Built-in Interface-based Exception Filters

On the controller, various interface-based exception filters are built in and invoked automatically. These filters protect the controller from unauthorized access to system management functions and services via the interfaces. Access to system management functions is granted if the administrator selects the allow management traffic option in a specific topology.

Allow management traffic is possible on the topologies that have L3 IP interface definitions. For example, if management traffic is allowed on a physical topology (esa0), only users connected through ESA0 will be able to get access to the system. Users connecting on any other topology, such as Routed or Bridged Locally at Controller, will no longer be able to target ESA0 to gain management access to the system. To allow access for users connected on such a topology, the given topology configuration itself must have allow management traffic enabled and users will only be able to target the topology interface specifically.

On the controller‘s L3 interfaces (associated with either physical, Routed, or Bridged Locally at Controller topologies), the built-in exception filter prohibits invoking SSH, HTTPS, or SNMP (Simple Network Management Protocol). However, such traffic is allowed, by default, on the management port.

If management traffic is explicitly enabled for any interface, access is implicitly extended to that interface through any of the other interfaces (VNS). Only traffic specifically allowed by the interface‘s exception filter is allowed to reach the controller itself. All other traffic is dropped. Exception filters are dynamically configured and regenerated whenever the system's interface topology changes (for example, a change of IP address for any interface).

Enabling management traffic on an interface adds additional rules to the exception filter, which opens up the well-known IP(TCP/UDP) ports, corresponding to the HTTPS, SSH, and SNMP applications.

The interface-based built-in exception policy rules, in the case of traffic from wireless users, are applicable to traffic targeted directly for the topology L3 interface. For example, a filter specified by a Role may be generic enough to allow traffic access to the controller's management (for example, Allow All [*.*.*.*]). Exception policy rules are evaluated after the user's assigned filter role, as such, it is possible that the role allows the access to management functions that the exception filter denies. These packets are dropped.