Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS

Transcription

1 Enterprise Policy Manager - Device Management Guide Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS This guide contains information relating to the configuration of the Nortel Ethernet Switch 460 (formerly BayStack 460), Ethernet Switch 470 (formerly BayStack 470), and Business Policy Switch (BPS), to receive policy configuration from Nortel Enterprise Policy Manager (EPM). It also includes information on the devices compatibility with various policy management objects. This guide covers the following subjects:

2 2 Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS Nortel product rebranding on page 2 Nortel product rebranding on page 2 Configuring the device for policy management on page 3 Testing an Ethernet Switch or BPS device s policy configuration on page 5 Known device limitations for EPM 4.1 on page 6 Policy object - device compatibility on page 7 EPM access requirements on page 8 Hardware changes on a policy-enabled device on page 9 Accessing device documentation on page 9 BPS action limitations on page 10 Nortel product rebranding Nortel transitioned to new names for many of its products over the course of The transition simplifies product naming in order to make it easier for customers to understand the Nortel product and services portfolio. Table 1 lists the names of rebranded Nortel products mentioned in this publication. Table 1 Nortel product rebranding Products formerly knowm as... Optivity Policy Services (OPS) BayStack New Nortel Name Nortel Enterprise Policy Manager (EPM) Nortel Ethernet Switch Full details of the Nortel product rebranding process can be obtained from Supported software The EPM 4.1 release has been tested to support the BoSS 3.0, 3.1 software, as well as the BPS version 2.5 software. BoSS software is required to support UBP functionality. EPM 4.1 has been tested to support BoSS 3.6 for the Ethernet Switch 460 and Ethernet Switch

3 Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS 3 If you are working with a maintenance release in the EPM 4-series (i.e. post-4.1), it may have been tested against a newer version of the device software. To verify the absolute latest supported device software versions, refer to the Release Notes for Enterprise Policy Manager manual. Configuring the device for policy management In order for an Ethernet Switch 460, Ethernet Switch 470, or Business Policy Switch unit to receive policy configuration from EPM, the devices themselves must be configured to communicate with the EPM Policy Server. Detailed instructions for accomplishing this task are included below. Once this is completed, the devices will report to the EPM Policy Server and they will appear as icons in the management console. The roles they report are also displayed. Policy management can be initiated by associating a policy with the device s reported role(s). You must open the Web interface for the device and specify the address and port number of the EPM Policy Server. You can specify more than one Policy Server. You must also enable QoS configuration on the device and define its role combinations. You must know the IP address and COPS-PR Client Port values for your Policy Server. You can obtain these values by right-clicking the Policy Server object in the EPM management console and choosing Properties from the menu. To configure an Ethernet Switch or BPS unit to accept policy configuration, follow these steps: 1 Launch the Web interface for the device you want to configure. Open a Web browser and go to the IP address of the device. 2 In the Access list, navigate to the following location: Application > COPS > Configuration 3 In the COPS Client Creation area, do the following: a Type the IP address of your EPM Policy Server in the IP Address field. b Type the Policy Server COPS-PR Client Port number (specified in EPM) in the TCP Port field. The default value for this field is 3288.

4 4 Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS c Type a priority value in the Priority field. If you are specifying more than one Policy Server, the priority value sets the sequential order in which the client connects to the Policy Servers. d Click the Submit button below the COPS Client Creation area. An entry for the Policy Server is added to the COPS Configuration Table. e Repeat steps a through d to specify additional Policy Servers (if required). 4 In the Access list navigate to the following location: Application > QoS > QoS Advanced > Agent 5 In the QoS Configuration area, choose the Enabled option from the QoS Policy Server Control drop-down list. 6 Click the Submit button. 7 In the Access list navigate to the following location: Application > QoS > QoS Advanced > Devices > Interface Config 8 In the Interface Group Creation area, do the following: a Type a name for a role combination in the Role Combination field. Do not use spaces in role combination names. The role combination is a common identifier that is used to enforce a specific set of policies on specific network entities (for example, the print server, the Web server, employee workstations, etc.). EPM includes a set of preconfigured roles with policy objects linked to them. You can use these roles for test purposes. To find the names of these roles, open the Policy Setup view of the EPM management console. b Choose an interface class from the Interface Class drop-down list. Your choice of Trusted, Untrusted, or Unrestricted will depend on the type of policy actions that will be enforced on the network traffic controlled under the role combination. c Click the Submit button below the Group Creation area. The new interface group is added to the Interface Group table. d Click the Edit button next to the new entry in the Interface Group table. The QoS - Interface Group Port Assignment dialog box appears

5 Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS 5 e f Enable the check box for each port on the device that you want to include under the new role combination, and then click the Submit button. Repeat steps a through e to define additional role combinations. 9 Exit the device s Web interface. Testing an Ethernet Switch or BPS device s policy configuration In order to check the policy filters installed on your COPS-PR devices, you must meet the following requirements: You must have SNMP reporting enabled on your network devices. You must enter the SNMP string for each device on the device s corresponding object in the EPM management console. You must have the EMANATE SNMP master agent (available as a default EPM installation option) installed with your Policy Server. 1 In the Policy Setup view, drag a policy from the Available Policy Components tree to the role that is being reported by the device. Enable the policy from the Options menu. For example, you can choose the Mark WWW Traffic Best Effort During Lunch policy to match all Web traffic between 11:30 am and 1:30 pm. You can remove the schedule from the policy to make it active all of the time. 2 Click the Deploy Changes button on the toolbar to notify the Policy Server of your changes. 3 In the Device Setup view, right-click on the device and choose Show Device Report from the menu. 4 In the Device Report dialog box, click the Lookup button next to the Interface field and choose the interface for which you want to view installed policy filters. If the policy was correctly installed on the device, a list of traffic filters generated by the policy appears in the Filter Set list. If any traffic matching the filters has passed through the device, the number of affected packets appears under the Packets column for each filter.

6 6 Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS Known device limitations for EPM 4.1 Users should consider the following guidelines when creating policy configuration for the BPS or Ethernet Switch devices. If you are running a stack of cascaded Ethernet Switch devices, you can configure user-based policies on the stack ONLY if the stack consists entirely of COPS-PR compatible devices (Business Policy Switch, Ethernet Switch 460, and Ethernet Switch 470). If you are running a mixed stack that includes Ethernet Switch 450 devices, you will not be able to configure user-based policies on the stack. Maximum 24 roles per device. Maximum 200 IP traffic conditions per device. Maximum traffic conditions per device. Devices with limited memory may not be able to achieve the limitations stated above. The BPS 2.x series has a special limit of 24 traffic conditions that specify the same source IP address. To avoid device limitations Avoid assigning multiple traffic conditions with overlapping traffic criteria to a single policy. This will result in excessive numbers of policy filters being sent to the device. For example, do not assign two traffic conditions, each specifying the same port number, to the same policy. When creating a traffic condition, you should limit the number of different types of traffic flow criteria you specify. A traffic condition that specifies too many traffic criteria will, in turn, cause the policies to which it is applied to send an excessive number of policy filters to network devices. The network devices may return error messages as a result

7 Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS 7 Policy object - device compatibility EPM provides a selection of policy-related objects (traffic conditions and actions) to support traffic matching and traffic conditioning on a number of policy-enabled network devices. This does not mean that all of the devices supported by EPM will support all of the policy objects provided by EPM. This section lists the traffic criteria matching and policy action types supported by BayRS devices. Note: The information displayed here reflects the most up-to-date information available at the time of the EPM 4.1 release. Policy filter support capabilities may change for individual device types as their software is upgraded. Check your device documentation for current policy support capabilities. Filtering capability Policy priority support (filter prioritization) DiffServ action capability Shaping support COPS-PR capability Ether Type VLAN ID Inbound User Priority Protocol Inbound DSCP Port Ranges Src/Dest Address and Mask Src/Dest Port (Yes) Mark DSCP Forward Drop Meter (2 Level) Mark User Priority (L2) Mark Drop Precedence (L2) (Yes) Configure Roles on Device Configure Backup PDP on Device

8 8 Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS Reporting capability Queue mapping capability Device Reporting - View Filters (via SNMP) Device Reporting - Filter Statistics (via SNMP) 802 COS to DSCP DSCP to 802 COS DSCP to queue 802 COS to queue EPM access requirements In order for EPM to be able to send policy configuration to your networking devices, COPS-PR, SNMP and Telnet connections must be permitted on your devices. The following protocols and port numbers are required for communication between the various components of the EPM product family and your networking devices: The management console uses LDAP (port 389 default) to communicate with the directory server. It uses SNMP to communicate with Policy Servers and networking devices. Remote access to the directory requires HTTP (port 80 default). The Policy Server uses LDAP (port 389 default) to communicate with the directory server. It uses COPS-PR (port 3288 default) and SNMP (ports 161 and 162) to communicate with networking devices and the Interface Manager. The Interface Manager uses LDAP (port 389 default) to communicate with the directory server. It uses COPS-PR (port 3288 default) to communicate with the Policy Server, and uses Telnet (port 23) to communicate with networking devices. The LDAP, HTTP, and COPS-PR port numbers can be changed

9 Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS 9 Hardware changes on a policy-enabled device Making hardware changes to a device that is enabled for policy management (for example, switching off and changing blades) will cause the Policy Server to generate errors when the device is disconnected. To avoid these errors, disable the device for policy management through EPM before making the hardware changes. After you have completed the hardware changes and reconfigured the device, you can re-enable the device for policy management. To disable a device for policy management, right-click its object in the EPM management console and then choose Disable For Policy Management from the menu. To enable a device for policy management, right-click its object in the EPM management console and then choose Enable For Policy Management from the menu. Fixed device reset issue (Q ) BoSS version had a problem that caused the device to reset repeatedly when running QoS with OPS (EPM). Fixed in BoSS Accessing device documentation A complete set of documentation for the Ethernet Switch and BPS devices, including configuration manuals, user manuals, release notes, and known anomalies, are available on the Nortel Networks web site at: Follow the link for Technical Documentation and then choose a device as the product family.

10 10 Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS BPS action limitations The Business Policy Switch (BPS) accepts different types of policy actions, depending on the software version installed on the device. In some cases, the EPM Policy Server does not send all of the action types accepted by the BPS. Use this appendix as a reference when assigning actions to policies intended for BPS units. Your choice of action depends on the port class, as defined on the BPS: Trusted ports assume that all traffic coming into the port is originating from a trusted source. Therefore, the DSCP field of any traffic that enters the BPS from a trusted port is never re-marked. Any policies instructing the BPS to set the value of the DSCP field on a trusted port will generate errors. Only policies with Drop or Forward actions are permitted on trusted ports. Untrusted ports assume that all traffic coming into the port is suspect. Therefore, the DSCP field of any traffic that enters the BPS from an untrusted port is always re-marked. Any policies instructing the BPS to not set the value of the DSCP field on an untrusted port will generate errors. Only policies with Meter, Mark, and Drop actions are permitted on untrusted ports. Unrestricted ports do not assume anything about the origin of the incoming traffic. You may assign a policy action to re-mark the DSCP or not to re-mark the DSCP. This allows you to manipulate the DSCP value based upon the filter criteria, and not upon the point of origin. All policy actions are permitted on unrestricted ports. The following traffic classifications are handled by the BPS: Layer 3 - refers to IP filters, or layer 2 filters with IP classification defined in the ether type value. Layer 2 - refers to filters that have no concept of IP. Layer 2 (Tagged) - refers to filters that are layer 2 and have the VLAN tag specified as Tagged Only. Layer 2 (UnTagged) - refers to filters that are layer 2 and have the VLAN tag specified as UnTagged Only. This section covers the BPS interface class behavior for the following action types:

11 Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS 11 Update DSCP actions Table 2 describes the allowable DSCP update actions under different interface classes, relative to BPS software versions and traffic classifications. Table 2 DSCP Update action behavior Device software version Untrusted Trusted Unrestricted BPS 2.0, 3.0, 3.1 Layer 3 Mark * Ignore All Layer 2 Tagged Ignore Ignore Ignore UnTagged Ignore Ignore Ignore * Mark - Update DSCP with value Ignore - Ignore DSCP. All - All actions allowed. Update User Priority actions Table 3 describes the allowable User Priority Update actions under different interface classes, relative to BPS software versions and traffic classifications. Table 3 User Priority Update action behavior (underlined text denotes EPM default setting, where multiple options exist) Device software version Untrusted Trusted Unrestricted BPS 2.0, 3.0, 3.1 Layer 3 Update 0-7 *, Defaults Layer 2 Egress Map Refer to Table 4. Tagged Update 0-7 * Ignore ** Update 0-7 *, Ignore ** UnTagged Ignore ** Ignore ** Update 0-7 *, Ignore ** * Update Update user priority with value of 0-7. Defaults - Use COS value from DSCP to COS mapping, based on DSCP value in action.

12 12 Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS Egress Map - Use COS value from DSCP to COS mapping, based on DSCP from incoming packet. ** Ignore - Ignore user priority value. Table 4 describes the allowable User Priority Update actions, based on the DSCP specification for the same action. Table 4 Allowable User Priority Update actions (underlined text denotes EPM default setting, where multiple options exist) DSCP Ignore DSCP Mark Drop Update User Priority Update 0-7 *, Egress Map, Ignore Defaults ** Ignore * Update Update user priority with value 0-7. Egress Map - Use COS value from DSCP to COS mapping, based on DSCP from incoming packet. Ignore - Ignore user priority. ** Defaults - Use COS value from DSCP to COS mapping, based on DSCP value in action. Update Drop Precedence actions Table 5 describes the allowable Drop Precedence Update actions under different interface classes, relative to BPS software versions and traffic classifications. Table 5 Drop Precedence Update action behavior (underlined text denotes EPM default setting, where multiple options exist) Device software version Untrusted Trusted Unrestricted BPS 2.0, 3.0, 3.1 Layer 3 Update 1-8 *, Defaults Egress Map Refer to Table 6. Layer 2 Tagged Update 8, Ignore ** Update 1-8 *, Ignore ** Update 1-8 * UnTagged Ignore ** Ignore ** Update 1-8 *, Ignore ** * Update Update drop precedence with value 1-8. Defaults - Use COS value from DSCP to COS mapping, based on DSCP value in action

13 Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS 13 Egress Map - Use COS value from DSCP to COS mapping, based on DSCP from incoming packet. ** Ignore - Ignore drop precedence. Table 6 describes the allowable Drop Precedence Update actions, based on the DSCP specification for the same action. Table 6 Allowable Drop Precedence actions (underlined text denotes EPM default setting, where multiple options exist) DSCP Ignore DSCP Mark Drop Update Drop Precedence Update 1-8 *, Egress Map, Ignore Defaults ** Ignore * Update Update drop precedence with value of 1-8. Egress Map - Use COS value from DSCP to COS mapping, based on DSCP from incoming packet. Ignore - Ignore drop precedence. ** Defaults - Use COS value from DSCP to COS mapping, based on DSCP value in action. EPM traffic shaping limitations on the Business Policy Switch The Business Policy Switch (BPS) 2.0 software allows shaping on different types of policy actions, depending on the traffic type (layer 2 or 3) and the device port class (as defined on the BPS). In some cases, the EPM Policy Server does not send all of the action types accepted by the BPS. Note: You must have the correct MDA module installed on your BPS units in order for them to accept traffic shaping actions. For more information, refer to the BPS documentation.

14 14 Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS In all cases, the 802.1p User Priority value must be known for a flow of packets in order for shaping to take place. Because packets must be re-marked before the 802.1p User Priority value can be known, Ignore or Drop actions cannot include shaping functionality. Only Mark actions can include shaping functionality. Table 7 Shaper limitations on BPS ports Device software version Untrusted Trusted Unrestricted BPS 2.0, 3.0, 3.1 Layer 3 Supported with Mark * action only. Not supported. Supported with Mark * action only. Layer 2 Not supported. Not supported. Not supported. * Mark - Update DSCP with value