Design Reference

Enhanced secure mode
If you enable enhanced secure mode, the system can provide role-based access levels, strong
password requirements, and strong rules on password length, password complexity, password
change intervals, password reuse, and password maximum age use. For more information, see
Administration for Avaya Virtual Services Platform 4000 Series, NN46251-600.
Security and access policies
Access policies permit secure switch access by specifying a list of IP addresses or subnets that can
manage the switch for a specific daemon, such as Telnet, SNMP, HTTP, SSHv2, TFTP, FTP, RSH,
and rlogin. Rather than using a management VLAN that is spread out among all of the switches in
the network, you can build a full Layer 3 routed network and securely manage the switch with one of
the in-band IP addresses attached to one of the VLANs (see the following figure).
Figure 77: Access levels
Avaya recommends that you use access policies for in-band management to secure access to the
switch. By default, all services are denied. You must enable the default policy or enable a custom
policy to provide access. A lower precedence takes higher priority if you use multiple policies.
Preference 120 has priority over preference 128.
RADIUS authentication
You can enforce access control by using Remote Authentication Dial-in User Service (RADIUS).
RADIUS provides a high degree of security against unauthorized access and centralizes the
knowledge of security access based on a client and server architecture. The database within the
RADIUS server stores pertinent information about clients, users, passwords, and access privileges
including the use of the shared secret.
When the switch acts as a Network Access Server, it operates as a RADIUS client. The switch is
responsible for passing user information to the designated RADIUS servers. Because the switch
operates in a LAN environment, it allows user access through Telnet, rlogin, and console logon.
You can configure a list of up to 10 RADIUS servers on the switch. If the first server is unavailable,
VSP 4000 tries the second, and so on, until it establishes a successful connection.
Control plane security
June 2015 Network Design Reference for Avaya VSP 4000 Series 157
Comments on this document? [e-mail]