Manual Policy Creation

Manual policy creation builds a rule by choosing an action and then the source, destination, and conditions that the action allows. The options presented adapt automatically to the site topology and the devices present, so that only combinations that can be enforced are offered.

Actions

Select the action that the rule performs:

  • Enable—Makes a network available. Used with a schedule to control when a network is active.
  • Disable—Makes a network unavailable.
  • Allow—Permits the traffic that matches the rule.
  • Block—Denies the traffic that matches the rule.
  • Restrict—Limits which sources can reach a destination, permitting only the specified sources.
  • Forward—Forwards traffic arriving on a WAN port to a device on the LAN (port forwarding). Requires a secure gateway.

Source

Depending on the action and topology, the source can be one of the following:

  • Networks (LAN)—One or more of the site’s wireless, wired, or VPN networks (All Networks or Selected Networks).
  • Clients—All clients or specific clients. Requires a secure gateway
  • IP Sources—One or more IP subnets or IP addresses.
  • WAN Sources—For the Forward action: the Internet, or specific WAN IP subnets or IP addresses.

Destination

When the action requires a destination (To Access), choose from:

  • Applications—One or more application categories.
  • IP Destinations—The Internet, one or more domains, the same network, or specific IP subnets or IP addresses.
  • Networks—One or more wired or VPN networks.
  • LAN IP address and port—For the Forward action: the LAN device and port that receive the forwarded traffic.

The Same Network destination and destinations such as the Internet, domains, and other networks require a secure gateway. On sites without a gateway, network and IP sources can target IP subnets and IP addresses, and wireless networks can target application categories.

Policy Options

For rules that carry traffic, the following options refine how the traffic is treated:

  • Selected Protocols—Restrict the rule to specific protocols and ports (for example, TCP 443, or UDP 123–456). Available for IP-based destinations and for port forwarding.

  • Bandwidth Limits—Limit the download and upload bandwidth available to the matching traffic. Select Download, Upload, or both, and set the rate with the corresponding slider (maximum 1 Gbps):

    • Download—Sets the maximum download rate for the matching traffic.
    • Upload—Sets the maximum upload rate for the matching traffic.
  • Traffic Priority—Assign a priority to the matching traffic, so that it is favored or deprioritized relative to other traffic when the connection is congested. Select one of the following priority levels:
    • Low—The lowest priority, for bulk transfers and other non-critical traffic that can tolerate delay.
    • Medium (default)—The default priority, for traffic that is not time-sensitive, such as most standard applications (best effort).
    • High—A higher priority for latency-sensitive traffic, such as video streaming and video conferencing.
    • Very High—The highest priority, for traffic that is highly sensitive to delay and jitter, such as voice (VoIP).

Bandwidth limits and traffic priority are not supported on the HPE Networking Instant On 1830, 1930, and 1960 switch series, so these options do not apply to traffic enforced by these switches. Bandwidth limits also do not apply to traffic between sources and destinations within the same network.

Creating a Policy Manually

Instant On supports the manual policy creation process for sites, serving as a simplified alternative for users.

The following procedure describes how to create a policy:

  1. Under Policies > Overview, click Create Policy.
  2. The Set Rule and Conditions page, select Action.
  3. Select the Source for the rule and choose the specific networks, clients, or IP addresses it applies to
  4. If the action requires a destination, under To Access, select the destination and its specific values.
  5. (Optional) Under Policy Options, enable Selected Protocols, Bandwidth Limits, or Traffic Priority and configure them.
  6. Click Next.

    The Set Policy Applicability page is displayed.

  7. On the Set Policy Applicability page, enter a Name for the policy and set its priority by positioning it lower or higher relative to an existing policy.
  8. Under Schedule, select Always Active, choose an existing schedule, or create a new schedule. See Schedules.
  9. Click Create Policy.

Examples

The following examples illustrate a few of the many possible policies. The selected action determines the available sources, destinations, and options.

Make a network available only during business hours — Choose the Enable action, select the wireless networks to control, and assign a business-hours schedule. The networks are broadcast only while the schedule is active. Use Disable to make networks unavailable during a schedule.

Block an application category on selected networks — Choose the Block action, select the wireless networks as the source, and choose one or more application categories as the destination.

Forward an external port to an internal server — Choose the Forward action, select the WAN source (Internet or a specific WAN IP), the protocol and WAN port, and the LAN IP address and port that receive the traffic.

Allow only specific sources to reach a destination — Choose the Restrict action, select the source IP subnets or addresses (or networks), and the destination they are permitted to reach.