Design Reference

Figure 74: 802.1x and OPS interaction
Virtual Services Platform 4000 includes software support for the Preside (Funk) and Microsoft IAS
RADIUS servers. Additional RADIUS servers that support the EAP standard are also compatible
with Virtual Services Platform 4000. For more information, contact your Avaya representative.
802.1x and the LAN Enforcer or Avaya Health Agent
The Sygate LAN Enforcer or the Avaya Health Agent enables Virtual Services Platform 4000 to use
the 802.1x standard to ensure that a user who connects from inside a corporate network is
legitimate. The LAN Enforcer or Health Agent also checks the endpoint security posture, including
anti-virus, firewall definitions, Windows registry content, and specific file content (plus date and
size). Noncompliant systems that attempt to obtain switch authentication can be placed in a
remediation VLAN, where updates can be pushed to the internal user, and users can subsequently
attempt to join the network again.
VLANs and traffic isolation
You can use Avaya Virtual Services Platform 4000 Series to build secure VLANs. If you configure
port-based VLANs, each VLAN is completely separate from the others. VSP 4000 supports the
IEEE 802.1Q specification for tagging frames and coordinating VLANs across multiple switches.
VSP 4000 analyzes each packet independently of preceding packets. This mode, as opposed to the
cache mode that other vendors use, allows complete traffic isolation.
For more information about VLANs, see Configuring VLANs and Spanning Tree on Avaya Virtual
Services Platform 4000 Series, NN46251-500.
Management of access policies
At Layer 2, VSP 4000 provides the following security mechanisms:
• Access policies
If you enable access policies globally, the system creates a default policy (1) that allows File
Transfer Protocol (FTP), Hypertext Transfer Protocol (HTTP), Telnet, and Secure Shell (SSH).
If you enable access policies globally but disable the default policy, the system denies FTP,
HTTP, rlogin, SSH, Simple Network Management Protocol (SNMP), Telnet, and Trivial FTP
(TFTP).
System and network stability and security
152 Network Design Reference for Avaya VSP 4000 Series June 2015
Comments on this document? [e-mail]