avaya数据产品PPT课件.ppt

0,EthernetRoutingSwitch8300v4.2ProductKnowledgeTransfer,January12,2009,1,Non-DisclosureAgreement,NORTELCONFIDENTIALTheinformationcontainedhereinisthepropertyofNortelandisstrictlyconfidential.ExceptasexpresslyauthorizedinwritingbyNortel,theholdershallkeepallinformationcontainedhereinconfidential,shalldiscloseitonlytoitsemployeeswithaneedtoknow,andshallprotectit,inwholeorinpart,fromdisclosureanddisseminationtothirdpartieswiththesamedegreeofcareitusestoprotectitsownconfidentialinformation,butwithnolessthanreasonablecare.ExceptasexpresslyauthorizedinwritingbyNortel,theholderisgrantednorightstousetheinformationcontainedherein.Theinformationcontainedhereinisforward-lookingandmaybesubjecttochange.,2,8300v4.2FeatureOverview,RichardMcGovern8300ProductBrandManager,3,ERS8300v4.2SoftwareFeatures,iBGP-Lite,IPFIX,IGMPv3Snoop,DHCP-snooping,IPSourceGuard,DynamicARPInspection,BPDU-Filtering,IPSpoofingDetection,VLACPEnhancement,InReleasev4.2,onlyBGP-LiteneedAdvancelicense,othersareBasiclicense,Notes:ForDHCP-snooping/IPSG/DAI,oftencalledSecurityFeatures,4,ERS8300v4.2SoftwareOverview-iBGP-Lite,FeatureIntroduceBGPisaninter-domainroutingprotocolthatprovidesloop-freeroutinginformation.BasedonTCP,twopeerroutersformBGPneighborandexchangeroutinginformation.BGPusesthisinformationtoconstructagraphofnetworkconnectivityBGPexchangeinter-domainroutinginformationbetweenautonomoussystems(ASs)orwithinanAS.RoutersthataremembersofthesameASandexchangeBGPupdatesruninternalBGP(iBGP),androutersthataremembersofdifferentASsandexchangeBGPupdatesrunexternalBGP(eBGP)ERS8300v4.2willnotfullysupportallBGPfunctions.Instead,onlyiBGPandthefollowingrelatedBGPfunctionswillbeimplementedinthisreleaseiBGPBGPRouteReflectorBGPAggregationBGPRedistributionBGPECMP,5,ERS8300v4.2SoftwareOverview-iBGP-Lite,FeatureLimitationOnlysupportson256MMemoryCPcards8393SF256M8394SF256MOnlysupportsinGRT(VRF0)AllI/OcardscansupportBGPfunctionFeatureScalingability4BGPneighbors8KBGProuters,6,AS10,ERS8300v4.2SoftwareOverview-BGP-Lite,FeatureApplication,IBGP,IBGP,IBGP,IBGP,iBGP,iBGP,AS200,AS100,7,ERS8300v4.2SoftwareOverview-iBGP-Lite,FeatureConfigurationCommandLine:#configipbgplocal-as#configipbgpenable#configipbgpneighborcreate#configipbgpneighborremote-as#configipbgpneighboradmin-state#configipbgprestart#showipbgpsummary#showipbgpneighborinfoJDM:(Menu:IP-BGP),8,ERS8300v4.2SoftwareOverview-IPFix,FeatureIntroduceIPFix-IPFlowInformationeXportItallowsmonitoringofIPflows.AnIPflowisdefinedasasetofpacketsoveraperiodoftimethathassomecommonproperties.IPFixcaptureandmeterthetrafficflowaccordingfieldsfollowed:SourceIPaddress,DestinationIPaddress,ProtocolType,SourceprotocolPort,DestinationprotocolPort,ingressVLANIDandingressPortTheflowinformationcanalsobeexportedperiodicallytoanythirdpartyIPFixcompliantCollector(s)SupportisforNetflowtrackerversion9onlyAllCPandI/OcardscansupportthisfeatureOperationdocumentedaspartofPerformanceManagementusermanualFeatureLimitationAnyIPFixenabledslot(CPorIO)willnotsupportportmirroring;ifportmirroringisalreadyenabledforanyportonanyslot,IPFixwillnotbeabletobeenabledforthatsameslot.Aswell,ifIPFixisenabledforanIOslotorslave/standbyCPslot,portmirroringonMasterCPslotisnotsupportedDoesnotsupportlocalcollectorDoesnotsupportMD5encryptionbetweenexportersandcollectorsSupportforonlyUDPprotocolbetweenERS8300andcollectors,IPFIXwillbeautomaticallydisabledifCPUutilitygreatthan90%orifMemoryislessthan2M.IPFixwillautomaticallyenabledagainifCPUutilityreturnstolessthan50%orMemorymorethan5M;thisbehaviorwillnotaffectanyconfigurationforIPFix,9,ERS8300v4.2SoftwareOverview-IPFIX,FeatureApplication,ERS8600,ERS8600,SMLTSquare,ERSxxxx,ERS8300,ERS8300,ERS8300,ERS8300,IPFIX,IPFIX,IPFIX,IPFIX,IPFIX,IPFIX,10,ERS8300v4.2SoftwareOverview-IPFix,FeatureConfigurationCommandLine:#configipipfixstate#configipipfixportall-traffic#showipipfixflowsJDM:(Menu:Serviceability-IPFIX),11,ERS8300v4.2SoftwareOverview-IGMPv3,FeatureIntroduceForERS8300,uponreceivingIS_INorALLOW,aL2MACforwardingentrywillbecreatedforthatport,thenthemulticasttrafficwillbeforwardedonlytothoseportsthatareinterestedinthegroup.IGMPv3SnoopisworkingontheconditionthatSSMSnoopisenabledontheinterface,andonlyprocessesthegroupinSSMrange.SSMSnoopwillbeenabledbydefaultwhentheversionofIGMPSnoopInterfaceissetto3SupportthebackwardcompatibilityforIGMPv1/v2packetprocessingonIGMPv3SnoopInterface.ThatstosayIGMPv1/v2hostandIGMPv3hostcancoexistinthesameIGMPv3SnoopInterfacePeriodicalgenericv3querywillbesentoutwhenL2Querierisenabled,andgroup-and-sourcespecificquerywillbesentoutuponreceivingBLOCKreportFeatureLimitationForIGMPv3packet,onlygroupinSSMrangeisprocessedbyIGMPv3Snoop.OnlyIS_IN,ALLOWandBLOCKisprocessedonswitch,otherreporttypesarejustforwardedtomulticastrouter.Onegroupcanbemappedtoonlyonesource,butonesourcecanbemappedtomultiplegroupsIncompatiblemode,ifIGMPv1/v2hostwantstojoinagroupinSSMrange,thisgroupmustbeastaticentryinSSMchanneltableThemaximumnumberofIGMPgroupsis2000AllCPandI/Ocardscansupportthisfeature,12,ERS8300v4.2SoftwareOverview-IGMPv3,FeatureApplication,13,ERS8300v4.2SoftwareOverview-IGMPv3,FeatureConfigurationCommandLine:#configvlanipigmpsnoop#configvlanipigmpversion#configvlanipigmpcompatibility-modeenableJDM:(Menu:VLAN-VLANs-IP),14,ERS8300v4.2SoftwareOverview-SecurityFeatures,FeatureIntroduceDHCP(DynamicHostConfigurationProtocol)snoopingisasecurityfeaturethatprovidesnetworksecuritybyfilteringun-trustedDHCPmessagestoeliminatetheattackersabilitytorespondtoDHCPrequestswithbogusIPinformation.BybuildingandmaintainingaDHCPbindingtableanddroppingun-matchedDHCPrequestpacket,DHCPsnoopingalsoprovidesthesecurityagainsttheDenial-Of-Service(DoS)attacksthatarelaunchedusingtheDHCPrequestmessagesIPSourceGuardisaperportfeatureandisusedtopreventIPspoofingbyonlyallowingIPaddressesobtainedthroughDHCPSnooping.WhenaconnectingclientreceivesavalidIPfromtheDHCPserver,afilterisinstalledontheporttoonlyallowtrafficfromtheassignedIPaddressDynamicARPinspectiondeterminesthevalidityofanARPpacketbasedonvalidIP-to-MACaddressbindingsstoredintheDHCPsnoopingbindingtable.ThistablewasbuiltbyDHCPsnoopingwhenitisenabledontheVLANsandontheswitch.IftheARPpacketisreceivedonatrustedinterface,theswitchforwardsthepacketwithoutanychecks.IftheARPpacketisreceivedonun-trustedinterfaces,theswitchforwardsthepacketonlyifitisvalid.Bydefault,Vlansarearp-inspectiondisableandallportsinvlanarearp-inspectionun-trusted,15,FeatureLimitationDHCP-SnoopingNSNAandDHCPSnoopingcannotbeenabledonthesameportDHCPSnoopingcannotbeenabledonanyportforwhichafilterhasbeenconfigured;anyportwithafilterconfigured,cannotbeenabledforDHCPSnoopingSavingofDHCPbindingtableacrossrebootsisnotsupportAdditionofstaticDHCPsnoopingentriesintobindingtableisnotsupportedThesizeofDHCPSnoopingBindingTableis512AllCPandI/OcardscansupportthisfeatureDynamicARPInspectionCannotbeenabledwhenNSNAhasbeenenabledonthesameportPorthasafilterloadedoncannotbeenabledARPInspectionAllCPandI/OcardscansupportthisfeatureIPSourceGuardRequiresDHCP-Snoopingenabled,GlobalandVLAN,andDynamicARPInspectionenabled,atVLAN,tofunctionandportsettingmustbesettountrustIPSourceGuardcannotbeenabledifNSNAhasbeenenabledonthesameportIPSourceGuardcannotbeenablediftheporthasanyfilterconfiguredOnly10IPentriescanbeappliedperun-trustedportAllCPandI/Ocardscansupportthisfeature,ERS8300v4.2SoftwareOverview-SecurityFeatures,16,FeatureApplication,ERS8300v4.2SoftwareOverview-SecurityFeatures,SecurityFeatures,SecurityFeatures,17,ERS8300v4.2SoftwareOverview-SecurityFeatures,FeatureConfigurationCommandLine:DHCP-snooping#configipdhcp-snooping#configipdhcp-snoopingvlan#configipdhcp-snoopingport#showipdhcp-snoopingbindingIPSourceGuard#configipsource-guardport#showipsource-guardbindingportsDynamicARPInspection#configiparp-inspectionvlan#configiparp-inspectionport#showiparp-inspectionvlan#showiparp-inspectionports,18,ERS8300v4.2SoftwareOverview-SecurityFeatures,FeatureConfiguration(Cont.)JDM:(Menu:IP-DHCP),19,ERS8300v4.2SoftwareOverview-BPDU-Filtering,FeatureIntroduceBPDU-FilteringisanenhancementforSTP.Thisfeatureallowstoachievethefollowingobjectives:BlocktheunwantedRootselectionprocesswhenanedgedevice,suchasalaptoprunningLinuxwithSTPon,isaddedtothenetwork.ThiswouldpreventunknowndevicesfrominfluencinganexistingSpanningTreeTopologyBlocktheBPDUfloodingoftheswitchfromanunknowndeviceBPDUfilteringisafeaturethatwhenenabledataportlevel,willeithershutdownaportforaspecifictimeperiodorforeverwhenitreceivesaSpanningTreeBPDU.Foralluseraccessports,itisrecommendedtoenableSpanningTreeFastStartinadditiontoBPDUfiltering.Ifyouselecttoshutdowntheportforever,manualinterventionisrequiredtobringtheportbackupbydisablingandthenre-enablingtheportstateFeatureLimitationNotsupportedonMLT/LACPportsAllCPandI/Ocardscansupportthisfeature,20,ERS8300v4.2SoftwareOverview-BPDU-Filtering,FeatureApplication,BPDU-FilteringFastStart,BPDU-FilteringFastStart,21,ERS8300v4.2SoftwareOverview-BPDU-Filtering,FeatureConfigurationCommandLine:#configetherbpdu-filter|#showbpdu-filterJDM:,22,ERS8300v4.2SoftwareOverview-IPSpoofingDetection,FeatureIntroduceIP-SpoofDetectionisanenhancementtotheIPsecurityinVLANarea.Withthisenhancement,usersarenowabletopreventVLANlogicalIPspoofingbydefiningthephysicalportsblockingtheusageofthisIPaddress.AconfigurableoptionisprovidedonaportbasiswhichwilldetectaduplicateIPaddressandblockanypacketto/fromthatMACaddressIfanARPpacketisreceivedhavingthesamesourceIPaddressasthelogicalVLANIPaddress,allthetrafficcomingtoanyportoftheswitchinthatVLANwiththisMACaddressassource/destinationaddresswillbesilentlydiscardedinhardware.AfterdetectingaduplicateIPaddress,theswitchwillsendagratuitousARPtoletotherdevicesontheVLANknowaboutthecorrectMACaddressforthatIPaddress.AconfigurableglobaltimercanbespecifiedbytheuserafterwhichtheMACdiscardrecordwillbedeletedandonceagaintheswitchwillstartacceptingpacketsfromthatMACaddressFeatureLimitationOnlytriggeredbybroadcastARPrequestsfortheduplicateIPaddressThisfeaturecandetectspoofingofVRRPvirtualIPaddressesaswellasphysicalIPaddressassignedtoaVLANAllCPandI/Ocardscansupportthisfeature,23,ERS8300v4.2SoftwareOverview-IPSpoofingDetection,FeatureApplication,IPSD,IPSD,24,ERS8300v4.2SoftwareOverview-IPSp