Design Reference

Encryption of control plane traffic
Control-plane traffic encryption involves Secure Shell (SSHv2), SFTP, and Simple Network
Management Protocol (SNMPv3).
Use SSH to conduct secure communications over a network between a server and a client. The
switch supports only the server mode (supply an external client to establish communication). The
server mode supports SSHv2. SSHv1 is not supported.
The SSH protocol offers:
• Authentication—SSHv2 determines identities. During the logon process, the SSH client asks
for digital proof of the identity of the user.
• Encryption—SSHv2 uses encryption algorithms to scramble data. This data is rendered
unintelligible except to the intended receiver.
• Integrity—SSHv2 guarantees that data is transmitted from the sender to the receiver without
alteration. If a third party captures and modifies the traffic, SSH detects this alteration.
VSP 4000 supports:
• SSH version 2 with password and Digital Signature Algorithm (DSA) authentication. SSH
version 1 is not supported.
• Digital Encryption Standard (DES)
• Advanced Encryption Standard (AES)
SNMP header network address
You can direct an IP header to have the same source address as the management virtual IP
address for self-generated UDP packets. If you configure a management virtual IP address and
enable the udpsrc-by-vip flag, the network address in the SNMP header is always the
management virtual IP address. This configuration is true for all traps routed out on the I/O ports or
on the out-of-band management Ethernet port.
SNMPv3 support
SNMP version 1 and version 2 are not secure because communities are not encrypted.
Avaya strongly recommends that you use SNMP version 3. SNMPv3 provides stronger
authentication services and the encryption of data traffic for network management.
If you enable enhanced secure mode, the VSP switch does not support the default SNMPv1 and
default SNMPv2 community strings, and default SNMPv3 user name. The individual in the
administrator access level role can configure a non-default value for the community strings, and the
VSP switch can continue to support SNMPv1 and SNMPv2. The individual in the administrator
access level role can also configure a non-default value for the SNMPv3 user name and the VSP
switch can continue to support SNMPv3.
If you disable enhanced secure mode, the SNMPv1 and SNMPv2 support for community strings
remains the same, and the default SNMPv3 user name remains the same. Enhanced secure mode
is disabled by default.
Other security equipment
Avaya offers other devices that increase the security of your network.
For sophisticated state-aware packet filtering (real stateful inspection), you can add an external
firewall to the architecture. State-aware firewalls can recognize and track application flows that use
Control plane security
June 2015 Network Design Reference for Avaya VSP 4000 Series 159
Comments on this document? [e-mail]