Specifications

Policy Configuration Example
May 18, 2009 Page 23 of 32
Basic Edge
Protocolsnotappropriatetotheedgeshouldbeblocked.ForthisexamplewewillblockDHCP,
DNS,SNMP,SSH,TelnetandFTPattheedgeonthedataVLAN.Wewillforwarddestinationport
DHCPandDNSandsourceportforIPaddressrequesttofacilitateautoconfigurationandIP
address
assignment.SeeBlockingNon‐EdgeProtocolsattheEdgeNetworkLayeronpage 11fora
listingofprotocolsyoushouldconsiderblockingattheedge.
Standard Edge
Platformssupportingstandardpolicywillberate‐limitedusingaconfiguredCoSthatwillbe
appliedtothestudentandfaculty,andphoneSSpolicyroles.Thoughlistedasanenhancedpolicy
feature,theSecureStackC3supportsthe hybridauthenticationenhancedpolicycapability.Hybrid
authenticationwillbeenabled.
Premium Edge
Platformssupportingenhancedpolicywillberate ‐limitedusingaconfiguredCoSthatisapplied
totheservicesandphoneN3policyrole.Thepremiumedgewillbeenabledforthefollowing
enhancedpolicycapabilities:
•PolicyAccounting
•Syslogruleusageenabledandsettomachine‐readable
•Invalidpolicyactionsettodrop
•TCIoverwrite
enabled
Premium Distribution
Thedistributionlayerswitchrouterwillberate‐limitedusingaconfiguredCoS.Premium
distributionwillbeenabledforthefollowingenhancedpolicycapabilities:
•PolicyAccounting
•SyslogRuleUsageenabledandsettomachine‐readable
•Invalidpolicyactionsettodrop
•TCIoverwriteenabled
Platform Configuration
ThissectionwillprovidetheCLIbasedpolicyconfigurationonthefollowingplatforms:
•StudentSecureStackC3
•FacultySecureStackC3
•ServicesN3
• DistributionSwitch
InCLImode,configurationtakesplaceoneachplatform.WhenusingtheNetSightPolicy
Manager,configurationtakesplaceatacentrallocationandispushedouttotheappropriate
network
devices.