Extreme Networks EPICenter 5.0, Manual

Page: 149 / 208

Policy Types
EPICenter Concepts and Solutions Guide 149
Policy Types
The EPICenter Policy Manager supports four types of policies: Access-based Security QoS policies, IP
QoS (Access List) policies, Source Physical Port QoS policies, and VLAN QoS policies. These policies
assign QoS profiles to traffic flows that are identified based on dynamically determined destination
port, IP-based endpoint addressing information, physical port of origin, or VLAN origin. This release of
the EPICenter Policy Manager does not support policies for traffic based on MAC address destination
information or on explicit class of service (802.1P and DiffServ) information.
ExtremeWare versions 5.0 or later support IP, VLAN and source port types. Only ExtremeWare 7.0
supports Security policies. ExtremeWare versions prior to 5.0 support only VLAN-based QoS. Thus,
although the Policy Manager supports IP, Access-based Security, and Source Port policies, non-
i- series
devices will not be able to use those policies unless they are running ExtremeWare version 5.0. The
Policy Manager will not attempt to configure policies on devices that cannot support them.
In the EPICenter Policy Manager, each policy type acts somewhat like a template, allowing you to
specify only components that are valid for the policy type. For example, the Policy Manager expects you
to enter two sets of endpoints for a Security or an IP policy, but only a single set of endpoints for a
VLAN or Source Port policy. In addition, the Policy Manager will only show endpoints of valid types in
the Select Policy Traffic list in the Edit Policy, Network Resource, Server, Clients or Users Endpoints
windows.
Access-based Security Policies
Access-based Security Policies represent a new policy type similar to IP policies. They are dynamic
policies which are designed and typically implemented at the edge of the network to enforce user based
security on an IP basis whenever and wherever the user connects. The principal difference is that the
ACL rules associated with the policy are dynamically applied to and removed from the network in
response to network login and 802.1x login and logout events. The IP addresses are static in nature and
determined by the network resources. The device port the user logs on dynamically determines the user
IP addresses. In addition, unlike IP policies, security policies are applied only on the device through
which the user logged on. These policies operate in concert with the currently defined static policies
and other access-based security policies and share the same precedence properties.
You use Access-based Security policies for a number of important reasons. One primary function of
these policies is to protect core network resources by controlling and enforcing security for user access
at the point of entry to the network (e.g. edge network devices). Additionally, these policies allow you
to augment the basic yes/no security provided by Netlogin with a finer grain control of access levels.
Users can be granted or denied access to certain areas of the network and users can be given different
service level guarantees by the use of different QoS profiles.
You also use Access-Based Security policies to grant various levels of service on a per user or user
group level. By using different QP assignments on a per user or user group basis in the access domain
of the security policy, each user receives a specific level of service on the edge device port. Static IP
policies should be defined in conjunction with dynamic user policies to establish a baseline security
access level and QoS level for all users. Typically, these static IP policies would be used to deny access
to sensitive network resources and/or to provide a base level quality of service. These static IP policies
should have lower precedence than the dynamic user based security policies to allow the dynamic user
based security policies to override the static IP policies on a per user basis.
Access-based Security policies are implemented with dynamic ACL allocation/deallocation on a per
edge device port basis by the policy server based on current users on the network. The ACL rules are
only applied to the single edge device port in the access domain on demand upon user network login