Avaya Inc.
– Proprietary & Confidential.
Use pursuant to the terms of your signed agreement or Avaya policy.
37
avaya.com
1.4.6 Adding User Based Policies (UBP) Option
The ERS 5500 and ERS 5600 both support User Based Policies (UBP) that can be used with
EAP or non-EAP MAC authentication. UBP filter sets can be configured locally on the switch and
applied upon an EAP Supplicant or non-EAP device successfully authenticating against a
RADIUS server. Once the EAP Supplicate or non-EAP device is authenticated by RADIUS, the
RADIUS server can be setup to send a RADIUS attribute for UBP. The RADIUS return attribute
for UBP is simply the UBP filter set name. This allows you to configure different UBP filter sets
and have RADIUS tell the switch what policy to apply based on the user or device credentials.
The following command is used to configure UBP:
ERS5520(config)#
qos ubp classifier name <Word 1..16 character string> ?
addr-type Specify the address type (IPv4, IPv6) classifier criteria
block Specify the label to identify access-list elements that are of
the same block
drop-action Specify the drop action
ds-field Specify the DSCP classifier criteria
dst-ip Specify the destination IP classifier criteria
dst-mac Specify the destination MAC classifier criteria
dst-port-min Specify the L4 destination port minimum value classifier
criteria
ethertype Specify the ethertype classifier criteria
eval-order Specify the evaluation order
flow-id Specify the IPv6 flow identifier classifier criteria
next-header Specify the IPv6 next header classifier criteria
priority Specify the user priority classifier criteria
protocol Specify the IPv4 protocol classifier criteria
set-drop-prec Specify the set drop precedence
src-ip Specify the source IP classifier criteria
src-mac Specify the source MAC classifier criteria
src-port-min Specify the L4 source port minimum value classifier criteria
update-1p Specify the update user priority
update-dscp Specify the update DSCP
vlan-min Specify the Vlan ID minimum value classifier criteria
vlan-tag Specify the vlan tag classifier criteria
<cr>
Assuming we wish to add UBP configuration to this example, please following the configuration
steps shown below.
1.4.6.1
ERS5520 Policy Configuration
Although any number of items can be configured for the policy, we will create two simply policies
to remark all traffic from the Philips VLAN with a DSCP value of 26 (Gold) and remark all traffic
from the Siemens VLAN with a DSCP value of 16 (Silver).
ERS5520-1 Step 1
– Configure a policy using the name „philips‟ and remark DSCP with a
DSCP value of 26. We will set the eval-order to 5 (value from 1-255) in case you wish to add
additional filters in the future with a higher preference.
5520-24T-1(config)#
qos ubp classifier name philips ethertype 0x0800 update-dscp
26 eval-order 5
ERS5520-1 Step 2
– Enable the UBP set
5520-24T-1(config)#
qos ubp set name philips
