Design Reference

You can also enable the spoof-detect feature on a port.
For more information about the spoof-detect feature, see Avaya Virtual Services Platform 4000
Configuration — VLANs and Spanning Tree, NN46251-500.
High Secure mode
To ensure that Virtual Services Platform 4000 does not route packets with an illegal source
address of 255.255.255.255 (RFC1812 Section 4.2.2.11 and RFC971 Section 3.2), you can
enable High Secure mode.
By default, this feature is disabled. After you enable this flag, the feature applies to all ports.
For more information about hsecure, see Avaya Virtual Services Platform 4000 Security,
NN46251-601.
Data plane security
Data plane security mechanisms include VLANs, filters, routing policies, and routing protocol
protection.
VLANs and traffic isolation
You can use Virtual Services Platform 4000 to build secure VLANs. If you configure port-based
VLANs, each VLAN is completely separate from the others. Virtual Services Platform 4000
supports the IEEE 802.1Q specification for tagging frames and coordinating VLANs across
multiple switches.
Virtual Services Platform 4000 analyzes each packet independently of preceding packets. This
mode, as opposed to the cache mode that other vendors use, allows complete traffic
isolation.
For more information about VLANs, see Avaya Virtual Services Platform 4000 Configuration
— VLANs and Spanning Tree, NN46251-500.
Management of access policies
At Layer 2, Virtual Services Platform 4000 provides the following security mechanisms:
• access policies
If you enable access policies globally, the system creates a default policy (1) that allows
File Transfer Protocol (FTP), Hypertext Transfer Protocol (HTTP), Telnet, and Secure
Shell (SSH). If you enable access policies globally but disable the default policy, the
system denies FTP, HTTP, rlogin, SSH, Simple Network Management Protocol (SNMP),
Telnet, and Trivial FTP (TFTP).
The access-strict parameter ties to the accesslevel parameter. If you enable
access-strict, the access policy looks at the accesslevel parameter, and only
applies to that access level. Use the following configuration as an example:
VSP-9012:1(config)#show access-policy
AccessPolicyEnable: off
System and network stability and security
122 Network Design Reference for Avaya VSP 4000 February 2014
Comments? [e-mail]