Configuring QoS and ACL-Based Traffic Filtering on Avaya Virtual Services Platform 7200 Series ...

196 Pages·2016·1.34 MB·English

Configuring QoS and ACL-Based Traffic
Filtering on Avaya Virtual Services
Platform 7200 Series and 8000 Series
Release 4.2.1
NN47227-502
Issue 04.02
October 2016
© 2014-2016, Avaya, Inc. applicable number of licenses and units of capacity for which the
All Rights Reserved. license is granted will be one (1), unless a different number of
licenses or units of capacity is specified in the documentation or other
Notice materials available to You. “Software” means computer programs in
While reasonable efforts have been made to ensure that the object code, provided by Avaya or an Avaya Channel Partner,
information in this document is complete and accurate at the time of whether as stand-alone products, pre-installed on hardware products,
printing, Avaya assumes no liability for any errors. Avaya reserves and any upgrades, updates, patches, bug fixes, or modified versions
the right to make changes and corrections to the information in this thereto. “Designated Processor” means a single stand-alone
document without the obligation to notify any person or organization computing device. “Server” means a Designated Processor that
of such changes. hosts a software application to be accessed by multiple users.
“Instance” means a single copy of the Software executing at a
Documentation disclaimer particular time: (i) on one physical machine; or (ii) on one deployed
software virtual machine (“VM”) or similar deployment.
“Documentation” means information published by Avaya in varying
mediums which may include product information, operating Licence types
instructions and performance specifications that Avaya may generally
make available to users of its products and Hosted Services. Designated System(s) License (DS). End User may install and use
Documentation does not include marketing materials. Avaya shall not each copy or an Instance of the Software only on a number of
be responsible for any modifications, additions, or deletions to the Designated Processors up to the number indicated in the order.
original published version of documentation unless such Avaya may require the Designated Processor(s) to be identified in
modifications, additions, or deletions were performed by Avaya. End the order by type, serial number, feature key, Instance, location or
User agrees to indemnify and hold harmless Avaya, Avaya's agents, other specific designation, or to be provided by End User to Avaya
servants and employees against all claims, lawsuits, demands and through electronic means established by Avaya specifically for this
judgments arising out of, or in connection with, subsequent purpose.
modifications, additions or deletions to this documentation, to the Heritage Nortel Software
extent made by End User.
“Heritage Nortel Software” means the software that was acquired by
Link disclaimer Avaya as part of its purchase of the Nortel Enterprise Solutions
Avaya is not responsible for the contents or reliability of any linked Business in December 2009. The Heritage Nortel Software currently
websites referenced within this site or documentation provided by available for license from Avaya is the software contained within the
Avaya. Avaya is not responsible for the accuracy of any information, list of Heritage Nortel Products located at http://support.avaya.com/
statement or content provided on these sites and does not LicenseInfo under the link “Heritage Nortel Products” or such
necessarily endorse the products, services, or information described successor site as designated by Avaya. For Heritage Nortel
or offered within them. Avaya does not guarantee that these links will Software, Avaya grants You a license to use Heritage Nortel
work all the time and has no control over the availability of the linked Software provided hereunder solely to the extent of the authorized
pages. activation or authorized usage level, solely for the purpose specified
in the Documentation, and solely as embedded in, for execution on,
Warranty or for communication with Avaya equipment. Charges for Heritage
Nortel Software may be based on extent of activation or use
Avaya provides a limited warranty on Avaya hardware and software.
authorized as specified in an order or invoice.
Refer to your sales agreement to establish the terms of the limited
warranty. In addition, Avaya’s standard warranty language, as well as Copyright
information regarding support for this product while under warranty is
available to Avaya customers and other parties through the Avaya Except where expressly stated otherwise, no use should be made of
Support website: http://support.avaya.com or such successor site as materials on this site, the Documentation, Software, Hosted Service,
designated by Avaya. Please note that if You acquired the product(s) or hardware provided by Avaya. All content on this site, the
from an authorized Avaya Channel Partner outside of the United documentation, Hosted Service, and the product provided by Avaya
States and Canada, the warranty is provided to You by said Avaya including the selection, arrangement and design of the content is
Channel Partner and not by Avaya. owned either by Avaya or its licensors and is protected by copyright
and other intellectual property laws including the sui generis rights
Licenses relating to the protection of databases. You may not modify, copy,
reproduce, republish, upload, post, transmit or distribute in any way
THE SOFTWARE LICENSE TERMS AVAILABLE ON THE AVAYA
any content, in whole or in part, including any code and software
WEBSITE, HTTP://SUPPORT.AVAYA.COM/LICENSEINFO OR
unless expressly authorized by Avaya. Unauthorized reproduction,
SUCH SUCCESSOR SITE AS DESIGNATED BY AVAYA, ARE
transmission, dissemination, storage, and or use without the express
APPLICABLE TO ANYONE WHO DOWNLOADS, USES AND/OR
written consent of Avaya can be a criminal, as well as a civil offense
INSTALLS AVAYA SOFTWARE, PURCHASED FROM AVAYA INC.,
under the applicable law.
ANY AVAYA AFFILIATE, OR AN AVAYA CHANNEL PARTNER (AS
APPLICABLE) UNDER A COMMERCIAL AGREEMENT WITH Third Party Components
AVAYA OR AN AVAYA CHANNEL PARTNER. UNLESS
OTHERWISE AGREED TO BY AVAYA IN WRITING, AVAYA DOES “Third Party Components” mean certain software programs or
NOT EXTEND THIS LICENSE IF THE SOFTWARE WAS portions thereof included in the Software or Hosted Service may
OBTAINED FROM ANYONE OTHER THAN AVAYA, AN AVAYA contain software (including open source software) distributed under
AFFILIATE OR AN AVAYA CHANNEL PARTNER; AVAYA third party agreements (“Third Party Components”), which contain
RESERVES THE RIGHT TO TAKE LEGAL ACTION AGAINST YOU terms regarding the rights to use certain portions of the Software
AND ANYONE ELSE USING OR SELLING THE SOFTWARE (“Third Party Terms”). As required, information regarding distributed
WITHOUT A LICENSE. BY INSTALLING, DOWNLOADING OR Linux OS source code (for those products that have distributed Linux
USING THE SOFTWARE, OR AUTHORIZING OTHERS TO DO SO, OS source code) and identifying the copyright holders of the Third
YOU, ON BEHALF OF YOURSELF AND THE ENTITY FOR WHOM Party Components and the Third Party Terms that apply is available
YOU ARE INSTALLING, DOWNLOADING OR USING THE in the products, Documentation or on Avaya’s website at: http://
SOFTWARE (HEREINAFTER REFERRED TO support.avaya.com/Copyright or such successor site as designated
INTERCHANGEABLY AS “YOU” AND “END USER”), AGREE TO by Avaya. You agree to the Third Party Terms for any such Third
THESE TERMS AND CONDITIONS AND CREATE A BINDING Party Components.
CONTRACT BETWEEN YOU AND AVAYA INC. OR THE Preventing Toll Fraud
APPLICABLE AVAYA AFFILIATE (“AVAYA”).
“Toll Fraud” is the unauthorized use of your telecommunications
Avaya grants You a license within the scope of the license types system by an unauthorized party (for example, a person who is not a
described below, with the exception of Heritage Nortel Software, for corporate employee, agent, subcontractor, or is not working on your
which the scope of the license is detailed below. Where the order company's behalf). Be aware that there can be a risk of Toll Fraud
documentation does not expressly identify a license type, the associated with your system and that, if Toll Fraud occurs, it can
applicable license will be a Designated System License. The
result in substantial additional charges for your telecommunications
services.
Avaya Toll Fraud intervention
If You suspect that You are being victimized by Toll Fraud and You
need technical assistance or support, call Technical Service Center
Toll Fraud Intervention Hotline at [phone] for the United
States and Canada. For additional support telephone numbers, see
the Avaya Support website: http://support.avaya.com or such
successor site as designated by Avaya. Suspected security
vulnerabilities with Avaya products should be reported to Avaya by
sending mail to: [email protected].
Downloading Documentation
For the most current versions of Documentation, see the Avaya
Support website: http://support.avaya.com, or such successor site as
designated by Avaya.
Contact Avaya Support
See the Avaya Support website: http://support.avaya.com for product
or Hosted Service notices and articles, or to report a problem with
your Avaya product or Hosted Service. For a list of support telephone
numbers and contact addresses, go to the Avaya Support website:
http://support.avaya.com (or such successor site as designated by
Avaya), scroll to the bottom of the page, and select Contact Avaya
Support.
Trademarks
The trademarks, logos and service marks (“Marks”) displayed in this
site, the Documentation, Hosted Service(s), and product(s) provided
by Avaya are the registered or unregistered Marks of Avaya, its
affiliates, or other third parties. Users are not permitted to use such
Marks without prior written consent from Avaya or such third party
which may own the Mark. Nothing contained in this site, the
Documentation, Hosted Service(s) and product(s) should be
construed as granting, by implication, estoppel, or otherwise, any
license or right in and to the Marks without the express written
permission of Avaya or the applicable third party.
Avaya is a registered trademark of Avaya Inc.
All non-Avaya trademarks are the property of their respective owners.
Linux® is the registered trademark of Linus Torvalds in the U.S. and
other countries.
Contents
Chapter 1: Introduction............................................................................................................ 8
Purpose.................................................................................................................................. 8
Related resources................................................................................................................... 8
Documentation.................................................................................................................. 8
Training............................................................................................................................ 8
Viewing Avaya Mentor videos............................................................................................. 9
Subscribing to e-notifications.............................................................................................. 9
Support................................................................................................................................ 11
Searching a documentation collection............................................................................... 11
Chapter 2: New in this release............................................................................................... 13
VOSS 4.2.1........................................................................................................................... 13
Features......................................................................................................................... 13
VOSS 4.2............................................................................................................................. 14
Features......................................................................................................................... 14
Other changes................................................................................................................ 14
Chapter 3: QoS fundamentals............................................................................................... 15
Introduction to QoS................................................................................................................ 15
Configuration considerations.................................................................................................. 16
QoS support for 10 GbE interface in 1GbE mode..................................................................... 16
Queuing............................................................................................................................... 16
Avaya Service Class.............................................................................................................. 17
Internal QoS level.................................................................................................................. 19
Classification and mapping..................................................................................................... 19
DiffServ................................................................................................................................ 20
Ingress port-rate limiter.......................................................................................................... 22
Ingress mappings.................................................................................................................. 22
Egress mappings.................................................................................................................. 25
QoS and filters...................................................................................................................... 26
Ingress port-rate limiting and shaping...................................................................................... 27
Layer 2 and Layer 3 trusted and untrusted ports...................................................................... 28
Broadcast and multicast traffic bandwidth limiters.................................................................... 29
QoS and VoIP....................................................................................................................... 30
QoS re-marking on a Transparent UNI.................................................................................... 31
QoS and channelization......................................................................................................... 31
Chapter 4: Traffic filtering fundamentals.............................................................................. 32
Overview.............................................................................................................................. 32
Access control lists................................................................................................................ 32
Access control entries............................................................................................................ 34
Traffic filter configuration........................................................................................................ 42
October 2016 Configuring QoS and ACL-Based Traffic Filtering on Avaya VSP 8000 and 7200
Series 4
Comments on this document? [email protected]
Contents
ACL and ACE configuration guidelines.................................................................................... 42
ACL filters behavior............................................................................................................... 43
Filter limitations..................................................................................................................... 43
Chapter 5: Basic DiffServ configuration using ACLI........................................................... 45
Enabling DiffServ on a port..................................................................................................... 45
Configuring Layer 3 trusted or untrusted ports......................................................................... 46
Configuring Layer 2 trusted or untrusted ports......................................................................... 47
Viewing the port 802.1p override status................................................................................... 48
Configuring the port QoS level................................................................................................ 49
Chapter 6: Basic DiffServ configuration using EDM........................................................... 50
Enabling DiffServ for a port.................................................................................................... 50
Configuring Layer 3 trusted or untrusted ports......................................................................... 51
Configuring Layer 2 trusted or untrusted ports......................................................................... 52
Configuring the port QoS level................................................................................................ 52
Chapter 7: QoS configuration using ACLI............................................................................ 53
Configuring broadcast and multicast bandwidth limiting............................................................ 53
Viewing the port-based shaper information.............................................................................. 54
Configuring the port-based shaper.......................................................................................... 54
Configuring the ingress port-rate limiter................................................................................... 55
Viewing the ingress port-rate limit information.......................................................................... 56
Configuring ingress mappings................................................................................................ 57
Configuring egress mappings................................................................................................. 58
Viewing port egress CoS queue statistics................................................................................ 59
Clearing port egress CoS queue statistics............................................................................... 60
Viewing CPU queue statistics................................................................................................. 61
Clearing CPU queue statistics................................................................................................ 62
Chapter 8: QoS configuration using EDM............................................................................ 63
Configuring port-based shaping.............................................................................................. 63
Configuring ingress port-rate limiter........................................................................................ 63
Modifying ingress 802.1p to QoS mappings............................................................................. 64
Modifying ingress DSCP to QoS mappings.............................................................................. 64
Modifying egress QoS to 802.1p mappings.............................................................................. 65
Modifying egress QoS to DSCP mappings............................................................................... 66
Viewing port egress CoS queue statistics................................................................................ 67
Clearing CPU statistics for the chassis.................................................................................... 67
Viewing CPU queue statistics................................................................................................. 68
Chapter 9: Access control list configuration using ACLI................................................... 69
Creating an IPv4 ACL............................................................................................................ 70
Creating an IPv6 ACL............................................................................................................ 71
Associating VLANs with an ACL............................................................................................. 72
Associating ports with an ACL................................................................................................ 73
Configuring global and default actions for an ACL.................................................................... 74
Renaming an ACL................................................................................................................. 75
October 2016 Configuring QoS and ACL-Based Traffic Filtering on Avaya VSP 8000 and 7200
Series 5
Comments on this document? [email protected]
Contents
Disabling an ACL.................................................................................................................. 76
Resetting an ACL to default values......................................................................................... 77
Deleting an ACL.................................................................................................................... 77
Chapter 10: Access control list configuration using EDM.................................................. 79
Configuring an access control list............................................................................................ 79
Chapter 11: Access control entry configuration using ACLI.............................................. 81
Configuring ACEs.................................................................................................................. 81
Configuring ACE actions........................................................................................................ 83
Configuring ARP ACEs.......................................................................................................... 84
Configuring an Ethernet ACE................................................................................................. 85
Configuring an IP ACE........................................................................................................... 88
Configuring an IPv6 ACE....................................................................................................... 90
Configuring a protocol ACE.................................................................................................... 92
Viewing ACL and ACE configuration data................................................................................ 94
Chapter 12: Access control entry configuration using EDM.............................................. 95
Configuring an ACE............................................................................................................... 95
Configuring ACE actions........................................................................................................ 96
Configuring ACE ARP entries................................................................................................. 98
Viewing all ACE ARP entries for an ACL................................................................................. 99
Configuring an ACE Ethernet source address........................................................................ 100
Configuring an ACE Ethernet destination address.................................................................. 101
Configuring an ACE LAN traffic type..................................................................................... 102
Configuring an ACE Ethernet VLAN tag priority...................................................................... 103
Configuring an ACE Ethernet port......................................................................................... 104
Configuring an ACE Ethernet VLAN ID.................................................................................. 105
Viewing all ACE Ethernet entries for an ACL.......................................................................... 106
Configuring an ACE IP source address................................................................................. 107
Configuring an ACE IP destination address........................................................................... 108
Configuring an ACE IP DSCP............................................................................................... 109
Configuring an ACE IP protocol............................................................................................ 110
Configuring ACE IP options.................................................................................................. 111
Configuring ACE IP fragmentation........................................................................................ 112
Viewing all ACE IP entries for an ACL................................................................................... 113
Configuring an ACE IPv6 source address.............................................................................. 114
Configuring an ACE IPv6 destination address........................................................................ 115
Configuring an ACE IPv6 next header................................................................................... 116
Configuring an ACE IPv6 traffic class.................................................................................... 117
Viewing all ACE IPv6 entries for an ACL............................................................................... 118
Configuring an ACE source port........................................................................................... 119
Configuring an ACE TCP flag............................................................................................... 122
Viewing all ACE protocol entries for an ACL.......................................................................... 123
Chapter 13: Common procedures using ACLI................................................................... 125
Saving the configuration....................................................................................................... 125
October 2016 Configuring QoS and ACL-Based Traffic Filtering on Avaya VSP 8000 and 7200
Series 6
Comments on this document? [email protected]
Contents
Restarting the platform......................................................................................................... 126
Chapter 14: Common procedures using EDM................................................................... 128
Saving the configuration....................................................................................................... 128
Chapter 15: Advanced filter examples................................................................................ 129
ACE filters for secure networks............................................................................................. 129
Glossary................................................................................................................................. 191
October 2016 Configuring QoS and ACL-Based Traffic Filtering on Avaya VSP 8000 and 7200
Series 7
Comments on this document? [email protected]
Chapter 1: Introduction
Purpose
This document provides information on features in VSP Operating System Software (VOSS). VOSS
runs on the following product families:
• Avaya Virtual Services Platform 4000 Series
• Avaya Virtual Services Platform 7200 Series
• Avaya Virtual Services Platform 8000 Series
This document provides conceptual information and configuration instructions to use Quality of
Service (QoS) and ACL-based filters on the Avaya Virtual Services Platform 7200 Series and 8000
Series switches.
For conceptual information and configuration instructions to use Quality of Service (QoS) and ACL-
based filters on Avaya Virtual Services Platform 4000 Series, see Configuration - QoS and ACL-
Based Traffic Filtering Avaya Virtual Services Platform 4000 Series, NN46251-502.
Examples and network illustrations in this document may illustrate only one of the supported
platforms. Unless otherwise noted, the concept illustrated applies to all supported platforms.
Related resources
Documentation
See the Documentation Reference for Avaya Virtual Services Platform 7200 Series and 8000
Series, NN47227-100 for a list of the documentation for this product.
Training
Ongoing product training is available. For more information or to register, you can access the Web
site at http://avaya-learning.com/.
October 2016 Configuring QoS and ACL-Based Traffic Filtering on Avaya VSP 8000 and 7200
Series 8
Comments on this document? [email protected]
Related resources
Viewing Avaya Mentor videos
Avaya Mentor videos provide technical content on how to install, configure, and troubleshoot Avaya
products.
About this task
Videos are available on the Avaya Support website, listed under the video document type, and on
the Avaya-run channel on YouTube.
Procedure
• To find videos on the Avaya Support website, go to http://support.avaya.com and perform one
of the following actions:
- In Search, type Avaya Mentor Videos to see a list of the available videos.
- In Search, type the product name. On the Search Results page, select Video in the
Content Type column on the left.
• To find the Avaya Mentor videos on YouTube, go to www.youtube.com/AvayaMentor and
perform one of the following actions:
- Enter a key word or key words in the Search Channel to search for a specific product or
topic.
- Scroll down Playlists, and click the name of a topic to see the available list of videos posted
on the website.
Note:
Videos are not available for all products.
Subscribing to e-notifications
Subscribe to e-notifications to receive an email notification when documents are added to or
changed on the Avaya Support website.
About this task
You can subscribe to different types of general notifications, for example, Product Correction
Notices (PCN), which apply to any product or a specific product. You can also subscribe to specific
types of documentation for a specific product, for example, Application & Technical Notes for
Ethernet Routing Switch 8800.
Procedure
1. In an Internet browser, go to https://support.avaya.com.
2. Type your username and password, and then click Login.
3. Under My Information, select SSO login Profile.
4. Click E-NOTIFICATIONS.
October 2016 Configuring QoS and ACL-Based Traffic Filtering on Avaya VSP 8000 and 7200
Series 9
Comments on this document? [email protected]
Introduction
5. In the GENERAL NOTIFICATIONS area, select the required documentation types, and then
click UPDATE.
6. Click OK.
7. In the PRODUCT NOTIFICATIONS area, click Add More Products.
8. Scroll through the list, and then select the product name.
9. Select a release version.
10. Select the check box next to the required documentation types.
October 2016 Configuring QoS and ACL-Based Traffic Filtering on Avaya VSP 8000 and 7200
Series 10
Comments on this document? [email protected]