Extreme Networks Policy Manager (EPM) 1.2 User Guide
9
1
Overview
Introduction
This chapter describes the following sections:
●
Description of the Extreme Networks Policy Manager on page 9
●
About This Manual on page 10
●
Editions of the EPM on page 10
Description of the Extreme Networks Policy Manager
The Extreme Networks Policy Manager (EPM) is a client application for the configuration and
management of Access Control Lists (ACLs) and Continuous Learning, Examination, Action and
Reporting of Flows (CLEAR-Flow or CF) on EXOS-based Extreme Networks switches. It is a GUI-based
software download designed to simplify the management process.
ACLs are used to perform packet filtering and forwarding decisions on traffic traversing the switch.
Each packet arriving on an ingress port and/or VLAN is compared to the access list applied to that
interface and is either permitted or denied. ACLs are typically applied to traffic that crosses Layer 3
router boundaries, but is possible to use access lists within a Layer 2 virtual LAN (VLAN).
CLEAR-Flow is an extension to ACLs that implements security, monitoring, and anomaly detection in
Extreme XOS software. ACL policy rules are created to count packets of interest. CLEAR-Flow rules are
added to the policy to monitor the ACL counter statistics for situations of interest in the individual
network. Such situations can include: the cumulative value of a counter; the change to a counter over a
sampling interval; the ratio of two counters; or even the ratio of the changes of two counters over an
interval. For example, monitoring the ratio between TCP SYN and TCP packets might show an
abnormally large ratio which may indicate a SYN attack.
The counters used in CLEAR-Flow are either defined by the user in an ACL entry, or can be a
predefined counter. Refer to a list and description of these counters in Appendix A
on page 63
.
If the rule conditions are met, the CLEAR-Flow actions configured in the rule are executed. The switch
can respond by modifying an ACL that will block, prioritize, or mirror the traffic, executing a set of CLI
commands, or sending a report using a SNMP trap or EMS log message.
For additional information about ACLs or CLEAR-Flow refer to the
ExtremeXOS Concepts Guide.
