Design Reference
Table Of Contents
- Contents
- Chapter 1: Introduction
- Chapter 2: New in this release
- Chapter 3: Network design fundamentals
- Chapter 4: Hardware fundamentals and guidelines
- Chapter 5: Optical routing design
- Chapter 6: Platform redundancy
- Chapter 7: Link redundancy
- Chapter 8: Layer 2 loop prevention
- Chapter 9: Layer 2 switch clustering and SMLT
- Chapter 10: Layer 3 switch clustering and RSMLT
- Chapter 11: Layer 3 switch clustering and multicast SMLT
- Chapter 12: Spanning tree
- Chapter 13: Layer 3 network design
- Chapter 14: SPBM design guidelines
- Chapter 15: IP multicast network design
- Multicast and VRF-Lite
- Multicast and MultiLink Trunking considerations
- Multicast scalability design rules
- IP multicast address range restrictions
- Multicast MAC address mapping considerations
- Dynamic multicast configuration changes
- IGMPv3 backward compatibility
- IGMP Layer 2 Querier
- TTL in IP multicast packets
- Multicast MAC filtering
- Guidelines for multicast access policies
- Split-subnet and multicast
- Protocol Independent Multicast-Sparse Mode guidelines
- Protocol Independent Multicast-Source Specific Multicast guidelines
- Multicast for multimedia
- Chapter 16: System and network stability and security
- Chapter 17: QoS design guidelines
- Chapter 18: Layer 1, 2, and 3 design examples
- Glossary
The access-strict parameter ties to the accesslevel parameter. If you enable access-
strict, the access policy looks at the accesslevel parameter, and only applies to that
access level. Use the following configuration as an example:
VSP-9012:1(config)#show access-policy
AccessPolicyEnable: off
Id: 1
Name: default
PolicyEnable: false
Mode: allow
Service: ftp|http|telnet|ssh
Precedence: 128
NetAddrType: any
NetAddr: N/A
NetMask: N/A
TrustedHostAddr: N/A
TrustedHostUserName: none
AccessLevel: readOnly
AccessStrict: false
Usage: 0
If you disable access-strict (false), the policy looks at the value for accesslevel, and
then the system applies the policy to anyone with equivalent rights or higher. In this example,
all levels include read-only so the default policy applies to l1, l2, l3, rw, ro, and rwa. If you
enable access-strict, the system applies the policy only to ro.
Note:
If you configure the access policy mode to deny, the system checks the mode and service,
and if they match the system denies the connection. With the access policy mode
configured to deny, the system does not check accesslevel or access-strict
information. If you configure the access policy mode to allow, the system continues to
check the accesslevel and access-strict information.
For SNMP and access policies, you must apply the service to the access policy. The only
choice is SNMPv3 but this parameter applies to all versions of SNMP. The additional command
access-policy <1–65535> snmp-group WORD<1–32> <snmpv1|snmpv2|usm>
applies the policy to the SNMP community or the SNMP group.
Note:
If you enable enhanced secure mode, the system can provide role-based access levels,
strong password requirements, and strong rules on password length, password complexity,
password change intervals, password reuse, and password maximum age use. For more
information, see Administration for Avaya Virtual Services Platform 4000 Series,
NN46251-600.
• Filters
ACL filters are used by individual VLANs to filter out packets based on source MAC,
destination MAC and other criteria.
For more information about these filters, see Configuration - QoS and ACL-Based Traffic
Filtering Avaya Virtual Services Platform 4000 Series, NN46251-502.
• Limited MAC learning
Data plane security
June 2015 Network Design Reference for Avaya VSP 4000 Series 153
Comments on this document? infodev@avaya.com