Design Reference

Prioritization of control traffic
VSP 4000 uses a sophisticated prioritization scheme to schedule control packets on physical ports.
This scheme involves two levels with both hardware and software queues to guarantee proper
handling of control packets regardless of the switch load. In turn, this scheme guarantees the
stability of the network. Prioritization also guarantees that applications that use many broadcasts are
handled with lower priority.
You cannot view, configure, or modify control-traffic queues.
ARP request threshold recommendations
The Address Resolution Protocol (ARP) request threshold defines the maximum number of
outstanding unresolved ARP requests. The default value for this function is 500 ARP requests. To
avoid excessive amounts of subnet scanning that a virus can cause, Avaya recommends that you
change the ARP request threshold to a value between 100 and 50. This configuration protects the
CPU from causing excessive ARP requests, protects the network, and lessens the spread of the
virus to other PCs. The following list provides further recommended ARP threshold values:
• Default: 500
• Severe conditions: 50
• Continuous scanning conditions: 100
• Moderate: 200
• Relaxed: 500
For more information about how to configure the ARP threshold, see Configuration - IP Routing for
Avaya Virtual Services Platform 4000 Series, NN46251-505.
Multicast Learning Limitation
The Multicast Learning Limitation feature protects the CPU from multicast data packet bursts
generated by malicious applications. If more than a certain number of multicast streams enter the
CPU through a port during a sampling interval, the port is shut down until the user or administrator
takes the appropriate action.
For more information, see Configuring IP Multicast Routing Protocols on Avaya Virtual Services
Platform 4000 Series , NN46251–504.
Damage prevention
To further reduce the chance that unauthorized users can use your network to damage other
existing networks, take the following actions:
1. Prevent IP spoofing.
You can use the spoof-detect feature.
2. Prevent the use of the network as a broadcast amplification site.
3. To block illegal IP addresses, enable the hsecure flag (High Secure mode).
For more information, see Security for Avaya Virtual Services Platform 4000 Series,
NN46251-601.
Damage prevention
December 2014 Network Design Reference for Avaya VSP 4000 Series 115
Comments? [e-mail]