Design Reference

High Secure mode
To ensure that VSP 4000 does not route packets with an illegal source address of 255.255.255.255
(RFC1812 Section 4.2.2.11 and RFC971 Section 3.2), you can enable High Secure mode.
By default, this feature is disabled. After you enable this flag, the feature applies to all ports.
For more information about High Secure mode, see Security for Avaya Virtual Services Platform
4000 Series, NN46251-601.
Data plane security
Data plane security mechanisms include the Extended Authentication Protocol (EAP) 802.1x,
VLANs, filters, routing policies, and routing protocol protection.
To protect the network from inside threats, the switch supports the 802.1x standard.
EAP separates user authentication from device authentication.
If you enable EAP, end-users must securely log on to the network before they can obtain access to
a resource.
Interaction between 802.1x and Optivity Policy Server v4.0
User-based networking links EAP authorization to individual user-based security policies based on
individual policies. As a result, network managers can define corporate policies and configure them
on an individual port basis. This configuration provides additional security based on a logon and
password.
The Avaya Optivity Policy Server supports 802.1x EAP authentication against Remote
Authentication Dial-in User Service (RADIUS) and other authentication, authorization, and
accounting (AAA) repositories. This support authenticates the user, grants access to specific
applications, and provides real time policy provisioning capabilities to mitigate the penetration of
unsecured devices.
The following figure shows the interaction between 802.1x and Optivity Policy Server. First, the user
initiates a logon from a user access point and receives a request/identify request from the switch
(EAP access point). The user receives a network logon. Prior to Dynamic Host Configuration
Protocol (DHCP), the user does not have network access because the EAP access point port is in
EAP blocking mode. The user provides logon credentials to the EAP access point using the
Extensible Authentication Protocol Over LAN (EAPoL). The client PC is both a RADIUS peer user
and an EAP supplicant.
Data plane security
June 2015 Network Design Reference for Avaya VSP 4000 Series 151
Comments on this document? [e-mail]