
Once enforced you can assign this policy dynamically or statically to a switch port.
To assign statically under the devices/port groups click on your switch --> Ports --> Right click the port/ports --> Policy --> Set Default role.
If you want to assign a VLAN, set the the Access Control to "Contain To VLAN" and assign a VLAN. If you go this route you could optionally create a new rule to deny ethertype for ipv4 and ipv6 to rebuild your implicit deny rule. Policy precedence should have this new rule be the least precedent so that it acts as your implicit deny.
Policy is a very powerful construct. When working with policy it's highly recommended that you test extensively before rolling it out to your network as it could result in service impact if improperly configured. Use a test switch on a test port and when you're confident that it's operating as you'd like move it to a switch/area that will be least impactful if issues arise.
It's highly recommended that you engage professional services if you are new to policy. They can help build this out exactly as you'd like.
Thanks
-Ryan
