Design Reference

Routing protocol security
You can protect OSPF and BGP updates with a Message Digest 5 (MD5) key on each interface.
At most, you can configure two MD5 keys for each interface. You can also use multiple MD5
key configurations for MD5 transitions without bringing down an interface.
For more information, see Avaya Virtual Services Platform 4000 Configuration — OSPF and
RIP, NN46251-506 and Avaya Virtual Services Platform 4000 Configuration — BGP
Services, NN46251-507.
Control plane security
The control plane physically separates management traffic using the in-band interface. The
control plane facilitates High Secure mode, access policies, authentication, SSH and Secure
Copy, and SNMP.
High Secure mode
Use High Secure to disable all unsecured applications and daemons, for example, FTP, TFTP,
and rlogin. Avaya strongly recommends that you do not use unsecured protocols. See also
High Secure mode on page 122.
Use Secure Copy (SCP) rather than FTP or TFTP.
Security and access policies
Access policies permit secure switch access by specifying a list of IP addresses or subnets
that can manage the switch for a specific daemon, such as Telnet, SNMP, HTTP, SSH, TFTP,
FTP, RSH, and rlogin. Rather than using a management VLAN that is spread out among all
of the switches in the network, you can build a full Layer 3 routed network and securely manage
the switch with one of the in-band IP addresses attached to one of the VLANs (see the following
figure).
You can use route policies to selectively accept or announce some networks and to block the
propagation of some routes. Route policies enhance the security in a network by hiding the
visibility of some networks (subnets) from other parts of the network.
You can apply one policy for one purpose. For example, you can apply a RIP announce policy
on a given RIP interface. In such cases, all sequence numbers under the given policy apply
to that filter. A sequence number also acts as an implicit preference (that is, a lower sequence
number is preferred).
System and network stability and security
124 Network Design Reference for Avaya VSP 4000 February 2014
Comments? [e-mail]