Extreme Networks EPICenter 5.0, Руководство пользователя

Страница: 151 / 208

Policy Types
EPICenter Concepts and Solutions Guide 151
Figure 66: Access-based QoS policy
An Access-based Security policy specifies traffic flow between two endpoints, one of which is
dynamically determined when the user logs in on the network. The policy is applied only at the entry
point to the system and does not need to be specified on each possible internal device that might be in
the path for that policy. This reduces the policy load on the rest of the system. On the contrary, for an IP
policy, the policy must be specified on each intermediate device in the path between the endpoints.
The EPICenter Policy Manager lets you specify the policy traffic flow in terms of named components.
Therefore, you can specify server “Iceberg” as the server endpoint, and users “A,” “B,” and “C” as user
endpoints. In addition, you can indicate that the traffic from the server should be filtered only to
include traffic generated by the Baan application, which translates to TCP traffic originating from L4
port 512. Ports are not specified for the users.
More details of the traffic flow can be seen in the following sections.
IP-Based Policies (Access List Policies)
An IP-based policy identifies IP traffic flowing between specific source and destination endpoints, and
then assigns that traffic to a QoS profile. For IP QoS, the traffic of interest is identified using any
combination of IP source and destination addresses, layer 4 protocol, and layer 4 (L4) port information.
In the EPICenter Policy Manager, the endpoints of the traffic flow are defined as one or more servers
and clients. The EPICenter Policy Manager lets you specify the endpoints using named resources such
as user names or host names, or groups that include such resources, as long as they can be mapped to