Profile Security Configuration and Deployment Considerations

Before defining a profile's security configuration, refer to the following deployment guidelines to ensure the profile configuration is optimally effective:

• Make sure the contents of the certificate revocation list are periodically audited to ensure revoked certificates remain quarantined or validated certificates are reinstated.

• A RFS 4000 model wireless controller ships with a baseline configuration supporting many-to-one NAT between devices connected to GE1 - GE5 ports on VLAN 1, and the UP1 port assigned to VLAN 2100. A RFS 4000 can be deployed within a small site using its default configuration, and then be connected to a Internet service providing instant access to the Internet.

• NAT alone does not provide a firewall. If deploying NAT on a profile, add a firewall on the profile to block undesirable traffic from being routed. For outbound Internet access, a stateful firewall can be configured to deny all traffic. If port address translation is required, a stateful firewall should be configured to only permit the TCP or UDP ports being translated.

• A RFS 6000 model wireless controller ships with a minimum baseline configuration without NAT enabled. A RFS 6000 wireless controller requires VLAN configuration, IP addressing and NAT rules be created before many-to-one NAT services can be defined.

• WiNG managed controllers and service platforms can provide outbound NAT services for hosts connected to multiple VLANs. For small deployments, VLANs should be terminated within a RFS 4000 wireless controller providing site routing services. For medium-scale deployments, VLANs are typically terminated on a L3 (IP layer) or L2 (Ethernet layer).