Design Reference

Chapter 13: System and network stability
and security
Use the information in this chapter to design and implement a secure network.
You must provide security mechanisms to prevent your network from attack. If links become
congested due to attacks, you can immediately halt end-user services. During the design phase,
study availability issues for each layer.
To provide additional network security, you can use the Avaya Virtual Services Platform 9000
or
your own high-performance stateful firewalls.
DoS protection mechanisms
Several internal mechanisms and features protect Avaya Virtual Services Platform 4000 Series
against Denial-of-Service (DoS) attacks.
Broadcast and multicast rate limiting
To protect the switch and other devices from excessive broadcast traffic, you can use broadcast and
multicast rate limiting on an individual-port basis.
For more information about how to configure the rate limits for broadcast or multicast packets on a
port, see Configuration - QoS and ACL-Based Traffic Filtering Avaya Virtual Services Platform 4000
Series, NN46251-502.
Directed broadcast suppression
You can enable or disable forwarding for directed broadcast traffic on an IP-interface basis. A
directed broadcast is a frame sent to the subnet broadcast address on a remote IP subnet. By
disabling or suppressing directed broadcasts on an interface, you cause all frames sent to the
subnet broadcast address for a local router interface to be dropped. Directed broadcast suppression
protects hosts from possible DoS attacks.
To prevent the flooding of other networks with DoS attacks, such as the Smurf attack, VSP 4000 is
protected by directed broadcast suppression. This feature is enabled by default. Avaya recommends
that you not disable it.
For more information about directed broadcast suppression, see Security for Avaya Virtual Services
Platform 4000 Series, NN46251-601.
116 Network Design Reference for Avaya VSP 4000 Series January 2015
Comments? [e-mail]