Brocade Mobility RFS Controller System Reference Guide (Supporting software release 5.5.0.0 and later) - Manual (Page 517)

Brocade Mobility RFS Controller System Reference Guide 505
53-1003099-01
8
10. Select + Add Row to set IP address range settings for the Bridge NAT configuration.
FIGURE 83 Security Source Dynamic NAT screen
11. Select OK to save the changes made within the Add Row and Source Dynamic NAT screen.
Select Reset to revert to the last saved configuration.
Profile Security Configuration and Deployment Considerations
Profile Security Configuration
Before defining a profile’s security configuration, refer to the following deployment guidelines to
ensure the profile configuration is optimally effective:
• Make sure the contents of the certificate revocation list are periodically audited to ensure
revoked certificates remain quarantined or validated certificates are reinstated.
• A RFS4000 model wireless controller ships with a baseline configuration supporting
many-to-one NAT between devices connected to GE1 - GE5 ports on VLAN 1, and the UP1
port assigned to VLAN 2100. A RFS4000 can be deployed within a small site using its
default configuration, and then be connected to a Internet service providing instant access
to the Internet.
• NAT alone does not provide a firewall. If deploying NAT on a controller or service platform
profile, add a firewall on the profile to block undesirable traffic from being routed. For
outbound Internet access, a stateful firewall can be configured to deny all traffic. If port
address translation is required, a stateful firewall should be configured to only permit the
TCP or UDP ports being translated.
• A RFS6000 model wireless controller ships with a minimum baseline configuration without
NAT enabled. A RFS6000 wireless controller requires VLAN configuration, IP addressing
and NAT rules be created before many-to-one NAT services can be defined.