Extreme Networks ExtremeWare 7.5, Command Reference Manual

Page: 827 / 2546

ExtremeWare 7.5 Command Reference Guide 827
11
Security Commands
This chapter describes commands for:
• Creating and configuring routing access policies
• Creating and configuring IP access lists
• Creating and configuring route maps (“ i ” series switches only)
• Managing MAC address access to the switch
• Managing the switch using SSH2
• Setting up switch user authentication through a RADIUS client
• Setting up switch user authentication through
• Protecting the switch from denial of service (DoS) attacks
• Configuring network login
• Configuring Trusted MAC or OUI configuration
• Configuring secure access for all wired and wireless stations through Unified Access™ Security
Controlling Access
Access policies are a generalized category of features that affect forwarding and route forwarding
decisions. Access policies are used primarily for security and quality of service (QoS) purposes.
IP access lists (also referred to as access lists or ACLs) consist of IP access rules. They are used to
perform packet filtering and forwarding decisions on incoming traffic. Each packet arriving on an
ingress port is compared to the access list in sequential order and is either forwarded to a specified QoS
profile or dropped. Using access lists has no impact on switch performance.
Access lists are typically applied to traffic that crosses layer 3 router boundaries, but it is possible to use
access lists within a layer 2 VLAN. Extreme products are capable of performing this function with no
additional configuration.
Routing access policies are used to control the advertisement or recognition of routing protocols, such as
RIP, OSPF, IS-IS, or BGP. (IS-IS and BGP are supported only on “ i ” series switches.) Routing access
policies can be used to “hide” entire networks or to trust only specific sources for routes or ranges of
routes. The capabilities of routing access policies are specific to the type of routing protocol involved,
but are sometimes more efficient and easier to implement than access lists.