Create Network Policies

Use this task to create a network policy.

  1. Go to Policies > Policies and in the Network Policies tab, select Add Policy > Network.
  2. Configure the following network policy settings:
    Table 1. Network Policy Settings
    FieldDescription
    Policy NameEnter at least three alphanumeric characters for the name of the new network policy.
    Description (Optional)Enter a policy description.
    Conditions
    Note: All conditions are mutually exclusive.
    		Select desired conditions:
    • Any User (Default) - If the default is not selected, search and select from the User Group(s) drop-down menu or create a new user group.
    • Any Device (Default) - If the default is not selected, search and select from the Device Group(s) drop-down menu or create a new device group.
    • Any Location (Default) - If the default is not selected, you can search, select, and edit from the optional Location-based Condition drop-down menu or create a new condition.
    • Any Time (Default) - If the default is not selected, search, select,and edit from the optional Time-based Condition drop-down menu or create a new condition.
    • Any Authentication Type (Default) - If the default is not select and edit from the optional Authentication-based Condition drop-down menu or create a new condition.
    Network Access
    • Default Access - Select the default access for the network. By default, all network access is dropped.
    • AP Aware - Enable this option to only authenticate the first MAC address connecting to the port of an Extreme Networks switch. The primary use case for this is an access point. All other MAC addresses will be authenticated by the access point.

    • Enter a VLAN ID or enable the switch to select an existing VLAN ID from ExtremeCloud IQ. Enter a Fabric Service Identifier if one is needed.

      Note:

      To add additional tagged VLANs, the first ID is always the untagged VLAN and should match the VLAN being assigned by the policy.

      In the Advanced Settings (below), you can use the FA-VLAN-ISID attribute to tag any extra VLANs. Even though the switch is not doing fabric attach, the attribute will allow for additional tagged VLANs.

      The format is:

      FA-VLAN-ISID=1:1,1101:1101,1102:1102,1201:1201,1202:1202

      In the above example, 1 is the first VLAN and is untagged and VLANs 1101,1102,1201,1202 are all tagged.

    • Network Service Group (Optional):
      • Select Add Network Service Group.
        Note: Drag Network Service Groups in the order to respond within the RADIUS response.
      • Select Allow or Deny.
    Note: In the Network Group table, select Revert Policy Order to reorder the columns.
    Advanced Settings (Optional)
    • RADIUS VSA's - Select from the drop-down menu.
    • Variables - Select from the drop-down menu.
  3. Select Add.

Your network policy displays in the list showing the Network Access status as Active.

To update or remove an existing Network policy, select Elipses and select Update or Remove from the drop-down list.
9039247-00 Rev AC