Design Reference

This feature limits the number of forwarding database (FDB) entries learned on a particular port
to a user-specified value. After the number of learned FDB entries reaches the maximum limit,
the switch drops packets with unknown source MAC addresses.
Note:
The current release of the VSP 4000 allows you to enable limit-learning on a port and
configure the maximum number of MAC entries on this port.
VSP-switch(config-if)#mac-security limit-learning ?
enable Enable limit-learning on this port
max-addrs Set the maximum number of entries on this port
Security at Layer 3: filtering
At Layer 3 and higher, VSP 4000 provides enhanced filtering capabilities as part of its security
strategy to protect the network from different attacks.
VSP 4000 supports advanced filters based on Access Control Lists (ACL).
Customer Support Bulletins (CSBs) are available on the Avaya Technical Support website to
provide information and configuration examples about how to block some attacks.
Routing protocol security
You can protect OSPF and BGP updates with a Message Digest 5 (MD5) key on each interface. At
most, you can configure two MD5 keys for each interface. You can also use multiple MD5 key
configurations for MD5 transitions without bringing down an interface.
For more information, see Configuring OSPF and RIP on Avaya Virtual Services Platform 4000
Series, NN46251-506 and Configuring BGP on Avaya Virtual Services Platform 4000 Series,
NN46251-507.
Control plane security
The control plane physically separates management traffic using the in-band interface. The control
plane facilitates High Secure mode, management access control, access policies, authentication,
SSH and Secure Copy, and SNMP.
Management port
Avaya Virtual Services Platform 4000 Series requires one port to be configured as the management
port. This port separates user traffic from management traffic in highly sensitive environments, such
as brokerages and insurance agencies. By using this dedicated network (see
Figure 75: Dedicated
Ethernet management link on page 155) to manage the switch, and by configuring access policies
(if you enable routing), you can manage the switch in a secure fashion. You can also use terminal
servers to access the console port on the CP module (see Figure 76: Terminal server access on
page 155).
System and network stability and security
154 Network Design Reference for Avaya VSP 4000 Series June 2015
Comments on this document? [e-mail]