Application Notes for Enterasys Secure Networks Acceptable Use Policy Solution in an Avaya IP Telephony Infrastructure - Issue 1.0

Transcription

1 Avaya Solution & Interoperability Test Lab Application Notes for Enterasys Secure Networks Acceptable Use Policy Solution in an Avaya IP Telephony Infrastructure - Issue 1.0 Abstract These Application Notes describe the procedure for configuring the Enterasys Secure Networks Acceptable Use Policy (AUP) Solution to successfully interoperate in an Avaya IP Telephony Infrastructure. Information in these Application Notes has been obtained through compliance testing and additional technical discussions. Testing was conducted via the DeveloperConnection Program at the Avaya Solution and Interoperability Test Lab. 1 of 31

2 1. Introduction These Application Notes describe a compliance-tested configuration utilizing Avaya S8300 Media Server, Avaya G700 Media Gateway, Avaya IP Softphone, Avaya IP Office, Avaya IP Office Phone Manager Pro and Avaya 4600 series IP Telephones with the Enterasys Secure Networks Acceptable Use Policy (AUP). The information provided in these Application Notes utilizes the configuration described in the Application Notes in references [1] and [2]. Configuration done through the NetSight Atlas Policy Manager supersedes configuration done directly at the Enterasys switch. Enterasys Acceptable Use Policy (AUP) is comprised of a policy-based system that allows the network to provision required business services such as VoIP to users automatically. At the same time AUP prevents undesirable and malicious traffic from entering the infrastructure. Policies may be used to insure appropriate traffic is allowed through at the correct priority (e.g., VoIP) while simultaneously restricting inappropriate traffic including unintended or undesirable traffic from applications, protocols, worms or viruses. These per user or device policies are applied automatically at each individual port at the time the user/device connects to the port. The configuration in Figure 1 shows a network consisting of Avaya S8300 Media Server with G700 Media Gateway, Avaya IP Office, Avaya 4600 series IP Telephones, Infoblox DNSone and PCs connected to Enterasys Matrix N5, Enterasys SecureStack C2, and Enterasys SecureStack B2 switches. The Enterasys Matrix N5 switch was used to provide Layer 3 routing Q tagged trunks were used to uplink Layer 2 Virtual LAN (VLAN) traffic from the Enterasys SecureStack C2 and the Enterasys SecureStack B2 to the Enterasys Matrix N5 s routing interfaces. See Table 1 for detailed port configurations, Table 2 for Enterasys services defined for the tested configuration and Table 3 for Enterasys roles/policies defined for the tested configuration. 2 of 31

3 Device Port PVID Port Priori ty Avaya S8300 Media Server with G700 Media Gateway Figure 1 Sample Network Configuration Assigned Role Static VLA Ns IP Interface 1/1 1 Processor /24 Voip v /24 Media Gateway Processor /24 3 of 31

4 Device Port PVID Port Priori ty Assigned Role Static VLA Ns IP Interface Stack /24 Avaya IP Office 412 LAN /24 Infoblox DNSone NIC /24 Enterasys NetSight Atlas Policy Manager PC NIC /24 Enterasys Matrix N5 fe Administrator vlan /24 Enterasys Matrix N5 fe Administrator vlan /24 Enterasys Matrix N5 fe Avaya IP412 Office vlan /24 Enterasys Matrix N5 fe.1.26 Avaya IPTEL46XX 5 tag vlan /24 Enterasys Matrix N5 fe Avaya S8300 wg700 Media Gateway vlan /24 Enterasys Matrix N5 fe.1.40 Avaya IPTEL46XX Enterasys Matrix N5 fe tag 2 tag 3 tag 4 tag 5 tag 6 tag 7 tag Enterasys Matrix N5 fe tag 2 tag 3 tag 4 tag 5 tag 6 tag 7 tag Enterasys SecureStack C2 Enterasys SecureStack C2 Enterasys SecureStack C2 Enterasys SecureStack C2 ge AvayaIPTEL4 6XX & PC ge Avaya IP SoftPhone ge Avaya IPTEL46XX ge tag vlan /24 vlan /24 vlan /24 vlan /24 vlan /24 vlan /24 vlan /24 vlan /24 vlan /24 vlan /24 vlan /24 vlan /24 vlan /24 vlan /24 vlan /24 6 tag vlan /24 vlan /24 vlan /24 4 tag vlan /24 1 tag 2 tag 3 tag vlan /24 vlan /24 vlan /24 1 The port s VLAN was not configured in reference [1] and [2]. It should be configured as indicated in Table 1. 4 of 31

5 Device Port PVID Port Priori ty Enterasys SecureStack B2 Enterasys SecureStack B2 Enterasys SecureStack B2 Enterasys SecureStack B2 Assigned Role fe Avaya IPTEL46XX & PC fe Avaya IPTEL46XX & PC fe Avaya IPTEL46XX ge.1.47 Table 1 Connectivity Matrix Static VLA Ns 4 tag 5 tag 6 tag 7 tag IP Interface vlan /24 vlan /24 vlan /24 vlan /24 vlan /24 4 tag vlan /24 vlan /24 1 tag 2 tag 3 tag 4 tag 5 tag 6 tag 7 tag vlan /24 vlan /24 vlan /24 vlan /24 vlan /24 vlan /24 vlan /24 vlan /24 The information in Table 2 is based on references [4] and [5]. Rule Name General Tab Traffic Description Tab Actions Tab Service Name: S8300 Allow DNS Type = IP UDP Port Destination Value = DNS Allow ICMP Type = IP Protocol Type Value = ICMP Allow RTP/RTCP ( ) Type = IP UDP Port Source Range Value = Allow TCP Dest Type = IP TCP Port Destination Range Allow TCP SRC 1720 Allow TCP SRC 5022 Allow TCP src 80 Allow TCP src 443 Allow UDP SRC 1719 Rule Type = Matrix N3/N5/N7/NSA Platinum Rule Status = Enabled Value = Type = IP TCP Port Bilateral Value = 1720 Type = IP TCP Port Source Value = 5022 Type = IP TCP Port Source Value = HTTP Type = IP TCP Port Source Value = HTTPS Type = IP UDP Port Source Value = 1719 Check CoS - Select Priority 6 (Priority-Based Rate Limit: 512 Kb/s Inbound) Check Access Control - Select Permit Traffic 5 of 31

6 Rule Name General Tab Traffic Description Tab Actions Tab Allow ntp Rule Type = Matrix N3/N5/N7/NSA Platinum Type = IP UDP Port Destination Value = NTP Check CoS - Select Priority 0 (Priority-Based Rate Limit: 512 Kb/s Inbound) Rule Status = Enabled Check Access Control - Select Permit Traffic 6 of 31

7 Rule Name General Tab Traffic Description Tab Actions Tab Service Name: IP Office Allow ICMP Allow TCP BIL 1720 Allow TCP Src 8080 Allow UDP ( ) 2,3 Allow UDP dest (Voic ) Rule Type = Matrix N3/N5/N7/NSA Platinum Rule Status = Enabled Type = IP Protocol Type Value = ICMP Type = IP TCP Port Bilateral Value = 1720 Type = IP TCP Port Source Value = 8080 Type = IP UDP Port Source Range Value = Type = IP UDP Port Destination Value = Check CoS - Select Priority 6 (Priority-Based Rate Limit: 512 Kb/s Inbound) Check Access Control - Select Permit Traffic Check Generate System Log on Rule Hit Check Generate Audit Trap on Rule Hit Service Name: IPTEL46XX Allow DNS Allow ICMP Allow UDP dest 1719 Allow bootpc allow TCP dest 1720 Rule Type = All Devices Type = IP UDP Port Destination Value = DNS Type = IP Protocol Type Value = ICMP Type = IP UDP Port Destination Value = 1719 Type = IP UDP Port Source Value = BootP Client Type = IP TCP Port Destination Value = 1720 Check CoS - Select Priority 6 (Priority-Based Rate Limit: 512 Kb/s Inbound) Check Access Control - Select Permit Traffic Check Generate System Log on Rule Hit Allow SNMP Rule Status = Enabled Type = IP UDP Port Source Value = SNMP Check Generate Audit Trap on Rule Hit Check CoS - Select Priority 0 (Priority-Based Rate Limit: 512 Kb/s Inbound) Check Access Control - Select Permit Traffic Check Generate System Log on Rule Hit Check Generate Audit Trap on Rule Hit 2 Phone Manager Pro registers to IP Office and downloads licensing and user information. TFTP is used as the transport protocol and uses random UDP ports ( ). 3 Rule includes vm port UDP src 50791, license dongle port UDP src 50800, Pcpartner port UDP src 50796, Solo vm port UDP src 50793, Monitor port UDP src 50794, Voice Networking port UDP src 50795, RTP/RTCP UDP src , UDP src port 1719 H.323 RAS. 7 of 31

8 Rule Name General Tab Traffic Description Tab Actions Tab Rule Type = Matrix Type = IP Protocol Type C2 Value = UDP [Matrix C2] allow RTP/RTCP 4 Rule Status = Enabled Check CoS - Select Priority 6 (Priority-Based Rate Limit: 512 Kb/s Inbound) [Matrix N3/N5/N7/NSA Platinum] Allow RTP/RTCP 4 Rule Type = Matrix N3/N5/N7/NSA Platinum Rule Status = Enabled Type = IP Protocol Type Value = UDP Check Access Control - Select Permit Traffic Check CoS - Select Priority 6 (Priority-Based Rate Limit: 512 Kb/s Inbound) Check Access Control - Select Permit Traffic Check Generate System Log on Rule Hit Check Generate Audit Trap on Rule Hit Service Name: IPTEL46XX&PC Allow DNS Type = IP UDP Port Destination Value = DNS Check CoS - Select Priority 0 (Priority-Based Rate Limit: 512 Kb/s Inbound) Allow ICMP Rule Type = All Devices Type = IP Protocol Type Value = ICMP Check Access Control - Select Permit Traffic Check CoS - Select Priority 4 (Priority-Based Rate Limit: 512 Kb/s Inbound) Permit HTTP Permit HTTPS Rule Status = Enabled Type = IP TCP Port Destination Value = HTTP Type = IP TCP Port Destination Value = HTTPS Check Access Control - Select Permit Traffic Check CoS - Select Priority 1 (Priority-Based Rate Limit: 512 Kb/s Inbound) Check Access Control - Select Permit Traffic 4 Rule also allows TFTP transfers. 8 of 31

9 Rule Name General Tab Traffic Description Tab Actions Tab Allow UDP dest 1719 Rule Type = All Devices Type = IP UDP Port Destination Value = 1719 allow TCP BIL 1720 Rule Status = Enabled Type = IP TCP Port Bilateral Value = 1720 Check CoS [Matrix C2] allow RTP/RTCP 4 Rule Type = Matrix C2 Type = IP Protocol Type Value = UDP - Select Priority 6 (Priority-Based Rate Limit: 512 Kb/s Inbound) [Matrix N3/N5/N7/NSA Platinum] Allow RTP/RTCP 4 Rule Status = Enabled Rule Type = Matrix N3/N5/N7/NSA Platinum Rule Status = Enabled Type = IP UDP Port Source Value = Check Access Control - Select Permit Traffic Service Name: Basic Services Allow ARP Rule Type = All Devices Rule Status = Enabled Type = Ethertype Value = ARP Uncheck CoS Check Access Control - Select Permit Traffic Service Name: Enterprise User Allow ICMP Permit Bootps Permit DNS Permit HTTP Permit HTTPS Rule Type = All Devices Rule Status = Enabled Type = IP Protocol Type Value = ICMP Type = IP UDP Port Destination Value = BootP Server Type = IP UDP Port Destination Value = DNS Type = IP TCP Port Destination Value = HTTP Type = IP TCP Port Destination Value = HTTPS Check CoS - Select Priority 0 (Priority-Based Rate Limit: 512 Kb/s Inbound) Check Access Control - Select Permit Traffic Check CoS - Select Priority 1 (Priority-Based Rate Limit: 512 Kb/s Inbound) Table 2 Defined Services Check Access Control - Select Permit Traffic Role Name General Tab Services Tab Administrator Check Access Control N/A no limitations - Select Permit Avaya S8300 w G700 Media Gateway - Basic Services - S8300 Avaya IP412 Office Check Access Control - Select Deny Traffic - Basic Services - IPOffice Avaya IPTEL46XX - Basic Services - IPTEL46XX 9 of 31

10 Role Name General Tab Services Tab Avaya IPTEL46XX & PC - Basic Services - IPTEL46XX&PC Avaya IP SoftPhone (also used for Avaya IP Check Access Control - Select Deny Traffic - Basic Services - IPTEL46XX&PC Office Phone Manager Pro) Enterprise User - Basic Services - Enterprise User Table 3 Defined Roles 2. Equipment and Software Validated The following equipment and software/firmware were used for the sample configuration provided: Equipment Avaya S8300 Media Server with G700 Media Gateway Software/Firmware Avaya Communication Manager 3.01 (R013x ) Avaya IP Office (17) Avaya IP400 Digital Module 3.2(17) Avaya IP Office Manager 5.2(17) Avaya IP Softphone Avaya IP Office Phone Manager Pro 3.2(12) Avaya 4600 Series IP Telephones 2.3 (H3.23) Enterasys Networks NetSight Console 2.1 Enterasys Networks NetSight Atlas Policy Manager Enterasys Networks Matrix N Enterasys Networks SecureStack C Enterasys Networks SecureStack B Enterasys Networks NetSight Console 2.1 Infoblox DNSone 3.2r1-1 Table 4 Equipment and Software / Firmware Versions Validated 3. Configure Enterasys NetSight Atlas Policy Manager The information provided in this section describes the configuration used to set up the Enterasys Networks Acceptable Use Policy for this solution using Enterasys NetSight Atlas Policy Manager. Note: The screen shots in the remainder of this section were taken after the compliance test. For all other provisioning information such as installation and general configuration, please refer to the product documentation in reference [6]. 10 of 31

11 3.1. Configure Services Step Description 1. Log into the Enterasys NetSight Atlas Policy Manager PC with administrative privileges. Go to Start Programs Enterasys Networks NetSight Atlas Policy Manager Policy Manager to launch the Policy Manager application. 2. In the NetSight Atlas Policy Manager window that appears, click the Services tab. 11 of 31

12 Step Description 3. In the Services tab that appears, click Services Manual Services to list all services defined for this solution. Service: S Click S8300 Allow DNS in the left pane. In the General tab that appears, verify Rule Type is set to N3/N5/N7/NSA Platinum and verify Rule Status is set to Enabled as listed in Table 2. Click the Traffic Description tab. 12 of 31

13 Step Description 5. In the Traffic Description tab that appears, verify Type is set to IP UDP Port Destination and verify Value is set to DNS as listed in Table 2 and click the Actions tab. 6. In the Actions tab that appears, verify CoS is checked as listed in Table 2. Verify Priority 6 (Priority-Based Rate Limit: 512 Kb/s Inbound) is and verify Access Control is checked and verify Permit Traffic is selected as listed in Table Repeat Steps 4 6 using the information in Table 2 to verify S8300 Allow ICMP. 8. Repeat Steps 4 6 using the information in Table 2 to verify S8300 Allow RTP/RTCP ( ). 9. Repeat Steps 4 6 using the information in Table 2 to verify S8300 Allow TCP Dest Repeat Steps 4 6 using the information in Table 2 to verify S8300 Allow TCP SRC of 31

14 Step Description 11. Repeat Steps 4 6 using the information in Table 2 to verify S8300 Allow TCP SRC Repeat Steps 4 6 using the information in Table 2 to verify S8300 Allow TCP src Repeat Steps 4 6 using the information in Table 2 to verify S8300 Allow TCP src Repeat Steps 4 6 using the information in Table 2 to verify S8300 Allow UDP SRC Repeat Steps 4 6 using the information in Table 2 to verify S8300 Allow ntp. 16. Click S8300 in the left pane and select Details View in the right pane to view a list of all S8300 services defined. Service: IP Office 17. Repeat Steps 4 6 using the information in Table 2 to verify IPOffice Allow ICMP. 18. Repeat Steps 4 6 using the information in Table 2 to verify IPOffice Allow TCP BIL Repeat Steps 4 6 using the information in Table 2 to verify IPOffice Allow TCP Src Repeat Steps 4 6 using the information in Table 2 to verify IPOffice Allow UDP ( ). 21. Repeat Steps 4 6 using the information in Table 2 to verify IPOffice Allow UDP dest (Voic ). 14 of 31

15 Step Description 22. Click IPOffice in the left pane and select Details View in the right pane to view a list of all IPOffice services defined. Service: IPTEL46XX 23. Repeat Steps 4 6 using the information in Table 2 to verify IPTEL46XX Allow DNS. 24. Repeat Steps 4 6 using the information in Table 2 to verify IPTEL46XX Allow ICMP. 25. Repeat Steps 4 6 using the information in Table 2 to verify IPTEL46XX Allow SNMP. 26. Repeat Steps 4 6 using the information in Table 2 to verify IPTEL46XX Allow UDP dest Repeat Steps 4 6 using the information in Table 2 to verify IPTEL46XX bootpc. 28. Repeat Steps 4 6 using the information in Table 2 to verify IPTEL46XX [Matrix C2] allow RTP/RTCP. 29. Repeat Steps 4 6 using the information in Table 2 to verify IPTEL46XX [Matrix N3/N5/N7/NSA Platinum] Allow RTP/RTCP. 30. Repeat Steps 4 6 using the information in Table 2 to verify IPTEL46XX allow TCP dest Click IPTEL46XX in the left pane and select Details View in the right pane to view a list of all IPTEL46XX services defined. 15 of 31

16 Step Description Service: IPTEL46XX&PC 32. Repeat Steps 4 6 using the information in Table 2 to verify IPTEL46XX&PC Allow SNMP. 33. Repeat Steps 4 6 using the information in Table 2 to verify IPTEL46XX&PC Allow DNS. 34. Repeat Steps 4 6 using the information in Table 2 to verify IPTEL46XX&PC Allow ICMP. 35. Repeat Steps 4 6 using the information in Table 2 to verify IPTEL46XX&PC Allow UDP dest Repeat Steps 4 6 using the information in Table 2 to verify IPTEL46XX&PC Permit HTTP. 37. Repeat Steps 4 6 using the information in Table 2 to verify IPTEL46XX&PC Permit HTTPS. 38. Repeat Steps 4 6 using the information in Table 2 to verify IPTEL46XX&PC [Matrix C2] allow RTP/RTCP. 39. Repeat Steps 4 6 using the information in Table 2 to verify IPTEL46XX&PC [Matrix N3/N5/N7/NSA Platinum] Allow RTP/RTCP. 40. Repeat Steps 4 6 using the information in Table 2 to verify IPTEL46XX&PC allow TCP BIL Click IPTEL46XX&PC in the left pane and select Details View in the right pane to view a list of all IPTEL46XX&PC services defined. Service: Basic Services 42. Repeat Steps 4 6 using the information in Table 2 to verify Basic Services Allow ARP. 16 of 31

17 Step Description 43. Click Basic Services in the left pane and select Details View in the right pane to view a list of all Basic Services services defined. Service: Enterprise User 44. Repeat Steps 4 6 using the information in Table 2 to verify Basic Services Allow ICMP. 45. Repeat Steps 4 6 using the information in Table 2 to verify Basic Services Permit Bootps. 46. Repeat Steps 4 6 using the information in Table 2 to verify Basic Services Permit DNS. 47. Repeat Steps 4 6 using the information in Table 2 to verify Basic Services Permit HTTP. 48. Repeat Steps 4 6 using the information in Table 2 to verify Basic Services Permit HTTPS. 49. Click Enterprise User in the left pane and select Details View in the right pane to view a list of all Enterprise User services defined. 17 of 31

18 3.2. Configure Roles Step Description 1. In the NetSight Atlas Policy Manager window, click the Roles tab. Role: Administrator 2. Click Administrator in the left pane. In the General tab that appears, verify Access Control is checked and verify Permit is selected as listed in Table of 31

19 Step Description Role: Avaya S8300 w G700 Media Gateway 3. Click Avaya S8300 w G700 Media Gateway in the left pane. In the General tab that appears, verify Access Control is checked and verify Deny Traffic is selected as listed in Table 3. Click the Services tab. 4. In the Services tab that appears, verify services Basic Services and S8300 are assigned to this role as listed in Table 3. Role: Avaya IP412 Office 5. Repeat Steps 3 4 using the information in Table 3 to verify the Avaya IP412 Office role. Role: Avaya IPTEL46XX 6. Repeat Steps 3 4 using the information in Table 3 to verify the Avaya IPTEL46XX role. Role: Avaya IP SoftPhone (also used for IP Office Phone Manager Pro) 7. Repeat Steps 3 4 using the information in Table 3 to verify the Avaya IP SoftPhone role. Role: Avaya IPTEL46XX & PC 8. Repeat Steps 3 4 using the information in Table 3 to verify the Avaya IPTEL46XX & PC role. 19 of 31

20 Step Description Role: Enterprise User 9. Repeat Steps 3 4 using the information in Table 3 to verify the Enterprise User role Configure Network Elements Step Description Matrix N5 1. In the NetSight Atlas Policy Manager window, click the Network Elements tab. Double click Devices in the left pane. 2. In the Devices list that appears, click Devices Slot1. 20 of 31

21 Step Description 3. In the Matrix N5 port list that appears in the right pane, verify the Default Role for port fe.1.7 is set to Administrator as listed in Table 1 (Table3). 4. Repeat Step 3 using the information in Table 1 and Table 3 to verify the Default Role for port fe.1.10 is set to Administrator. 5. Repeat Step 3 using the information in Table 1 and Table 3 to verify the Default Role for port fe.1.20 is set to Avaya IP412 Office. 6. Repeat Step 3 using the information in Table 1 and Table 3 to verify the Default Role for port fe.1.26 is set to Avaya IPTEL46XX. 7. Repeat Step 3 using the information in Table 1 and Table 3 to verify the Default Role for port fe.1.37 is set to Avaya S8300 w G700 Media Gateway. 8. Repeat Step 3 using the information in Table 1 and Table 3 to verify the Default Role for port fe.1.40 is set to Avaya IPTEL46XX. 21 of 31

22 Step Description SecureStack C2 9. In the Network Elements tab of the NetSight Policy Manager window, click Devices Ports in the left pane. In the SecureStack C2 port list that appears in the right pane, verify the Default Role for port ge.1.1 is set to Avaya IPTEL46XX & PC as listed in Table 1 (Table3). 10. Repeat Step 9 using the information in Table 1 and Table 3 to verify the Default Role for port ge.1.2 is set to Avaya IP SoftPhone. 22 of 31

23 Step Description 11. Repeat Step 9 using the information in Table 1 and Table 3 to verify the Default Role for port ge.1.38 is set to policy4 (Avaya IPTEL46XX). 23 of 31

24 Step Description SecureStack B2 NOTE: The SecureStack B2 version used during the compliance test did not support policies. As a workaround, the MAC addresses of devices connected to the SecureStack B2 were added to their assigned roles and the policies were enforced through the Matrix N5 at the trunk port connecting the SecureStack B2 to the Matrix N5. The next SecureStack B2 firmware release will support policies. 10. In the NetSight Atlas Policy Manager window, click the Roles tab. Next, click Avaya IPTEL46XX & PC in the left pane, then click the Mappings tab in the right pane. In the Mappings tab that appears, verify the MAC Address of the Avaya 4600 series IP Telephone with an attached PC that is connected to the SecureStack B2 is listed with Mask set to ff:ff:ff:ff:ff:ff. 24 of 31

25 Step Description 11. Click Avaya IP SoftPhone in the left pane and then click the Mappings tab in the right pane. In the Mappings tab that appears, verify the MAC Address of the PC running Avaya IP Phone Manager Pro as a VoIP endpoint that is connected to the SecureStack B2 is listed with Mask set to ff:ff:ff:ff:ff:ff. 25 of 31

26 Step Description 12. Click Avaya IP46XX in the left pane and then click the Mappings tab in the right pane. In the Mappings tab that appears, verify the MAC Address of the Avaya 4600 series IP Telephone connected to the SecureStack B2 is listed with Mask set to ff:ff:ff:ff:ff:ff. 26 of 31

27 3.4. Save the configuration and apply the policies Step Description To save or backup the configuration 1. In the NetSight Atlas Policy Manager window, select File Save to save the configuration to a file. To apply the configuration 2. In the NetSight Atlas Policy Manager window, select File Enforce Role Set to propagate the configuration defined in Sections to the Enterasys Networks Matrix N5, Enterasys SecureStack C2 and Enterasys SecureStack B2. 3. In the Enforce popup that appears, click OK. 4. In the next Enforce popup that appears, click OK. 27 of 31

28 Step Description To verify configuration 5. In the NetSight Atlas Policy Manager window, select File Verify Role Set to verify the configuration defined in Sections in the Enterasys Networks Matrix N5, Enterasys SecureStack C2 and Enterasys SecureStack B2. 6. Once verification is complete, click OK in the Verify popup that appears. 4. Configure Infoblox DNSone (DHCP/TFTP Server) Refer to Section 9 of the Application Notes in reference [1] and the Application Notes in reference [3]. 5. Interoperability Compliance Testing The Interoperability Compliance Test included feature functionality and performance testing. Feature functionality testing examined the ability of devices (Avaya 4600 series IP Telephones, Avaya IP Softphone, and Avaya IP Office Phone Manager Pro) to successfully boot, obtain network configuration from the DHCP Server (Infoblox DNSone), and register to either Avaya Communication Manager or Avaya IP Office as applicable with the network policies defined through the Enterasys Networks NetSight Atlas Policy Manager. VoIP calls were made to confirm that the defined policies did not impact voice quality. Performance tests verified that the configuration remained stable under load. 28 of 31

29 5.1. General Test Approach Feature functionality testing was performed manually. Calls were made between stations that were registered to Avaya Communication Manager for Avaya Communication Manager tests and calls were made between stations that were registered to Avaya IP Office for Avaya IP Office tests. A protocol analyzer was used to monitor call signaling and audio flows to ensure that proper QoS markers at Layer 2 and Layer 3 as defined by the Acceptable Use Policy were being relayed. Performance testing was done using a data traffic generator to stress the QoS functionality of the devices over a one-hour period Test Results All feature functionality and performance test cases passed successfully. A one-hour test was conducted with 200 Mbps of traffic saturating the 100 Mbps LAN link between the Matrix N5 switch and the SecureStack C2 and SecureStack B2 respectively 5. Various calls were placed between extensions on the Matrix N5 and SecureStack C2 and SecureStack B2 without any call loss or voice quality degradation. 6. Verification Steps Verify the Policy Manager configuration (Section 3.4). Verify that the IP Telephones power up, obtain initial DHCP address from the data VLAN, tag on the voice VLAN based on option 176 values and successfully complete the registration process. Place IP-to-IP calls and verify audio quality. 7. Support For technical support on the Enterasys Secure Networks Solutions, contact the Enterasys Technical Support at Technical support can be sent to support@enterasys.com. Additional information can be found in the Enterasys Support website at 5 The policies used in the configuration were rate limiting the traffic entering the Enterasys switches. In order to successfully perform the load test, throughput limits were removed from ports connected to the traffic generator to ensure the network trunk links were properly saturated. 29 of 31

30 8. Conclusion These Application Notes describe a compliance-tested configuration of Enterasys Secure Networks Acceptable Use Policy (AUP) in an Avaya IP Telephony Infrastructure. Features and functionality were successfully validated. 9. Additional References Available from Avaya: [1] Application Notes for Enterasys Networks Matrix N5, Enterasys Networks SecureStack C2 and Enterasys Networks SecureStack B2 with Avaya Communication Manager Issue 1.0, December 2006 [2] Application Notes for Enterasys Networks Matrix N5, Enterasys Networks SecureStack C2, and Enterasys Networks SecureStack B2 with Avaya IP Office Issue 1.0, December 2006 [3] Application Notes for Infoblox DNSone in an Avaya Communication Manager IP Telephony Infrastructure Issue 1.0, March 2006 [4] Avaya IP Office Monitor (SysMon), Issue 1e, 13 th October 2005 [5] Avaya Application Solutions: IP Telephony Deployment Guide, , Issue 3.4.1, June 2005 Available from Enterasys: [6] Enterasys NetSight Policy Manager, Version of 31

31 Avaya and the Avaya Logo are trademarks of Avaya Inc. All trademarks identified by and are registered trademarks or trademarks, respectively, of Avaya Inc. All other trademarks are the property of their respective owners. The information provided in these Application Notes is subject to change without notice. The configurations, technical data, and recommendations provided in these Application Notes are believed to be accurate and dependable, but are presented without express or implied warranty. Users are responsible for their application of any products specified in these Application Notes. Please any questions or comments pertaining to these Application Notes along with the full title name and filename, located in the lower right corner, directly to the Avaya DeveloperConnection Program at 31 of 31