Extreme Gen2 ACL Enforcement

In order to push ACL enforcement to a user during authentication the below VSA must be configured and used in ClearpassClearpass. You can substitute the example for any one policy name you have created to enforce that specific policy.

Radius:ExtremeIETF    Extreme-Security-ProfileFilter-Id    =    Internet-Only-5MData

Below is an example script that can be used to provide internet only access with a limit of 5mbpsseveral bandwidthone limit.policy configurations.  This example below was configured and pushed from Extreme XMC

createconfigure upmpolicy captive-portal web-redirect 1 server 1 url "https://clearpass.designlogic.net:443/guest/cpguestwrd.php" enable
configure policy profile 1 name "Data" pvid-status "enable" pvid 1280 egress-vlans 100 untagged-vlans 1280
configure policy profile 2 name "Internet-Only-5MOnly" pvid-status "enable" pvid 1280 untagged-vlans 1280
configure policy profile 3 name "Device-Profile" pvid-status "enable" pvid 1280 untagged-vlans 1280
configure policy profile 4 name "Guest-Portal" pvid-status "enable" pvid 1280 untagged-vlans 1280 web-redirect 1
configure policy profile 5 name "Deny" pvid-status "enable" pvid 0
configure policy profile 6 name "Voice" pvid-status "enable" pvid 1280 untagged-vlans 1280
configure policy profile 7 name "test" pvid-status "enable" pvid 20 untagged-vlans 20
configure policy rule 2 ipdestsocket 10.0.0.0 mask 8 drop
configure policy rule 2 ipdestsocket 10.21.0.10 mask 32 forward
configure policy rule 2 ipdestsocket 172.16.0.0 mask 12 drop
configure policy rule 2 ipdestsocket 192.168.0.0 mask 16 drop
configure policy rule 2 udpdestportIP 53 mask 16 forward
configure policy rule 2 udpdestportIP 67 mask 16 forward
configure policy rule 2 ether 0x0806 mask 16 forward
configure policy rule 3 udpdestportIP 53 mask 16 forward
configure policy rule 3 udpdestportIP 67 mask 16 forward
configure policy rule 3 ether 0x0806 mask 16 forward
configure policy rule 4 udpdestportIP 53 mask 16 forward
configure policy rule 4 udpdestportIP 67 mask 16 forward
configure policy rule 4 tcpdestportIP 80 mask 16 forward
configure policy rule 4 tcpdestportIP 443 mask 16 forward
configure policy rule 4 ether 0x0806 mask 16 forward
configure policy maptable response both
configure policy captive-portal listening 80
configure policy captive-portal listening 443
configure policy captive-portal listening 8080
enable clipolicy

scripting
set

var

This namedPortIdis $TCL(regsubanother ":"way ${EVENT.USER_PORT}to "")
setpush vara macvsimilar $TCL(stringconfiguration range ${EVENT.USER_MAC} 6 end)
set var namedMACId $TCL(regsub -all ":" ${macv} "")
if (!$match($EVENT.NAME,USER-AUTHENTICATED)you're thennot using XMC.

configure policy rule-model access-list
configure clipolicy modecaptive-portal non-persistent
createweb-redirect meter1 NLM-P$namedPortIdserver 1 url "https://clearpass.designlogic.net:443/guest/cpguestwrd.php" enable
configure meterpolicy NLM-P$namedPortIdprofile committed-rate1 5name Mbps"Data" pvid-status "enable" pvid 1280 egress-vlans 100 untagged-vlans 1280
configure portspolicy $EVENT.USER_PORTprofile rate-limit2 egressname 5 Mbps max-burst-size 128 Kb
create"Internet-Only" access-list $(namedMACId)_allow"Internet_Only" pvid-status "ethernet-source-addressenable" $(EVENT.USER_MAC);pvid destination-address1280 0.0.0.0/0"untagged-vlans 1280
configure policy profile 3 name "permit;meter NLM-P$(namedPortId)"
createDevice-Profile" access-list $(namedMACId)_10_0"Device_Profile" pvid-status "ethernet-source-addressenable" $(EVENT.USER_MAC);pvid destination-address1280 untagged-vlans 1280
configure policy profile 4 name "Guest-Portal" access-list "Guest_Portal" pvid-status "enable" pvid 1280 untagged-vlans 1280 web-redirect 1
configure policy profile 5 name "Deny" pvid-status "enable" pvid 0
configure policy profile 6 name "Voice" pvid-status "enable" pvid 1280 untagged-vlans 1280
create policy access-list Internet_Only.Allow_DNS matches udpdestportIP 53 mask 16 actions forward
create policy access-list Internet_Only.Allow_DHCP matches udpdestportIP 67 mask 16 actions forward
create policy access-list Internet_Only.Deny_Tens matches ipdestsocket 10.0.0.0/8"0 "deny"mask 8 actions drop
create policy access-list $(namedMACId)_172_16Internet_Only.Deny_One_Sevens "ethernet-source-addressmatches $(EVENT.USER_MAC); destination-addressipdestsocket 172.16.0.0/12"0 "deny"mask 12 actions drop
create policy access-list $(namedMACId)_192_168Internet_Only.Deny_One_Nines "ethernet-source-addressmatches $(EVENT.USER_MAC); destination-addressipdestsocket 192.168.0.0/16"0 "deny"mask 16 actions drop
create policy access-list $(namedMACId)_dhcpDevice_Profile.Allow_DNS "protocolmatches udp;udpdestportIP destination-port53 67"mask "permit"16 actions forward
create policy access-list $(namedMACId)_dnsDevice_Profile.Allow_DHCP "protocolmatches udp;udpdestportIP destination-port67 53"mask "permit"16 actions forward
create policy access-list $(namedMACId)_ntpGuest_Portal.Allow_DNS "protocolmatches udp;udpdestportIP destination-port53 123"mask "permit"16 actions forward
create policy access-list $(namedMACId)_denyGuest_Portal.Allow_DHCP "ethernet-source-addressmatches $(EVENT.USER_MAC);udpdestportIP destination-address67 0.0.0.0/0"mask "deny"16 actions forward
configurecreate policy access-list addGuest_Portal.Allow_HTTP $(namedMACId)_allowmatches firsttcpdestportIP port80 $EVENT.USER_PORTmask 16 actions forward
configurecreate policy access-list addGuest_Portal.Allow_HTTPS $(namedMACId)_10_0matches firsttcpdestportIP port443 $EVENT.USER_PORTmask 16 actions forward
configurecreate policy access-list addGuest_Portal.Allow_ARP $(namedMACId)_172_16matches firstether port0x0806 $EVENT.USER_PORTmask 16 actions forward
configure access-listpolicy addmaptable $(namedMACId)_192_168response first port $EVENT.USER_PORTboth
configure access-listpolicy addcaptive-portal $(namedMACId)_dhcplistening first port $EVENT.USER_PORT80
configure access-listpolicy addcaptive-portal $(namedMACId)_dnslistening first port $EVENT.USER_PORT443
configure access-listpolicy addcaptive-portal $(namedMACId)_ntplistening first8080
enable port $EVENT.USER_PORT
configure access-list add $(namedMACId)_deny last port $EVENT.USER_PORT
endif
if (!$match($EVENT.NAME,USER-UNAUTHENTICATED)) then
configure access-list delete $(namedMACId)_allow ports $EVENT.USER_PORT
configure access-list delete $(namedMACId)_10_0 ports $EVENT.USER_PORT
configure access-list delete $(namedMACId)_172_16 ports $EVENT.USER_PORT
configure access-list delete $(namedMACId)_192_168 ports $EVENT.USER_PORT
configure access-list delete $(namedMACId)_dhcp ports $EVENT.USER_PORT
configure access-list delete $(namedMACId)_dns ports $EVENT.USER_PORT
configure access-list delete $(namedMACId)_ntp ports $EVENT.USER_PORT
configure access-list delete $(namedMACId)_deny ports $EVENT.USER_PORT
delete access-list $(namedMACId)_allow
delete access-list $(namedMACId)_10_0
delete access-list $(namedMACId)_172_16
delete access-list $(namedMACId)_192_168
delete access-list $(namedMACId)_dhcp
delete access-list $(namedMACId)_dns
delete access-list $(namedMACId)_ntp
delete access-list $(namedMACId)_deny
delete meter NLM-P$namedPortId
configure ports $EVENT.USER_PORT rate-limit egress no-limit
endif
.
 
configure upm event user-authenticate profile "Internet-Only-5M" ports 1:1-24
configure upm event user-unauthenticated profile "Internet-Only-5M" ports 1:1-24policy