Enterasys Networks Policy Manager Help
Hirdetés
Hirdetés
NetSight Policy Manager Help
Table of Contents
MIXED−STACK SECURESTACK C2/C3 and B2/B3 CONSIDERATIONS:...................................47
ENTERASYS NETWORKS PRIVATE ENTERPRISE MIB SUPPORT:..........................................57
i
NetSight Policy Manager Help
Table of Contents
ii
NetSight Policy Manager Help
Table of Contents
Getting Started with Policy Manager
iii
NetSight Policy Manager Help
Table of Contents
iv
NetSight Policy Manager Help
Table of Contents
v
NetSight Policy Manager Help
Table of Contents
How to Configure and Manage the NetSight Server
vi
NetSight Policy Manager Help
Table of Contents
vii
NetSight Policy Manager Help
Table of Contents
viii
NetSight Policy Manager Help
Table of Contents
How to Create or Modify a Rule
ix
NetSight Policy Manager Help
Table of Contents
x
NetSight Policy Manager Help
Table of Contents
How to Stop and Start the NetSight Server
xi
NetSight Policy Manager Help
Table of Contents
xii
NetSight Policy Manager Help
Table of Contents
xiii
NetSight Policy Manager Help
Table of Contents
xiv
NetSight Policy Manager Help
Table of Contents
xv
NetSight Policy Manager Help
Table of Contents
xvi
NetSight Policy Manager Help
Table of Contents
xvii
NetSight Policy Manager Help
Table of Contents
xviii
NetSight Policy Manager Help
Table of Contents
xix
NetSight Policy Manager Help
Table of Contents
xx
NetSight Policy Manager Help
Table of Contents
xxi
Policy Manager Help
Welcome to the online help system for Enterasys NetSight
®
Policy Manager. Policy Manager is a configuration tool that simplifies the creation and enforcement of policies on networks, enabling network engineers, information technology administrators, and business managers to work together to create the appropriate network experience for each user in their organization.
All Policy Manager documentation is available in the online help system. Online help is available from the
Help menus and Help buttons throughout Policy Manager. The Help viewer is divided into two panels. The left panel contains two tabs: the Table of Contents tab and the Search tab. The right panel displays the actual help text itself.
Accessing Help
There are several ways to access the help system:
•
For help on any Policy Manager feature, select the Help > Help Topics menu option.
•
For help on the tab currently displayed in the right panel, select the Help > About This Window
• menu option.
Help on a particular window is also often available via a Help button on the window itself.
Table of Contents Tab
Click on the Table of Contents Tab in the left panel to display a list of help topics for Policy Manager. The
Table of Contents is "collapsed" when you first open the help. To expand any folder in the Table of Contents, double−click it. When you click on an item in the Table of Contents, the associated help topic appears in the right panel. If the help topic you select is located within a long file, you may need to wait a second or two for the help window to locate your particular topic within the file.
Search Tab
To search for specific instances of a term in all the help topics, click the Search tab in the left panel. In the
Find box, enter the term for which you want to search and press Enter. A list of topics in which the term appears is displayed, along with the number of instances found in each topic. The first instance in the first topic is highlighted in the right panel. You can then scroll through that help topic, or select another from the list, to view the other instances of the search term within the topic.
There is a limit on the number of instances of the criteria that can be highlighted during one search. If the number of "hits" exceeds this limit, the help window highlights the closest matches within each topic, rather than all of them, and if the hits greatly exceed the limit, it highlights only the first few hits in each file. You can't do searches on terms like "the" and "and."
Policy Manager Help 1
NetSight Policy Manager Help
Help Topics with Graphics
Some of the help topics contain a graphic (image) of a Policy Manager window or tab. These graphics are usually clickable so that you can navigate easily to the field definition or area of the window on which you need information. If the full graphic is not displayed in the help window when it first loads, you may need to click once on the graphic to display it fully before the graphic's hotspots will work.
Help Topics with Graphics 2
Notice
Enterasys Networks reserves the right to make changes in specifications and other information contained in this document without prior notice. The reader should in all cases consult Enterasys Networks to determine whether any such changes have been made.
The hardware, firmware, or software described in this manual is subject to change without notice.
IN NO EVENT SHALL ENTERASYS NETWORKS BE LIABLE FOR ANY INCIDENTAL, INDIRECT,
SPECIAL, OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING BUT NOT LIMITED TO
LOST PROFITS) ARISING OUT OF OR RELATED TO THIS DOCUMENT, WEB SITE, OR THE
INFORMATION CONTAINED IN THEM, EVEN IF ENTERASYS NETWORKS HAS BEEN ADVISED
OF, KNOWN, OR SHOULD HAVE KNOWN, THE POSSIBILITY OF SUCH DAMAGES.
Copyright © 2000−2007 by Enterasys Networks. All rights reserved.
Enterasys Networks, Inc.
50 Minuteman Rd.
Andover, MA 01810
Enterasys NetSight Policy Manager references software in Enterasys NetSight Console whose copyright is licensed from MySQL AB.
Enterasys, Enterasys Matrix, XPedition, and RoamAbout are trademarks or registered trademarks of Enterasys
Networks.
NetSight is a registered trademark of Enterasys Networks, Inc.
Windows, Windows NT, Windows XP, Microsoft, Microsoft Windows, and Microsoft Windows for
Workgroups are trademarks or registered trademarks of Microsoft Corporation.
Solaris, Sun, Sun Microsystems, and Java are trademarks or registered trademarks of Sun Microsystems, Inc.
C++ is a trademark of American Telephone and Telegraph, Inc.
AppleTalk is a trademark of Apple Computer, Inc.
NetWare and Novell are registered trademarks; and IPX is a trademark of Novell, Inc.
Raima Database Manager
®
(RDM) and db_VISTA
®
are registered trademarks of Centura Software.
UNIX is a trademark of The Open Group.
Ethernet is a trademark of Xerox Corporation.
HP OpenView
®
is a registered trademark of Hewlett−Packard, Inc.
InstallAnywhere is a trademark or registered trademark of Zero G Software, Inc.
Steel−Belted Radius is a registered trademark of Funk Software.
Notice 3
NetSight Policy Manager Help
This product includes software developed by L2FProd.com ( http://www.L2FProd.com/
).
JFreeChart Software
JFreeChart is a free chart library for the Java(tm) platform. It runs on the Java 2 Platform (JDK 1.2.2 or later) and uses the Java 2D API for drawing.
JFreeChart is licensed under the terms of the GNU Lesser General Public License (LGPL). A copy of the license is included in the distribution.
The latest version of this class library can be obtained from: http://www.jfree.org/jfreechart/index.html
Virus Disclaimer
Enterasys Networks makes no representations or warranties to the effect that the Licensed Software is virus−free.
Enterasys has tested its software with current virus checking technologies. However, because no anti−virus system is 100% reliable, we strongly caution you to write protect and then verify that the Licensed Software, prior to installing it, is virus−free with an anti−virus system in which you have confidence.
Restricted Rights Notice
(Applicable to licenses to the United States Government only.)
1. Use, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software clause at DFARS
252.227−7013.
Enterasys Networks, Inc., 50 Minuteman Rd., Andover, MA 01810.
2. This computer software is submitted with restricted rights. It may not be used, reproduced, or disclosed by the Government except as provided in paragraph (b) of this Notice or as otherwise expressly stated in the contract.
3. This computer software may be: a. Used or copied for use in or with the computer or computers for which it was acquired, including use at any Government installation to which such computer or computers may be transferred; b. Used or copied for use in a backup computer if any computer for which it was acquired is inoperative; c. Reproduced for safekeeping (archives) or backup purposes; d. Modified, adapted, or combined with other computer software, provided that the modified, combined, or adapted portions of the derivative software incorporating restricted computer software are made subject to the same restricted rights; e. Disclosed to and reproduced for use by support service contractors in accordance with subparagraphs (b) (1) through (4) of this clause, provided the Government makes such disclosure or reproduction subject to these restricted rights; and f. Used or copied for use in or transferred to a replacement computer.
4. Notwithstanding the foregoing, if this computer software is published copyrighted computer software, it is licensed to the Government, without disclosure prohibitions, with the minimum rights set forth in paragraph (b) of this clause.
Virus Disclaimer 4
NetSight Policy Manager Help
5. Any other rights or limitations regarding the use, duplication, or disclosure of this computer software are to be expressly stated in, or incorporated in, the contract.
6. This Notice shall be marked on any reproduction of this computer software, in whole or in part.
50 Minuteman Rd.
Andover, MA 01810 (USA)
Tel: (978) 684−1000
Virus Disclaimer 5
CUSTOMER RELEASE NOTES
Enterasys NetSight
®
Policy Manager
Version 2.3
March, 2007
INTRODUCTION:
The most recent version of these release notes can also be found on the NetSight Documentation web page: http://www.enterasys.com/support/manuals/netsight.html
.
NOTE:
When this topic is opened outside of the application help system, the links from this topic to other help topics will not work Links within the topic will work and once you've installed Policy
Manager, you can launch the help system and access help for all topics.
Policy Manager Features
Enterasys NetSight Policy Manager is a tool that simplifies the configuration of policies on networks, and deploys the policies on multiple devices throughout the switch fabric. It may be used for any device that supports the Enterasys Networks Policy Profile MIB. Web−based authentication is available on devices with firmware that supports the Enterasys Networks PWA MIB and the Enterasys Networks RADIUS Auth Client
Encrypt MIB or the Enterasys Networks RADIUS Client MIB. 802.1X authentication is available on devices
CUSTOMER RELEASE NOTES 6
NetSight Policy Manager Help with firmware that supports the EAP MIB and the Enterasys Networks RADIUS Auth Client Encrypt MIB or the Enterasys Networks RADIUS Client MIB.
With Policy Manager, you can create policy profiles, called roles, that are assigned to the ports in your network. These roles provide four key policy features: traffic containment, traffic filtering, traffic security, and traffic prioritization. When authentication is enabled, users identify themselves to the network and are given customized access capabilities based on what role they serve in the organization.
Using the Policy Manager wizards and configuration tools, you can create multiple roles tailored to your specific needs, and set a default role for all or some of your network devices and ports. Basic Policy Manager operations include creating, editing, and deleting roles. You can also view role configuration on a per device and per port basis. In addition, Policy Manager allows you to verify that the roles enforced on your network device match the roles currently configured in the application. Policy Manager supports a maximum of 1,000 devices (25,000 ports) and 50 roles per policy domain, and can process a maximum of 250 classification rules with a maximum of 50 classification rules per role.
Enterasys recommends that you review this document prior to installing or upgrading this product.
SOFTWARE CHANGES AND ENHANCEMENTS:
Software Enhancements
The following enhancements were added to release 2.3 of Policy Manager:
•
Support for Industrial I3 Devices. Policy Manager now supports the new high−performance
•
I−Series switch for the industrial automation market.
ICMP Types and Codes. When creating an ICMP traffic classification rule, you can now select
• well−known value types and codes for ICMP types that support a code.
Initialize Policy Manager Database. This feature provides a way to initialize only the Policy
•
Manager components in the NetSight Database.
Enhanced Policy Manager/Firmware Feature Support Tables. The Firmware Feature Support tables (found in these release notes) were reorganized and enhanced to provide more complete feature support information for each device type.
SYSTEM REQUIREMENTS:
Supported Platforms
The system requirements for operating Policy Manager are listed here:
•
Windows
®
2000 w/ Service Pack 4, Windows Server" 2003, and Windows XP
®
w/ Service Pack
2 (qualified on the English version of the operating systems)
•
Recommended P4−2.4 GHz, 1GB RAM
•
Free Disk Space − 500MB
•
Solaris
®
•
•
8, 9, and 10 on Sun
Recommended Sun
®
®
Platforms only (with latest operating system patches installed)
Ultra 30/60 (or equivalent), 900MHz, 1GB RAM
Free Disk Space − 800MB
SOFTWARE CHANGES AND ENHANCEMENTS: 7
NetSight Policy Manager Help
•
Linux: Red Hat Version 9, Red Hat Enterprise Linux WS, ES v3, and SuSE Linux 9
•
Recommended P4−2.4 GHz, 1GB RAM
•
Free Disk Space − 500MB
Enterasys NetSight Console
The Policy Manager Client and Server license must be installed on a workstation that has an Enterasys
NetSight Console Server (minimum version 2.2) already installed. Policy Manager depends on functionality provided by the NetSight Server, which is a component of Console. Policy Manager Client−only installations do not have this requirement.
UNIX
®
Operating System Patches
Before installing Policy Manager on the UNIX platform, be sure to install the latest patches for your operating system. You can download the most recent operating system patches from www.sunsolve.sun.com
.
PRODUCT/FIRMWARE SUPPORT:
Classification Rule Support for the supported devices.
Table 1: Devices/Firmware Versions Supported
Industrial I3
Device Type
SecureStack A2
SecureStack B2
SecureStack C2
SecureStack B3
SecureStack C3
Matrix E1 (1H5xx−xx, 1G5xx−xx)
Matrix E6/E7
Matrix N−Series Platinum
Matrix N−Series Gold
3.07.xx
5.09.xx
5.25.xx
5.31.xx
5.32.xx
5.35.xx
5.25.xx
5.31.xx
5.32.xx
Firmware Version
1.00.xx
1.03.xx
3.01.xx
4.00.xx
4.00.xx
5.00.xx
1.00.xx
1.00.xx
Enterasys NetSight Console 8
Matrix V−Series
RoamAbout R2
RoamAbout AP3000
RoamAbout AP4102
NetSight Policy Manager Help
5.35.xx
2.5.0.x
5.04.xx
6.xx.xx
2.00.06
V3.1.0
1.1.x
Table 2: Policy Manager/Firmware Feature Support
Industrial I3
Functionality
802.1X Authentication Type
MAC Authentication Type
MAC Mask (MAC−Auth)
Web−based Authentication Type
(PWA)
Enhanced Login Mode
Redirect Time
Guest Networking
CEP (Convergence End Point)
Single User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
CEP
Multi−User Authentication Support
(1)
:
802.1X
MAC
Web−Based
802.1X+MAC
802.1X+Web−Based
MAC+Web−Based
802.1X+MAC+Web−Based
CEP
Global Authentication Settings:
Authentication Timeout
Current # of Authenticated
Users
Multi−Users per Port
RFC3580 VLAN Authorization
RFC3580 VLAN Egress
Firmware Version
1.00.xx
X
X
X
X
X
X
−
X
−
X
−
−
−
−
(2)
X
X
X
X
−
−
X
X
X
X
−
−
−
Enterasys NetSight Console 9
NetSight Policy Manager Help
RADIUS Support
RADIUS Accounting
RADIUS Response Conflict
Resolution
VLAN Support (802.1Q)
Drop VLAN Tagged Frame
GVRP
Dynamic Egress
Priority Support (802.1p)
Policy Support
Classification Rules − VLAN
Classification Rules − Priority
(Class of Service)
Policy−based VLAN Egress
Tagged Packet VLAN to Role
Mapping
Authentication−based VLAN to
Role Mapping
IP to Role Mapping
MAC to Role Mapping
Rule Accounting
Port Disabled on Rule Hit
Disable Traffic Classify Type
(Admin−Profile only)
Clear Rule Usage
Invalid Policy Action
Rate Limiting:
Priority−Based
Role−Based
MAC Locking:
Dynamic
Static
ToS/DSCP Rewrite (etsysCoS
MIB)
ToS/DSCP Rewrite (ctPriClassify
MIB)
SNMPv3
X
−
−
<1−4093>/ 1024 max
X
X
X
X
X (3)
X
−
−
−
−
−
−
−
−
−
−
−
X
X
X
−
X
1
All three types of authentication can be enabled at the device−level and port−level, but there can be only one
2 active session at a time.
3
Only supported for 802.1X authentication.
See Firmware Release Notes for details.
SecureStack A2
Functionality
Firmware Version
1.03.xx
Enterasys NetSight Console 10
NetSight Policy Manager Help
802.1X Authentication Type
MAC Authentication Type
MAC Mask (MAC−Auth)
Web−based Authentication Type
(PWA)
Enhanced Login Mode
Redirect Time
Guest Networking
CEP (Convergence End Point)
Single User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
CEP
Multi−User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
802.1X+Web−Based
MAC+Web−Based
802.1X+MAC+Web−Based
CEP
Global Authentication Settings:
Authentication Timeout
Current # of Authenticated
Users
Multi−Users per Port
RFC3580 VLAN Authorization
RFC3580 VLAN Egress
RADIUS Support
RADIUS Accounting
RADIUS Response Conflict
Resolution
VLAN Support (802.1Q)
Drop VLAN Tagged Frame
GVRP
Dynamic Egress
Priority Support (802.1p)
Policy Support
Classification Rules − VLAN
Classification Rules − Priority
(Class of Service)
Policy−based VLAN Egress
Tagged Packet VLAN to Role
Mapping
X
X
X
X
−
−
−
−
−
X
−
−
−
−
X
X
−
X
−
−
−
−
−
−
−
−
(1)
X
X
−
−
<1−4093>/ 1024 max
−
−
−
X
−
−
−
−
−
−
−
Enterasys NetSight Console 11
Authentication−based VLAN to
Role Mapping
IP to Role Mapping
MAC to Role Mapping
Rule Accounting
Port Disabled on Rule Hit
Disable Traffic Classify Type
(Admin−Profile only)
Clear Rule Usage
Invalid Policy Action
Rate Limiting:
Priority−Based
Role−Based
MAC Locking:
Dynamic
Static
ToS/DSCP Rewrite (etsysCoS
MIB)
ToS/DSCP Rewrite (ctPriClassify
MIB)
SNMPv3
NetSight Policy Manager Help
−
−
−
−
−
−
Inbound Only
(2)
−
X
−
−
−
X
1
Only supported for 802.1X authentication.
2
GE ports − 8 rate limits (Priority 0 only); FE ports − 2 rate limits (Priorities 0,1,2,3 and 4,5,6,7). Inbound
Only.
SecureStack B2
Functionality
802.1X Authentication Type
MAC Authentication Type
MAC Mask (MAC−Auth)
Web−based Authentication Type
(PWA)
Enhanced Login Mode
Redirect Time
Guest Networking
CEP (Convergence End Point)
Single User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
CEP
Firmware Version
3.01.xx
4.00.xx (1)
X
X
X
X
X
−
X
−
X
−
−
−
−
Enterasys NetSight Console 12
NetSight Policy Manager Help
Multi−User Authentication Support
(2) :
802.1X
MAC
Web−Based
802.1X+MAC
802.1X+Web−Based
MAC+Web−Based
802.1X+MAC+Web−Based
CEP
Global Authentication Settings:
Authentication Timeout
Current # of Authenticated
Users
Multi−Users per Port
RFC3580 VLAN Authorization
RFC3580 VLAN Egress
RADIUS Support
RADIUS Accounting
RADIUS Response Conflict
Resolution
VLAN Support (802.1Q)
Drop VLAN Tagged Frame
GVRP
Dynamic Egress
Priority Support (802.1p)
X
X
X
X
X
X
X
X
−
−
−
−
(3)(4)
X (5)
X
X
−
−
<1−4093>/ 1024 max
X
X
(6)
X (6)
X
Policy Support
Classification Rules − VLAN
Classification Rules − Priority
(Class of Service)
Policy−based VLAN Egress
Tagged Packet VLAN to Role
Mapping
Authentication−based VLAN to
Role Mapping
IP to Role Mapping
MAC to Role Mapping
Rule Accounting
Port Disabled on Rule Hit
Disable Traffic Classify Type
(Admin−Profile only)
Clear Rule Usage
Invalid Policy Action
Rate Limiting:
Priority−Based
Role−Based
MAC Locking:
Dynamic
Static
ToS/DSCP Rewrite (etsysCoS
MIB)
X
X
X
X
(2)
X
X (7)
−
−
−
−
−
−
−
−
(8)
X
X
(4)
(4)
Enterasys NetSight Console 13
NetSight Policy Manager Help
ToS/DSCP Rewrite (ctPriClassify
MIB)
SNMPv3
−
X
1
This firmware version supports mixed−stacking with SecureStack B3 devices.
2
All three types of authentication can be enabled at the device−level and port−level, but there can be only one
3 active session at a time.
4
One authenticated user and one VoIP phone (with VLAN tagged VoIP traffic) per port.
5
If Policy support is enabled.
6
Only supported for 802.1X authentication.
7
Available, but requires Policy support to enforce.
This feature will not work properly, unless the "Number of Users Allowed" attribute on a port is set to 2.
Only one device−level VLAN to Role mapping is supported. Firmware version 4.00.xx also supports one
8 port−level mapping per port.
GE ports − 8 rate limits (Priority 0 only); FE ports − 2 rate limits (Priorities 0,1,2,3 and 4,5,6,7). Inbound
Only.
SecureStack C2
Functionality
802.1X Authentication Type
MAC Authentication Type
MAC Mask (MAC−Auth)
Web−based Authentication Type
(PWA)
Enhanced Login Mode
Redirect Time
Guest Networking
CEP (Convergence End Point)
Single User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
CEP
Multi−User Authentication Support
(2) :
802.1X
MAC
Web−Based
802.1X+MAC
802.1X+Web−Based
MAC+Web−Based
802.1X+MAC+Web−Based
CEP
Global Authentication Settings:
Firmware Version
4.00.xx
5.00.xx (1)
X
X
X
X
X
−
X
−
X
−
−
−
−
X
X
X
X
X
X
X
−
−
−
Enterasys NetSight Console 14
NetSight Policy Manager Help
Authentication Timeout
Current # of Authenticated
Users
Multi−Users per Port
RFC3580 VLAN Authorization
RFC3580 VLAN Egress
RADIUS Support
RADIUS Accounting
RADIUS Response Conflict
Resolution
VLAN Support (802.1Q)
Drop VLAN Tagged Frame
GVRP
Dynamic Egress
Priority Support (802.1p)
Policy Support
Classification Rules − VLAN
Classification Rules − Priority
(Class of Service)
Policy−based VLAN Egress
Tagged Packet VLAN to Role
Mapping
Authentication−based VLAN to
Role Mapping
IP to Role Mapping
MAC to Role Mapping
Rule Accounting
Port Disabled on Rule Hit
Disable Traffic Classify Type
(Admin−Profile only)
Clear Rule Usage
Invalid Policy Action
Rate Limiting:
Priority−Based
Role−Based
MAC Locking:
Dynamic
Static
ToS/DSCP Rewrite (etsysCoS
MIB)
ToS/DSCP Rewrite (ctPriClassify
MIB)
SNMPv3
X
X
X
−
(3)
(4)
X
X
−
−
<1−4093>/ 1024 max
X
X
X
X
X (5)
X
X (6)
−
−
−
−
−
−
−
−
(7)
X
X
X
X
−
X
1
This firmware version supports mixed−stacking with SecureStack C3 devices.
2
All three types of authentication can be enabled at the device−level and port−level, but there can be only one
3 active session at a time.
One authenticated user and one VoIP phone (with VLAN tagged VoIP traffic) per port.
Enterasys NetSight Console 15
NetSight Policy Manager Help
4
Only supported for 802.1X authentication.
5
See Firmware Release Notes for details.
6
This feature will not work properly, unless the "Number of Users Allowed" attribute on a port is set to 2.
Only one device−level VLAN to Role mapping is supported. Firmware version 5.00.xx also supports one
7 port−level mapping per port.
GE ports − 8 rate limits (Priority 0 only); FE ports − 2 rate limits (Priorities 0,1,2,3 and 4,5,6,7). Inbound
Only.
SecureStack B3
Functionality
802.1X Authentication Type
MAC Authentication Type
MAC Mask (MAC−Auth)
Web−based Authentication Type
(PWA)
Enhanced Login Mode
Redirect Time
Guest Networking
CEP (Convergence End Point)
Single User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
CEP
Multi−User Authentication Support
(1)
:
802.1X
MAC
Web−Based
802.1X+MAC
802.1X+Web−Based
MAC+Web−Based
802.1X+MAC+Web−Based
CEP
Global Authentication Settings:
Authentication Timeout
Current # of Authenticated
Users
Multi−Users per Port
RFC3580 VLAN Authorization
RFC3580 VLAN Egress
RADIUS Support
RADIUS Accounting
RADIUS Response Conflict
Resolution
Firmware Version
1.00.xx
X
X
X
X
X
X
X
X
X
X
X
−
−
−
−
(2)(3)
X
X
X
−
X
−
X
−
−
−
−
(4)
X
X
−
−
Enterasys NetSight Console 16
NetSight Policy Manager Help
VLAN Support (802.1Q)
Drop VLAN Tagged Frame
GVRP
Dynamic Egress
Priority Support (802.1p)
Policy Support
Classification Rules − VLAN
Classification Rules − Priority
(Class of Service)
Policy−based VLAN Egress
Tagged Packet VLAN to Role
Mapping
Authentication−based VLAN to
Role Mapping
IP to Role Mapping
MAC to Role Mapping
Rule Accounting
Port Disabled on Rule Hit
Disable Traffic Classify Type
(Admin−Profile only)
Clear Rule Usage
Invalid Policy Action
Rate Limiting:
Priority−Based
Role−Based
MAC Locking:
Dynamic
Static
ToS/DSCP Rewrite (etsysCoS
MIB)
ToS/DSCP Rewrite (ctPriClassify
MIB)
SNMPv3
<1−4093>/ 1024 max
X
X
(5)
X
(5)
X
X (3)
X
X
X (6)
−
−
−
−
−
−
−
−
−
−
X
X
(3)
−
X
1
All three types of authentication can be enabled at the device−level and port−level, but there can be only one
2 active session at a time.
3
One authenticated user and one VoIP phone (with VLAN tagged VoIP traffic) per port.
4
If Policy support is enabled.
5
Only supported for 802.1X authentication.
6
Available, but requires Policy support to enforce.
This feature will not work properly, unless the "Number of Users Allowed" attribute on a port is set to 2.
Supported on both device and port level, but only one mapping is allowed at the device level and on each port.
SecureStack C3
Functionality
802.1X Authentication Type
Firmware Version
1.00.xx
X
Enterasys NetSight Console 17
NetSight Policy Manager Help
MAC Authentication Type
MAC Mask (MAC−Auth)
Web−based Authentication Type
(PWA)
Enhanced Login Mode
Redirect Time
Guest Networking
CEP (Convergence End Point)
Single User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
CEP
Multi−User Authentication Support
(1)
:
802.1X
MAC
Web−Based
802.1X+MAC
802.1X+Web−Based
MAC+Web−Based
802.1X+MAC+Web−Based
CEP
Global Authentication Settings:
Authentication Timeout
Current # of Authenticated
Users
Multi−Users per Port
X
X
X
X
X
−
X
−
X
−
−
−
−
X
X
X
X
X
X
X
−
−
−
−
(2)
RFC3580 VLAN Authorization
RFC3580 VLAN Egress
RADIUS Support
RADIUS Accounting
RADIUS Response Conflict
Resolution
VLAN Support (802.1Q)
Drop VLAN Tagged Frame
GVRP
Dynamic Egress
Priority Support (802.1p)
Policy Support
Classification Rules − VLAN
Classification Rules − Priority
(Class of Service)
Policy−based VLAN Egress
Tagged Packet VLAN to Role
Mapping
Authentication−based VLAN to
Role Mapping
X (3)
X
X
−
−
<1−4093>/ 1024 max
X
X
X
X
X (4)
X
X (5)
−
−
−
−
Enterasys NetSight Console 18
IP to Role Mapping
MAC to Role Mapping
Rule Accounting
Port Disabled on Rule Hit
Disable Traffic Classify Type
(Admin−Profile only)
Clear Rule Usage
Invalid Policy Action
Rate Limiting:
Priority−Based
Role−Based
MAC Locking:
Dynamic
Static
ToS/DSCP Rewrite (etsysCoS
MIB)
ToS/DSCP Rewrite (ctPriClassify
MIB)
SNMPv3
NetSight Policy Manager Help
−
−
−
−
−
−
X
X
X
−
X
1
All three types of authentication can be enabled at the device−level and port−level, but there can be only one
2 active session at a time.
3
One authenticated user and one VoIP phone (with VLAN tagged VoIP traffic) per port.
4
Only supported for 802.1X authentication.
5
See Firmware Release Notes for details.
This feature will not work properly, unless the "Number of Users Allowed" attribute on a port is set to 2.
Supported on both device and port level, but only one mapping is allowed at the device level and on each port.
Matrix E1
Functionality
802.1X Authentication Type
MAC Authentication Type
MAC Mask (MAC−Auth)
Web−based Authentication Type
(PWA)
Enhanced Login Mode
Redirect Time
Guest Networking
CEP (Convergence End Point)
Single User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
Firmware Version
3.07.xx
X
X
−
X
X
X
X
X
(1)
X
X
X
X
X
Enterasys NetSight Console 19
NetSight Policy Manager Help
CEP
Multi−User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
802.1X+Web−Based
MAC+Web−Based
802.1X+MAC+Web−Based
CEP
Global Authentication Settings:
Authentication Timeout
Current # of Authenticated
Users
Multi−Users per Port
−
−
−
−
−
−
−
−
−
−
−
−
RFC3580 VLAN Authorization
RFC3580 VLAN Egress
RADIUS Support
RADIUS Accounting
RADIUS Response Conflict
Resolution
VLAN Support (802.1Q)
Drop VLAN Tagged Frame
GVRP
Dynamic Egress
Priority Support (802.1p)
Policy Support
Classification Rules − VLAN
Classification Rules − Priority
(Class of Service)
Policy−based VLAN Egress
Tagged Packet VLAN to Role
Mapping
Authentication−based VLAN to
Role Mapping
IP to Role Mapping
MAC to Role Mapping
Rule Accounting
Port Disabled on Rule Hit
Disable Traffic Classify Type
(Admin−Profile only)
Clear Rule Usage
Invalid Policy Action
X
X
X
SNMPv3 Only
X
<1−4094>/ 4094 max
X (RO attribute)
X
X
X
X
−
−
X
−
−
−
−
−
−
X
Rate Limiting:
Priority−Based
Role−Based
MAC Locking:
Dynamic
Static
X
(2)
−
X
X
Enterasys NetSight Console 20
NetSight Policy Manager Help
ToS/DSCP Rewrite (etsysCoS
MIB)
ToS/DSCP Rewrite (ctPriClassify
MIB)
SNMPv3
−
X
X
1
CEP is not supported if Web Authentication is enabled.
2
Eight rate limits, inbound only. Min = 200 Kb/s Max = 1 Gb/s.
Matrix E6/E7
Functionality
802.1X Authentication Type
MAC Authentication Type
MAC Mask (MAC−Auth)
Web−based Authentication Type
(PWA)
Enhanced Login Mode
Redirect Time
Guest Networking
CEP (Convergence End Point)
Single User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
CEP
Multi−User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
802.1X+Web−Based
MAC+Web−Based
802.1X+MAC+Web−Based
CEP
Global Authentication Settings:
Authentication Timeout
Current # of Authenticated
Users
Multi−Users per Port
RFC3580 VLAN Authorization
RFC3580 VLAN Egress
RADIUS Support
RADIUS Accounting
Firmware Version
5.09.xx
X
X
−
X
−
−
−
−
X
X
X
X
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
X
−
Enterasys NetSight Console 21
NetSight Policy Manager Help
RADIUS Response Conflict
Resolution
VLAN Support (802.1Q)
Drop VLAN Tagged Frame
GVRP
Dynamic Egress
Priority Support (802.1p)
Policy Support
Classification Rules − VLAN
Classification Rules − Priority
(Class of Service)
Policy−based VLAN Egress
Tagged Packet VLAN to Role
Mapping
Authentication−based VLAN to
Role Mapping
IP to Role Mapping
MAC to Role Mapping
Rule Accounting
Port Disabled on Rule Hit
Disable Traffic Classify Type
(Admin−Profile only)
Clear Rule Usage
Invalid Policy Action
−
<1−4094>/ 1024 max
X
X
X
X
X
−
−
−
−
−
−
−
−
−
−
Rate Limiting:
Priority−Based
Role−Based
MAC Locking:
Dynamic
Static
ToS/DSCP Rewrite (etsysCoS
MIB)
ToS/DSCP Rewrite (ctPriClassify
MIB)
SNMPv3
X (1)
−
X
X
−
X
−
1
Six rate limits, inbound/outbound. Min = 96 Kb/s Max = 7 Gb/s.
Matrix N−Series Platinum
Functionality
802.1X Authentication Type
MAC Authentication Type
MAC Mask (MAC−Auth)
5.25.xx
Firmware Version
5.31.xx
5.32.xx
5.35.xx
X
X
X
X
X
X
Enterasys NetSight Console 22
NetSight Policy Manager Help
Web−based Authentication Type
(PWA)
Enhanced Login Mode
Redirect Time
Guest Networking
CEP (Convergence End Point)
Single User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
CEP
Multi−User Authentication Support
(1) :
802.1X
MAC
Web−Based
802.1X+MAC
802.1X+Web−Based
MAC+Web−Based
802.1X+MAC+Web−Based
CEP
Global Authentication Settings:
Authentication Timeout
Current # of Authenticated
Users
Multi−Users per Port
RFC3580 VLAN Authorization
RFC3580 VLAN Egress
RADIUS Support
RADIUS Accounting
RADIUS Response Conflict
Resolution
VLAN Support (802.1Q)
Drop VLAN Tagged Frame
GVRP
Dynamic Egress
Priority Support (802.1p)
Policy Support
Classification Rules − VLAN
Classification Rules − Priority
(Class of Service)
Policy−based VLAN Egress
Tagged Packet VLAN to Role
Mapping
Authentication−based VLAN to
Role Mapping
IP to Role Mapping
MAC to Role Mapping
Rule Accounting
X
X
X
−
X
X
X
−
−
−
−
X
X
X
X
X
X
X
X
X
X
X
(2)
−
−
X
X
X
<1−4094>/ 1024 max
X
X
X
X
X
X
X
−
X
X
X
X
X
X
X
X
X
−
X
X
X
−
−
−
−
X
X
X
X
X
X
X
X
X
X
X
(2)
X
X
X
X
X
<1−4094>/ 1024 max
X
X
X
X
X
X
X
X
X
X
X
X
X
X
Enterasys NetSight Console 23
NetSight Policy Manager Help
X X Port Disabled on Rule Hit
Disable Traffic Classify Type
(Admin−Profile only)
Clear Rule Usage
Invalid Policy Action
Rate Limiting (3) :
Priority−Based
Role−Based
MAC Locking:
Dynamic
Static
ToS/DSCP Rewrite (etsysCoS
MIB)
ToS/DSCP Rewrite (ctPriClassify
MIB)
SNMPv3
X
X
X
X
X
−
X
X
X
X
X
−
X X
1
The maximum number of users per device can be increased if an appropriate key is entered using the CLI on
2 the device. Refer to the firmware documentation for more details.
For 802.1X, Web−based, and MAC authentication, Gigabit Ethernet supports 128 users per port and Fast
Ethernet supports eight users per port. The number of users per port can be increased if an appropriate key is
3 entered using the CLI on the device. Refer to the firmware documentation for more details.
There are important differences in priority−based rate limit behavior on N−Series Platinum devices. For more
information, see Priority−Based Rate Limiting on N−Series Platinum Devices.
Matrix N−Series Gold
Functionality
802.1X Authentication Type
MAC Authentication Type
MAC Mask (MAC−Auth)
Web−based Authentication Type
(PWA)
Enhanced Login Mode
Redirect Time
Guest Networking
CEP (Convergence End Point)
Single User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
CEP
X
X
−
X
X
5.25.xx
Firmware Version
5.31.xx
5.32.xx
5.35.xx
X
X
X
X
X
X
X
X
−
X
X
X
−
−
−
−
X
−
−
−
−
Enterasys NetSight Console 24
NetSight Policy Manager Help
Multi−User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
802.1X+Web−Based
MAC+Web−Based
802.1X+MAC+Web−Based
CEP
Global Authentication Settings:
Authentication Timeout
Current # of Authenticated
Users
Multi−Users per Port
RFC3580 VLAN Authorization
RFC3580 VLAN Egress
RADIUS Support
RADIUS Accounting
RADIUS Response Conflict
Resolution
VLAN Support (802.1Q)
Drop VLAN Tagged Frame
GVRP
Dynamic Egress
Priority Support (802.1p)
Policy Support
Classification Rules − VLAN
Classification Rules − Priority
(Class of Service)
Policy−based VLAN Egress
Tagged Packet VLAN to Role
Mapping
Authentication−based VLAN to
Role Mapping
IP to Role Mapping
MAC to Role Mapping
Rule Accounting
Port Disabled on Rule Hit
Disable Traffic Classify Type
(Admin−Profile only)
Clear Rule Usage
Invalid Policy Action
Rate Limiting:
Priority−Based
Role−Based
MAC Locking:
Dynamic
Static
ToS/DSCP Rewrite (etsysCoS
MIB)
X
X
X
X
X
X
X
X
X
X
X
X
X
(1)
−
−
X
X
X
<1−4094>/ 1024 max
X
X
X
X
X (max 63 roles)
X
−
−
−
−
−
−
X
−
X
(2)
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
(1)
X
X
X
X
X
<1−4094>/ 1024 max
X
X
X
X
X (max 63 roles)
X
−
X
−
−
−
−
X
−
X
(2)
X
X
X
X
Enterasys NetSight Console 25
NetSight Policy Manager Help
ToS/DSCP Rewrite (ctPriClassify
MIB)
SNMPv3
− −
X X
1
Supports two users per port.
2
GE ports − 8 inbound/8 outbound. FE ports − 8 inbound/4 outbound.
Matrix V2
Functionality
802.1X Authentication Type
MAC Authentication Type
MAC Mask (MAC−Auth)
Web−based Authentication Type
(PWA)
Enhanced Login Mode
Redirect Time
Guest Networking
CEP (Convergence End Point)
Single User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
CEP
Multi−User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
802.1X+Web−Based
MAC+Web−Based
802.1X+MAC+Web−Based
CEP
Global Authentication Settings:
Authentication Timeout
Current # of Authenticated
Users
Multi−Users per Port
RFC3580 VLAN Authorization
RFC3580 VLAN Egress
RADIUS Support
RADIUS Accounting
RADIUS Response Conflict
Resolution
Firmware Version
2.5.0.x
X
−
−
−
−
−
−
−
X
−
−
−
−
X
X
X
−
−
−
−
−
−
−
−
−
−
−
−
−
−
Enterasys NetSight Console 26
VLAN Support (802.1Q)
Drop VLAN Tagged Frame
GVRP
Dynamic Egress
Priority Support (802.1p)
Policy Support
Classification Rules − VLAN
Classification Rules − Priority
(Class of Service)
Policy−based VLAN Egress
Tagged Packet VLAN to Role
Mapping
Authentication−based VLAN to
Role Mapping
IP to Role Mapping
MAC to Role Mapping
Rule Accounting
Port Disabled on Rule Hit
Disable Traffic Classify Type
(Admin−Profile only)
Clear Rule Usage
Invalid Policy Action
Rate Limiting:
Priority−Based
Role−Based
MAC Locking:
Dynamic
Static
ToS/DSCP Rewrite (etsysCoS
MIB)
ToS/DSCP Rewrite (ctPriClassify
MIB)
SNMPv3
RoamAbout R2
Functionality
802.1X Authentication Type
MAC Authentication Type
MAC Mask (MAC−Auth)
Web−based Authentication Type
(PWA)
Enhanced Login Mode
Redirect Time
Guest Networking
NetSight Policy Manager Help
X
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
Firmware Version
5.04.xx
6.xx.xx
X
X
−
−
−
−
−
Enterasys NetSight Console 27
NetSight Policy Manager Help
CEP (Convergence End Point)
Single User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
CEP
Multi−User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
802.1X+Web−Based
MAC+Web−Based
802.1X+MAC+Web−Based
CEP
Global Authentication Settings:
Authentication Timeout
Current # of Authenticated
Users
Multi−Users per Port
RFC3580 VLAN Authorization
RFC3580 VLAN Egress
RADIUS Support
RADIUS Accounting
RADIUS Response Conflict
Resolution
VLAN Support (802.1Q)
Drop VLAN Tagged Frame
GVRP
Dynamic Egress
Priority Support (802.1p)
Policy Support
Classification Rules − VLAN
Classification Rules − Priority
(Class of Service)
Policy−based VLAN Egress
Tagged Packet VLAN to Role
Mapping
Authentication−based VLAN to
Role Mapping
IP to Role Mapping
MAC to Role Mapping
Rule Accounting
Port Disabled on Rule Hit
Disable Traffic Classify Type
(Admin−Profile only)
Clear Rule Usage
Invalid Policy Action
−
X
X
−
X
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
X
−
−
Permit/Deny Traffic Only
−
−
−
−
X
−
−
−
−
−
−
−
−
−
−
−
Enterasys NetSight Console 28
NetSight Policy Manager Help
Rate Limiting:
Priority−Based
Role−Based
MAC Locking:
Dynamic
Static
ToS/DSCP Rewrite (etsysCoS
MIB)
ToS/DSCP Rewrite (ctPriClassify
MIB)
SNMPv3
RoamAbout AP3000
Functionality
802.1X Authentication Type
MAC Authentication Type
MAC Mask (MAC−Auth)
Web−based Authentication Type
(PWA)
Enhanced Login Mode
Redirect Time
Guest Networking
CEP (Convergence End Point)
Single User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
CEP
Multi−User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
802.1X+Web−Based
MAC+Web−Based
802.1X+MAC+Web−Based
CEP
Global Authentication Settings:
Authentication Timeout
Current # of Authenticated
Users
Multi−Users per Port
Firmware Version
2.00.06
X
(1)
X (1)
−
V3.1.0
X
X
(1)
(1)
−
−
−
−
−
−
X
X
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
X
X
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
X
Enterasys NetSight Console 29
RFC3580 VLAN Authorization
RFC3580 VLAN Egress
RADIUS Support
RADIUS Accounting
RADIUS Response Conflict
Resolution
VLAN Support (802.1Q)
Drop VLAN Tagged Frame
GVRP
Dynamic Egress
Priority Support (802.1p)
Policy Support
Classification Rules − VLAN
Classification Rules − Priority
(Class of Service)
Policy−based VLAN Egress
Tagged Packet VLAN to Role
Mapping
Authentication−based VLAN to
Role Mapping
IP to Role Mapping
MAC to Role Mapping
Rule Accounting
Port Disabled on Rule Hit
Disable Traffic Classify Type
(Admin−Profile only)
Clear Rule Usage
Invalid Policy Action
Rate Limiting:
Priority−Based
Role−Based
MAC Locking:
Dynamic
Static
ToS/DSCP Rewrite (etsysCoS
MIB)
ToS/DSCP Rewrite (ctPriClassify
MIB)
SNMPv3
X (1)
−
X
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
X
−
−
−
−
−
−
−
−
NetSight Policy Manager Help
X (1)
−
X
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
X
−
−
−
−
−
−
−
−
X X
1
Authentication settings and RFC3580 VLAN Authorization must be configured via the AP3000's Web
Interface.
RoamAbout AP4102
Functionality
802.1X Authentication Type
Firmware Version
V1.1.00
X (1)
Enterasys NetSight Console 30
NetSight Policy Manager Help
MAC Authentication Type
MAC Mask (MAC−Auth)
Web−based Authentication Type
(PWA)
Enhanced Login Mode
Redirect Time
Guest Networking
CEP (Convergence End Point)
Single User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
CEP
Multi−User Authentication
Support:
802.1X
MAC
Web−Based
802.1X+MAC
802.1X+Web−Based
MAC+Web−Based
802.1X+MAC+Web−Based
CEP
Global Authentication Settings:
Authentication Timeout
Current # of Authenticated
Users
Multi−Users per Port
X (1)
−
−
−
−
−
−
X
X
−
−
−
−
−
−
−
−
−
−
−
−
−
−
−
RFC3580 VLAN Authorization
RFC3580 VLAN Egress
RADIUS Support
RADIUS Accounting
RADIUS Response Conflict
Resolution
VLAN Support (802.1Q)
Drop VLAN Tagged Frame
GVRP
Dynamic Egress
Priority Support (802.1p)
Policy Support
Classification Rules − VLAN
Classification Rules − Priority
(Class of Service)
Policy−based VLAN Egress
Tagged Packet VLAN to Role
Mapping
Authentication−based VLAN to
Role Mapping
X (1)
−
X
−
−
Permit/Deny Traffic Only
−
−
−
−
X
−
−
−
−
−
−
−
Enterasys NetSight Console 31
IP to Role Mapping
MAC to Role Mapping
Rule Accounting
Port Disabled on Rule Hit
Disable Traffic Classify Type
(Admin−Profile only)
Clear Rule Usage
Invalid Policy Action
Rate Limiting:
Priority−Based
Role−Based
MAC Locking:
Dynamic
Static
ToS/DSCP Rewrite (etsysCoS
MIB)
ToS/DSCP Rewrite (ctPriClassify
MIB)
SNMPv3
NetSight Policy Manager Help
−
−
−
−
−
−
−
−
−
−
X
1
Authentication settings must be configured via the AP4102's Web Interface.
Table 3: VLAN/Priority Classification Rule Support Table
I3
Layer 2
Ethertype
DSAP/SSAP
MAC Address Source
MAC Address Destination
MAC Address Bilateral
VLAN ID
Priority
IP Type of Service
IP Protocol Type
IP Address Source
VLAN
YES
NO
NO
NO
NO
NO
NO
Permit/Deny
Only
Permit/Deny
Only
(range)
Permit/Deny
Only
Priority
YES
NO
NO
NO
NO
NO
NO
YES
YES
(range)
YES
(IP masking)
Enterasys NetSight Console
Layer 3
32
IP Address Destination
IP Address Bilateral
IP Socket Source
IP Socket Destination
IP Socket Bilateral
IP Fragment
IPX Class of Service
IPX Packet Type
IPX Network Source
IPX Network Destination
IPX Network Bilateral
IPX Socket Source
IPX Socket Destination
IPX Socket Bilateral
ICMP
IP UDP Port Source
IP UDP Port Destination
IP UDP Port Bilateral
Layer 4
IP TCP Port Source
NetSight Policy Manager Help
NO
Permit/Deny
Only
(port range)
Permit/Deny
Only
(port range)
Permit/Deny
Only
(port range)
Permit/Deny
Only
(port range)
(IP masking)
Permit/Deny
Only
(IP masking)
Permit/Deny
Only
(IP masking)
Permit/Deny
Only
(port w/ masking)
Permit/Deny
Only
(port w/ masking)
Permit/Deny
Only
(port w/ masking)
NO
YES
(IP masking)
YES
(IP masking)
YES
(port w/ masking)
YES
(port w/ masking)
YES
(port w/ masking)
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
YES
(port range)
YES
(port range)
YES
(port range)
YES
(port range)
Enterasys NetSight Console 33
IP TCP Port Destination
IP TCP Port Bilateral
IP UDP Port Src Range
IP UDP Port Des Range
IP UDP Port Bi Range
IP TCP Port Src Range
IP TCP Port Des Range
IP TCP Port Bi Range
Ethertype
DSAP/SSAP
Layer 2
MAC Address Source
MAC Address Destination
MAC Address Bilateral
VLAN ID
Priority
IP Type of Service
IP Protocol Type
NetSight Policy Manager Help
Permit/Deny
Only
(port range)
Permit/Deny
Only
(port range)
Permit/Deny
Only
Permit/Deny
Only
Permit/Deny
Only
Permit/Deny
Only
Permit/Deny
Only
Permit/Deny
Only
YES
(port range)
YES
(port range)
YES
YES
YES
YES
YES
YES
VLAN
YES
2
(range)
NO
Permit/Deny
Only
(MAC masking)
Permit/Deny
Only
(MAC masking)
C2/B2
1
Priority
YES
(range)
NO
YES
(MAC masking)
YES
(MAC masking)
Permit/Deny
Only
(MAC masking)
NO
3
NO
Permit/Deny
Only
Permit/Deny
Only
YES
(MAC masking)
NO
NO
3
YES
YES
(range)
Enterasys NetSight Console
NO
NO
NO
NO
Permit/Deny
Only
Permit/Deny
Only
VLAN
C3/B3
1
Priority
NO
NO
NO
NO
NO NO
NO
NO
NO
NO
YES
YES
(range)
34
Layer 3
IP Address Source
IP Address Destination
IP Address Bilateral
IP Socket Source
IP Socket Destination
IP Socket Bilateral
IP Fragment
IPX Class of Service
IPX Packet Type
IPX Network Source
IPX Network Destination
IPX Network Bilateral
IPX Socket Source
IPX Socket Destination
IPX Socket Bilateral
ICMP
IP UDP Port Source
IP UDP Port Destination
IP UDP Port Bilateral
NetSight Policy Manager Help
(range)
Permit/Deny
Only
(IP masking)
Permit/Deny
Only
(IP masking)
Permit/Deny
Only
(IP masking)
YES
(IP masking)
YES
(IP masking)
YES
(IP masking)
YES
(port w/ masking)
Permit/Deny Only
(port w/ masking)
Permit/Deny
Only
(port w/ masking)
Refer to
IP Socket Src/Dest
(port w/ masking)
NO
NO
NO
NO
NO
NO
NO
NO
NO
Permit/Deny
Only
(range)
Permit/Deny
Only
(port range)
Permit/Deny
Only
(port range)
Permit/Deny
YES
(port w/ masking)
YES
(port w/ masking)
YES
(range)
YES
(port range)
YES
(port range)
YES
NO
NO
NO
NO
NO
NO
NO
NO
NO
(range)
Permit/Deny
Only
(IP masking)
Permit/Deny
Only
(IP masking)
Permit/Deny
Only
(IP masking)
YES
(port w/ masking)
Permit/Deny
Only
(port w/ masking)
Refer to
IP Socket Src/Dest
(port w/ masking)
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
YES
(IP masking)
YES
(IP masking)
YES
(IP masking)
YES
(port w/ masking)
YES
(port w/ masking)
YES
(port w/ masking)
NO
NO
NO
NO
Permit/Deny
Only
(port range)
Permit/Deny
Only
(port range)
Permit/Deny
NO
YES
(port range)
YES
(port range)
YES
Enterasys NetSight Console
Layer 4
35
IP TCP Port Source
IP TCP Port Destination
IP TCP Port Bilateral
IP UDP Port Src Range
IP UDP Port Des Range
IP UDP Port Bi Range
IP TCP Port Src Range
IP TCP Port Des Range
IP TCP Port Bi Range
NetSight Policy Manager Help
Only
(port range)
Permit/Deny
Only
(port range)
Permit/Deny
Only
(port range)
Permit/Deny
Only
(port range)
Permit/Deny
Only
Permit/Deny
Only
Permit/Deny
Only
Permit/Deny
Only
Permit/Deny
Only
Permit/Deny
Only
(port range)
YES
(port range)
YES
(port range)
YES
(port range)
YES
YES
YES
YES
YES
YES
Only
(port range)
Permit/Deny
Only
(port range)
Permit/Deny
Only
(port range)
Permit/Deny
Only
(port range)
Permit/Deny
Only
Permit/Deny
Only
Permit/Deny
Only
Permit/Deny
Only
Permit/Deny
Only
Permit/Deny
Only
(port range)
YES
(port range)
YES
(port range)
YES
(port range)
YES
YES
YES
YES
YES
YES
1
If Policy support is enabled.
2
VLAN support varies depending on versions. See your firmware release notes for more information.
3
VLAN ID traffic classification rules can be configured on C2 devices with firmware versions 3.01.xx or older, using CLI.
Layer 2
Ethertype
DSAP/SSAP
MAC Address Source
MAC Address Destination
E1 (WS & GWS)
VLAN Priority
YES
YES
YES
YES
3.02.xx and newer
Permit/Deny Only
Prior firmware
Discard Only
3.02.xx and newer
Permit/Deny Only
Prior firmware
Discard Only
YES
YES
VLAN
YES
YES
E6/E7
Priority
YES
YES
YES
YES
YES
YES
Enterasys NetSight Console 36
MAC Address Bilateral
VLAN ID
Priority
IP Type of Service
IP Protocol Type
IP Address Source
IP Address Destination
IP Address Bilateral
Layer 3
IP Socket Source
IP Socket Destination
IP Socket Bilateral
IP Fragment
IPX Class of Service
IPX Packet Type
NetSight Policy Manager Help
3.02.xx and newer
Permit/Deny Only
Prior firmware
Discard Only
NO
YES YES YES
NO NO NO
NO
3.02.xx and newer
Permit/Deny Only
Prior firmware
Discard Only
3.02.xx and newer
Permit/Deny Only
Prior firmware
Discard Only
NO
YES
YES
3.02.xx and newer
Permit/Deny Only
(IP masking)
Prior firmware
Discard Only
(IP masking)
YES
(IP masking)
NO
YES
YES
NO
YES
YES
YES
(IP masking)
YES
(IP masking)
3.02.xx and newer
Permit/Deny Only
(masking)
Prior firmware
Discard Only
(IP masking)
YES
(IP masking)
YES
(IP masking)
YES
(IP masking)
3.02.xx and newer
Permit/Deny Only
(masking)
Prior firmware
Discard Only
(IP masking)
YES
(IP masking)
YES
(IP masking)
YES
(IP masking)
NO
NO
NO
NO
3.2 and newer
Permit/Deny Only
Prior firmware
Discard Only
3.2 and newer
Permit/Deny Only
Prior firmware
Discard Only
NO
NO
NO
NO
YES
YES
NO
NO
NO
YES
YES
YES
NO
NO
NO
YES
YES
YES
Enterasys NetSight Console 37
IPX Network Source
IPX Network Destination
IPX Network Bilateral
IPX Socket Source
IPX Socket Destination
IPX Socket Bilateral
ICMP
IP UDP Port Source
IP UDP Port Destination
IP UDP Port Bilateral
IP TCP Port Source
Layer 4
IP TCP Port Destination
IP TCP Port Bilateral
NetSight Policy Manager Help
NO
3.02.xx and newer
Permit/Deny Only
Prior firmware
Discard Only
3.02.xx and newer
Permit/Deny Only
Prior firmware
Discard Only
3.02.xx and newer
Permit/Deny Only
Prior firmware
Discard Only
3.02.xx and newer
Permit/Deny Only
Prior firmware
Discard Only
3.2 and newer
Permit/Deny Only
Prior firmware
Discard Only
3.2 and newer
Permit/Deny Only
Prior firmware
Discard Only
3.2 and newer
Permit/Deny Only
Prior firmware
Discard Only
3.2 and newer
Permit/Deny Only
Prior firmware
Discard Only
3.2 and newer
Permit/Deny Only
Prior firmware
Discard Only
3.2 and newer
Permit/Deny Only
Prior firmware
Discard Only
3.02.xx and newer
Permit/Deny Only
Prior firmware
Discard Only
3.02.xx and newer
Permit/Deny Only
YES
YES
YES
YES
YES
YES
NO
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
NO
YES
YES
YES
YES
YES
YES
Enterasys NetSight Console
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
NO
YES
38
IP UDP Port Src Range
IP UDP Port Des Range
IP UDP Port Bi Range
IP TCP Port Src Range
IP TCP Port Des Range
IP TCP Port Bi Range
NetSight Policy Manager Help
Prior firmware
Discard Only
3.02.xx and newer
Permit/Deny Only
Prior firmware
Discard Only
3.02.xx and newer
Permit/Deny Only
Prior firmware
Discard Only
3.02.xx and newer
Permit/Deny Only
Prior firmware
Discard Only
3.02.xx and newer
Permit/Deny Only
Prior firmware
Discard Only
3.02.xx and newer
Permit/Deny Only
Prior firmware
Discard Only
3.2 and newer
Permit/Deny Only
Prior firmware
Discard Only
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
Ethertype
DSAP/SSAP
Layer
2
MAC Address
Source
MAC Address
Destination
MAC Address
Bilateral
VLAN ID
N−Series Platinum
VLAN
YES
(range)
Priority
YES
(range)
YES
(DSAP/SSAP masking)
YES
(DSAP/SSAP masking)
YES
(MAC masking)
YES
(MAC masking)
YES
(MAC masking)
YES
(MAC masking)
YES
(MAC masking)
YES
(MAC masking)
YES
(VLAN ID range)
YES
(VLAN ID range)
N−Series Gold
VLAN Priority
YES YES
YES
YES
YES
YES
NO
YES
YES
YES
YES
NO
YES
YES
YES
YES
YES
YES
R2/AP4102
VLAN Priority
NO NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
Enterasys NetSight Console 39
Priority
IP Type of
Service
IP Protocol Type
IP Address
Source
IP Address
Destination
YES
NetSight Policy Manager Help
YES NO
YES
YES
(range)
YES
(IP masking)
YES
(IP masking)
IP Address
Bilateral
Layer
3
IP Socket Source
YES
(IP masking)
IP Socket
Destination
IP Socket
Bilateral
IP Fragment
IPX Class of
Service
IPX Packet Type
IPX Network
Source
IPX Network
Destination
IPX Network
Bilateral
IPX Socket
Source
IPX Socket
Destination
IPX Socket
Bilateral
YES
(port range)
YES
(port range)
YES
(port range)
YES
(port range)
YES
(port range)
YES
(port range)
YES
(port w/ masking)
YES
(port w/ masking)
YES
(port w/ masking)
YES
YES
(port range)
YES
(port range)
YES
YES
(range)
YES
(IP masking)
YES
(IP masking)
YES
(IP masking)
YES
(port range)
YES
(port range)
YES
(port range)
YES
(port range)
YES
(port range)
YES
(port range)
YES
(port w/ masking)
YES
(port w/ masking)
YES
(port w/ masking)
YES
YES
(port range)
YES
(port range)
YES
YES
YES
(IP masking)
YES
(IP masking)
YES
(IP masking)
NO
NO
NO
YES
NO
NO
NO
NO
NO
NO
NO
NO
NO
YES
NO
NO
Permit/Deny
Only
YES
YES
(IP masking)
YES
(IP masking)
YES
(IP masking)
NO
Permit/Deny
Only
NO
NO
NO
NO
YES
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
Enterasys NetSight Console 40
Layer
4
ICMP
IP UDP Port
Source
IP UDP Port
Destination
IP UDP Port
Bilateral
IP TCP Port
Source
IP TCP Port
Destination
IP TCP Port
Bilateral
IP UDP Port Src
Range
IP UDP Port Des
Range
IP UDP Port Bi
Range
IP TCP Port Src
Range
IP TCP Port Des
Range
YES
NetSight Policy Manager Help
YES
YES
(IP w/ masking)
YES
(IP w/ masking)
YES
(IP w/ masking)
YES
(IP w/ masking)
YES
(IP w/ masking)
YES
(IP w/ masking)
YES
(IP w/ masking)
YES
(IP w/ masking)
YES
(IP w/ masking)
YES
(IP w/ masking)
YES
(IP w/ masking)
YES
(IP w/ masking)
NO
YES
(IP w/ masking)
YES
(IP w/ masking)
YES
(IP w/ masking)
YES
(IP w/ masking)
YES
(IP w/ masking)
YES
(IP w/ masking)
NO
YES
(IP w/ masking)
YES
(IP w/ masking)
YES
(IP w/ masking)
YES
(IP w/ masking)
YES
(IP w/ masking)
YES
(IP w/ masking)
NO
Permit/Deny
Only
Permit/Deny
Only
Permit/Deny
Only
Permit/Deny
Only
Permit/Deny
Only
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
Permit/Deny
Only
AP4102 and
R2
4.00.xx and newer
Permit/Deny
Only
AP4102 and
R2
4.00.xx and newer
Permit/Deny
Only
AP4102 and
R2
4.00.xx and newer
Permit/Deny
Only
AP4102 and
R2
4.00.xx and newer
Permit/Deny
Only
AP4102 and
R2
4.00.xx and newer
Permit/Deny
Enterasys NetSight Console
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
NO
41
IP TCP Port Bi
Range
YES
NetSight Policy Manager Help
YES YES YES
Only
AP4102 and
R2
4.00.xx and newer
Permit/Deny
Only
NO
The following devices do not support VLAN/Priority traffic classification rules:
Device
SecureStack A2
Matrix V2
AP3000
VLAN/Priority Classification Rule Support
Not Supported
Not Supported
Not Supported
INSTALLATION:
When you purchased Policy Manager, you received a Licensed Product Entitlement ID that allows you to generate a product license. Prior to installing Policy Manager, you must redeem your Entitlement ID for a product license. Refer to the instructions included with the Entitlement that was sent to you. (For more information, see http://www.enterasys.com/products/management/
.)
The NetSight Installer (InstallAnywhere
®
by Zero G Software, Inc.) leads you through a series of windows that ask you for all the information required in order to install Policy Manager. In one of the windows, you will need to enter the license text that you receive when you redeem your Entitlement ID. When you finish with the series of windows, Policy Manager is installed according to your specification.
For complete installation instructions, refer to the installation documentation located on the NetSight
Documentation web page: http://www.enterasys.com/support/manuals/netsight.html
.
If you will be installing from a CD, you can also access the installation instructions from the CD with a web browser by opening the install.htm
file located in the top−level directory.
Evaluation Copy
If you have requested a Policy Manager evaluation license, you will receive a License Key. Evaluation requests for each product are limited to three 30−day instances. To upgrade from an evaluation copy of Policy
Manager to a purchased copy, contact your Enterasys Networks Representative to purchase the software and receive an Entitlement ID. You do not need to reinstall the software to perform the conversion.
Warning:
If you have installed an evaluation copy of this software, be sure to remove all policies from your devices prior to letting your evaluation copy expire. Without Policy
Manager, there is no way to remove policies from your devices short of clearing
INSTALLATION: 42
non−volatile RAM.
NetSight Policy Manager Help
Upgrading from a Previous Version
NOTE:
If you are upgrading from Policy Manager version 2.1 you do not need to purchase a new product license.
If you are upgrading from a previous version of Policy Manager (version 1.5 or newer) to version 2.3, follow these instructions:
1. Exit Policy Manager.
2.
Install Policy Manager 2.3 according to the Installation instructions.
3.
4.
Read the If You are Upgrading Help topic for information on new and changed functionality in
version 2.0.
5. If you are upgrading from a version prior to 2.0, you can import your .pmd files into version 2.3 to
preserve your network information. Refer to Importing a File into a Domain for specific information
on importing your Policy Manager database.
6. If you are upgrading Policy Manager in conjunction with a firmware upgrade, download the firmware to your devices and reset them. Then, be sure to Refresh your devices in Policy Manager (select the
All Devices folder in the Network Elements tab and choose View > Refresh from the menu).
Upgrade Considerations
•
Well−known identifiers (IDs). If you have edited the pre−defined list of well−known identifiers
(IDs) (Version 1.5 or newer), you may see the following Event Log message when launching Policy
Manager 2.3: "Policy Manager has found a newer version of the Well Known IDs file. The new file will not be overwritten by the old one. Please update the new file with IDs defined in the older file."
To update your new file you can either:
−− recreate your older version well−known IDs in version 2.3 or
−− copy your old wellknowns
file from
C:\Documents and Settings\[username]
to
C:\Documents and Settings\[username]\Users\AllUsers . Be aware that this will overwrite any well−known IDs in the new file.
CONSIDERATIONS
Class of Service Mode Support
•
The following Role−Based Rate Limit functions are not supported in release 2.3 of Policy Manager:
•
Outbound role−based rate limits
•
Low latency queuing
•
Rate shaping algorithm
•
These will be available in a future release.
On Matrix N Series and SecureStack C2 and B2 devices, the IP type of service (ToS) value of a Class of Service (CoS) is only used if the Class of Service mode is set to Role−Based Rate Limits on the device General tab.
Upgrading from a Previous Version 43
NetSight Policy Manager Help
Authenticating without Policy
This section discusses how authentication works in a network where end users must authenticate, but there are no roles (policy) for authenticated users defined on the network devices.
The following table shows Authentication Behavior for each device type when the authenticated role is not defined on the device:
Authentication
Type
802.1X
Matrix N−Series
Gold and Platinum
Successful
MAC
Successful
Web−Based
Successful
Matrix E6/E7
Successful
Successful
Successful on firmware version 5.06.x.
Failed on older firmware versions.
Matrix E1
RoamAbout R2
RoamAbout AP3000
Successful Successful
Successful Successful
SecureStack C2/B2
Successful
Successful
Successful
Web−Based Auth
Not Supported
Successful
The following table shows Authenticated Traffic Behavior for each device type when the authenticated role is not defined on the device:
Authentication
Type
802.1X
MAC
Matrix N−Series
Gold and Platinum
4.11 and earlier
1
1
Web−Based
1
Matrix N−Series
Gold and Platinum
5.01 and later
3
3
3
Matrix E6/E7 Matrix E1
RoamAbout R2
RoamAbout AP3000
2
2
2
2
2
2
3
3
Web−Based Auth
Not Supported
SecureStack
C2/B2
2
2
2
1 − Traffic is forwarded based on the 802.1Q PVID and 802.1p priority for the port, regardless of whether the port has been assigned a default role. Authenticated users will display a current role of "None" in the Port
Usage tab.
2 − Traffic is forwarded based on the port's default role and authenticated users will display the default role as their current role in the Port Usage tab. If no default role has been assigned to the port, the port's 802.1Q
PVID and 802.1p priority are used, and the current role will be "None."
3 − Traffic is forwarded based on the Invalid Role Action configuration at the device level in Policy Manager.
Terminating Role Override Sessions
On Port Usage tabs, you cannot terminate Role Override (IP) or Role Override (MAC) sessions that were created through the CLI (command line interface).
Role Precedence for the Matrix N−Series Platinum
The following precedence determines the role (policy) that is being applied on a user/port on a Matrix
N−Series Platinum device. The precedence used depends on whether the device is configured for multi−user authentication or single user authentication.
Authenticating without Policy 44
NetSight Policy Manager Help
Multi−User Authentication:
Devices configured with multi−user authentication use the following precedence when applying a role on a user/port (starting with the highest precedence):
MAC override policy (created by ASM)
Authenticated role
MAC−to−Role mapping
IP override policy (created by ASM)
IP−to−Role mapping
VLAN−to−Role mapping
Default port role
Single User Authentication:
Devices configured with single user authentication use the following precedence when applying a role on a user/port (starting with the highest precedence):
MAC override policy (created by ASM)
MAC−to−Role mapping
IP override policy (created by ASM)
IP−to−Role mapping
Authenticated role
VLAN−to−Role mapping
Default port role
Port−Level MAC to Role Mappings
Enforcing port−level MAC to Role mappings could potentially remove rules that were created by NetSight
Automated Security Manager (ASM) as an intrusion detection response.
Import From Device
If you perform a Verify operation following an Import Policy Configuration from Device, the Verify may fail.
This is because the import operation imports only roles and rules from the device, not the complete policy configuration. Also, when you import device−specific rules, these rules are converted to a Rule Type of "All
Devices," and this will cause Verify to fail. If you want the rules to be device−specific, you will have to change their Rule Type via the Rule General tab after the import and prior to Enforce.
MATRIX C1 POLICY SUPPORT:
Policy support on Matrix C1 devices utilizes both a port−level role and a device−level role. In Policy
Manager, a role is a set of network access services made up of traffic classification rules. It may also contain default Access Control (VLAN) and/or Class of Service settings that will be applied to traffic not handled specifically by the rules contained in the role. Although both the device−level and port−level roles may contain all of these components, only certain portions of each role are used when applied to a port on a C1 device.
On the Matrix C1, classification rules are implemented at the device level through a device−level role. Policy
Manager allows you to set a unique device−level role for each C1 device. The device−level role is a regular role that defines how inbound traffic is handled in terms of classification rules and default Class of Service assignment. In other words, all classification rules are taken from the device−level role, and any rules defined in the port−level role are ignored when applied to a port. The Class of Service setting is also implemented
Port−Level MAC to Role Mappings 45
NetSight Policy Manager Help through the device−level role and ignored in the port−level role. However, the default Access Control setting of the device−level role is ignored, and is defined through the port−level role.
Classification rules from the device−level role are only applied to ports which also have a port−level role applied (either statically or dynamically). This allows you to exclude the device−level role from uplink ports and hosts ports, by not applying a port−level role to these ports and not enabling authentication on them.
When a port−level role is applied to a port, it overrides any PVID and Class of Service settings defined on the port through Console or local management. When a device−level role is applied to a port, it also overrides these PVID and Class of Service settings, and overrides any Class of Service setting defined in the port−level role. It does not override any default Access Control setting defined in the port−level role.
In addition, if the port−level role's default Access Control is configured to deny traffic (discard VLAN) then
all inbound traffic will be discarded even if it matches a (forward) classification rule.
C1 Considerations
Review the following considerations prior to configuring policy on Matrix C1 devices:
•
C1 devices limit the number of rules you can create for some classification types. Refer to the C1
information in Table 3 to see which classification types limit the number of rules.
SECURESTACK C2 AND B2 CONSIDERATIONS:
Review the following considerations prior to configuring policy on SecureStack C2 and B2 devices.
•
TCI Overwrite is always set to Enabled on SecureStack C2 and B2 devices.
•
On SecureStack C2 and B2 gigabit and 10/100 ports, the number of rules per port is restricted. Refer to your C2 and B2 firmware release notes for the maximum number of rules that can be utilized on a
• port.
SecureStack C2 and B2 10/100 ports support two priority−based rate limits (inbound only). When creating a rate limit to be used on SecureStack C2 and B2 10/100 ports, create the limit with either
Low priority to associate the rate limit with priorities 0−3 or High priority to associate the rate limit with priorities 4−7. You can specify both Low and High priorities if you want to associate the rate
• limit with priorities 0−7.
SecureStack C2 and B2 devices do not support setting a default role on a logical port.
•
On SecureStack C2 and B2 devices, it is strongly recommended that you do not enforce rules that assign a Class of Service (CoS) that includes Priority 7. Doing so will interfere with stack
• communication.
SecureStack C2 and B2 devices do not allow a mask for an IP type of service (ToS) rewrite value
• associated with a class of service (CoS); they will always use ff.
SecureStack C2 and B2 devices do not support VLAN ID traffic classification rules. C2 devices
(firmware 3.02.xx and newer) and B2 devices (firmware 2.xx.xx) support device−level VLAN to Role mapping. However, VLAN ID traffic classification rules can be configured on C2 devices with
• firmware versions 3.01.xx or older, using CLI.
In order for VLAN to Role mapping to work on SecureStack C2 and B2 devices, the device−level
Authentication Type must be set to Multi−User (via the Device Configuration Wizard or the device
Authentication tab) and the port−level "Number of Users Allowed" setting must be set to 2 (via the
Port Configuration Wizard or the Port Properties Authentication Configuration tab, Authenticated
C1 Considerations 46
NetSight Policy Manager Help
•
SecureStack B2 only. Each port on a policy−enabled SecureStack B2 switch can support up to 100 rules and up to 10 masks. The maximum number of unique rules in a single switch or B2 stack is 100, while the maximum number of unique masks is 18. These unique rules and masks may be shared across any and all ports in a stack or switch.
SECURESTACK C3 AND B3 CONSIDERATIONS:
Review the following considerations prior to configuring policy on SecureStack C3 and B3 devices.
•
Secure Stack C3 and B3 devices do not support Layer 2 rules or Layer 3 ICMP rules.
•
Secure Stack C3 and B3 devices do not support rate limiting; however, they do support class of
• service ToS values.
SecureStack C3G and B3 devices have the following additional limitations:
•
Maximum 100 rules per policy role.
•
A system limitation of 768 unique rules.
•
Maximum of 15 roles.
•
SecureStack C3 and B3 devices do not support setting a default role on a logical port.
•
In order for VLAN to Role mapping to work on SecureStack C3 and B3 devices, the device−level
Authentication Type must be set to Multi−User (via the Device Configuration Wizard or the device
Authentication tab) and the port−level "Number of Users Allowed" setting must be set to 2 (via the
Port Configuration Wizard or the Port Properties Authentication Configuration tab, Authenticated
MIXED−STACK SECURESTACK C2/C3 and B2/B3
CONSIDERATIONS:
Review the following considerations prior to configuring policy on mixed stacks of SecureStack C2/C3 and
Tool for information on managing mixed stacks.
NOTE:
While you can create mixed stacks of C2/C3 devices and mixed stacks of B2/B3 devices, you should not create mixed stacks of C and B devices (e.g. mixed stacks of C2/B2 or C3/B3 devices).
•
It is strongly recommended that a C3 device be configured as the master in a mixed C2/C3 stack.
•
It is strongly recommended that a B3 device be configured as the master in a mixed B2/B3 stack.
•
When you have a mixed stack, all devices in the stack have the rule type and Class of Service limitations of a C3 or B3 device, despite the fact that the stack may report itself as a C2 or a B2. The
• device type that the stack reports is based on what switch is set as the master.
Mixed stacks do not support rate limiting; however, they do support class of service ToS values. In order to support class of service ToS values, you should configure a mixed stack with a B3 or C3 as the master. A mixed stack with a B2 or C2 master will only support ToS values if Role−based Rate
•
Limits is selected as the Class of Service mode.
A mixed stack containing a C2H or a B2 has the following limitations:
•
A single role limitation of 100 rules and 10 masks.
•
A system limitation of 100 unique rules and 18 unique masks.
•
No support for Layer 2 rules or Layer 3 ICMP type rules.
•
Maximum of 15 roles.
SECURESTACK C3 AND B3 CONSIDERATIONS: 47
NetSight Policy Manager Help
•
No support for rate limiting.
•
A mixed stack containing a C2G has the following limitations:
•
A single role limitation of 100 rules and 10 masks.
•
A system limitation of 768 unique rules.
•
No support for Layer 2 rules.
•
Maximum of 15 roles.
•
No support for rate limiting.
•
When adding a new device to a mixed stack, the ports should not go active unless the stack supports the policy configuration. Once a device has joined the stack, no roles should be enforced that are not supported on all devices. For example:
1. A C3 is added to an existing C2 stack that has Layer 2 rules.
•
The C3 ports are not allowed to go active until the Layer 2 rules are removed.
•
Once the C3 joins the stack, no Layer 2 rules can be enforced to the stack even if the stack has a C2 master.
2. A C2K is added to an existing C3 stack.
•
If the number of masks in the C3 stack's current configuration exceed those allowed
• by the C2K, its ports cannot go active.
Once the C2K joins the stack, no roles can be enforced that exceed the limitations of any device.
ENTERASYS NETSIGHT COMPATIBILITY:
Policy Manager’s interoperability and concurrent application capabilities are listed below:
NMS Platform
Enterasys NetSight Console
Version No. Support
2.3
Yes
KNOWN RESTRICTIONS AND LIMITATIONS:
The known restrictions and limitations for this release of Policy Manager are listed below. Solutions for these restrictions and limitations are noted, if available.
For the most up−to−date information concerning known issues, go to the Global Knowledgebase section at http://www.enterasys.com/services/support/
. For the latest copy of this release note, go to http://www.enterasys.com/support/manuals/netsight.html
. To report an issue not listed in this document or in the Global Knowledgebase, contact our Technical Support Staff.
Install/Uninstall
Problem 1:
(Windows only.) An evaluation of your system is not automatically performed during the installation. If system requirements are not met, the install will take place, but results will be unpredictable.
Solution:
Verify that all Windows system requirements are met prior to installing Policy
Manager.
ENTERASYS NETSIGHT COMPATIBILITY: 48
NetSight Policy Manager Help
Problem 2:
(Solaris only.) The Installer may not come up, due to path problems.
Solution:
Ensure that
/usr/ucb
does not precede
/bin
in your path. To do this, in a UNIX window, type
which chown
. If the result is
/usr/ucb/chown
, replace
/usr/ucb with /bin in your path. If the result is /bin/chown , the path is not the problem.
Problem 3:
Solaris only. The installer reports that it is unable to complete the Host Evaluation, and you cannot proceed with the installation.
General
Solution:
The /tmp directory is probably full. You must exit the installer and reboot the workstation. You can then restart the installation.
Problem 1:
In the Print window, the Print Range area has a Pages option with the default values of "from 1 to 9999".
Solution:
Enter the desired values.
Problem 2:
When no printer is configured, clicking the Print button on the toolbar or selecting File > Print results in a Printing Error message; closing the error message results in repeated error messages.
Solution:
Close the error message box three times.
Problem 3:
Periodically, when you try to access local management or when a user tries to log in via a browser, access is denied although the RADIUS Server log shows that access has been granted.
Solution:
Log in again and access will be successful.
Problem 4:
Selecting a SmartTrunk port in the Network Elements tab produces error messages in the Event Log.
Solution:
Policies cannot be configured on logical ports such as SmartTrunk ports. You can prevent logical ports from being displayed in the Network Elements tab by opening the Options window (Tools > Options), selecting the Ports view, and checking the Hide Logical Ports checkbox.
Problem 5:
Selecting a SmartTrunk port in Policy Manager produces the following error messages in the Policy Manager Event Log similar to these:
Jul 23, 2001 17:53:47 EDT : ERR − Failed getting port authentication data.
Jul 23, 2001 17:53:55 EDT : ERR − Contacting device [172.20.3.58].
ERROR : Pdu NoSuchName
In MIB Tools, the SmartTrunk port is not shown in the etsysPwaAuthPwaState attribute. This only occurs if the SmartTrunk port has been activated/configured.
General 49
General
NetSight Policy Manager Help
Solution:
Web−based authentication operates only on physical (bridge) ports; it is not supported on trunking ports. This is consistent with how 802.1X handles port aggregation; it requires authentication of the individual ports rather than the aggregated port.
Problem 6:
After you create multiple rate limits, enforcing may cause SNMP timeouts.
Solution:
Create and enforce one rate limit at a time.
Problem 7:
(Policy VLAN Islands) If the complete Local VLAN name (for example,
[VLAN_Island + Local_VLAN_Name]) has more than 32 characters, the VLAN
ID, but not the VLAN name, will be written to the device upon enforcing, and a
Pdu Bad Value error will be displayed in the Event Log. In addition, because the
VLAN name was not written to the device, Verify will fail, even though all the roles are written to the device correctly.
Solution:
When choosing Local VLAN names and VLAN island names for use with the naming convention "VLAN_Island−Name", keep in mind that the combined number of characters should equal no more than 32. This limitation applies to the other Local VLAN naming conventions as well, although exceeding the limit is less likely to occur with those options.
Problem 8:
(Policy VLAN Islands Wizard) If you increase a previously set Offset value, and the maximum number of Local VLANs exists for the previous Offset, you can't increase the number of Local VLANs through the Wizard.
Solution:
Finish the Wizard with the current number of Local VLANs, and create the additional Local VLANs using the Create VLAN menu option (Left panel
VLANs tab > Local VLANs folder > right mouse).
Problem 9:
The following issues have been identified with regard to the RoamAbout R2:
32. Authenticated R2 users cannot be terminated through Policy Manager.
33. The status of an 802.1X client on the R2 is not updated if reauthentication is disabled, and the supplicant either:
• moves out of range of the wireless network while authenticated,
• or terminates the wireless session without logging off or shutting down the client gracefully.
The R2 will only remove these entries after a timeout period has expired having not heard from the supplicant.
34. Both the primary and secondary RADIUS servers must have the same password.
Solution:
These issues will be addressed in a future release.
Problem 10:
(Windows XP only.) A Web−based Authentication user fails to connect to the switch for the Web Authentication web page, and an error message states that the
Microsoft Java VM (Virtual Machine) must be downloaded before the page will be displayed. This occurs because, while most XP systems are set up with the
50
General
NetSight Policy Manager Help
Java VM, this particular machine was not.
Solution:
Download the Microsoft Java VM from www.microsoft.com
and install it.
Problem 11:
Matrix E7 Rate Limiting: The Matrix E7 with 5.00.xx−5.04.09 firmware uses the incorrect transmit rate for Rate Limiting. The rate is in kilobits instead of kilobytes. For example, if you set a rate limit of 5 MB (megabytes) using Policy
Manager, it only transmits 5 megabits, or approximately 625 kilobytes.
Solution:
Upgrade your firmware version.
Problem 12:
On the RoamAbout R2, ICMP (Ping) and Telnet deny rules still allow ICMP and
Telnet to the R2's IP address itself.
Solution:
This is a known issue that has been identified with regard to the RoamAbout R2.
Problem 13:
On the RoamAbout R2, configuring port−based 802.1X through Policy Manager does not configure tumbling keys. 802.1X under XPSPI will not allow 802.1X
without tumbling keys enabled. Therefore, the default port state will not allow the client to "associate" with the R2.
Solution:
Use Enterasys NetSight Console, AP Manager, CLI, or Telnet to set up tumbling keys when configuring 802.1X on the RoamAbout R2.
Problem 14:
If the RoamAbout R2 acquires an IP address via BOOTP, and the user then adds an IP address statically and saves the configuration, RADIUS client requests will continue to use the original IP address.
Solution:
Reboot the device and the new IP address will be used by the RADIUS client portion of the firmware.
Problem 15:
E1 devices do not support rate limits in excess of 125 MB/S, and any rate limits over 125 MB/S should fail on E1 devices when enforced. However, if you create a rate limit of 537 MB/S or more, when you enforce the rate limit, it succeeds on
E1 devices. In addition, the rate limit actually set on the device is incorrect and does not match the rate limit that was enforced, causing a verify to fail.
Solution:
To avoid a false success on enforce of rate limits exceeding 536MB/S, add your
E1 devices to the Exclusion list in the rate limit's General tab, and re−enforce the
rate limit. To avoid enforce failing on E1 devices for rate limits exceeding 125
MB/S, add your E1 devices to the exclusion list prior to enforce. This will be fixed in a future E1 firmware release.
Problem 16:
Even though Layer 3 Priority rules are not supported on Matrix N−Series Gold devices, if you have created a TCI rule through local management on a Gold device, you will be able to import that rule using the Import From Device wizard.
However, when you perform an Enforce, the rule will be Excluded, and will be deleted from the device.
Solution:
This issue will be addressed in a future release.
51
General
NetSight Policy Manager Help
Problem 17:
(Matrix E1 and E6/E7 devices configured for web−based authentication only.)
Ports configured for Active/Discard mode display the temporary IP address assigned to the user prior to authentication (instead of the permanent IP address assigned after authentication) in the IP Address column of the right−panel Port
Usage tabs.
Problem 18:
Renaming a role causes the role to not be assigned properly during authentication.
Solution:
When you rename a role in Policy Manager, the role name in the filter−id also needs to be updated in the RADIUS configuration.
Problem 19:
On Matrix C1 devices, when enforcing IP Protocol Type or IP TCP/UDP Port
Source and Port Destination rules, the following two problems may be encountered:
1. The enforce succeeds, but no rules are created on the device, even though the maximum number of rules allowed has not yet been reached.
2. The enforce fails when writing or deleting these rules.
Solution:
For the first problem, be sure to perform a verify on C1 devices after an enforce, and then check the event log to ensure that the correct rules were written to the device. For the second problem, perform the enforce twice. This will be fixed in a future C1 firmware release.
Problem 20:
(Linux and UNIX only.) You cannot specify a range of pages when printing on
UNIX or Linux systems. If you right−click and select Print or use File > Print, the resulting print settings window does not open to a sufficient size (and cannot be resized) to allow access to the page range fields.
Solution:
For these systems, the only option is to print the entire table.
Problem 21:
(Matrix N−Series devices only.) After downgrading from firmware version
4.00.xx to an earlier firmware version, a device Refresh does not update the device correctly. This causes the following problems:
1. All the fields in the device Authentication tab are grayed out.
2. The two checkboxes in the Port Mode section of the port Authentication
Configuration tab become active. These two checkboxes should not be active because the older firmware version does not support multiple authentication types.
Solution:
Delete and re−create the device. This problem will be fixed in a future release.
Problem 22:
(Matrix N−Series devices running 4.00.xx firmware only. These devices support multiple authentication types.) If you use other tools to enable multiple authentication with 802.1X authentication only, the device will be configured in
Policy Manager as "strict 802.1X," (802.1X without multiple authentication enabled.) This results in two problems:
52
General
NetSight Policy Manager Help
1. The Port Mode may be displayed incorrectly in the slot Details View tab and the device Ports tab.
2. The Unauthenticated Behavior buttons in the Port Mode section of the port Authentication Configuration tab are grayed out.
Solution:
Use Policy Manager to configure the authentication types for your devices.
Problem 23:
(Matrix V2 devices only.) When setting the Number of Retry Attempts and the
Retry Timeout Duration in the device RADIUS tab, the values are not applied to the RADIUS server(s).
Solution:
Use the CLI to set these values for each RADIUS server.
Problem 24:
(RoamAbout AP3000 devices only.) When setting the Number of Retry Attempts and the Retry Timeout Duration in the device RADIUS tab, the values are only applied to the primary RADIUS server.
Solution:
Use the CLI to set these values for each RADIUS server.
Problem 25:
(RoamAbout R2 devices only.) If the R2's community names are set to the factory default settings, the device cannot be created in Policy Manager using
SNMPv1. In addition, if an existing R2 is reset to factory defaults, it will be removed from Policy Manager (if it is set to the factory default SNMPv1 community names) when it is recontacted.
Solution:
If you are creating the device with SNMPv1 (SNMPv3 is recommended), the default community names on the device must be updated. There are four
SNMPv1 community names on the R2:
•
Community #1 −− allows limited read−only access (MIB II system
• group)
Community #2 −− allows creation of new views
•
Community #3 −− allows read−only access to all MIBs
•
Community #4 −− allows read/write access to all MIBs
Policy Manager will create the device based on community names #3 and #4. For read−only access, set community name #3 on the device (using CLI or AP
Manager) and then use that community name for the Read Only community name in your device list or the Create Device window. For read/write access, set community name #4 on the device, and then use that community name for the
Read Write and Super User community names in your device list, or the Read
Write community name in the Create Device window.
Problem 26:
(SecureStack C2 devices running firmware version 2.xx.xx and 3.00.xx, and
SecureStack B2 devices running firmware version 2.00.16 and higher.) You cannot terminate an active 802.1X session using the Terminate button in the Port
Usage tab.
Problem 27:
(RoamAbout AP3000 devices only.) Due to recent firmware changes, the port−level RFC3580 VLAN Authorization enable/disable option is not supported.
53
General
NetSight Policy Manager Help
Solution:
Use the Web or CLI to set this option at the port level.
Problem 28:
SecureStack C2 and B2 devices do not implement the attribute required for
Policy Manager to detect or display a Role Override in the Type column of the
Port Usage tab.
Problem 29:
(SecureStack C2 and B2 devices only.) Rate limits only work for Priority 0.
Solution:
This will be fixed in a future firmware release.
Problem 30:
(SecureStack B2 devices only.) Terminating an 802.1X session results in the
Duration field being reset to "497+2:27:51" on the Port Usage tab.
Solution:
This will be fixed in a future firmware release.
Problem 31:
(SecureStack B2 and Matrix V2 devices only.) Performing a Set/Clear Frozen
(ports) or Terminate Sessions action is not successful when initiated from the right−click menu on the Ports icon in the left−panel Network Elements tree, and errors are displayed in the Event Log.
Solution:
Select the desired ports in the right−panel Ports Details View, and use the right−click menu to perform the operations.
Problem 32:
(SecureStack C2 and B2 devices only.) The Logical Ports group may not be displayed in the device Details View even though Policy Manager has been configured to display logical ports (via Tools > Options > Ports).
Solution:
You can view the logical ports under the Ports Group in the device Details View.
Problem 33:
(Matrix N−Series devices.) The IP ToS value defined for a Class of Service is not enforced to N−Series devices unless Role−Based Rate Limiting is enabled on the devices.
Solution:
You must have Role−Based Rate Limits selected as the Class of Service Mode on the device General tab.
Problem 34:
Priority−Based Rate Limiting cannot be enabled on the SecureStack B2 device
General tab, even though the B2 device supports rate limiting.
Solution:
This will be fixed in a future release.
Problem 35:
The Authorization Group that appears in the title bar of Policy Manager's main view is not updated when the group membership of the current user is changed in the Groups and Users tab of the Authorization and Device Access window.
Solution:
The title shows the correct Authorization Group when a new Policy Manager
Client session is started. This problem will be fixed in a future release.
Problem 36:
Policy Manager 2.x cannot be installed on the same machine where Policy
Manager 1.x is running.
54
General
NetSight Policy Manager Help
Solution:
Close Policy Manager 1.x prior to installing 2.x.
Problem 37:
(SecureStack C2 and B2 (with Policy support enabled) devices only.) The IP
Socket Destination rule with an Access Control action of "Contain to VLAN" is not supported on the 3.02.xx firmware for the C2 and B2 device, even though
Policy Manager allows you to create a rule with this configuration. The rule will be displayed and counted in the Enforce Preview window, but it will not be written down to the C2 and B2 during the enforce. This problem will also occur when you try to create an IP Socket Bilateral rule.
Problem 38:
(SecureStack C2 and B2 devices with Policy support enabled only. C2 devices running 3.02.xx or older firmware, and B2 devices running all firmware revisions up to 2.01.10, as of this release.) If you configure a pre−defined Class of Service to include a ToS value, enforce will fail. This is because the ToS value for pre−defined Class of Services is not editable on C2 and B2 firmware.
Solution:
Create your own Class of Service to include a ToS value.
Problem 39:
The Matrix N−Series Platinum devices and Matrix X devices allow users to create LLC (DSAP/SSAP) rules with a mask less than 17 bits (i.e.
0xFFFF000000) via CLI. If these rules are imported from devices (File > Import
Policy Configuration From Device), either the rules are not imported successfully or the masks of the rules are imported correctly but the masks are not displayed correctly in the Edit Rule window.
Solution:
This will be fixed in a future release.
Problem 40:
(SecureStack C2 and B2 devices only.) You cannot set the VLAN Authorization
Admin Egress in the RFC3580 VLAN Authorization sub−tab (in the Port
Properties window Authentication Configuration tab). The option is grayed out.
Solution:
You can set the RFC3580 VLAN Egress using the CLI. This will be fixed in a future release.
Problem 41:
(Devices with Class of Service mode set to either "Rate Limits Disabled" or
"Priority Based Rate Limits" in the Device General tab.) A rule with an
associated user−defined Class of Service (CoS) that does not include an 802.1p
priority, will not be written to the devices during an enforce, even though the
Enforce Preview window lists the rule as "Included" for the next enforce. This happens whether the CoS has a ToS value defined or not. As long as the CoS does not include an 802.1p priority, the rule will not be enforced.
Solution:
This will be fixed in a future release.
Problem 42:
When you attempt to assign an SNMPv3 device to a Policy Domain, a warning window states the device is identified as unsupported. However, the device is in the Console database and you can do SNMP writes to it.
Solution:
Policy Manager does not support write−only profiles. Any write profile should also have the read ability set. A read−only profile can exist and be set as the read
55
NetSight Policy Manager Help profile for the device, but Policy Manager uses the write profile for reading as well as writing.
Problem 43:
(E1 devices only.) RADIUS accounting configuration is allowed on the device
RADIUS tab when you change an E1 device using SNMPv3 credentials to use
SNMPv1. (Only SNMPv3 devices support RADIUS accounting, so if the E1 is using SNMPv1, RADIUS accounting should not be configurable.)
Solution:
Refresh (View > Refresh) will fix the problem −− RADIUS accounting will be non−configurable for the E1 (using SNMPv1) device.
Problem 44:
When importing a policy configuration from a device that supports Role−Based
Rate Limiting (File > Import > Policy Configuration from Device), no Class of
Service (CoS) values (including 802.1p priority, IP type of service (ToS), rate limits, and transmit queue configuration) are imported.
Solution:
You will have to re−create a new Class of Service with the desired values.
Problem 45
(Matrix E1 devices using SNMPv1.) Configuring RADIUS Accounting Server(s) using the Device Configuration Wizard fails and errors occur in the Event Log.
Solution:
Only Matrix E1 devices using SNMPv3 support RADIUS Accounting. Therefore, you cannot configure accounting servers for E1 devices that are using SNMPv1.
Help System
Problem
1:
A graphic hotspot may not work correctly the first time you click it unless the graphic is fully displayed on the screen.
Problem
2:
If you use the JavaHelp search to find a term, then return to the Contents and navigate to another topic that contains the term you were just searching for, the viewer takes you to the term inside that topic.
Solution:
Return to the Search tab, clear the entry and click Search. Go back to the Contents and the navigation will work correctly.
Problem
3:
Help does not launch from the Help button in the Authorization/Device Access window.
Solution:
You can access Help for the Authorization/Device Access window from the Help viewer
Table of Contents (Help > Help Topics).
IEEE STANDARDS LEVERAGED:
Policy Manager addresses the following IEEE standards:
Title Standard
Help System 56
NetSight Policy Manager Help
IEEE 802.1D
Transparent Bridging Specifications (ISO/IEC 10038)
IEEE 802.1p
Traffic Class Expediting and Dynamic Multicast Filtering
IEEE 802.1Q
Virtual Bridged Local Area Networks
IEEE 802.1X
Port−Based Network Access Control
IETF MIBS REQUIRED:
Policy Manager requires the following MIBs:
RFC No.
1157
1213
1493
2674
Title
Simple Network Management Protocol (SNMP)
MIB−II
Bridge MIB
Groups Supported
System, Interfaces and IP dot1dBase group dot1qBase group and dot1qVlan group (specifically the static VLAN
Database)
Definitions of Managed Objects for Bridges with Traffic
Classes, Multicast Filtering and Virtual LAN
Extensions
IEEE8021−PAE−MIB dot1qBase OBJECT IDENTIFIER
::= { qBridgeMIBObjects 1 } dot1qVlan OBJECT IDENTIFIER
::= { qBridgeMIBObjects 4 } dot1qBase group and dot1qVlan group (specifically the static VLAN
Database) dot1xPaeSystem dot1xPaeAuthenticator
ENTERASYS NETWORKS PRIVATE ENTERPRISE MIB
SUPPORT:
Policy Manager supports the Enterasys Networks Private Enterprise MIBs listed below. These IETF and
Private Enterprise MIBs enumerate the minimum set of MIBs that a hardware device must implement in order to be supported by this application. Implementation of these MIBs may not be sufficient to assure that an unsupported hardware device will function properly with this software.
Enterasys Networks Private Enterprise MIBs are available in ASN.1 format from the Enterasys Networks web site at: http://www.enterasys.com/support/mibs/
. Indexed MIB documentation is also
IETF MIBS REQUIRED: 57
NetSight Policy Manager Help available.
Title
CTIF−EXT−MIB
CTRON−AP3000−MIB
CTRON−CDP−MIB
CTRON−MIB−NAMES
CTRON−OIDS
CTRON−PRIORITY−CLASSIFY−MIB
CTRON−Q−BRIDGE−MIB−EXT
CTRON−VLAN−CLASSIFY−MIB
ENTERASYS−8021X−EXTENSIONS−MIB
Version
version 1.06.03
revision 200404200755Z revision 01.00.04
revision 1.04.17
revision 1.19.15
revision 01.00.02
revision 200501211717Z version 01.02.00 200301292215Z revision 200311211623Z
ENTERASYS−CLASS−OF−SERVICE−MIB
ENTERASYS−CONVERGENCE−END−POINT−MIB
ENTERASYS−MAC−AUTHENTICATION−MIB
ENTERASYS−MAC−LOCKING−MIB
ENTERASYS−MIB−NAMES
ENTERASYS−MIB−ORG
ENTERASYS−MULTI−AUTH−MIB revision 200411221628Z revision 200508161233Z revision 200207181812Z revision 200307301545Z revision 200311061515Z revision 200603061353Z revision 200603231332Z
ENTERASYS−MULTI−USER−8021X−MIB
ENTERASYS−POLICY−PROFILE−MIB
ENTERASYS−PWA−MIB
ENTERASYS−RADIUS−ACCT−CLIENT−EXT−MIB revision 200411111531Z revision 200505182008Z revision 200311051656Z revision 200411121523Z
ENTERASYS−RADIUS−AUTH−CLIENT−MIB revision 200507291348Z
ENTERASYS−RADIUS−AUTH−CLIENT−ENCRYPT−MIB revision 200211111556Z
ENTERASYS−UPN−TC−MIB revision 200402032200Z
IETF MIBS REQUIRED: 58
NetSight Policy Manager Help
ENTERASYS−VLAN−AUTHORIZATION−MIB
TMS−COMMON−MIB revision 200406021922Z revision 200011020000Z
IMPORTANT URLS:
The following Enterasys URLs provide access to NetSight software products and product information.
•
For information on obtaining a software license, visit http://www.enterasys.com/products/management
.
•
Download the latest NetSight software products* from the product web pages at http://www.enterasys.com/products/management/
.
•
Download previously released NetSight products*, using the Download Library at http://www.enterasys.com/download/
.
•
To receive information on Enterasys NetSight management products, including the availability of new versions and new product releases, sign up for ProActive Notification at http://sweval.enterasys.com/notify/
.
•
To register any NetSight products that are covered under a service contract, use the NetSight Service
Contract Product Registration form at http://sweval.enterasys.com/netsight/
.
*Software license keys are version dependent and will only operate with the version of software related to the license key.
GLOBAL SUPPORT:
By Phone: 978−684−1000
1−800−872−8440 (toll−free in U.S. and Canada)
For the Enterasys Networks Support toll−free number in your country:
http://www.enterasys.com/services/support/contact/
By Email: [email protected]
By Web: http://www.enterasys.com/services/support
By Fax: 978−684−1499
By Mail: Enterasys Networks, Inc., 50 Minuteman Rd., Andover, MA 01810 (USA)
For information regarding the latest software available, recent release note revisions, or if you require additional assistance, please visit the Enterasys Networks Support web site.
ADDENDUM:
This section provides updated release information, available to current Policy Manager customers through the
updates are listed by date, with the most recent updates listed first.
IMPORTANT URLS: 59
NetSight Policy Manager Help
3/2007 P/N: 9038095−17 Subject to Change Without Notice F1650−I
IMPORTANT URLS: 60
Policy Manager
Installation
NOTE:
When this file is opened from the CD, the links from this topic to other help topics will not work.
Links within the topic will work, and once you've installed Policy Manager, you can launch the help system and access help for all topics.
This document provides instructions for installing Enterasys NetSight Policy Manager. The most recent version of this file is located on the NetSight Documentation web page: http://www.enterasys.com/support/manuals/netsight.html
.
•
General Installation Information
•
•
•
Upgrading from a Previous Version
•
•
•
•
Stopping the NetSight Server and Database (Windows)
•
Installing Policy Manager (Windows)
•
•
Preparing for Installation on Solaris
•
Stopping the NetSight Server and Database (Solaris)
•
Installing Policy Manager (Solaris)
•
•
Preparing for Installation on Linux
•
Stopping the NetSight Server and Database (Linux)
•
Installing Policy Manager (Linux)
•
•
•
•
•
•
•
•
•
•
•
•
•
•
General Installation Information
You can install Policy Manager on the following platforms:
Policy ManagerInstallation 61
NetSight Policy Manager Help
•
Windows®XP, Windows Server" 2003, or Windows®2000
•
UNIX®Solaris® 8, 9, or 10 on Sun®Platforms only
•
Linux: Red Hat Version 9, Red Hat Enterprise Linux WS, ES v3, and SuSE Linux
The most recent version of the release notes can be found on the NetSight Documentation web page: http://www.enterasys.com/support/manuals/netsight.html
. You can also access the release notes from the CD by opening the relnotes.htm
file with a web browser.
The following tasks comprise the Policy Manager installation process:
•
When you purchased Policy Manager, you received a Licensed Product Entitlement ID that allows you to generate a product license. Prior to installing Policy Manager, you must redeem your
Entitlement ID for a product license. Refer to the instructions included with the Entitlement that was sent to you. (For more information, see
• http://www.enterasys.com/products/management/
.)
Installing any operating system patches required for Java or InstallAnywhere®(Solaris only).
•
Preparing your system for installation.
•
Installing Policy Manager.
NOTE:
The Policy Manager Client and Server license must be installed on a workstation that has an Enterasys NetSight Console version 2.2 Server already installed. Policy Manager depends on functionality provided by the NetSight Server, which is a component of
Console 2.2. Policy Manager Client−only installations do not have this requirement.
System Requirements
The system requirements for operating Policy Manager are listed here.
•
Windows
®
2000, Windows Server" 2003, Windows XP
®
Professional w/ Service Pack 2
(qualified on the English version of the operating systems)
•
Recommended P4−2.4 GHz, 1GB RAM
•
Free Disk Space − 500MB
•
Solaris
®
•
•
8, 9, and 10 on Sun
Recommended Sun
®
®
Platforms only (with latest operating system patches installed)
Ultra 30/60 (or equivalent), 900MHz, 1GB RAM
Free Disk Space − 800MB
•
Linux: Red Hat Version 9, Red Hat Enterprise Linux WS, ES v3, and SuSE Linux 9
•
Recommended P4−2.4 GHz, 1GB RAM
•
Free Disk Space − 500MB
Evaluation Copy
WARNING:
If you install an evaluation copy, be sure to remove all policies from your devices prior to the expiration of your evaluation copy. Without Policy Manager, there is no way to remove policies from your devices, and you will need to clear
Non−Volatile RAM (NVRAM).
If you have requested a Policy Manager evaluation license, you will receive a License Key. Evaluation requests for each product are limited to three 30−day instances.
System Requirements 62
NetSight Policy Manager Help
To upgrade from an evaluation copy of Policy Manager to a purchased copy, contact your Enterasys Networks
Representative to purchase the software and receive an Entitlement ID. You do not need to reinstall the software to perform the conversion. If your evaluation copy has not expired:
1. In the Policy Manager main window, select Tools > Server Information.
2. In the Server Information window, click the License tab.
3. Select Policy Manager from the table and click Change License.
4. Read and accept the License and click OK.
5. Enter the license text that you received when you generated the product license. (When you purchased the software, you received a License Entitlement ID that allows you to generate a product license.
Refer to the instructions included with the License Entitlement ID that was sent to you.)
6. Click Update. The license file will be updated with the new license text.
If you have let your Evaluation Copy expire, when you launch Policy Manager a window opens where you can enter the license text.
Upgrading from a Previous Version
If you are upgrading your currently installed version of Policy Manager to a newer one, consult the Upgrading
section of the Release Notes for considerations and instructions related to your version.
Recommended Reading Sequence
It is highly recommended that you read the following information before you use Policy Manager:
Before installation:
•
Installation (this Help topic)
•
After installation:
•
Welcome to Policy Manager Help (Help > Help Topics on the Policy Manager menu bar)
•
Getting Started with Policy Manager
•
Authentication Configuration Guide
Installation on Windows
Use the following instructions to install Policy Manager on a Windows 2000, Windows XP, or Windows
Server 2003 system. Before installing Policy Manager on a Windows platform, you need to:
•
•
Stop the NetSight Server and Database (Windows)
Once your system is properly configured, you can proceed with:
•
Installing Policy Manager (Windows)
•
Upgrading from a Previous Version 63
NetSight Policy Manager Help
Configuring the Environment
Below are the instructions for configuring the environment on Windows 2000, Windows Server 2003, and
NOTE:
Some of the operations in the following instructions may generate a message prompting you to reboot your system. It is not necessary to reboot your system until you have completed the configuration process.
Windows 2000
1. Open your system's Control Panel (Start > Settings > Control Panel) and double−click the System icon. The System Properties window opens.
2. Select the Advanced tab and click the Performance options button. The Performance Options window opens.
3. Verify that the "Application response" section has Optimize performance for: Applications selected.
4. Click the Change button in the "Virtual Memory" section of the Performance Options window. The
Virtual Memory window opens.
5. Enter the following settings in the "Paging file size for selected drive" section:
Initial size (MB) −− set to a minimum of 128 MB or equivalent to your system RAM.
Maximum size (MB) −− typically set to twice the Initial size. For example, if your Initial size is set to
128 MB, your maximum size would be set to 256 MB.
6. Click Set and OK to close the window.
7. Click OK to close the Performance Options window.
8. Click OK to close the System Properties window.
9. With the cursor in an open area of the desktop, right click and select Properties from the drop−down menu. The Display Properties window opens.
10. Select the Settings tab, and set Colors to a minimum of High Color (16 bit) and Screen area to 1024 by 768 pixels (recommended minimum). The Colors setting affects the appearance of Policy Manager windows. With a setting of 24 bit (16,777,216 colors) and above, certain window features such as tables, appear with a color gradient. Setting the Colors lower than 24 bit will not support color gradients.
11. Click OK to close the Display Properties window.
12. Reboot your system.
Windows Server 2003 and Windows XP
1. Open your system's Control Panel (Start > Settings > Control Panel) and double−click the System icon. The System Properties window opens.
2. Select the Advanced tab and click the Settings button in the "Performance" section. The Performance
Options window opens.
3. Select the Advanced tab and verify that the "Processor scheduling" and "Memory usage" sections have Adjust for best performance of: programs selected.
4. Click the Change button in the "Virtual Memory" section of the Performance Options window. The
Virtual Memory window opens.
5. In the "Paging file size for selected drive" section, select the Custom size option and enter the following settings:
Configuring the Environment 64
NetSight Policy Manager Help
Initial size (MB) −− set to a minimum of 128 MB or equivalent to your system RAM.
Maximum size (MB) −− typically set to twice the Initial size. For example, if your Initial size is set to
128 MB, your maximum size would be set to 256 MB.
6. Click Set and OK to close the window.
7. Click OK to close the Performance Options window.
8. Click OK to close the System Properties window.
9. With the cursor in an open area of the desktop, right click and select Properties from the drop−down menu. The Display Properties window opens.
10. Select the Settings tab, and set the Screen resolution to 1024 by 768 pixels (recommended minimum), and the Color quality to a minimum of Medium (16 bit). The Color quality setting affects the appearance of Policy Manager windows. With a setting of 24 bit and above, certain window features such as tables, appear with a color gradient. Setting the Color quality lower than 24 bit will not support color gradients.
11. Click OK to close the Display Properties window.
12. Reboot your system.
Stopping the NetSight Server and Database (Windows)
You must stop the NetSight Server and the NetSight Database prior to installing Policy Manager.
1. Go to the Taskbar Notification Area of your desktop (on the lower right of your screen, unless you've relocated your Taskbar).
2. Right−click the Services Manager icon ( ) and select NetSight Server > Stop Server and
Database.
Installing Policy Manager (Windows)
Now that you have configured your system, you are ready to launch the Policy Manager Installer.
1. Log onto your system as the user who will be using Policy Manager.
2. Download the Policy Manager software from the Policy Manager product web page at http://www.enterasys.com/products/management/
. Or, if you are installing from a CD, insert the
Policy Manager CD into your system's CD drive.
3. Navigate to install.exe
and double−click it.
4. The Installer leads you through a series of windows that ask you for all the information required in order to install NetSight Policy Manager. You will need the following information to complete the installation:
•
Client/Server or Client−only Install −− You will need to select whether you are installing a
Client−only or Client and Server version of Policy Manager.
•
Client−only − This will install the Policy Manager client on the system. No server or database components will be installed. This requires that a Policy Manager Client and
Server has been installed on another system with an Enterasys NetSight Console 2.2
•
Server.
Client and Server − This requires that an Enterasys NetSight Console 2.2 Server already be installed on the system. This provides the server and database components for the Policy Manager features to integrate with Enterasys NetSight Console 2.2. A
Policy Manager client will also be installed on this system.
Stopping the NetSight Server and Database (Windows) 65
NetSight Policy Manager Help
•
License Text −− You will need to enter the license text that you received when you generated the Policy Manager license. (When you purchased Policy Manager, you received a Licensed
Product Entitlement ID that allows you to generate a product license. You must generate the license prior to installing Policy Manager. Refer to the instructions included with the
•
Entitlement ID that was sent to you.)
Destination Directory −− This is the path to your Policy Manager Installation Directory. In the Destination Directory window, click Browse to navigate to the directory, or type the path in manually. The Installer will add the NetSight Policy Manager directory to the end of the path.
When you click Done on the final window in the Installer, Policy Manager has been installed
according to your specifications. You are now ready to launch Policy Manager.
Installation on Solaris
Policy Manager supports the Sun Solaris 8, 9, and 10 operating systems on Sun® Platforms only. Before installing Policy Manager, be sure to install the latest patches for your operating system. You can download these from http://sunsolve.sun.com
.
Before installing Policy Manager from a CD on a Solaris platform, you need to:
•
Prepare for Installation on Solaris
Once your system is properly configured, you can proceed with:
•
Stopping the NetSight Server and Database (Solaris)
•
Installing Policy Manager (Solaris)
•
Preparing for Installation on Solaris
Perform the following steps if you will be installing the Policy Manager software from a CD. If you have
procedures assume that the CD drive from which you are installing is physically attached to the system where
Policy Manager is being installed. The user performing the installation must be logged in as root.
1. Insert the Policy Manager CD into the CD drive.
2. Use an xterm window where you are logged in as root using the su −
command.
NOTE:
You may encounter a Java exception when becoming the root user with the su −
command. Be sure that your system's root environment has a proper DISPLAY variable setting. The
Installation program will report a Java exception
(
InvocationTargetException
) if the DISPLAY variable is undefined.
If this occurs:
Installation on Solaris 66
NetSight Policy Manager Help
•
Set the system display variable to accept a remote display with the command:
/usr/openwin/bin/xhost +
•
Set the display variable in the environment where the su
− was done.
For C shell: setenv DISPLAY :0.0
For Korn shell: export DISPLAY=:0.0
3. Using the cd
command, cd
to the
/cdrom/cdrom0
(where 0 is zero) directory. If it does not exist, make the directory using the mkdir −p
command, then cd
to the newly created directory.
4. Using the ls
command, check to see if the CD drive is mounted. If no files are listed, issue the following commands: cd / mount −r −F hsfs /dev/sr0 /cdrom/cdrom0
(where 0 is zero).
Stopping the NetSight Server and Database (Solaris)
Before you install, you must stop the NetSight Server and the NetSight Database.
1. On the server system, navigate to the <NetSight Console installdir>
/server
2. Stop the server and database using the command:
stopserver.sh
Installing Policy Manager (Solaris)
The user performing the installation must have privileges to create, read, write, and execute within the installation directory.
1. Use an xterm where you are logged in as root. (Be sure that your system's root environment has a
proper DISPLAY variable setting. For more information see the above note.)
2.
If you have downloaded the software:
cd
to the directory where you downloaded the Installer and start the Installer with the command sh
./install.bin
.
If you are installing from a CD:
Start the Installer with the command
/cdrom/cdrom0/Solaris/install.bin
3. The Policy Manager Installer leads you through a series of windows that ask you for all the information required in order to install Policy Manager. You will need the following information to complete the installation:
•
Client/Server or Client−only Install −− You will need to select whether you are installing a
Client−only or Client and Server version of Policy Manager.
Stopping the NetSight Server and Database (Solaris) 67
NetSight Policy Manager Help
•
Client−only − This will install the Policy Manager client on the system. No server or database components will be installed. This requires that a Policy Manager Client and
Server has been installed on another system with an Enterasys NetSight Console 2.2
•
Server.
Client and Server − This requires that an Enterasys NetSight Console 2.2 Server already be installed on the system. This provides the server and database components for the Policy Manager features to integrate with Enterasys NetSight Console 2.2. A
Policy Manager client will also be installed on this system.
•
License Text −− You will need to enter the license text that you received when you generated the Policy Manager license. (When you purchased Policy Manager, you received a Licensed
Product Entitlement ID that allows you to generate a product license. You must generate the license prior to installing Policy Manager. Refer to the instructions included with the
•
Entitlement ID that was sent to you.)
Destination Directory −− This is the path to your Policy Manager Installation Directory. In the Destination Directory window, click Browse to navigate to the directory, or type the path in manually. The Installer will add the NetSight Policy Manager directory to the end of the path.
When you click Done on the final window in the Installer, Policy Manager has been installed
according to your specifications. You are now ready to launch Policy Manager.
Installation on Linux
On the Linux platform, Policy Manager supports the Red Hat Linux version 9, Linux Enterprise WS, ES v3, and SuSE Linux operating systems.
NOTE:
Prior to beginning installation, verify that your /etc/hosts file has the local host name specified. It should have an entry that looks like:
127.0.0.1 localhost
Before installing Policy Manager from a CD on a Linux platform, you need to:
•
Prepare for Installation on Linux
Once your system is properly configured, you can proceed with:
•
Stopping the NetSight Server and Database (Linux)
•
Installing Policy Manager (Linux)
•
Preparing for Installation on Linux
Perform the following steps if you will be installing the Policy Manager software from a CD. If you have
procedures assume that the CD drive from which you are installing is physically attached to the system where
Policy Manager is being installed. The user performing the installation must be logged in as root.
Installation on Linux 68
NetSight Policy Manager Help
1. Insert the Policy Manager CD into the CD drive.
2. Use an xterm where you are logged in as root.
NOTE:
Be sure that your system's root environment has a proper DISPLAY variable setting. For
more information see the above note.
3. Using the cd
command, cd
to the
/mnt/cdrom
directory.
4. Using the ls
command, check to see if the CD drive is mounted. If no files are listed, issue the following command: mount /mnt/cdrom
Stopping the NetSight Server and Database (Linux)
Before you install, you must stop the NetSight Server and the NetSight Database.
1. On the server system, navigate to the <NetSight Console installdir>
/server
2. Stop the server and database using the command:
stopserver.sh
Installing Policy Manager (Linux)
The user performing the installation must have privileges to create, read, write, and execute within the installation directory.
1. Use an xterm where you are logged in as root. (Be sure that your system's root environment has a
proper DISPLAY variable setting. For more information see the above note.)
2.
If you have downloaded the software:
cd
to the directory where you downloaded the Installer and start the Installer with the command sh
./install.bin
.
If you are installing from a CD:
Start the Installer with the command
/mnt/cdrom/linux/install.bin
3. The Installer leads you through a series of windows that ask you for all the information required in order to install Policy Manager. You will need the following information to complete the installation:
•
Client/Server or Client−only Install −− You will need to select whether you are installing a
Client−only or Client and Server version of Policy Manager.
•
Client−only − This will install the Policy Manager client on the system. No server or database components will be installed. This requires that a Policy Manager Client and
Server has been installed on another system with an Enterasys NetSight Console 2.2
•
Server.
Client and Server − This requires that an Enterasys NetSight Console 2.2 Server already be installed on the system. This provides the server and database components for the Policy Manager features to integrate with Enterasys NetSight Console 2.2. A
Policy Manager client will also be installed on this system.
•
License Text −− You will need to enter the license text that you received when you generated the Policy Manager license. (When you purchased Policy Manager, you received a Licensed
Product Entitlement ID that allows you to generate a product license. You must generate the license prior to installing Policy Manager. Refer to the instructions included with the
•
Entitlement ID that was sent to you.)
Destination Directory −− This is the path to your Policy Manager Installation Directory. In the Destination Directory window, click Browse to navigate to the directory, or type the path
Stopping the NetSight Server and Database (Linux) 69
NetSight Policy Manager Help in manually. The Installer will add the NetSight Policy Manager directory to the end of the path.
When you click Done on the final window in the Installer, Policy Manager has been installed
according to your specifications. You are now ready to launch Policy Manager.
Launching Policy Manager
Now that you've installed Policy Manager, you can launch it.
Launching on Windows
From the Start menu, select Programs > Enterasys Networks > NetSight Policy Manager > Policy
you of the expiration date. Click OK to continue.
Launching on Solaris
1. Use the cd
command to navigate to the Policy Manager Installation Directory.
2. Issue the Policy Manager startup command:
PolicyManager
Launching on Linux
1. Use an xterm window where you are logged in as root.
2. Use the cd
command to navigate to the Policy Manager Installation Directory.
3. Issue the Policy Manager startup command:
PolicyManager
Authentication Configuration
The authentication scheme for Enterasys' Secure Networks depends on the proper configuration and setup of the required authentication components. It is strongly recommended that, after you have installed Policy
properly installing and configuring your authentication components.
Uninstalling Policy Manager
Use the procedures below to uninstall Policy Manager. When you uninstall, only the files which were distributed with Policy Manager will be uninstalled. Files you generate will not be automatically uninstalled.
Uninstalling on Windows
You must stop the NetSight Server and the NetSight database prior to uninstalling Policy Manager.
Launching Policy Manager 70
NetSight Policy Manager Help
1. Go to the Taskbar Notification Area of your desktop (on the lower right of your screen, unless you've relocated your Taskbar).
2. Right−click the Services Manager icon ( ) and select NetSight Server > Stop Server and
Database.
You can now uninstall Policy Manager:
From the Start menu, select Programs > Enterasys Networks > NetSight Policy Manager > Uninstall
Policy Manager. You must be logged in as the user who installed Policy Manager in order to see this selection on the Start menu.
If a different user is uninstalling Policy Manager, go to the UninstallerData directory located in the Policy
Manager Installation Directory and double−click on
Uninstall Policy Manager.exe
. In such a case the Uninstaller may not be able to remove certain files due to permission conflicts.
Uninstalling on Solaris
Policy Manager should be uninstalled from an xterm window by a user who is logged on with the same ID as that of the user who installed the application.
You must stop the NetSight Server and the NetSight Database prior to uninstalling Policy Manager.
1. On the server system, navigate to the <NetSight Console installdir>
/server
2. Stop the server and database using the command:
stopserver.sh
You can now uninstall Policy Manager:
1. Use the cd
command to navigate to the Policy Manager Installation Directory (top level).
2. Start the Uninstaller by issuing the command:
UninstallPolicyMgr.sh
Uninstalling on Linux
The user performing the uninstall must be logged in as root.
You must stop the NetSight Server and the NetSight database prior to uninstalling Policy Manager.
1. On the server system, navigate to the <NetSight Console installdir>
/server
2. Stop the server and database using the command:
stopserver.sh
You can now uninstall Policy Manager:
1. Use the cd
command to navigate to the Policy Manager Installation Directory (top level).
2. Start the Uninstaller by issuing the command:
UninstallPolicyMgr.sh
Uninstalling on Solaris 71
NetSight Policy Manager Help
Support
To locate product specific information, refer to the Enterasys website: http://www.enterasys.com
Accessing Help
After you have installed Policy Manager on your system, the full Help system is available from the Help menu option on Policy Manager windows, and from any window that has a Help button on it. The online Help system is also available as a PDF file in the
Help
directory located in your Policy Manager installation directory.
Technical Support
If you need technical support related to Policy Manager, contact the Enterasys Enterasys Global Call Center:
Phone: (800) 872−8440 (24 hours a day, 365 days a year)
Email: [email protected]
Mail:
Enterasys Networks, Inc.
Technical Support
50 Minuteman Rd.
Andover, MA 01810
FTP: ftp.enterasys.com
Login: anonymous
Password: [your email address]
Documentation
For the latest Enterasys documentation on the web, see http://www.enterasys.com/support/manuals/netsight.html
.
Training
For training on this and other Enterasys products, see http://www.enterasys.com/training
.
Support 72
Getting Started with Policy Manager
Getting Started with Policy Manager gives you an overview of Policy Manager, and provides a quick tour of its components using a policy configuration demo file. It also includes a summary of the basic steps you must perform to create and configure policies with Policy Manager.
Because Getting Started is meant to be used side−by−side with Policy Manager, it will be most useful if you install Policy Manager first. Once Policy Manager is installed, you can use the steps and suggestions below as an aid in planning and implementing your network policy profiles using Policy Manager.
It is recommended that you read the following Policy Manager information in sequence before you implement
Policy Manager on your network:
•
•
•
•
Getting Started with Policy Manager (this guide)
•
Authentication Configuration Guide
•
This guide includes the following information:
•
•
•
Policy Manager Overview
NetSight Policy Manager is a configuration tool that simplifies the creation and enforcement of policies on networks, enabling network engineers, information technology administrators, and business managers to work together to create the appropriate network experience for each user in their organization.
Policy Manager enables you to create policy profiles, called roles, that are assigned to the ports in your network. These roles are based on the existing business functions in your company, and consist of services that you create, made up of traffic classification rules. Roles provide four key policy features: traffic containment, traffic filtering, traffic security, and traffic prioritization.
network. Only after users have been authenticated are they given customized access capabilities based on the role they are assigned.
The illustration below shows the Policy Manager relationship hierarchy, with Rules at the base to define specific packet handling behaviors, Roles at the top to identify specific job functions in the organization, and
Services in the middle, providing the interface between the two layers.
Getting Started with Policy Manager 73
NetSight Policy Manager Help
Using Policy Manager wizards and configuration tools, you can create multiple roles tailored to your specific needs, and set a default policy for some or all of your network devices and ports. These policies can be deployed on multiple devices throughout your switch fabric. Once the network infrastructure has been empowered to enforce the relationship hierarchy, no further communication with the Policy Manager application is needed.
Quick Tour
The Quick Tour will acquaint you with Policy Manager by associating the concepts and features presented here with something you can actually see in the application. While the Quick Tour does not explain all of
Policy Manager's features, it shows you how to do some of the basic Policy Manager operations. Links to more detailed instructions for performing basic and more complex Policy Manager tasks are provided throughout the Quick Tour. As you get into the Quick Tour, you will notice that each section of the tour begins with an explanation in regular type, followed by the actual steps you perform, highlighted.
The Quick Tour assumes that you have installed and launched Policy Manager. It also assumes you have installed and launched NetSight Console, and performed a Console Discover to populate the NetSight
Database with your network devices. Refer to the Console online Help for information on performing a
Quick Tour 74
NetSight Policy Manager Help
Discover operation.
The Quick Tour covers the following features:
•
•
•
•
•
Understanding Traffic Classification Rules
•
•
Configuring Devices for Authentication
•
•
Viewing Port Configuration Information
•
•
•
•
•
•
•
Creating a Policy Domain
Policy Manager provides the ability to create multiple policy configurations by allowing you to group your roles and devices into Policy Domains. A Policy Domain contains any number of roles and a set of devices that are uniquely assigned to that particular domain. Policy Domains are centrally managed in the database and shared between Policy Manager clients.
When you first launch Policy Manager, you are in the Default Policy Domain. You can do all your work in the
Default domain, or you can create multiple domains each with a different policy configuration, and assign your network devices to the appropriate domain.
Policy Manager comes with a demonstration file called Demo.pmd. The Demo.pmd file contains all the elements (roles, services, rules, VLAN membership, class of service) that define how network traffic is handled. You can use the Demo.pmd file to create a demonstration Policy Domain and explore the basic features and functionality of Policy Manager. Later, you may find the Demonstration domain useful as you create your own Policy Domains.
The first step in the Quick Tour is to create a new domain and import policy configuration data from the
Demo.pmd file.
Note: If someone else has been using Policy Manager before you, when you create the new domain, you may be prompted to save the previous domain's configuration.
Quick Tour: Creating a Policy Domain.
1. Select Domain > Create Domain. Enter the domain name
Demo Domain
for the new domain and click OK. Select No to running the Quarantine Role Wizard. The new Demo Domain opens.
2. Select File > Import > Import From File. The Import from File window opens.
3. Navigate to the <install area>\Enterasys Networks\NetSight Policy Manager directory and select the
Creating a Policy Domain 75
NetSight Policy Manager Help
Demo.pmd file. Click Open.
4. Click the Select All button to select all the data elements to import.
5. Select the Append domain data to existing elements option.
6. Click OK. The data elements will be imported from the Demo.pmd file into the new Demo Domain.
7. Click on the various left−panel tabs to see the different elements that make up the Demo Domain policy configuration.
For more information:
•
Now that you've created the Demo domain and viewed its left−panel tabs, we will explore Policy Manager in a little more depth.
Understanding Roles
Roles are usually designed to reflect different users in your organization and to provide customized access capabilities based on the role users have in your organization. For example, accounting and engineering personnel have different network access and priority needs and therefore might have different roles.
Quick Tour: Checking out roles.
1. Click on the left−panel Roles tab in the Policy Manager main window.
2. Click on the various roles listed in the left panel, and in the right panel you'll see tabs that display specific information for each role. Click the right−panel tabs to see the information they contain.
A role can be made up of one or more network access services that are defined in Policy Manager. These services determine how network traffic will be handled at any network access point configured to use that role. A role may also contain default access control (VLAN) and/or class of service designations that will be applied to traffic not handled specifically by the services contained in the role. A role can contain any number of services or service groups.
Roles are assigned to users during the authentication process. When a user successfully authenticates, the port is opened, and if there was a role assigned to the user, that role is applied to the port. A role can also be directly assigned to a port as a default role for instances when authenticated users are not assigned a role. If an end user on a port was not assigned a role when logging in (authenticating), or if authentication is inactive on a port, then the port's default role will take effect. However, if a user is assigned a role upon login, then that role will override any default role on the port.
Understanding Roles 76
NetSight Policy Manager Help
To create and define a role, you can use the Role Wizard or do it using the right−panel Role tabs.
Right now, we will just create and name a role without defining it further:
Quick Tour: Creating a role.
1. In the Policy Manager left panel, select the Roles tab.
2. Right−click the Roles folder, and select Create Role.
3. Enter the role name
Office Assistant
in the highlighted box and press Enter.
For more information:
•
•
Understanding Services
Roles can be made up of one or more network access services. These services determine how network traffic will be handled at any network access point configured to use that role. In Policy Manager, you can create
Manual services with customized classification rules that you create, or Automated services that are associated with a particular set of network resources.
Manual services contain one or more traffic classification rules that define how a network access point will handle traffic for a particular network service or application. For example, you might create a Manual service called "Restricted Employee" that contains a classification rule that discards TCP HTTP traffic.
We will create a Manual service and add it to a role later on. Right now, we'll just take a look at the services in the Demo domain.
Quick Tour: Checking out Services.
1. Click on the left−panel Services tab in the Policy Manager main window.
2. Expand the Services folder and the Manual Services folder, and view the list of services.
3. Expand a service or two to see the individual classification rules that make up the service.
4. Select a service or two in the left panel to see the right−panel tabs that display specific information for each service. Click the right−panel tabs to see the information they contain.
Understanding Services 77
NetSight Policy Manager Help
For more information:
•
•
Working with Service Groups
Services can be grouped together into Service Groups. This allows you to easily add a set of services to one or more roles.
Quick Tour: Checking out Service Groups.
1. Click on the left−panel Services tab in the Policy Manager main window.
2. Expand the Service Groups folder.
3. Expand the Acceptable Use Policy service group to see its services. Note that the services listed are also in the Services folder.
After you have defined and created your services, you can easily create a Service Group and then drag and drop your services into the group.
Quick Tour: Creating a Service Group.
1. In the Policy Manager left panel, select the Services tab.
2. Right−click the Service Groups folder, and select Create Service Group.
3. Enter the service group name
Trusted User
in the highlighted box and press Enter.
4. Drag and drop one or two of the existing Acceptable Use Policy services from the Acceptable Use
Policy service group into the Trusted User service group. Notice that this makes a copy of the existing service in the new folder.
For more information:
•
Working with Service Groups 78
NetSight Policy Manager Help
Understanding Traffic Classification Rules
Traffic Classification rules allow you to assign access control (VLAN membership) and/or class of service to your network traffic based on the traffic's classification type. Classification types are derived from Layers 2,
3, and 4 of the OSI model, and all network traffic can be classified according to specific layer 2/3/4 information contained in each frame.
A Traffic Classification rule has two main parts: Traffic Description and Actions. The Traffic Description identifies the traffic classification type for the rule. The Actions specify whether traffic matching that classification type will be assigned access control, class of service, or both.
You create a rule for a specific service, but a rule can be added to multiple services simply by using drag and drop to copy the rule from one service to another in the Services tab.
Quick Tour: Checking out Rules.
1. In the left−panel Services tab, expand the Acceptable Use Policy service group.
2. Expand the Deny Unsupported Protocol Access service and click on the Discard AppleTalk rule.
3. Click on the right−panel tabs to see the rule's Traffic Description and Actions.
4. Add a description to the General Tab, for example: AppleTalk not supported on this network.
For more information:
•
•
•
How to Create or Modify a Rule
Adding Devices
The first step in adding network devices to Policy Manager, is to add the devices to the NetSight database.
You do this initially, by performing a Console Discover to populate the database, or by using Console to import devices from a .ngf file. We will assume that you have already done this. If you need more information, refer to your NetSight Console online Help.
using Policy Manager. As soon as the devices are assigned to a domain, they are automatically displayed in the Policy Manager device tree. Only devices assigned to the domain you are currently viewing are displayed.
Quick Tour: Assigning Devices to a Domain.
1. In the Policy Manager main window, select Domain > Assign Devices to Domain. The Assign
Devices to Domain window opens.
2. In the left panel, the Unassigned device tree contains all the devices in the database that have not been assigned to a domain. The right panel displays the devices in the current domain.
3. For the Quick Tour, select a couple of devices to add to the Demo Domain and click Add. Click OK to add the devices.
4. You can also use this window to remove a device from the current domain. This removes the device from the current domain and places it in the Unassigned folder. It does not delete the device from the
NetSight database.
Understanding Traffic Classification Rules 79
NetSight Policy Manager Help
After you have initially added your devices, you can use Policy Manager's Add Device window to add a single device to the database. Adding a device this way also automatically adds it to the current domain.
For more information:
•
•
Configuring Devices for Authentication
Now that you have added devices to your domain, you can configure them for authentication. In Policy
Manager, several types of authentication are offered, including Web−based, 802.1X, and MAC authentication.
In order to take advantage of the authentication features of Policy Manager, you need to configure your network and your devices to work with a RADIUS server. In the Quick Tour, we will take a look at the right−panel tabs where you can view and modify authentication and RADIUS configuration on devices.
Quick Tour: Viewing the Authentication Settings on a Device.
1. In the Policy Manager left panel, select the Network Elements tab.
2. Double−click the All Devices folder and select a device.
3. In the right panel, look at the Details View tab. Expand a Ports or Slot folder to see ports on the device. Scroll to the right to see all the port information available on this tab.
4. Select the right−panel Authentication tab. This tab is where you specify the authentication type, enable or disable authentication, and configure your authentication settings for the selected device.
5. Select the RADIUS tab. On this tab you can enable the device as a RADIUS client, and set up communication between the RADIUS client device and the RADIUS server.
For more information:
•
•
Authentication Configuration Guide
•
Working with Device Groups
In the Network Elements tab, devices are listed individually, but they are also grouped into Device Groups.
This can be useful when you want to configure policies for a group of devices. An example of how devices could be grouped is shown here.
Configuring Devices for Authentication 80
NetSight Policy Manager Help
Policy Manager provides several system−created device groups for your convenience. When a device is assigned to a domain, it automatically becomes a member of the appropriate group:
•
All Devices − contains all the devices that are assigned to the current domain.
•
Grouped By − contains five subgroups:
•
Chassis −− contains subgroups for specific chassis in the domain.
•
Contact −− contains subgroups of the devices in a domain based on the system contact.
•
Device Types −− contains subgroups for the specific product families and device types in the
• domain.
IP −− contains subgroups based on the IP subnets in the domain.
•
Location −− contains subgroups of the devices in a domain based on the system location.
You can also create your own device groups, called user−defined device groups, using NetSight Console.
Policy Manager system−created device groups are displayed with blue folders. Any group you add via
Console will be displayed with a yellow folder. For more information, see How to Add, Remove, and Rename
Groups in your Console online Help.
Viewing Port Configuration Information
After devices have been imported into Policy Manager, you can view and configure their ports by selecting a device and displaying its ports in the right−panel Details View tab or Ports tab.
Quick Tour: Viewing Port Configuration Information.
1. Click on the left−panel Network Elements tab in the Policy Manager main window.
2. Expand the All Devices folder and select a device.
3. In the right−panel Details View tab, expand a Ports or Slot folder to display ports on the device.
4. Right−click on a port and select Properties. The Port Properties window opens.
5. Take a look at all the tabs where you can view and modify configuration information for the selected port.
For more information:
•
Viewing Port Configuration Information 81
Working with Port Groups
NetSight Policy Manager Help
Policy Manager allows you to group ports into User−Defined Port Groups, similar to the way you can group services into service groups. Port groups enable you to configure multiple ports on the same device or on different devices, at the same time. Policy Manager also provides you with Pre−Defined Port Groups. Every time one of the Pre−Defined Port Groups is accessed, Policy Manager goes to the devices in the current domain and retrieves the ports which fit the pre−defined characteristics of the port group.
Quick Tour: Checking out Pre−Defined Port Groups.
1. Click on the left−panel Port Groups tab in the Policy Manager main window.
2. Expand the Port Groups folder.
3. Expand the Pre−Defined Port Groups to see the groups.
Quick Tour: Creating a User−Defined Port Group.
1. Expand the Port Groups folder.
2. Right−click the User−Defined Port Groups folder, and select Create Port Group.
3. Type in a Port Group name in the highlighted box and press Enter.
4. Look at the General tab in the right panel. Notice that you can either add individual ports to the group, or specify ranges on all devices to comprise the port group.
For more information:
•
•
Working with VLANS
All traffic in a Policy Manager network is assigned membership in a VLAN. Roles are used to assign VLAN membership to traffic either through the role's default access control or through the role's services which may include traffic classification rules that assign VLAN membership (access control).
When you open a new domain, the Global VLANs folder is prepopulated with the Default VLAN (not to be confused with a default VLAN that is assigned to a role, although the Default VLAN could be a default
VLAN for a role). You can then create additional VLANs and assign them as default access control for a role and/or use them to define traffic classification rules. You can view the roles and services associated with a
VLAN on the Roles and Services tabs that are displayed when you select the VLAN in the left panel. You can also make role and service changes from these tabs.
Local VLANs are used in Policy VLAN Islands, which enable you to deploy a policy across your network, while restricting user access to only selected local devices. You must select the Policy VLAN Islands Enabled checkbox (on the Edit Menu) to see the Local VLANs folder and the Policy VLAN Islands folder.
Quick Tour: Checking out VLANs.
1. Click on the left−panel VLANs tab in the Policy Manager Main window.
2. Expand the Global VLANs folder to see the individual VLANs.
3. Click on the Default VLAN listed and view the tabs in the right panel.
Working with Port Groups 82
NetSight Policy Manager Help
For more information:
•
•
•
•
•
Viewing Classes of Service
Policy Manager lets you create a class of service (CoS) that includes one or more of the following components: an 802.1p priority, an IP type of service (ToS) value, rate limits, and transmit queue configuration. You can then assign the class of service as a classification rule action, as part of the definition of an automated service, or as a role default.
Quick Tour: Checking out Classes of Service.
1. Click on the left−panel Classes of Service tab in the Policy Manager main window and expand the
Classes of Service folder. This folder is pre−populated with classes of service that you can define, or you can create your own.
2. Select one of the classes of service, and view the tabs in the right panel. You can define the class of service and view how it is being used on these tabs.
3. Expand the CoS Components folder to see the potential components of a class of service: 802.1p
Priorities; IP Type of Service Values; Rate Limits; and Transmit Queue configuration.
4. Expand the five folders in the CoS Components folder, explore the selections, noticing the right−panel tabs that are available for defining these elements or that provide information on them.
For more information:
•
Getting Started with Class of Service
•
•
How to Configure Transmit Queues
•
How to Create a Class of Service
Using Policy Manager Wizards
In Policy Manager, you can create roles, services, rules, and VLANs, and configure devices and ports, by selecting the appropriate item in the left panel and filling out the right−panel tabs. But Policy Manager also provides wizards that lead you through the steps required to perform these functions.
If you are creating roles, services, and rules, and configuring devices and ports from scratch, the wizards can be easier to use. Once you've created everything you need, you may find it easier to make changes and additions on the right−panel tabs, or you may still want to use the wizards, depending on the situation.
The wizards provided by Policy Manager include the Role Wizard, the Service Wizard, the Classification
Rule Wizard, the Device Configuration Wizard, the Port Configuration Wizard, the Network Resources
Wizard, the Policy VLAN Islands Configuration Wizard, and the Quarantine Role Wizard. The Service
Wizard incorporates the elements of the Classification Rule Wizard, and the Role Wizard incorporates the elements of the Service Wizard, including the Classification Rule Wizard.
Viewing Classes of Service 83
NetSight Policy Manager Help
In the Quick Tour, we will use the Service Wizard to create a Manual service that includes one classification rule. We will then apply it to the role you created earlier in the Quick Tour.
Quick Tour: Creating a Service Using the Service Wizard.
Let's create a service that discards TCP HTTP traffic.
1. In the Policy Manager left panel, select the Services tab.
2. Right−click the Services folder, and select Service Wizard.
3. Enter
Restricted Employee
for the service name and click Next.
4. Make sure the Service Type selected is Manual, and click Next.
5. Enter
Discard HTTP
for the classification rule name and click Next.
6. Choose Enabled as the Rule Status and click Next.
7. Choose All Devices as the Rule Type and click Next.
8. Choose Layer 4 − Application Transport as the Traffic Classification Layer, and click Next.
9. Choose IP TCP Port Destination as the Traffic Classification Type and click Next.
10. Choose Well−Known Values and HTTP (80) as the TCP Type and click Next.
11. Adding an IP Address is optional, so just click Next.
12. View the Traffic Description Summary and click Next.
13. Select the Access Control checkbox and the Deny Traffic option. Click Next.
14. View the Classification Rule Summary and click Next.
15. Select the role you created earlier (Office Assistant) and click Finish.
16. Look at the right side of the Status Bar at the bottom of the window. The Enforce icon means your new role and its service need to be enforced (written to the devices). We'll talk about that later.
For more information:
•
•
Using the Classification Rule Wizard
•
Using the Device Configuration Wizard
•
Using the Port Configuration Wizard
•
•
Using the Network Resources Wizard
•
Using the Quarantine Role Wizard
Saving the Domain
After a Policy Domain has been changed, you must save the domain to notify all clients that are viewing that domain of the change and automatically update their view with the new configuration. A Save icon is displayed in the status bar at the bottom of the main window when you have made changes to the domain that
Saving the Domain 84
NetSight Policy Manager Help need to be saved.
Quick Tour: Saving the Domain.
1. Note that a Save icon appears on the status bar. This is a reminder that you need to save changes you've made to the domain.
2. From the menu, select File > Save Policy Domain.
3. The domain is saved and all clients viewing the domain will automatically have their view updated with the new configuration.
For more information:
•
Enforcing
Any time you add, make a change to, or delete a role or any part of it (any of its services and/or rules), the devices in your current domain need to be informed of the change so that your revised policy configuration can take effect. This is accomplished by enforcing −− writing your policy configuration to a device or devices.
Enforce operations are performed only on the current domain.
To enforce to all devices in the current domain, you would use the Enforce button in the toolbar or the File
> Enforce Role Set menu option. To enforce to a single device, you would right−click the device and select
Enforce Role Set from the menu. If you have made any changes that need to be enforced, the Enforce icon
appears on the status bar at the bottom of the Policy Manager window as a reminder.
Policy Manager's Enforce Preview window enables you to view the information that will be written to your domain devices, before you actually enforce. This feature is particularly useful if you have devices that only support certain aspects of policy management. The Enforce Preview window appears whenever you initiate an enforce using one of the methods mentioned above, so that you always have a chance to review the effects of enforcing prior to actually performing the enforce. You can also access this window from the File > Enforce
Preview menu option.
To determine if the roles currently in effect on your domain devices match the set of roles you have defined in
your current Policy Domain configuration, use the Verify feature.
Quick Tour: Enforce Preview.
At this point, you probably don't want to actually enforce to the devices in the Demo domain. So let's just look at the Enforce Preview window.
1. Select File > Enforce Preview. The Enforce Preview window opens. Use the tabs in the window to check out all the information that would be written to your devices if you did perform an enforce.
For more information:
•
•
•
Enforcing 85
NetSight Policy Manager Help
Accessing Policy Manager Help
All Policy Manager documentation is available in the Help system accessible from the application.
•
Help on Policy Manager features is available via the Help > Help Topics menu option.
•
Help for the tab currently displayed in the right panel is available via the Help > About This
•
Window menu option.
Help for a particular window is also available via a Help button on the window itself.
The Help system includes a Search feature that lets you search for specific instances of a term in all the help topics.
Quick Tour: Using the Help Search Feature.
1. Select the Help > Help Topics menu option.
2. Click the left−panel Search tab in the Help viewer.
3. In the Find box, enter the term
Role
and press Enter.
4. A list of topics in which the term appears is displayed.
For more information:
•
Where to Go from Here
ready to start implementing your own policy configurations using Policy Manager.
Use the following summary to guide you through the basic steps for using Policy Manager.
1.
Configure your network for authentication (see the Authentication Configuration Guide.)
2.
Create your Policy Domains (see How to Create and Use Domains.)
3.
Add your devices to the NetSight Database and assign them to the appropriate domain.
4.
Configure authentication on devices and ports (see How to Configure Devices and How to Configure
5.
If desired, group your ports into port groups (see How to Create a Port Group).
6.
Create services (see How to Create a Service).
7.
If desired, group services into service groups (see How to Create a Service Group).
8.
Create roles (see How to Create a Role).
9.
Write your configuration to your devices (see Enforcing).
Now that you have set up your authentication and policy configuration, you can start exploring some of Policy
Manager's other features:
Define Authorization and Device Access
Use the Authorization/Device Access window to configure your
Policy Manager access privileges. The window has four tabs:
Accessing Policy Manager Help 86
NetSight Policy Manager Help
•
Users/Groups tab lets you manage user access to
• specific features and capabilities.
Profiles/Credentials tab lets you define SNMP
credentials used to access your network devices, and create profiles that use these credentials for various
• device access levels.
Profile/Device Mapping tab lets you specify the
profiles that will be used by users when communicating
• with network devices.
Manage SNMP Passwords tab where you can manage
the credentials that have been set on your network's devices.
Policy Manager uses Server Locks to manage interactions between multiple clients and the server. When a user begins editing a Policy Domain, a lock is acquired for that domain at the server. That lock is not released until the same user saves the domain data. This guarantees a consistent view of that domain for all clients.
The Server Information window lets you view and configure certain NetSight Server functions, including management of client connections, database backup and restore, locks, and licenses. It also provides access to the server log and server statistics.
Use the Options window to set options for NetSight functions on a suite−wide and per−application basis.
Policy Manager supports Class of Service (CoS), which allows you to assign priority, modify rates, and change transmit queue behavior for your network traffic.
Network Resource Groups are groups of network resources such as routers, VoIP (Voice over IP) gateways, and servers.
You can create a network resource group and associate it with
an Automated service. The Automated service automatically
creates an IP address rule with a specified action (class of service and/or access control), for each IP address in the network resource group.
Policy Manager offers you the ability to set up Policy VLAN
Islands which enable you to deploy a policy across your network, while restricting user access to only selected local devices.
Policy Manager provides an easy way to access and download product updates using a web update operation. You can perform an immediate check for updates, or schedule a routine check for updates.
Accessing Policy Manager Help 87
NetSight Policy Manager Help
Accessing Policy Manager Help 88
If You are Upgrading
This Help topic provides information for users who are upgrading from a Policy Manager version prior to 2.0.
It outlines changes in functionality and provides a description of new procedures and concepts introduced in version 2.0. It does not address all the new functionality offered in this release of Policy Manager. For an
overview of new functionality, refer to Software Changes and Enhancements in the Release Notes.
Many of the changes listed below resulted from the new Client/Server architecture introduced in Policy
Manager 2.0. This architecture lets you deploy Policy Manager in a multi−user environment where remote clients connect to a common, centralized database located on the NetSight Server, which is a component of
NetSight Console. Because of this new centralized database, both Console and Policy Manager (and other
NetSight application plugins) share a common view of the Network Elements device tree.
NOTE:
Following an upgrade, you can import your .pmd files into your upgraded version to
preserve your network information. Refer to Importing a File into a Domain for specific
information on importing your Policy Manager database.
Use the following table to get an idea of what changed in version 2.0 and the procedures you must now use.
The left−hand column lists different Policy Manager functionality and the right−hand column gives a short description of what changed.
Functionality
Network Elements Tree
Policy Manager Database (.pmd)
Files
Importing Data from a .pmd File
Adding Devices
What Changed
Console and Policy Manager now share a common view of the
Network Elements device tree, except that only devices that support policy are displayed in the Policy Manager tree. Any device status changes detected by Console will be reflected in Policy Manager’s device tree. Any user−defined device groups will also be displayed in the device tree of both applications; however, device groups cannot be created in Policy Manager −− they must be created in Console.
Policy Manager now uses Policy Domains instead of Policy Manager
Database (.pmd) files. A Policy Domain contains any number of roles and a set of devices that are uniquely assigned to that particular domain. You work in one current domain at a time and each domain is identified by a unique name that you assign. The Domain menu lets you easily switch from one domain to another. You can still export policy configuration data to a .pmd file, (one file per domain) for backup and troubleshooting purposes, and you can also import data from a .pmd file into a new policy domain. For more information, see
Policy Domains and How to Create and Use Domains.
You can still import policy data from a .pmd file into a Policy Domain.
For more information, see Importing a File into a Domain.
Initially, you must use Console to add devices to the NetSight database. Once devices have been added to the database, you must assign the devices to a Policy Domain using Policy Manager. As soon as the devices are assigned to a domain, they are automatically
If You are Upgrading 89
SNMP Version and
Access/Community Names
Device Groups
Ports
Port Groups
Network Resource Groups
Policy VLAN Islands
Options
If You are Upgrading
NetSight Policy Manager Help displayed in the Policy Manager Network Elements tree. After you have initially added your devices, you can use Policy Manager's Add
Device window to add a single device to the database and the current
domain. For more information, see How to Add and Delete Devices.
SNMP Version and Access properties are now configured using the
Authorization/Device Access window accessed from the Tools menu.
The window has four tabs:
Users/Groups tab lets you manage user access to specific
features and capabilities.
Profiles/Credentials tab lets you define SNMP credentials used
to access your network devices, and create profiles that use
these credentials for various device access levels.
Profile/Device Mapping tab lets you specify the profiles that
will be used when communicating with network devices.
Manage SNMP Passwords tab where you can manage the
credentials that have been set on your network's devices.
It is important that you have your profiles and credentials set up correctly for the Enforce operation. For more information, see this
The Network Elements device tree is organized a little bit differently.
There is now a top−level My Network folder which contains two folders: All Devices and Grouped By. The Grouped By folder contains five subfolders: Chassis, Contact, Device Types, IP, and Location.
When a device is assigned to a domain, it automatically becomes a member of the appropriate group. You cannot create user−defined device groups using Policy Manager; device groups must be created using Console.
Ports are not longer displayed in the left−panel Network Elements tree.
Now you must select a device in the left−panel tree and expand a slot or ports grouping in the right−panel Details view to see the ports on a device. Right−click on a port and select Properties from the menu to
open the Port Properties window where you can view port information.
Port Groups are now displayed on their own separate left−panel Port
Groups tab.
Network Resource Groups are now displayed on the left−panel
Services tab.
Policy VLAN Islands are now displayed on the left−panel VLANs tab.
The Options window (Tools > Options) now allows you to set Suite options that apply across all NetSight plugin applications as well as options specific to the Policy Manager application. For more
information, see How to Set Options.
90
NetSight Policy Manager Help
If You are Upgrading 91
Configuring Authentication
Authentication is the process by which end users identify themselves to the network and are given customized access capabilities based on the role they serve in the organization. Policy Manager supports three different types of authentication: Web−based, 802.1X, and MAC. For more information on the different types of
authentication, see Authentication Types.
To assist you in configuring authentication for your network, Policy Manager provides an Authentication
Configuration Guide that presents steps for configuring the various components required for authentication. In addition, two configuration supplements provide information specific to different types of authentication. It is recommended that you begin by following the instructions in the Authentication Configuration Guide, then refer to the supplements for additional information, if applicable to your type of authentication.
The following Authentication Configuration Help topics are provided:
•
Authentication Configuration Guide
•
802.1X Authentication Configuration Supplement
•
Configuring Windows 2000 Advanced Server for RADIUS Authentication
Configuring Authentication 92
Authentication Configuration
Guide
Authentication is the process by which end users identify themselves to the network and are given customized access capabilities based on the role they serve in the organization. Policy Manager uses a RADIUS server and an authentication−enabled device to dynamically assign a policy (or role) to a port, based on the end user's login or MAC address.
Policy Manager supports four different types of authentication: Web−based, 802.1X, MAC and CEP
Concepts Help topic.) This guide presents steps for configuring the various components required for
specific to the different types of authentication.
Some devices support multiple authentication types and multiple users (Multi−User Authentication) per port, while others are restricted to only one or two authentication types and single users per port (Single User
information on the authentication types supported by each device type.
While most of the main configuration tasks can be performed in any order, the recommended sequence is below. When you have completed the configuration tasks, a test user should be able to authenticate on the network and be assigned the correct role.
In order to configure your setup for authentication, you will need the following components:
•
NetSight Policy Manager
•
RADIUS authentication server and user interface
•
Policy−enabled devices (switches)
•
Hardware for running Policy Manager and the RADIUS Server
You may already have these components installed and running, but you should read all the sections of this document anyway, as they contain information that will help you to configure them for use with Policy
Manager. You may want to perform your initial configuration in a test environment before deploying it on your network.
NOTES:
Configuring Windows 2000 Advanced Server
Users of Windows 2000 Advanced Server should read this Authentication Configuration Guide,
but should follow the steps in Configuring Windows 2000 Advanced Server for RADIUS
Authentication for instructions on installing and configuring the RADIUS server.
Configuring Windows 2000
Windows 2000 users who plan to utilize Funk Software Inc.'s Steel−Belted RADIUS should consult Funk's website www.funk.com
for assistance in setting up Steel−Belted RADIUS on
Windows 2000, in particular Tech Bulletins RD 410 and RD 447 (look for Tech Support >
Steel−Belted Radius > Steel−Belted Radius Tech Notes > View by Tech Note ID Number).
Instructions on:
1.
Authentication ConfigurationGuide 93
NetSight Policy Manager Help
2.
3.
4.
Planning Your Policies (Roles and Services)
a.
b.
5.
6.
a.
Configuring a Windows Workstation as a DHCP Client
b.
Configuring a Solaris Workstation as a DHCP Client
c.
Configuring a Linux Workstation as a DHCP Client
d.
Browser Requirements for Web−Based Authentication
7.
Installing and Configuring the RADIUS Server
a.
b.
c.
8.
Configuring RADIUS in Policy Manager
a.
b.
Adding Devices to Policy Manager
c.
d.
Configuring Devices as RADIUS Clients
e.
Configuring Authentication on Devices
9.
a.
Testing Web−Based Authentication
b.
Preliminary Reading
Before configuring your network for Policy Manager, read as much about Policy Manager and its associated technologies as you can, to familiarize yourself with Policy Manager's features and the business challenges it has been designed to solve. The following reading sequence is advised:
•
Secure Networks Technology Foundation − This Enterasys white paper provides an in depth discussion of Enterasys Secure Networks technology, and presents NetSight Policy Manager as the key to role−based administration—the modeling of both IT and business concepts inherent in an
Enterasys Secure Network. You can access this white paper at
• http://www.enterasys.com/products/whitepapers.
RADIUS Vendor Documentation − Policy Manager utilizes a RADIUS server for authentication. If you do not already have a RADIUS server installed, you will need to install one following your vendor's installation instructions. You will then need to be able to use the RADIUS server user
• interface to configure the RADIUS server for use with Policy Manager.
Installation − This topic provides information on the minimum requirements for running Policy
Manager, platform−specific information, and instructions for installing the application. The
Installation document is available by selecting Help > Help Topics from the Policy Manager menu after installation, or on the NetSight Documentation website:
• http://www.enterasys.com/support/manuals/netsight.html.
Policy Manager Release Notes − The release notes for your version of Policy Manager contain
release−specific information, including known issues and any available workarounds. You can access the Release Notes by selecting Help > Release Notes from the Policy Manager menu after installation. In addition, the latest version of the release notes are available on the NetSight
Documentation website: http://www.enterasys.com/support/manuals/netsight.html.
Preliminary Reading 94
NetSight Policy Manager Help
Installing Policy Manager
In Policy Manager, you will be setting up communication between your RADIUS server and your Policy
Manager devices, and creating the roles that will be mapped to your users in the RADIUS server for authentication purposes. Although it is not required that you install Policy Manager before installing your
RADIUS server, installing Policy Manager as a first step gives you easy access to Policy Manager documentation via the Help > Help Topics menu option, and lets you familiarize yourself with the
instructions.
Post−Installation Reading
After you've installed Policy Manager, familiarize yourself with the application by selecting Help > Help
Topics from the menu and reading the following Help topics:
•
Getting Started with Policy Manager − This topic provides a brief overview of Policy Manager and
a Quick Tour of its features. It is suggested that you take the Quick Tour before you start creating
• roles and configuring devices in Policy Manager.
Policy Manager Concepts − This topic explains some of the concepts you'll need to understand in
order to make the most effective use of Policy Manager, including a section on Authentication that
• describes the types of authentication that Policy Manager supports, and how authentication works.
Configuration Supplements − These Help topics provide supplemental information for specific authentication types and configurations:
•
Configuring Windows 2000 Advanced Server for RADIUS Authentication −− for users of
•
Windows 2000 Advanced Server.
802.1X Authentication −− configuration information specifically for networks using 802.1X
authentication.
After completing this reading, continue with the tasks below.
Planning Your Policies (Roles and Services)
It is recommended that, prior to performing any configuration tasks, you plan in advance the policy profiles, or "roles," that will be applied to your users. For testing purposes, you do not need to create all the roles at this point, but you should have an idea what some, if not all, of the role names are going to be.
The roles you will eventually be creating in Policy Manager are usually named for business functions that already exist in the enterprise. You will create customized services made up of traffic classification rules, that you will apply to your roles. A role may also contain default access control (VLAN) and/or class of service designations that will be applied to traffic not identified specifically by the set of access services contained in the role. The set of services included in a role, along with any access control or class of service defaults, determine how all network traffic will be handled at any network access point configured to use that role.
If you have not done so already, read the white paper Secure Networks Technology Foundation, the
Installing Policy Manager 95
NetSight Policy Manager Help for background. This will assist you in planning your roles, and the services and rules you'll need to create to apply to them.
Identifying Roles
Roles are usually named for a type of user such as Student or Faculty. As you begin identifying potential policy roles within your organization, consider the following issues:
•
What are the different users and their network access requirements? For example, do you have some
• users that require priority access? Do you have other users that should be denied access?
What are the network service or application priority requirements? For example, is there an application like SAP that requires priority?
After the different roles have been determined, you must determine if each role will have a default access control and whether or not the traffic should be contained to a VLAN or denied. Should there be a default class of service for a role? If so, what should it be?
Defining Services
Once a role has been identified, you need to define the services and rules that will make up that role. It is helpful to establish a naming convention for services where the name describes the service's action. By carefully determining this naming convention, you can facilitate the administration of the policy configuration.
Examples of a naming conventions might be:
•
Services that do not deny traffic (go to a discard VLAN) and don't have a class of service action associated with them are prefixed with the term "Allow" (e.g. "Allow Print Access" or "Allow
•
Email").
Services that deny traffic (go to a discard VLAN) are prefixed with the term "Deny" (e.g. "Deny
•
Telnet").
Services that do not deny traffic and have a priority action associated with them are suffixed with a term denoting the priority of the action (e.g. "External Web (P3)" and "External Web (P7)").
An alternative convention would be to have the "Allow" and "Deny" terms be suffixes so when the services are listed alphabetically, all the different versions of a single service would be listed together.
You should also consider whether there is an advantage to grouping your services into Service Groups. If you will be adding the same group of services to multiple roles, Service Groups will make this task easier.
Once you have defined your required services, you can outline the various classification rules that must be created as the working base of each service. For more information on how classification rules are created and
used, see Traffic Classification Rules.
Once you've got an idea of what your roles and services will be, continue with the configuration tasks below.
Identifying Roles 96
NetSight Policy Manager Help
Planning for Port Mode
Another issue to be decided in advance is port mode. Port mode determines which ports in your network will require authentication by users, and how you wish unauthenticated traffic to be handled on all ports, whether
information.
For testing purposes, you do not need to set the port mode on every port, but you should know how you want each port to behave before you implement your policies. We will be setting the port mode on a couple of ports
later on in our configuration procedures (Configuring the Port Mode) for testing purposes.
Once you have an idea of what the port mode settings will be on your ports, continue with the tasks below.
Configuring End Users
This section deals with configuring the end user. Depending on your setup, you may or may not need to set up your end user workstations as DHCP clients. If you are configuring web−based authentication, the end user must have access to either an Internet Explorer (IE) or Netscape browser in order to launch the authentication web page. Use the procedures in this section that are appropriate to your configuration.
Configuring a Windows Workstation as a DHCP Client
To configure a Windows workstation as a DHCP client, you will enable the DHCP protocol and remove the
WINS and DNS IP addresses. The procedure may vary slightly, depending on the operating system. The following instructions are for a Windows XP workstation:
1. Launch the TCP/IP Properties window. Select Start > Settings > Network Connections and right−click on Local Area Connection to open the Local Area Connection Properties window.
2. Select Internet Protocol (TCP/IP) and click the Properties button to open the Internet Protocol
(TCP/IP) Properties window.
3. In the General tab, select the "Obtain an IP address automatically" and "Obtain DNS server address automatically" options. Click the Advanced button to open the Advanced TCP/IP Settings window.
NOTE:
The next two steps are required so that the existing IP addresses will not overwrite the addresses obtained by DHCP.
4. In the DNS tab, remove all the values or IP addresses, except for the Host Name.
5. In the WINS tab, remove all WINS IP addresses and check the "Enable LMHOSTS Lookup" box.
6. Click OK to close the windows.
7. Reboot the system.
8. To verify that the DHCP server is now providing the IP addresses for the clients, open an MS−DOS window and use the appropriate ipconfig
command:
•
To view the current IP address: ipconfig /all
•
To release the current IP address: ipconfig /release
•
To renew the current IP address or request a new IP address: ipconfig /renew
Planning for Port Mode 97
NetSight Policy Manager Help
Configuring a Solaris Workstation as a DHCP Client
To configure a Solaris workstation as a DHCP client, you need only start the DHCP daemon. Setting up
DHCP and rebooting is not necessary.
1. To start the DHCP daemon at the prompt, type:
/sbin/dhcpagent
2. To enable DHCP on interface le0, at the prompt, type: ifconfig le0 dhcp start
3. To get or release an IP address from the DHCP server, use the appropriate ipconfig
command:
•
To view the current IP address: ifconfig −a
•
To release the current IP address: ifconfig le0 dhcp release
•
To renew the current IP address or request a new IP address: ifconfig le0 dhcp
Configuring a Linux Workstation as a DHCP Client
To cause a Linux workstation to request a DHCP address, type the command:
/sbin/dhclient in an xterm window where you are logged in as root. This request will not persist if you reboot the workstation.
If you would like to configure DHCP so that it is persistent across reboots, you can use the DHCP configuration tool.
1. In an xterm window where you are logged in as root, type:
/usr/sbin/redhat−config−network
2. In the tool window, select the appropriate network adapter (e.g. eth0).
3. Select Edit from the menu bar.
4. Select the "Automatically obtain IP Address Settings with DHCP" option.
5. Select the "Automatically obtain DNS Information from Provider" checkbox.
6. Click Ok.
7. Select File > Save from the menu bar.
8. Reboot the workstation.
Browser Requirements for Web−Based Authentication
These instructions pertain to web−based authentication only. In order to launch the authentication web page, the end user must have access to either the Internet Explorer (IE) or Netscape browser. The requirements are as follows:
Netscape
•
Version 4.5 or later
•
Java Virtual Machine (JVM). This should come with the Netscape installation. If not, install the JVM after you've installed Netscape. You can download it from http://www.sun.com.
NOTE:
Netscape browsers that are configured to use an HTTP (web) proxy server will need to be adjusted to launch the authentication login web page in order for the user to log in. There are two ways to do this:
•
Add the authentication login web page URL as one of the web services not requiring a proxy:
Configuring a Solaris Workstation as a DHCP Client 98
NetSight Policy Manager Help
1. From the menu, select Preferences >Advanced >Proxies.
2. Select "Manual proxy configuration" and click View.
3. Enter your proxy address in the appropriate field.
4. Under Exceptions, enter the URL for your authentication login web page.
5. Click OK to save and exit the Manual Proxy Configuration window, and OK again to exit the Preferences window.
•
Before launching the login web page, the user disables the proxy (Preferences
>Advanced >Proxies, select "Direct connection to Internet"), and after logging in, re−enables the proxy in order to gain access to the Internet (Preferences >Advanced
>Proxies, select "Automatic proxy configuration" and click OK).
NOTE:
If you can't get out to the Internet after authentication login, close and restart Netscape.
Internet Explorer
•
Version 4.x or later
•
Solaris: Microsoft Virtual Machine (MVM). This should come with the Internet Explorer installation.
If not, install it afterward. You can download it from http://www.microsoft.com.
NOTE:
Internet Explorer users do not need to change the proxy as Netscape users do, but they will need to wait approximately thirty seconds for the system to detect the proxy change when launching the login page, and again when accessing the Internet after logging in.
Installing and Configuring the RADIUS Server
Policy Manager has been designed to work with a RADIUS server for authentication. Funk Software, Inc.'s
RADIUS
TM
(Remote Authentication Dial In User Service) is an authentication solution that has been tested at
Enterasys. It exchanges information between a RADIUS client (a device that provides network access to users) and a RADIUS authentication server (a device that contains authentication information for these users).
There are many RADIUS server products available. Policy Manager has been tested with the following:
•
Steel−Belted RADIUS (Funk Software Inc.)
•
Windows 2000 RADIUS
•
Radiator (Open System Consultants Ltd.)
To give you an idea of how to configure your RADIUS server, we are providing instructions for configuring the RADIUS server using Funk's Steel Belted RADIUS Administrator user interface. If you are using another vendor's product, adapt the instructions as needed.
After installing your RADIUS server and user interface, you will need to use the user interface to configure your Policy Manager devices (RADIUS client devices) and end users on the server. The RADIUS server user interface is sometimes called the "client". This is not to be confused with the RADIUS client devices that you will be adding to the server.
NOTES:
The procedures below may vary depending on the operating system you are using.
Configuring Windows 2000 Advanced Server
Users of Windows 2000 Advanced Server should read this Authentication Configuration Guide,
but should follow the steps in Configuring Windows 2000 Advanced Server for RADIUS
Authentication for instructions on installing and configuring the RADIUS server.
Browser Requirements for Web−Based Authentication 99
NetSight Policy Manager Help
Configuring Windows 2000
Windows 2000 users who plan to utilize Funk Software Inc.'s Steel−Belted RADIUS should consult Funk's website www.funk.com
for assistance in setting up Steel−Belted RADIUS on
Windows 2000, in particular Tech Bulletins RD 410 and RD 447 (look for Tech Support >
Steel−Belted Radius > Steel−Belted Radius Tech Notes > View by Tech Note ID Number).
Installing the RADIUS Server
Install your RADIUS server and its user interface according to the vendor's instructions. In preparation, read the following installation requirements:
•
The RADIUS server must be installed on a machine other than the one where Policy Manager is
• installed.
Make sure you install the RADIUS server on a machine whose operating system is supported by the
• vendor's product.
You'll need to install both the RADIUS server and the RADIUS user interface (or RADIUS client −− in Steel Belted RADIUS, it's called the Steel Belted RADIUS Administrator). However, they do not
• need to be on the same machine.
Be sure to read the vendor's release notes prior to installing.
•
Have on hand the license key provided to you by your vendor.
•
You must be logged in as Administrator, or another user with full read/write privileges.
Adding RADIUS Client Devices
Now that you've installed the RADIUS server and user interface, you will add the RADIUS clients (Policy
Manager devices, not end users) to the server. If you are using a RADIUS server other than Funk Software
Inc.'s Steel−Belted RADIUS, you will need to adapt the instructions below to your product.
1. From the Windows Start menu, select Settings > Control Panel > Services and confirm that the
RADIUS server is running by scrolling down to Steel Belted Radius Server. The Status of the server should be "Started." If it is not running, start it by clicking Start.
2. Close the Services window.
3. Open the RADIUS server user interface (Start > Programs > Steel Belted Radius > Steel Belted
Radius Administrator).
4. Click Connect to connect to the local RADIUS server.
5. Select RAS Clients.
6. Click Add.
7. Client Name: If the device has a name that can be resolved to an IP address, enter the name.
Otherwise, enter its IP address.
8. IP Address: Enter the IP address of the device.
9. Make/Model: Verify that Standard Radius is selected.
10. Select Edit authentication shared secret.
11. Shared Secret: Enter a string of characters that will be used to encrypt and decrypt communications between the RADIUS server and the device (RADIUS client). Without the shared secret, the server and client will be unable to communicate, and authentication attempts will fail. The shared secret must be at least 6 characters long; 16 characters is recommended. Dashes are allowed in the string, but spaces are not. Be sure to write the shared secret down, as you will be adding it to the RADIUS client devices later.
NOTE:
If you are configuring multiple RADIUS servers, the same server shared secret must be used for each RADIUS server. This is because most Policy Manager devices (RADIUS
Installing the RADIUS Server 100
NetSight Policy Manager Help clients) only support one shared secret. Matrix N−Series devices with firmware version
5.0 or above are an exception to this, as these devices do support a unique shared secret for each server.
12. Click Set.
13. Repeat until all of your Policy Manager devices have been added.
Adding RADIUS Users
In order for your end users to communicate with the RADIUS server, you need to add them to the RADIUS server and map them to the appropriate Policy Manager roles. You will do this with the RADIUS user interface. You can add RADIUS users as Native users (local users) or as Domain users (defined on a domain controller) or both.
NOTE:
If you are configuring MAC authentication in addition to 802.1X and/or Web−based authentication, you will need to make two entries for each end user: one for the MAC address and one for the user name.
NOTE:
For information on configuring end user VLAN ID attributes (in compliance with RFC
3580) to be used in conjunction with VLAN to Role Mapping, refer to your device
firmware and RADIUS server documentation.
Preparation: In order to add RADIUS users, you need to know what role names will apply to each user. See
Planning Your Policies for more information.
Adding Native (Local) Users
1. In the RADIUS client window (Steel Belted RADIUS Administrator window), select Users.
2. Click Add.
3. In the Add New User window, verify that the Native tab is selected.
4. In the Enter User Name field, enter the user name, and click OK.
NOTE:
If you are configuring MAC authentication, enter the MAC address in the Enter User
Name field. When you enter the MAC addresses, do not use dots, semi−colons, or colons as delimiters. The correct format is as follows:
XX−XX−XX−XX−XX−XX
5. Click Set Password.
6. In the Enter User Password window, enter the user's password.
NOTE:
If you are configuring MAC authentication, enter the MAC password in the
Enter User Password field.
7. Click Set.
8. Select Allow CHAP. (You can also use PAP for native users. PAP would be used for users configured on a domain controller.)
9. Click Set.
10. In the Users Window, select the Return list attributes tab and click Ins.
11. Add New Attributes window: In the Available Attributes panel, click Filter−Id.
12. In the Enter a String field, enter:
Enterasys:version=1:mgmt=su:policy=[role]
where
[role]
is the role name to be applied to this user.
CAUTION:
Include
:mgmt=su
in the string only for users who should have administrative privileges and the ability to telnet to devices and/or use local management on devices when authentication is enabled. For other users, leave it out.
Adding RADIUS Users 101
NetSight Policy Manager Help
13. Click Add, then Close, then Save.
14. Repeat until all of your native users have been added.
Adding Domain Users
If you are going to add domain users, they must be set up in your Domain Controller first.
1. In the RADIUS client window (Steel Belted RADIUS Administrator window), select Users.
2. Click Add.
3. In the Add New User window, select the Domain tab.
4. Select a domain on the left pane and users or groups on the right pane, and click OK.
5. Click Ins.
6. Add New Attributes window: In the Available Attributes panel, click Filter−Id.
7. In the Enter a String field, enter:
Enterasys:version=1:mgmt=su:policy=[role]
where
[role]
is the role name to be applied to this user.
CAUTION:
Include
:mgmt=su
in the string only for users who should have administrative privileges and the ability to telnet to devices and/or use local management on devices when authentication is enabled. For other users, leave it out.
8. Click Add, then Close, then Save.
9. Repeat until all of your domain users have been added.
Configuring RADIUS in Policy Manager
Now that the RADIUS server side has been set up, you can complete your configuration using Policy
Manager. The steps are as follows:
1.
2.
Adding Devices to Policy Manager
3.
4.
Configuring Devices as RADIUS Clients
5.
Configuring Authentication on Devices
Downloading the Firmware
Policy Manager works with devices that support the Enterasys Policy Profile and Enterasys Web
Authentication MIBs, such as the Enterasys Matrix E7, SmartSwitch 2000, and Matrix N−Series devices.
Follow the instructions that come with your hardware to download the latest authentication image (which includes the MIBs) to your devices. An easy way to download firmware to multiple devices is to use NetSight
Inventory Manager, or you can use NetSight Console to download firmware to a single device.
Once you have downloaded the firmware, clear NVRAM on all the devices.
Adding Devices to Policy Manager
Policy Manager and Console share the NetSight database which contains the device models that represent the
Adding RADIUS Users 102
NetSight Policy Manager Help actual devices in your network. There are three ways to add devices to the NetSight database. Initially, you must perform a Console Discover to populate the database or you can also use Console to import devices from
Domain using Policy Manager. As soon as the devices are assigned to a domain, they are automatically
displayed in the Policy Manager Network Elements tree. Only devices assigned to the domain you are currently viewing are displayed.
After you have initially added your devices, you can use Policy Manager's Add Device window to add a
instructions.
Configuring the Port Mode
contact with your devices when authentication is enabled. Since this is the default port mode for all ports, you only need to confirm that these ports are set correctly.
•
Router ports
•
RADIUS server ports
•
NetSight Policy Manager port
•
DHCP/DNS/WINS server ports
•
Backplane ports
•
Front panel interswitch link ports
To confirm that the required ports are set to Inactive/Default Role:
1. Launch Policy Manager (Start > Programs > Enterasys Networks > NetSight Policy Manager >
Policy Manager).
2. In the left panel, select the Network Elements tab.
3. Open the All Devices folder and select the device on which the port is located.
4. Select the right−panel Ports tab for the device and click Retrieve. Scroll to the right to see the Port
Mode column and verify that the Port Mode for the port is Inactive/Default Role.
If the port mode for a port is incorrect, do the following:
1. Right click on the port and select Properties. The Port Properties window opens.
2. Select the Authentication Configuration tab.
3. Select the General sub−tab. In the Port Mode area, set the port as follows:
Authentication Behavior: Inactive
Unauthenticated Behavior: Default Role
4. Click Apply. To confirm that the port was set to Inactive/Default Role, select the right−panel Ports tab for the applicable device and check the Port Mode column for the port.
NOTE:
The procedures above enable you to set a few ports quickly for testing purposes. If you
need to set a large number of ports, you may want to use the Port Configuration Wizard,
which includes windows where you can set up authentication parameters and default
roles and apply them to multiple ports. See the How to Configure Ports Help topic for
more information.
Configuring the Port Mode 103
NetSight Policy Manager Help
Configuring Devices as RADIUS Clients
You can now use Policy Manager to configure each device as a RADIUS client.
CAUTION:
Be sure you have completed the previous task, Configuring the Port Mode, before moving on
to this procedure. Otherwise, you may lose contact with your devices.
Configure each device as follows (see the RADIUS Tab Help topic for more information):
1. In the left−panel Network Elements tab, select the device.
2. In the right panel, select the RADIUS tab.
3.
In the RADIUS Server(s) area, select the Authentication sub−tab and click Add to open the Add
RADIUS Authentication Server window .
4. Enter the following information:
RADIUS Server IP:
[IP address of your RADIUS server]
Auth. Client UDP Port:
1812
NOTE:
Depending on what RADIUS server you are using, another client UDP port might be appropriate. For example, 1645 is the client UDP port used by Funk
Software, Inc.'s RADIUS
TM
version 2.25.80). 1812 is the client UDP port used by many other RADIUS servers.
Verify Shared Secret: Retype the shared secret to confirm.
NOTE:
If you are configuring multiple RADIUS servers, the same server shared secret must be used for each RADIUS server. This is because most Policy Manager devices (RADIUS clients) only support one shared secret. Matrix N−Series devices with firmware version
5.0 or above are an exception to this, as these devices do support a unique shared secret for each server.
Auth. Access Type: Use the drop−down list to select the type of authentication access allowed for this RADIUS server:
•
Any access − the server can authenticate users originating from any access type.
•
Management access − the server can only authenticate users that have requested
• management access via the console, Telnet, SSH, or HTTP, etc.
Network access − the server can only authenticate users that are accessing the network via
802.1X, MAC, or Web−Based authentication.
This feature allows you to have one set of servers for authenticating management access requests and a different set for authenticating network access requests. Devices that do not support this feature will have this field grayed out.
RADIUS Server Priority: Select the order in which the RADIUS authentication server will be checked, as compared to the other RADIUS authentication servers on the device. The lower the number, the higher the priority.
5. If this is the only RADIUS server you are adding, click OK. If you are adding another RADIUS server for backup or for another reason, click Apply and repeat steps 4 and 5.
6. On the RADIUS tab, click the Apply button in the RADIUS Server(s) section.
7. In the RADIUS Authentication Client Settings section, set the RADIUS Client Status field to
Enabled, and click the Apply button in that section.
Configuring Devices as RADIUS Clients 104
NetSight Policy Manager Help
Configuring Authentication on Devices
Now, use Policy Manager to configure authentication on each device. The steps you will use depend on the authentication type(s) you are configuring. Some devices support multiple authentication types and multiple users (Multi−User Authentication) per port, while others are restricted to only one or two authentication types and single users per port (Single User Authentication). Refer to the Policy Manager/Firmware Feature Support
more information).
Web−Based Authentication
1. In the left−panel Network Elements tab, select the device.
2.
In the right panel, select the Authentication tab and make the following selections in the General
Settings section:
Authentication Type: Single User Web−Based or Multi−User Web−Based
Authentication Status: Enabled
For devices that support multi−authentication types, you can set the Multi−User Authentication
Type Precedence. This allows you to set the order in which the authentication types will be tried on the device, with the authentication type on the left having the highest precedence (it will be tried first). Select the authentication type you want to position, and use the left or right arrow to arrange the types in the desired order of precedence.
3. Click the Apply button in the General Settings section.
4. In the Web Authentication Settings sub−tab, select the General sub−tab and select/enter the following information:
Enhanced Login Mode: Enable this feature, if desired. (This option is grayed out if not supported on the device.)
Logo Display Status: Select Show or Hide, as desired. (This option is grayed out if not supported on the device.)
WINS/DNS Spoofing: Select Enabled. (This option is grayed out if not supported on the device.)
Authentication Protocol: Select PAP
Web Authentication URL: Enter the URL for your authentication web page. (This option is grayed out if not supported on the device.) The Enterasys default name for the web authentication URL is
"secureharbour," but you can enter your own URL, if desired.
Web Authentication IP Address: Enter the IP address of your authentication web page server.
5. Click the Apply button at the bottom of the tab.
6. Still in the Web Authentication Settings sub−tab, select the Web Login sub−tab and modify the Web
Page Banner the end users will see at the top of the authentication web page so that it fits your needs.
For example, you might include your company name and information on what to do if the user has questions or problems. Because this banner also appears in messages that occur during successful logon and failed authentication, as well as on the "Radius Busy" screen, it would not be appropriate to include "Welcome to [Your Company]" in the banner.
7. Click the Apply button at the bottom of the tab.
8. Repeat until all of your devices have been configured. If you are configuring multiple devices, you
may want to use the Device Configuration Wizard.
802.1X Authentication
1. In the left−panel Network Elements tab, select the device.
2.
In the right panel, select the Authentication tab and make the following selections in the General
Configuring Authentication on Devices 105
NetSight Policy Manager Help
Settings section:
Authentication Type: Single User 802.1X or Multi−User 802.1X
Authentication Status: Enabled
For devices that support multi−authentication types, you can set the Multi−User Authentication
Type Precedence. This allows you to set the order in which the authentication types will be tried on the device, with the authentication type on the left having the highest precedence (it will be tried first). Select the authentication type you want to position, and use the left or right arrow to arrange the types in the desired order of precedence.
3. Click the Apply button in the General Settings section.
4. Repeat until all of your devices have been configured. If you are configuring multiple devices, you
may want to use the Device Configuration Wizard.
MAC Authentication
1. In the left−panel Network Elements tab, select the device.
2.
In the right panel, select the Authentication tab and make the following selections in the General
Settings section:
Authentication Type: Single User MAC or Multi−User MAC
Authentication Status: Enabled
For devices that support multi−authentication types, you can set the Multi−User Authentication Type
Precedence. This allows you to set the order in which the authentication types will be tried on the device, with the authentication type on the left having the highest precedence (it will be tried first).
Select the authentication type you want to position, and use the left or right arrow to arrange the types in the desired order of precedence.
3. Click the Apply button in the General Settings section.
4. In the MAC Authentication Settings sub−tab, specify the MAC authentication password that will be used for that device.
5. Click the Apply button at the bottom of the tab.
6. Repeat until all of your devices have been configured. If you are configuring multiple devices, you
may want to use the Device Configuration Wizard.
802.1X+MAC Authentication
1. In the left−panel Network Elements tab, select the device.
2.
In the right panel, select the Authentication tab and make the following selections in the General
Settings section:
Authentication Type: Single User 802.1X+MAC
Authentication Status: Enabled
3. Click the Apply button in the General Settings section.
4. In the MAC Authentication Settings sub−tab, specify the MAC authentication password that will be used for that device.
5. Click the Apply button at the bottom of the tab.
6. Repeat until all of your devices have been configured. If you are configuring multiple devices, you
may want to use the Device Configuration Wizard.
CEP Authentication
1. In the left−panel Network Elements tab, select the device.
2.
In the right panel, select the Authentication tab and make the following selections in the General
Settings section:
Authentication Type: Single User CEP or Multi−User CEP
Configuring Authentication on Devices 106
NetSight Policy Manager Help
Authentication Status: Enabled
For devices that support multi−authentication types, you can set the Multi−User Authentication
Type Precedence. This allows you to set the order in which the authentication types will be tried on the device, with the authentication type on the left having the highest precedence (it will be tried first). Select the authentication type you want to position, and use the left or right arrow to arrange the types in the desired order of precedence.
3. Click the Apply button in the General Settings section.
4. In the CEP sub−tab, select the CEP product types supported on the device, and map a role for each type. Then, when a convergence endpoint (such as an IP phone) connects to the network, the device identifies the type of endpoint and applies the assigned role. Click Add to open the Add CEP
Mapping window where you can select a CEP product type supported on the device, and map a role for that type. Click OK.
5. Click the Apply button at the bottom of the tab.
6. Repeat until all of your devices have been configured. If you are configuring multiple devices, you
may want to use the Device Configuration Wizard.
NOTE:
In addition to configuring CEP on the device, you must also enable CEP protocols on
each port using the CEP Access sub−tab in the Port Properties Authentication
Configuration Tab or the Port Configuration Wizard.
Testing Authentication
configuration. This section provides two testing scenarios: one for web−based authentication and one for
802.1X authentication.
If your tests are successful, you can go on to create your remaining roles and services, referring to your plan
and to the Help topics How to Create a Role and How to Create a Service as needed.
If your test is unsuccessful and you have issues you cannot resolve by reviewing the configuration steps in this
document, contact Enterasys Technical Support for assistance.
Testing Web−Based Authentication
In order to test your web−based authentication configuration, you will use Policy Manager to create one of the roles from the plan you worked out earlier. You do not need to create the role's services and classification rules at this time; only the role name is required for the test.
After creating the role, you will enforce it (write it to the device). You will then configure the port mode on one port to be Active/Discard and another to be Active/Default Role. Finally, you will attempt to log in to both ports as one of the users you mapped to the role on the RADIUS server.
NOTE:
Because Multi−User Web−Based Authentication does not support the Active/Discard port mode, you must configure your device with Single User Web−Based
Authentication in order to perform the following Active/Discard mode test.
Testing Authentication 107
NetSight Policy Manager Help
Preparation
1. Decide on the role you want to test. It might be helpful to test the role that is assigned to your own user ID.
2. Create the role as follows: a. In Policy Manager, select the Roles tab in the left panel.
b. Right−click the Roles folder, and select Create Role.
c. Type the role name in the highlighted box and press Enter.
d.
Click Enforce on the toolbar, review the effects of enforcing on the Enforce Preview window
if it is enabled, then click Enforce on that window. This writes the role to the devices, making them aware of the role's existence, but it does not associate the role with any port.
3. Select the Network Elements tab in the left panel.
4. Select a port to use as an Active/Discard mode port.
a. Select the right−panel Ports tab for the device where the port resides and click Retrieve.
b. Right click on the port and select Properties. The Port Properties window opens.
c. Select the Authentication Configuration tab.
d. Select the General sub−tab. In the Port Mode area, set the port as follows:
Authentication Behavior: Active
Unauthenticated Behavior: Discard
5. Select a port to use as an Active/Default Role mode port.
a. Right click on the port and select Properties. The Port Properties window opens.
b. Select the Authentication Configuration tab.
c. Select the General sub−tab. In the Port Mode area, set the port as follows:
Authentication Behavior: Active
Unauthenticated Behavior: Default Role d. Assign a default role to the port by right−clicking the port and selecting Set Default Role.
e. Select the role you created earlier, and click OK. Now the role is associated with the port.
6. To confirm that the ports are set correctly, select the right−panel Ports tab for the device and view the
Default Role and Port Mode columns for the ports you just configured.
Testing Active/Discard Mode
NOTE:
Because Multi−User Web−Based Authentication does not support the Active/Discard port mode, you must configure your device with Single User Web−Based
Authentication in order to perform the following Active/Discard mode test.
Active/Discard mode means that authentication is enabled on the port, and unauthenticated traffic is not
for the device:
•
Prior to user login, the Default Role for the port is <None>, and the Current Role for the port is also
•
<None>.
After successful login, the Default Role for the port is still <None>, but the Current Role for the port
• becomes the user's assigned role.
After the user logs out, the Default Role is still <None> and the Current Role reverts to <None>.
NOTE:
This test assumes the end user workstation is configured as a DHCP client. If your end
users use static IP addresses, they must be on the 192.168.0.0 network (with a mask of
255.255.0.0) or have a route to it. Otherwise, they will not be able to access the login screen for authentication.
To test your authentication configuration in Active/Discard mode:
Testing Web−Based Authentication 108
NetSight Policy Manager Help
1. Before the user is authenticated, verify that the Active/Discard port you configured earlier does not allow unauthenticated traffic to pass in either direction.
2. Configure a user machine to be a DHCP client and connect it to the Active/Discard port.
3. On the Ports tab, look at the Default Role and Current Role for the selected port. They should both be
<None>.
4. On the user machine, confirm that you can get the correct IP address, as follows:
Windows: Open a DOS window and enter:
ipconfig /renew
Solaris: At the prompt, enter:
ifconfig le0 dhcp
The IP address should be
192.168.1.[port number]
where
[port number]
is the port number on the device to which the user machine is connected. End users who use DHCP receive this temporary IP address from the device. This IP address provides access to the authentication login web page. If authentication is successful, the user can obtain a permanent IP address from the DHCP server.
5. On the user machine, open your Netscape or Internet Explorer browser.
6. If you are using Netscape, disable the proxy (unless you have performed one of the other proxy
configuration procedures in Browser Requirements, earlier).
7. Bring up the authentication login web page URL that you entered in the Web Authentication section of the Authentication tab.
8. Type in the user name and password for the user being tested, and click Login to Network. Within a few seconds, you should see the message Welcome to the Network.
If the Welcome message does not appear, check the following:
•
Make sure you entered the user name and password correctly in the RADIUS server.
•
If the message "Access is Denied" appears, it could mean the device cannot reach the
RADIUS server. Possible causes include:
•
The device's IP address has not been properly entered in the RADIUS server
•
The device has not been enabled as a RADIUS client
•
The RADIUS server has not been properly specified on the device
•
The correct client UDP port for the RADIUS server has not been specified in Policy
Manager
•
Other possible causes of the "Access is Denied" message include:
•
The wrong user/password combination was entered
•
The user is not in the database
•
The wrong authentication protocol has been specified (PAP vs. CHAP) on the device.
•
The wrong shared secret has been specified on the device
NOTES:
−− If you have configured multiple RADIUS servers, the same shared secret must be used for each RADIUS server. This is because
RADIUS clients (Policy Manager devices) only support one shared secret.
−− In the event of errors, the RADIUS server log for today's date may assist in troubleshooting. For Funk RADIUS servers, this file is located in the Service directory in your RADIUS server installation area. For Microsoft Authentication servers, view this information in the Event Viewer.
9. To confirm that your authentication was successful, do the following:
•
To see that the role was assigned to the port, in Policy Manager, look at the Ports tab for the device again. The Default Role should say <None>, and the Current Role should be the one
• assigned to the user who just logged on.
To see that the user machine has the new IP address, issue the
ipconfig /all
(Windows)
• or
ifconfig le0 dhcp
(Solaris) command at the command prompt.
To see that the user is a client in the DHCP IP address scope, on the DHCP services machine
Testing Web−Based Authentication 109
NetSight Policy Manager Help open the DHCP Manager, double−click Local Machine, and double−click the scope. The
Active Lease window opens to show you the active DHCP clients.
10. On the user machine, return to the web authentication URL and log off the network. To confirm that your role is no longer active on the port, return to the Policy Manager Ports tab for the device and note that the Current Role for the port again says <None>.
11. Verify again that the port does not allow unauthenticated traffic to pass in either direction.
Testing Active/Default Role Mode
Active/Default Role mode means that authentication has been enabled on the port, but a default role will apply in the absence of an authenticated user. A user does not need to authenticate to access the (usually limited) services provided by the default role. However, a user may opt to authenticate in order to access the (possibly more robust) services provided by his or her own role. For this test, the Active/Default Role mode port should
behave as follows, as displayed on the Ports tab for the device:
•
Prior to user login, the Default Role for the port is whatever role has been assigned as the default in
•
Policy Manager, and the Current Role is the same as the Default Role.
After successful login, the Default Role remains the assigned default role for the port, but the Current
•
Role becomes the user's role.
After the user logs off, the Current Role reverts to the Default Role.
NOTE:
This test assumes the user has a static IP address. End users who use static IP addresses must be on the 192.168.0.0 network (with a mask of 255.255.0.0) or have a route to it..
To test your authentication configuration in Active/Default Role mode:
1. Connect a user machine to the Active/Default Role port to which you assigned the default role earlier.
2. In Policy Manager, on the Ports tab for the device, confirm that the Default Role and Current Role for that port are identical.
3. On the user machine, bring up the authentication login web page URL that you entered in the Web
Authentication section of the Authentication tab.
4. Type in the user name and password, and click Login to Network. Within a few seconds, you should see the message Welcome to the Network.
5. In Policy Manager, look at the Ports tab for the device again. The Default Role should be the role you assigned as the default for the port, but the Current Role should be the one assigned to the user who just logged on.
6. On the user machine, return to the web authentication login page and log off the network. To confirm that the role for the port has reverted to the default, return to the Policy Manager Ports tab for the device and note that the Current Role for the port is again the same as the Default Role.
Testing 802.1X Authentication
In order to test your 802.1X authentication configuration, you will use Policy Manager to create one of the roles from the plan you worked out earlier. You do not need to create the role's services and classification rules at this time; only the role name is required for the test.
After creating the role, you will enforce it (write it to the device). You will then configure the port mode on one port to be Active/Discard and another to be Active/Default Role. Finally, you will attempt to log in to both ports as one of the users you mapped to the role on the RADIUS server.
Testing Web−Based Authentication 110
NetSight Policy Manager Help
NOTE:
Be sure to complete the additional configuration steps in the 802.1X Authentication
Configuration Supplement prior to performing this test.
Preparation
1. Decide on the role you want to test. It might be helpful to test the role that is assigned to your own user ID.
2. Create the role as follows: a. In Policy Manager, select the Roles tab in the left panel.
b. Right−click the Roles folder, and select Create Role.
c. Type the role name in the highlighted box and press Enter.
d.
Click Enforce on the toolbar, review the effects of enforcing on the Enforce Preview window
if it is enabled, then click Enforce on that window. This writes the role to the devices, making them aware of the role's existence, but it does not associate the role with any port.
3. Select the Network Elements tab in the left panel.
4. Select a port to use as an Active/Discard mode port.
a. Select the right−panel Ports tab for the device where the port resides and click Retrieve.
b. Right click on the port and select Properties. The Port Properties window opens.
c. Select the Authentication Configuration Settings tab.
d. Select the General sub−tab. In the Port Mode area, set the port as follows:
Authentication Behavior: Active
Unauthenticated Behavior: Discard e. If you have configured Single User 802.1X or 802.1X+MAC authentication types,
Active/Discard mode requires that any default role set on the port is cleared. If you have set a default role for this port, you will be prompted to clear it.
5. Select a port to use as an Active/Default Role mode port.
a. Right click on the port and select Properties. The Port Properties window opens.
b. Select the Authentication Configuration Settings tab.
c. Select the General sub−tab. In the Port Mode area, set the port as follows:
Authentication Behavior: Active
Unauthenticated Behavior: Default Role d. If you have configured Single User 802.1X or 802.1X+MAC authentication types,
Active/Default Role mode requires that you set a default role on the port, and you will be prompted to assign a role. Otherwise, you must assign a default role to the port by right−clicking the port and selecting Set Default Role.
e. Select the role you created earlier, and click OK. Now the role is associated with the port.
6. To confirm that the ports are set correctly, select the right−panel Ports tab for the device and view the
Default Role and Port Mode columns for the ports you just configured.
Testing Active/Discard Mode
Active/Discard mode means that authentication is enabled on the port, and unauthenticated traffic is not
for the device:
•
Prior to user login, the Default Role for the port is <None>, and the Current Role for the port is also
•
<None>.
After successful login, the Default Role for the port is still <None>, but the Current Role for the port
• becomes the user's assigned role.
After the user logs off, the Default Role is still <None> and the Current Role reverts to <None>.
Testing 802.1X Authentication 111
NetSight Policy Manager Help
To test your authentication configuration in Active/Discard mode:
1. Before the user is authenticated, verify that the Active/Discard mode port you configured earlier does not allow unauthenticated traffic to pass in either direction.
2. Connect a user machine to the port.
3. On the Ports tab, look at the Default Role and Current Role for the selected port. They should both be
<None>.
4. On the user machine, log on to the network.
5. In Policy Manager, look at the Ports tab for the device again. The Default Role should be <None>, but the Current Role should be the one assigned to the user who just logged on.
6. On the user machine, log off the network. To confirm that your role is no longer active on the port, return to the Ports tab for the device and note that the Current Role for the port again says <None>.
7. Verify again that the port does not allow unauthenticated traffic to pass in either direction.
Testing Active/Default Mode
Active/Default Role mode means that authentication has been enabled on the port, but a default role will apply in the absence of an authenticated user. A user does not need to authenticate to access the (usually limited) services provided by the default role. However, a user may opt to authenticate in order to access the (possibly more robust) services provided by his or her own role. For this test, the Active/Default Role mode port should
behave as follows, as displayed on the Ports tab for the device:
•
Prior to user login, the Default Role for the port is whatever role has been assigned as the default in
•
Policy Manager, and the Current Role is the same as the Default Role.
After successful login, the Default Role remains the assigned default role for the port, but the Current
•
Role becomes the user's role.
After the user logs off, the Current Role reverts to the Default Role.
To test your authentication configuration in Active/Default Role mode:
1. Connect a user machine to the Active/Default Role mode port to which you assigned the default role earlier.
2. In Policy Manager, on the Ports tab for the device, confirm that the Default Role and Current Role for that port are identical.
3. On the user machine, log on to the network.
4. In Policy Manager, look at the Ports tab for the device again. The Default Role should be the role you assigned as the default for the port, but the Current Role should be the one assigned to the user who just logged on.
5. On the user machine, log off the network. To confirm that the role for the port has reverted to the default, return to the Policy Manager Ports tab for the device and note that the Current Role for the port is again the same as the Default Role.
Related Information
For information on related concepts:
•
•
NetSight Policy Manager Release Notes
Testing 802.1X Authentication 112
NetSight Policy Manager Help
•
•
For information on related tasks:
•
•
Getting Started with Policy Manager
•
•
•
•
•
How to Create or Modify a Rule
For information on related windows:
•
•
•
Add RADIUS Authentication Server Window
•
Add RADIUS Accounting Server Window
Testing 802.1X Authentication 113
802.1X Authentication
Configuration Supplement
This Help topic provides supplemental instructions for users who are configuring their network for 802.1X
authentication. It is recommended that you begin by following the instructions in the Policy Manager
to configuring 802.1X end users. For more detailed information regarding client setup, consult the documentation for your particular client(s).
Instructions on:
•
EAP MD5−Challenge End User (Supplicant) Setup
•
Windows XP and Windows 2000 End User (Supplicant) Setup
•
How to Speed up MD5 Prompt on XP Client
•
•
•
Windows 2000 AS Certificate Server Configuration
•
Windows XP Client Certificate Setup
•
•
RoamAbout R2 802.1X Configuration
EAP MD5−Challenge End User (Supplicant) Setup
Windows XP and Windows 2000 End User (Supplicant) Setup
Use the following instructions to set up a Windows XP or Windows 2000 end user for 802.1X authentication:
1. On the end user's machine, open Network Connections (Start menu > Settings > Network
Connections).
2. Right click on the connection and select Properties.
3. In the General tab, verify that the "Show icon in notification area when connected" option is selected.
4. In the Authentication tab, select the "Enable network access control using IEEE 802.1X" check box.
Then, select "MD5−Challenge" as EAP type.
NOTE:
Depending on your network's needs, you can select "Authenticate as computer when computer information is available" and/or "Authenticate as guest when user or computer information is unavailable".
The authentication process is as follows:
1. Press Ctrl−Alt−Delete and log on to the end user's machine.
2. Allow a couple of minutes (or less) to initialize and establish the EAP authentication between the local machine and the 802.1X−enabled device.
3. After establishing the EAP authentication, notice that a bubble (balloon) appears in the notification area.
4. Click on the bubble to open the network logon window.
5. Provide the end user's username and password, and the domain, if appropriate.
802.1X Authentication Configuration Supplement 114
NetSight Policy Manager Help
NOTES:
If a user logs in incorrectly twice, the Windows XP client will not let them retry the login again. To be able to retry the login, the user can toggle link on the port, or log out and log back in.
After launching the network logon window by clicking the bubble, the user might get another bubble in the notification area before logging in. In this case, the user must close the logon window opened previously and click the second bubble which appeared in the notification area to re−launch the network logon window.
How to Speed up MD5 Prompt on XP Client
By default, the MD5 prompt can take up to two minutes to appear after you log into the machine or plug into an 802.1X enabled device. It is possible to speed up this process by making the following changes to the XP client and the 802.1X−enabled device.
Modify the XP client’s Registry:
1. Run regedit.exe from the Run box.
2. Navigate to HEY_LocalMachine\Software\Microsoft\EAPOL\Parameters\General\Global.
3. Right click on Global and select New and the DWORD value.
4. Name it SupplicantMode.
5. After it is created, double−click it and set its value to a 3.
6. You must reboot the PC before the new registry value takes effect.
On the 802.1X−enabled device, use Policy Manager to change the Authentication Request Period on the supplicant port to a shorter interval:
1. Launch Policy Manager (Start > Programs > Enterasys Networks > NetSight Policy Manager >
Policy Manager).
2. In the left panel, select the Network Elements tab.
3. Open the Devices folder and select the 802.1X−enabled device on which the port is located.
4. Select the port in the left panel.
5. In the right panel, select the Authentication Configuration tab.
6. In the Login Settings area, set the Authentication Request Period to a short interval, for example, 5 seconds.
7. Click Apply.
Linux SecureSupplicant Setup
You can download the OpenSource 802.1X client from http://www.open1x.org
at no cost, or you can purchase the Meetinghouse 802.1X supplicant called AEGIS Client from http://www.mtghouse.com
.
Refer to the instructions included in the download to install and set up your Linux SecureSupplicant.
Windows XP and Windows 2000 End User (Supplicant) Setup 115
NetSight Policy Manager Help
EAP/TLS Certificate Setup
Windows 2000 AS Certificate Server Configuration
Use the following instructions to set up Windows 2000 Advanced Server (AS) for Certificate Authentication
(CA). These instructions are only an example; refer to Microsoft documentation to install on a production network.
1. Install Windows 2000 Advanced Server with Active Directory, DNS service, and IAS.
2. If you did not install Internet Information Services (IIS) with the Windows 2000 AS installation, do so now.
a. Select the Start menu > Settings > Control Panel, and click on Add/Remove Programs.
b. On the left panel, select Add/Remove Windows Components.
c. When the Windows Components window opens, select Internet Information Services (IIS), and Next. This will install the IIS service. You can now install the Certificate Services.
3. Launch the Windows Components Wizard by opening Add/Remove Programs in Control Panel and clicking on Add/Remove Windows Components.
4. When the Wizard opens, select Certificate Services from the component list. The installer will warn you that once the CA software is installed, you can't change the name of the server or move it out of an Active Directory Domain.
5. The Certification Authority Type Selection screen will appear, giving you a choice of the different
CA types. Select Enterprise root CA. Do not select Advanced Options.
6. On the CA Identifying Information screen, enter a unique name for the CA Name, then fill out the rest of the form with whatever applies to your setup environment.
7. The next screen prompts you for the location of the Data Storage files. Select the defaults.
8. If you are running IIS WWW service, the installer will tell you that it must stop the service to complete the installation.
9. When the wizard finishes, you'll be prompted to restart your server. After rebooting, the CA service will start automatically.
Windows XP Client Certificate Setup
Install a certificate on a Windows XP client:
1. Connect the client PC to the Domain on which the CA resides.
2. Open your browser and go to http://<CA server>/certsrv
. This brings up the Certificate
Services page for the CA server.
3. Select Request a Certificate.
4. Select User Certificate.
5. Select Submit. This prompts the client to request a certificate from the CA.
6. When the "Certificate Issued" response is presented, select "Install this Certificate". This results in
"Certificate Installed".
View the installed certificate on the client:
1. Select the Start menu > Run.
2. Type mmc .
3. When the Console starts, select File > Add/Remove Snap−in.
EAP/TLS Certificate Setup 116
NetSight Policy Manager Help
4. From the Standalone tab, select Add.
5. Select Certificates, then Add.
6. The Certificates Snap−in window prompts for what type of account the certificate will manage.
7. Select "My user account", then Finish.
8. Close the Add Standalone Snap−in window.
9. On the Add/Remove Snap−in window, click OK .
10. In the Console, expand Certificates, expand Personal, and select Certificates.
11. You will see your certificate(s) in the right pane .
12. Double−click on the certificate to view the certificate properties.
13. Upon initial authentication (within a few minutes of attempting), the client will be prompted to accept certificate as valid from server.
802.11 Wireless Setup
RoamAbout R2 802.1X Configuration
Use the following instructions to set up and configure 802.1X authentication for the RoamAbout R2.
RoamAbout R2 firmware and boot images should be upgraded to the latest versions, which are available at http://www.enterasys.com/download/download.cgi?lib=roam .
System requirements:
•
RoamAbout R2 with RoamAbout card
•
PC with Windows XP or Windows 2000 installed
•
A null modem cable to connect the console port on the PC to the console port of the RoamAbout R2.
•
(See http://www.loop−back.com/null−mod.html
.)
AP Manager installed on the PC
•
A RADIUS Server with 802.1X support (Steel−Belted RADIUS Administrator Service Provider
Edition) or Windows 2000 IAS
Configure the RoamAbout R2:
1. Connect a null modem cable from the PC to the RoamAbout R2.
2. Using a terminal emulator like Microsoft®HyperTerminal, log in to the RoamAbout R2.
3. Select Network Configuration, assign an IP mask and gateway, and save the configuration.
4. On the PC, launch AP Manager.
5. In AP Manager, select the Add button to add a new AP.
6. Upgrade the RoamAbout boot image to the latest version. To download the boot image: a. In the AP Manager Main menu select Reload. The Reload window opens.
b. In the Options area, select the Use This Computer option.
c. In the Firmware Image area, select the Operational BootROM option.
d. Enter the path to the boot image or use the Browse button to navigate to the boot image.
e. Click Reload Now.
7. Upgrade the RoamAbout firmware image to the latest version. To download the firmware image: a. In the Main menu select Reload.
b. In the Options area, select the Use This Computer option.
c. In the Firmware Image area, select the Operational Firmware option.
802.11 Wireless Setup 117
NetSight Policy Manager Help d. Enter the path to the firmware image or use the Browse button to navigate to the firmware image.
e. Click Reload Now.
8. When the images have finished downloading, at the prompt, reboot the RoamAbout R2 device.
9. In the AP Manager Main menu, select Wireless Parameters.
10. In the Wireless Parameters window, enter the Wireless Network Name. For more information, refer to the 802.11 Wireless Networking Guide at www.enterasys.com/support/manuals/hardware/4042_12.pdf
.
11. Use Policy Manager to configure the RoamAbout R2 as a RADIUS client, following the instructions
in the Authentication Configuration Guide.
12. On the RoamAbout R2, you must enable 802.1X on each port by setting the port's Authentication
Behavior to Active.
a. In Policy Manager, select the Network Elements tab in the left panel.
b. Expand the RoamAbout R2 device to see its ports.
c. Select a port in the left panel.
d. In the right panel, select the Authentication Configuration tab.
e. In the Port Mode area, set the port's Authentication Behavior to Active.
f. Click Apply.
Set up the Windows XP Client:
Requirements:
•
A PC that meets windows XP requirements.
•
A wireless interface card on the XP PC.
1. Select Start menu > Settings > Network Connections and then right−click on wireless adapter icon.
2. From the drop−down menu select Properties.
3. Select the Authentication tab, and check "Enable network access control using the IEEE 802.1X."
4. Set EAP type to MD5 Challenge.
Set up the Funk RADIUS Server:
Requirements:
•
RADIUS Server with 802.1X support (Steel−Belted RADIUS Administrator Service Provider
Edition)
1. Install application.
2. Go to the eap.ini
file in in the RADIUS Services folder, and uncomment the EAP−Type =
MD5−Challenge for the native, domain, and domain user groups.
3. Go to the
RADIUS.ini
file and set the LogLevel = 2 and the TraceLevel = 2. This sets logfile verbose level.
4. Start RADIUS Server Service.
Related Information
For information on related concepts:
802.11 Wireless Setup 118
NetSight Policy Manager Help
•
For information on related tasks:
•
Authentication Configuration Guide
802.11 Wireless Setup 119
Configuring a Windows Server for
RADIUS Authentication
This Help topic provides instructions for users who wish to configure a Windows 2000 Advanced Server or
Windows Server 2003 to provide RADIUS authentication. It includes steps for configuring the Internet
Authentication Service (IAS), and for creating users in Active Directory. Policy Manager has been designed to work with a RADIUS server for authentication. The IAS implements the RADIUS protocol, and provides authentication of users connecting to the network via LAN, virtual private network (VPN), and dial−up technology.
general authentication instructions prior to following the steps here. Windows 2000 Advanced Server and
Windows Server 2003 users should follow the steps in this topic, instead of the Installing and Configuring the
RADIUS Server section in the Authentication Configuration Guide.
The recommended sequence for performing the configuration is listed below. When you have completed these
the Authentication Configuration Guide for instructions on how to use Policy Manager to configure authentication parameters on your devices, and verify that the users created in Active Directory can authenticate to the network.
NOTE:
The following instructions assume that you already have IAS installed on your computer.
Instructions on:
1.
2.
Configuring Internet Authentication Service (IAS)
a.
Specifying RADIUS Port Numbers
b.
c.
Adding a New Remote Access Policy
d.
e.
3.
Creating Users in Active Directory
a.
b.
4.
Configuring Devices and Testing Authentication
Configuring Active Directory
When using CHAP protocol, the "password reversed encryption" option must be enabled. You can enable this option globally for all users in the domain, or for a specific user.
To enable this option globally:
1. Select Start > Programs > Administrative Tools > Active Directory Users and Computers.
2. In the Active Directory Users and Computers window, right click on your domain and select
Properties.
Configuring a Windows Server for RADIUS Authentication 120
NetSight Policy Manager Help
3. In the Group Policy tab, select "Default Domain Policy" and click Edit.
4. In the Group Policy window, navigate to Password Policy in the left−panel Tree view: Computer
Configuration > Windows Settings > Security Settings > Account Policies > Password Policy.
5. Right−click on "Store password using reversible encryption for all users in the domain" and select
Security.
6. In the Security Policy Setting window, select the "Define this policy setting" checkbox and the
Enabled radio button. Click OK.
7. Close all applications and restart the computer, and log into your domain.
To enable this option for a specific user:
1. Select Start > Programs > Administrative Tools > Active Directory Users and Computers.
2. In the Active Directory Users and Computers window, right−click on the user and select Properties.
3. In the Account tab, check "Store password using reversible encryption." Click OK.
4. Close all applications and restart the computer, and log into your domain.
NOTE:
The Windows 2000 Advanced Server Troubleshooting IAS Installation guide states: "After you enable reversibly−encrypted passwords in a domain, all users must change their passwords before they will be able to authenticate against the domain."
Configuring Internet Authentication Service (IAS)
NOTE:
Install the latest service pack, which is available at the Microsoft website, before configuring authentication for Windows 2000 Advanced Server or Windows Server
2003. The following instructions assume that you already have IAS installed on your computer.
Specifying RADIUS Port Numbers
Use the following steps to specify the RADIUS authentication and accounting port numbers.
1. Select Start > Programs > Administrative Tools > Internet Authentication Service. The Internet
Authentication Service window opens.
2. Right click on "Internet Authentication Service (Local)" and select Properties.
3. In the RADIUS Tab (for Windows 2000 Advanced Server) or the Ports Tab (for Windows Server
2003), enter
1645
in the Authentication field and
1646
in the Accounting field.
4. Click OK.
Adding RADIUS Client Devices
Follow these steps to add RADIUS clients (Policy Manager devices, not end users) to the server.
1. In the Internet Authentication Service window (Start > Programs > Administrative Tools > Internet
Authentication Service), right click on the Clients folder (for Windows 2000 Advanced Server) or the
RADIUS Clients folder (for Windows Server 2003), and select New > Client.
2. Enter a Friendly Name and Protocol and then click Next.
3. Enter the IP address of the RADIUS client and select a Client Vendor (i.e. RADIUS Standard).
Configuring Internet Authentication Service (IAS) 121
NetSight Policy Manager Help
4. Enter a shared secret. A shared secret is a string of characters that will be used to encrypt and decrypt communications between the RADIUS server and the device (RADIUS client). Without the shared secret, the server and client will be unable to communicate, and authentication attempts will fail. The shared secret must be at least 6 characters long; 16 characters is recommended. Dashes are allowed in the string, but spaces are not. Be sure to write the shared secret down, as you will be adding it to the
RADIUS client devices later.
5. Click Finish.
6. Repeat until all of your Policy Manager devices have been added.
Adding a New Remote Access Policy
Follow these steps to add a new Remote Access Policy. A Remote Access Policy is a set of actions which is applied to a group of users that meet a specified set of conditions.
NOTE:
For information on configuring end user VLAN ID attributes (in compliance with RFC
3580) to be used in conjunction with VLAN to Role Mapping, refer to your device
firmware and RADIUS server documentation.
1. In the Internet Authentication Service window (Start > Programs > Administrative Tools > Internet
Authentication Service), right click on the Remote Access Policies folder and select New > Remote
Access Policy.
2. Windows 2000 Advanced Server: Enter a Policy friendly name and then click Next.
Windows Server 2003: Enter a Policy friendly name, select the "Set up a Custom Policy" radio button (as opposed to selecting the Wizard), and then click Next.
3. Follow these steps to add a condition. For example, to add a Windows Group condition: a. Click the Add button to open the Select Attribute window.
b. Select "Windows Groups" and click Add.
c. Click Add in the Groups window.
d. Select a domain group (i.e. Domain Users) and click Add. Click OK.
e. Add more groups if needed in the Groups window. Otherwise, click OK.
f. Click Next.
4. In the Permissions window, select "Grant remote access permission" and click Next.
5. Add a User Profile for users who match the conditions you have specified: a. Click the Edit Profile button to open the Edit Dial−in Profile window.
b. In the Authentication tab, select the appropriate authentication methods.
c. In the Advanced tab, remove all parameters, such as "Server−Type" and "Framed−Protocol" and click Add to add a Filter−Id attribute.
d. In the Add Attributes window, select "Filter−Id" and then click Add.
e. In the Multivalued Attribute Information window, click Add.
f. In the Attribute Information window, enter the attribute value:
Enterasys:version=1:mgmt=su:policy=[role]
where
[role]
is the role name to be applied to this user.
CAUTION:
Include
:mgmt=su
in the string only for users who should have administrative privileges and the ability to telnet to devices and/or use local management on devices when authentication is enabled. For other users, leave it out.
6. Click OK to proceed through the windows and Finish.
Adding a New Remote Access Policy 122
NetSight Policy Manager Help
Registering the IAS
Follow these steps to register the Internet Authentication Service in the Active Directory, which enables IAS to authenticate users in the Active Directory.
1. In the Internet Authentication Service window (Start > Programs > Administrative Tools > Internet
Authentication Service), right click on the "Internet Authentication Service (Local)" and select
Register Service in Active Directory.
2. Click OK.
Stopping and Restarting the IAS
After completing the above steps to configure the Internet Authentication Service, you must stop and restart the Service.
1. In the Internet Authentication Service window (Start > Programs > Administrative Tools > Internet
Authentication Service), right click on the "Internet Authentication Service (Local)" and select "Stop
Service".
2. Right click on the "Internet Authentication Service (Local)" and select "Start Service".
Creating Users in Active Directory
Use these steps to create users and specify user permissions.
Creating a User
Create a new object for each user who will be authenticating.
1. Select Start > Programs > Administrative Tools > Active Directory Users and Computers. The
Active Directory Users and Computers window opens.
2. Right click on the left−panel Users folder and select New > User.
3. Proceed through the windows, entering the user name, password and other relevant information. Click
Finish.
Specifying User Permissions
The steps for specifying user permissions are different depending on whether you are using Windows 2000
Advanced Server or Windows Server 2003.
Windows 2000 Advanced Server
The steps to specify user permissions depends on your domain operation mode. There are two domain operation modes in Active Directory: Mixed Mode and Native Mode. In Mixed Mode, user permission is
consult the Microsoft Windows 2000 Advanced Server documentation for guidance.
Registering the IAS 123
NetSight Policy Manager Help
•
Mixed Mode:
1. Right click on a user and select Properties. The User Properties window opens.
2. In the Dial−In tab, select either the "Allow access" or the "Deny Access" radio button in the
Remote Access Permission (Dial−in or VPN) section.
3. Click OK.
•
Native Mode:
1. Right click on a user and select Properties. The User Properties window opens.
2. In the Dial−In tab, select the "Control access through Remote Access Policy" radio button in the Remote Access Permission (Dial−in or VPN) section.
3. Go to the appropriate policy configured in the Internet Authentication Service and check either the "Grant remote access permission" or "Deny remote access permission" radio button in the policy's Properties window.
4. Click OK.
Windows Server 2003
Internet Authentication Service.
1. Right click on a user and select Properties. The User Properties window opens.
2. In the Dial−In tab, select the "Control access through Remote Access Policy" radio button in the
Remote Access Permission (Dial−in or VPN) section.
3. Go to the appropriate policy configured in the Internet Authentication Service and check either the
"Grant remote access permission" or "Deny remote access permission" radio button in the policy's
Properties window.
4. Click OK.
Configuring Devices and Testing Authentication
When you have completed the above instructions, refer to the sections Configuring RADIUS Devices in
how to use Policy Manager to configure authentication parameters on your devices, and verify that the users created in Active Directory can authenticate to the network.
Related Information
For information on related concepts:
•
For information on related tasks:
•
Authentication Configuration Guide
Configuring Devices and Testing Authentication 124
NetSight Policy Manager Help
Configuring Devices and Testing Authentication 125
Policy Manager
Concepts
This topic explains some of the concepts you'll need to understand in order to make the most effective use of
Policy Manager.
Information on:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Configuring Authentication in Policy Manager
•
•
•
•
•
•
•
•
•
•
•
Controlling Client Interactions with Locks
Policy
In Policy Manager, network access policies are called Roles. See Role, below, for a description.
Role
What is a Role
A role is a set of network access services that can be applied at various access points in a policy−enabled network. A port takes on a user's role when the user authenticates. Roles are usually named for a type of user
Policy Manager Concepts 126
NetSight Policy Manager Help such as Student or Engineering. Often, role names will match the naming conventions that already exist in the
organization. A role can contain any number of services in Policy Manager.
A role may also contain default access control (VLAN) and/or class of service (priority) characteristics that will be applied to traffic not identified specifically by the set of access services contained in the role. The set of services included in a role, along with any access control or class of service defaults, determine how all network traffic will be handled at any network access point configured to use that role.
Default Role
Ports). The default role becomes the current role for the user on a port if:
1. unauthenticated behavior is set to "Default Role," and
2. either of these cases is true:
• authentication behavior is set to "inactive," or
• authentication behavior is set to "active" but the user fails to authenticate.
If authentication is disabled on a port, the default role is the only way policy can be assigned to an end user.
button to make default role changes.
Policy Domains
Policy Manager provides the ability to create multiple policy configurations by allowing you to group your roles and devices into Policy Domains. A Policy Domain contains any number of roles and a set of devices that are uniquely assigned to that particular domain. For example, a university may have a Dormitory domain with a policy configuration created for students, and an Administration domain with a policy configuration for staff members. Policy Domains are centrally managed in the database and shared between Policy Manager clients.
In Policy Manager, you work in one current domain at a time. Each domain is identified by a unique name that you assign. The Domain menu lets you easily switch from one domain to another. There is no limit to the number of domains you can create, however, a device can exist in only one Policy Domain. You can import data elements from one domain into another domain. You can also import data from a .pmd file into a domain, and you can export data to a .pmd file, (one file per domain) for backup and troubleshooting purposes. Verify and Enforce operations are performed only on the current domain.
In order for your network devices to be displayed in the Policy Manager Network Elements tree, they must be assigned to a Policy Domain. Initially, you must use Console to add your devices to the NetSight database.
Once devices have been added to the NetSight database, you can assign the devices to a Policy Domain using
Policy Manager. As soon as a device is assigned to a domain, it is automatically displayed in the Policy
Manager Network Elements tree. Only devices that support policy are displayed in the Policy Manager tree.
Policy Manager automatically locks the current Policy Domain when you begin to edit the domain configuration. Other Policy Manager clients are notified that the domain is locked and they will not be able to
Default Role 127
NetSight Policy Manager Help clients that are viewing that domain of the change and automatically update their view with the new configuration.
Service
application should be handled by a network access device. A service might consist of only one rule governing, for example, email priority, or it might consist of a complex set of rules combining class of service, filtering,
Policy Manager.
As an example, you might create a service called "High Priority Internet Web Access" that contains priority classification rules for traffic directed toward each of your organization's Internet proxy servers. This service would likely contain one traffic classification rule for each of your Internet proxy servers.
There are two types of services in Policy Manager:
•
Manual Service
− This service consists of one or more traffic classification rules that you create
• based on your requirements. Manual services are good for applying customized sets of rules to roles.
Automated Service
− This service automatically creates a Layer 3 IP address rule with a specified action (class of service and/or access control), for each device in a particular network resource group. You create a network resource group using a list of IP addresses or an IP subnet, and
then associate the group with the Automated service (see How to Create a Network Resource Group
for more information). You cannot create Manual rules for an Automated service, and IP address is the only rule type available for Automated services.
Policy Manager services provide a common language that network engineers, information technology
administrators, and business managers understand. See How to Create a Service for more information.
Rule
What is a Rule
In Policy Manager, a rule defines one element of how traffic for a particular network service or application will be handled by a network access device. For example, you might create a rule that assigns a certain priority to all email traffic, by adding an 802.1p, ToS, or DiffServ value to all SMTP traffic. In Policy
the rule applies.
See Traffic Classification Rules for a detailed explanation of rules.
Service 128
NetSight Policy Manager Help
Disabling Rules
In Policy Manager, you can elect to disable a rule during or after its creation. If you disable a rule, it is temporarily unavailable for use by the current service, but it can still be copied to other services and enabled, or re−enabled at another time for the current service. Disabling a rule is a way to temporarily remove a rule from your service without having to delete and recreate it.
Conflict Checking
As your Policy Manager database grows, the potential for conflicts between new and existing rules in a service or role increases. For example, two rules might have the same traffic descriptor but forward traffic to different VLANs, or have different priorities. If the two rules are applied to the same service, or to the same role via two different services, unpredictable and undesired behavior could result.
Policy Manager ensures that this does not occur by checking rule traffic descriptions and action values, providing a message if conflicts are found, and writing the conflict information to the Event Log. Conflicts are checked at the following points:
•
When you add a rule to a service.
•
When you add a service to a role.
•
When you edit a rule.
•
When you edit a Network Resource Group.
•
When you import a Policy Manager database (.pmd) file.
•
When you import data from one domain into another.
•
When you start Policy Manager.
If a rule is disabled, conflicts between that rule and others are ignored.
Authentication
Authentication is the process by which end users identify themselves to the network and are given customized access capabilities based on the role they serve in the organization.
In the past, the IP address has been a means of identifying users on a network. But the mobility of today's workforce and the dynamic nature of IP address assignment has rendered the IP address ineffective as an indicator of the user's identity. Authentication via the user's login has become the most viable option for discovering a user's identity, and provides a mechanism by which policy may be enforced, as well.
Authentication Types
Policy Manager offers the following types of authentication. Some devices support multiple authentication types and multiple users (Multi−User Authentication) per port, while others are restricted to only one or two authentication types and single users per port (Single User Authentication). Refer to the Policy Manager
Release Notes for information on the authentication types supported by each device type.
•
Web−based Authentication (PWA or Port Web Authentication) − Users wishing to receive network services access a secure web page from a browser, and supply a user name and password that is sent to the authentication server. In return, the authentication server supplies a predetermined role for that
Disabling Rules 129
NetSight Policy Manager Help user based on the user name.
The process is as follows: The user authenticates by typing the Web Authentication URL or IP address into a browser, which then downloads a web page from the switch. A user name and password is entered into the page and sent to the switch, which forwards the request to a RADIUS server. The RADIUS server responds with a filter ID which corresponds to a role. The switch then applies the role to the port, which allows the user to access the DHCP server for a more permanent IP address, and receive the services required.
NOTE:
End users who use DHCP will get a temporary IP address from the switch in the form
192.168.1.Port_Number
. This IP address provides access to the authentication login web page. If authentication is successful, the end user can obtain a permanent IP address from the DHCP server. End users who use static IP addresses must be on the 192.168.0.0 network (with a mask of
255.255.0.0) or have a route to it. Otherwise, they will not be able to access the authentication login web page for authentication.
For information on configuring the components required for web−based authentication using Policy
Manager, see the Authentication Configuration Guide.
•
802.1X Authentication − With 802.1X authentication, no Web Authentication URL is used; rather, the login process is combined with the operating system's login process. The credentials supplied by the user during the operating system login are used to do the authentication.
The process is as follows: The end station running 802.1X connects to the switch, and the switch sends out an EAP (Extensible Authentication Protocol) challenge. The end station responds with an
EAP response containing the user credentials, which the switch forwards to a RADIUS server. The
RADIUS server passes the request to an authentication server, and the authentication server relays the results back to the RADIUS server. Upon successful authentication, the RADIUS server sends an
EAP response with a filter ID which corresponds to a role, back to the switch. The switch then applies the role to the port, which allows the user to receive the appropriate services. With 802.1X
authentication, you can set up periodic automatic re−authentication of logged−in users without disrupting their sessions.
For information on configuring the components required for 802.1X authentication using Policy
Manager, see the Authentication Configuration Guide and the 802.1X Authentication Configuration
•
MAC Authentication − For devices that support this feature, MAC authentication provides a means of authenticating without the user login required by the web−based and 802.1X methods. On the device, you specify a MAC password which will be used for all MAC addresses connected to that device. On the RADIUS server, instead of entering user names, you enter the MAC addresses which are allowed to authenticate, and enter the appropriate MAC password for every MAC address. Then, when a MAC address attempts to access a port, the device sends the MAC address and the MAC authentication password to the RADIUS server for authentication. Automatic re−authentication is available with MAC authentication.
For information on configuring the components required for MAC authentication using Policy
Manager, see the Authentication Configuration Guide.
NOTE:
Single User 802.1X+MAC Authentication. On Matrix E1 and Matrix E6/E7 devices, if both 802.1X and MAC authentication are enabled on a device, it is
Disabling Rules 130
NetSight Policy Manager Help possible for the device to receive a start or response 802.1X packet while a
MAC authentication is in progress. If this happens, the device immediately terminates the MAC authentication, and the 802.1X authentication proceeds to completion. Regardless of the success of the 802.1X login attempt, no new
MAC authentication logins may occur on the port until 1) the link is toggled;
2) the user executes an 802.1X logout; or 3) the 802.1X session is terminated administratively.
•
CEP Authentication − For devices that support this feature, CEP (Convergence End Point) authentication provides support for CEP products such as IP phones. To configure CEP authentication, you select the CEP product types supported on a device, and map a role for each type.
Then, when a convergence endpoint (such as an IP phone) connects to the network, the device identifies the type of endpoint and applies the assigned role. In addition to configuring CEP on a device, you must also enable CEP protocols on each port. Once you have configured CEP on the device and each port, you can monitor CEP product activity using Policy Manager's Port Usage tabs.
RADIUS Authentication
Policy Manager uses a RADIUS server and an authentication−enabled switch to allow the active policy (or role) on a port to be dynamically assigned, based on the user's login. Funk Software, Inc.'s RADIUS
TM
(Remote Authentication Dial In User Service) is an authentication solution that has been tested at Enterasys. It exchanges information between a RADIUS client (a device that provides network access to users) and a
RADIUS server (a device that contains authentication information for these users).
How Authentication Works
If authentication is enabled on a network port, a user connected through that port may not be allowed to access network resources unless the user's user name and password are authenticated by the RADIUS authentication server. The unauthenticated port may be configured with some default access permissions, through the use of a default role, or the port may be configured to deny all network access until a user authenticates.
When a user logs in, the RADIUS server is contacted to determine whether or not a policy profile (role) exists for the user in its database. If a role exists, the user is allowed to access the network, and that user's role becomes the current role for the port. If authorization fails, the user is not allowed on the network, and the port assumes the default role for the port. (Only one default role is allowed per port.) Once a role is assigned
RADIUS Authentication 131
NetSight Policy Manager Help to a port, the port's current role takes precedence over its default role, and the only way it can be replaced with another role is via authentication, or if the user logs out.
There are some devices within an IT system that may not be configured for authentication. These include printers, FAX machines, and legacy devices such as software−based routers and shared hubs. You can configure default network behavior for these devices in Policy Manager by assigning default roles to the
desired network ports or port groups. (See Assigning Default Roles to Ports for more information.)
Port Authentication States
When deploying an Enterasys authentication−enabled network, there are three primary port authentication states that can exist:
•
Authentication off/Port on − This is simply the network behaving the way it would without
• authentication. Authentication is not required, and there may or may not be static policy rules applied.
Authentication on/Port off − This occurs when users must authenticate to the interface prior to getting any kind of connectivity. It is the strictest of the port states, as the user can neither send nor receive any network traffic, except for authentication traffic, until he or she has successfully
• authenticated to the system
Authentication on/Port on with default policy − This involves the enabling of authentication on the interface, but allowing certain traffic to traverse that interface, either prior to authentication, or after a failed attempt to authenticate. In this scenario, it is likely that users would be allowed to use basic network services, such as Internet, or NOS login, but not access other areas of the network, or consume large amounts of network bandwidth. Alternately, all of the ports that don't have authenticated users might restrict all of their traffic to a lower priority until they authenticate. This allows the network administrator to allow basic network connectivity to users that need it, such as consultants, or temporary employees but to not expose them to all of the organization's resources and available services.
You can control the state of a port with regard to authentication by defining its port mode in Policy Manager.
Port Mode
Port mode defines whether or not a user is required to authenticate on a port, and how unauthenticated traffic will be handled. It is a combination of Authentication Behavior (whether or not authentication is enabled on
•
Authentication Behavior −− Defines whether or not end users are required to authenticate on the port (device).
•
Active −− Normal authentication procedures are implemented. End users are required to
• authenticate.
Inactive −− Authentication of end users is not required.
•
Unauthenticated Behavior −− Defines how the traffic of unauthenticated end users will be handled on the port.
•
Default Role −− If the end user is unauthenticated, the port will implement its default role. If
• there is no default role, there will be no role on the port.
Discard −− If the end user is unauthenticated, no traffic is allowed on the port.
These two settings can be combined to create four possible port modes.
Port Authentication States 132
NetSight Policy Manager Help
•
Inactive/Discard Mode: In this mode, authentication is inactive for the port. All traffic from users connected to the port is discarded. This effectively turns the port off. This port mode is not available for Single User MAC Authentication.
•
Inactive/Default Role Mode: In this mode, authentication is inactive for the port. All users connecting to this port will use the default role, if one has been assigned to the port, in combination with any existing static classifications. If there is no default role assigned to the port, the port uses only the static classification rules which exist. If there are no static rules, the port uses the PVID and default class of service for the port. This is the default port mode for ports.
•
Active/Discard Mode: In this mode, authentication is active for the port and end users are required to authenticate. All traffic from unauthenticated users connected to the port is discarded. The
Unauthenticated Behavior varies depending on the type of authentication configured on the device.
Single User Web−based Authentication: If authentication is successful, the port is assigned the end user's role as its current role. If unsuccessful, all traffic is discarded. A default role has no meaning on this Active/Discard port, since all unauthenticated traffic is discarded.
Single User 802.1X and 802.1X+MAC Authentication: If authentication is successful, the port is assigned the end user's role as its current role. If unsuccessful, all traffic is discarded. This mode requires that there be no default role assigned to the port.
Single User MAC Authentication: This port mode is not available for Single User MAC
Authentication.
Multi−User 802.1X and MAC Authentication: If authentication is successful, the port is assigned the end user's role as its current role. If unsuccessful, all traffic is discarded. A default role has no meaning on this Active/Discard port, since all unauthenticated traffic is discarded.
Multi−User Web−based Authentication: This port mode is not available for Multi−User Web−based
Authentication.
Advantages of Active/Discard mode: This mode is highly secure, since the end user receives no network services at all until authentication is successful.
Disadvantages of Active/Discard mode: The unauthenticated end user is unable to connect to any network services, such as the Domain Controller (if using a Microsoft operating system), DHCP services, DNS services, or the Web proxy. In single user web−based authentication, the device spoofs
WINS/DNS services (if the functionality is enabled) in order to allow the user to communicate with it for authentication.
•
Active/Default Role Mode − In this mode, authentication is active for the port and end users are required to authenticate. If authentication is successful, the port is assigned the end user's role as its current role. All unauthenticated users connected to the port will use the default role, if one has been assigned to the port, in combination with any existing static classifications. If there is no default role assigned to the port, the port uses only the static classification rules which exist. If there are no static rules, the port uses the PVID and default class of service for the port. For Single User 802.1X and
802.1X+MAC Authentication, this mode requires that a default role be assigned to the port.
Advantages of Active/Default Role mode: In this mode, a default role is applied to the port to allow unauthenticated end users access to basic services such as the DHCP Server, Domain Services,
WINS, and the Web proxy. When the end user is authenticated, that user's role is applied to the port,
Port Authentication States 133
NetSight Policy Manager Help providing a customized set of services allowed by his or her role. Active/Default Role mode is an alternative to Active/Discard mode, which is limiting in that there are no network services available at all until the end user is authenticated.
Disadvantages of Active/Default Role mode: This mode is less secure than Active/Discard, in that the user receives some network access prior to authentication.
It is important to plan in advance the port mode for the ports in your network before implementing authentication in your policy−enabled network. You can configure port mode in the Port Mode window in the
the port mode settings to take effect, authentication must be configured and enabled on the device.
Configuring Authentication in Policy Manager
In Policy Manager you can configure and enable authentication on your devices using the Device
for ports or port groups will take effect, you need to configure and enable authentication on the devices.
for a selected port on the Port Properties Port Usage Tab.
Packet Tagging
Packet tagging in a Policy Manager environment occurs as follows:
Tagged packets and ingress filtering are processed first. Then, VLAN ID and priority are determined.
•
VLAN ID: If the packet matches an active VLAN classification rule on the ingress port, the VID
(VLAN ID) specified in the matching VLAN classification rule is assigned. Otherwise, if there is an active role on the ingress port and it specifies a default VLAN, the default VID from the active role on the ingress port is assigned. If there is no active role and no classification rule matches, the 802.1Q
•
PVID for the ingress port is assigned.
Priority: If the packet matches an active priority classification rule on the ingress port, the priority specified in the matching priority classification rule is assigned. Otherwise, if there is an active role on the ingress port and it specifies a default priority, the default priority from the active role on the ingress port is assigned. If there is no active role and no classification rule matches, the 802.1Q_PPRI
for the ingress port is assigned.
The set of classification rules that are active on a port includes statically created rules that specify the ingress port on their port list, as well as any rules established as a result of a role being applied on that port. If the port has no active role and thus no default access control (VLAN) or class of service (priority), untagged packets that do not match any classification rules are assigned a VLAN and priority from the 802.1Q and 802.1p
defaults for the ingress port.
VLAN tagging and once for priority tagging.
Configuring Authentication in Policy Manager 134
NetSight Policy Manager Help
NOTE:
Policy Manager offers a Drop VLAN Tagged Frames feature which, if enabled, drops any VLAN tagged packet arriving at a port. This provides extra security in that it prevents users from, for example, coming in with a card capable of VLAN tagging and attempting to access the network.
It is recommended that you enable the Drop VLAN Tagged Frames feature when you set a default role on a port or when you enable authentication on a port, because these things indicate that the
port is a user port that should not be transmitting tagged packets. See Drop VLAN Tagged Frames
for more information.
VLAN to Role Mapping
VLAN to Role mapping lets you assign a role to an end user based on a VLAN ID. There are two kinds of
VLAN to Role Mapping: Authentication−Based and Tagged Packet.
•
Authentication−Based VLAN to Role Mapping (RFC 3580) − Provides a way to assign a role to a user during the authentication process, based on a VLAN Attribute. An end user connects to a policy−enabled device that supports 802.1X authentication using a RADIUS Server. During the authentication process, the RADIUS server returns a VLAN ID in its RADIUS VLAN Tunnel
Attribute. The device uses the Authentication−Based VLAN to Role mapping list to determine what role to assign to the end user, based on the VLAN Tunnel Attribute. If the RADIUS server returns both a VLAN Tunnel Attribute and a Filter ID, the RADIUS Response Conflict Resolution Setting
(see the device RADIUS tab) determines which one to use. Authentication−Based VLAN to Role
mappings are only configured at the device level (for all devices).
NOTE:
When configuring Authentication−Based VLAN to role mapping, you must enable
RFC3580 VLAN Authorization on the device via the device Authentication tab. In
addition, VLAN IDs must be configured on the RADIUS server for each user authorized to access the network. If a user does not have a configured VLAN ID, the default role (if there is one) or the 802.1Q PVID for the ingress port is assigned. For more information on configuring VLAN ID attributes on the RADIUS server, refer to your device firmware documentation, RFC 3580, and your RADIUS server documentation.
•
Tagged Packet VLAN to Role Mapping − Provides a way to let policy−enabled devices assign a role to network traffic, based on a VLAN ID. When a device receives network traffic that has been tagged with a VLAN ID (tagged packet) it uses the Tagged Packet VLAN to Role mapping list to determine what role to assign the traffic based on the VLAN ID. Tagged Packet VLAN to Role mapping can be configured at the device level (all devices) and at the port level (for an individual port on a device). A VLAN can only be mapped to one role at the device level, but the same VLAN can be mapped to a different role at the port level. A mapping does not have to exist at the device level to be created at the port level, and port−level mappings will override any device−level mappings.
NOTE:
Tagged Packet VLAN to Role Mapping requires that the TCI Overwrite attribute be enabled. TCI Overwrite allows the VLAN or class of service tag in a received packet to be overwritten by the VLAN (access control) and class of service characteristics defined
in the mapped role. You can enable TCI Overwrite on a per−port basis in the Port
Properties window General tab, or for an individual role in the role's General tab.
To configure VLAN to Role Mapping in Policy Manager, use the role's Mappings tab and/or the VLAN's
Mappings tab. Port−level Tagged Packet VLAN to Role mappings are configured via the Port Properties
VLAN to Role Mapping 135
NetSight Policy Manager Help
General tab, Mappings Sub−tab. You must have the Port Level Role Mappings feature enabled in Policy
Manager for port−level mappings to take effect. (From the menu bar, select the Edit > Port Level Role
Mappings checkbox.) If the feature is not enabled, any port−level mappings will be ignored.
Dynamic Egress
In Policy Manager, you can control whether or not Dynamic Egress is enabled for a VLAN by checking or
VLAN. The default setting for Dynamic Egress is enabled.
When Dynamic Egress is enabled for a VLAN, any time a device tags a packet with that VLAN ID, the ingress port is automatically added to the VLAN's egress list, enabling the reply packet to be forwarded back to the source. This means that you do not need to add the ingress port to the VLAN's egress list manually.
Dynamic Egress affects only the egress lists for the source and destination ingress ports. However, GVRP
(GARP VLAN Registration Protocol), which automatically adds the interswitch ingress ports to the egress lists of VLANs, is enabled by default in Policy Manager the first time you enforce a Dynamic Egress VLAN.
NOTE:
If you do not want GVRP enabled on your network, you can disable it by selecting the
Policy Manager Edit > GVRP Disabled menu option. If necessary, you can then manually configure the interswitch ports to do what GVRP does automatically, using
NetSight Element Manager or local management to set up your interswitch links as Q trunks. The trunk ports will be automatically added to the egress lists of all the VLANs at the time of trunk configuration.
If GVRP is already enabled on your network and you enforce, the GVRP status of
ports on which you have disabled GVRP will not change.
When you disable Dynamic Egress for a VLAN, the VLAN effectively becomes a discard VLAN. Since the destination port is not added to the egress list of the VLAN, the device discards the traffic. If you want a
VLAN to act as a discard VLAN, disable Dynamic Egress for that VLAN. (See Example 3, below.)
If an endstation is talking to a "silent" endstation which does not send responses, like a printer, you will need to add the silent endstation's ingress port to the VLAN's egress list manually with a tool like NetSight Switch
Manager, NetSight Element Manager, or local management. Dynamic Egress and GVRP take care of adding
the other ingress ports to the VLAN's egress list. (See Example 4, below.)
CAUTION:
If no packets are tagged with the applicable VLAN on a port within five minutes, Dynamic Egress list entries will time out. The result is that an endstation will appear "silent" if the VLAN has not been used within that time period. For example, if there is a "telnet" rule and two users (A and B) are on ports whose role includes a service containing the "telnet" rule, if User B has not utilized the "telnet" rule within the five minute time frame, User A will not be able to telnet to User B. For this reason, the best application of Dynamic
Egress is for containing undirected traffic on "chatty" clients which utilize, for example, IPX, NetBIOS, AppleTalk, and/or broadcast/multicast protocols such
Dynamic Egress 136
NetSight Policy Manager Help as routing protocols.
Example 1: Dynamic Egress Enabled
In this example, Dynamic Egress is enabled for VLAN 5. When source endstation A is tagged with VLAN 5,
Dynamic Egress places A's ingress port (1) on VLAN 5's egress list. When destination endstation B's traffic is tagged with VLAN 5, Dynamic Egress places B's ingress port (2) on VLAN 5's egress list. The device can then forward traffic to both endstations.
Example 2: Dynamic Egress + GVRP
In this example, Dynamic Egress is enabled for VLAN 5, and the destination endstation, B, is on a different device from the source endstation, A. When A is tagged with VLAN 5, Dynamic Egress places A's ingress port (1) on VLAN 5's egress list. GVRP then places interswitch ingress ports (2) and (3) on VLAN 5's egress list. When B's traffic is tagged with VLAN 5, Dynamic Egress places B's ingress port (4) on VLAN 5's egress list. GVRP then places interswitch ingress ports (5) and (6) on VLAN 5's egress list. The devices can then forward traffic to both endstations.
Example 3: Dynamic Egress Disabled
In this example, Dynamic Egress is disabled. When source endstation A is tagged with VLAN 5, A's ingress port is not placed on VLAN 5's egress list. GVRP places interswitch ingress ports (1) and (2) on VLAN 5's egress list. When B's traffic is tagged with VLAN 5, B's ingress port is not placed on VLAN5's egress list.
GVRP places interswitch ingress ports (3) and (4) on VLAN 5's egress list. But VLAN 5 traffic for both A and B is discarded, because VLAN 5 is not aware of the ingress ports for A and B.
Dynamic Egress 137
NetSight Policy Manager Help
Example 4: Silent Endstation
In this example, Dynamic Egress is enabled for VLAN 5, but the destination endstation, B, is a "silent" endpoint, like a printer. Endstation B does not send responses, so the Administrator must place B's ingress port on VLAN 5's egress list manually (1). When A is tagged with VLAN 5, Dynamic Egress places A's ingress port (2) on VLAN 5's egress list. GVRP then places interswitch ingress ports (3) and (4), then (5) and
(6) on VLAN 5's egress list. Endstation A is then able to communicate with the printer.
Policy VLAN Islands
Policy Manager offers you the ability to set up Policy VLAN Islands which enable you to deploy a policy across your network, while restricting user access to only selected local devices. For example, if you want to have a guest VLAN but you do not want the guests in one facility to be able to communicate with guests in another facility, you can set up a VLAN island containing only selected devices in each facility, with access controlled by local VLANs.
•
Global VLAN − Global VLANs are written to all selected devices with the same VID. They are referenced in the format <VID[name]>.
Policy VLAN Islands 138
NetSight Policy Manager Help
•
Local VLAN − A local VLAN is conceptual and does not have an actual VID. It may be remapped into one or more VLANs, each consisting of a local name and a local VID, which Policy Manager creates automatically in the island to which it belongs, based on the VID range, offset, and naming convention you provide. This effectively segments the network so that VLANs in different buildings can exist in same Policy Domain.
To enable this feature, select Edit > Policy VLAN Islands Enabled from the menu. This enables Policy
VLAN Islands for the current domain. Policy Manager provides a Policy VLAN Islands Configuration
Wizard which leads you through the configuration of local VLANs and the selection of the set of devices for
each island. See How to Create a Policy VLAN Island for more information.
MAC Locking
MAC Locking ensures that only specific MAC addresses can access a port, and that traffic from any other
MAC addresses will be discarded. You might take advantage of MAC Locking if, for example, you want to prevent more than one user from accessing a port at a given time. There are two kinds of MAC Locking:
Dynamic and Static. When you enable Dynamic MAC Locking on a port, the next MAC address that authenticates or accesses the port (up to the maximum number of dynamic locked MAC addresses allowed) will have exclusive access to that port from that time on. Static MAC Locking lets you create a list of locked
MAC addresses for a port so that the port only accepts traffic from those MAC addresses. MAC Locking is only available on devices that support it, and is not allowed on backplane and logical ports.
In order for MAC Locking to take effect on a port, it must be enabled at the device level. You can do this
using the Device Configuration wizard, or the device MAC Locking tab. You can enable and disable MAC
multiple selected ports in the Port Configuration wizard.
Device Groups
Policy Manager allows devices to be combined into groups, similar to the way services can be combined into service groups. With device groups, you can perform certain operations on an entire group at once, instead of performing the operation on individual devices. A device can be a member of more than one group.
Policy Manager provides several system−created device groups for your convenience. You can also create your own device groups, called user−defined device groups, using NetSight Console. Policy Manager system−created device groups are displayed with blue folders. Any group you add via Console will be displayed with a yellow folder.
System−Created Device Groups
System−created device groups are located under the My Network folder in the Network Elements tab. When a device is assigned to a domain, it automatically becomes a member of the appropriate group:
•
All Devices − contains all the devices that are assigned to the current domain.
•
Grouped By − contains five subgroups:
•
Chassis −− contains subgroups for specific chassis in the domain.
MAC Locking 139
NetSight Policy Manager Help
•
Contact −− contains subgroups of the devices in a domain based on the system contact.
•
Device Types −− contains subgroups for the specific product families and device types in the
• domain.
IP −− contains subgroups based on the IP subnets in the domain.
•
Location −− contains subgroups of the devices in a domain based on the system location.
User−Defined Device Groups
You can add your own device groups and subgroups under the My Network folder using NetSight Console.
For more information, see How to Add, Remove, and Rename Groups in your NetSight Console online Help.
Port Groups
Policy Manager allows ports to be combined into groups, similar to the way services can be combined into service groups. Port groups enable you to configure multiple ports on the same device or on different devices simultaneously, or to retrieve port information from them. You can view port groups on the left−panel Port
Groups tab.
Policy Manager provides you with several commonly used port groups for your convenience, called
Pre−Defined Port Groups. You can also create your own port groups, called User−Defined Port Groups.
Pre−Defined Port Groups
Policy Manager provides the following commonly used port groups:
•
10/100 Ports − Ports whose speed is 10/100.
•
All Ports − All ports on all devices.
•
CDP Ports − All ports whose port type is CDP (Cabletron Discovery Protocol). CDP is a protocol used by devices to determine the topology of the network fabric. CDP is not enabled by default, so in order to use the CDP port group, you need to enable it using Local Management by going to Network
Tools in Local Management, then using the "cdp" command set. (Type
cdp ?
to see the rules for the
"cdp" command set.) For example, to ensure that the Global Status is set to 1, enter
cdp set_global status 1
and
cdp list_global
. You can also turn CDP on per port, if preferred. You only need to enable CDP on one device, because when CDP is enabled, it instructs the device to send CDP packets through all access and CDP ports to discover its neighbors, and therefore
• the CDP port group will be populated automatically with all the CDP and interswitch link ports.
FTM 1 Backplane Ports − Ports whose port type is FTM 1 Backplane and CDP FTM 1 Backplane.
•
Frozen Ports − All ports that have been frozen.
•
Gigabit Ports − All gigabit ports.
•
Host Data Ports − The host data ports on devices (such as the Matrix N−Series) that allow you to
• apply policies to these ports.
Logical Ports − All logical ports.
Every time one of the Pre−Defined Port Groups is accessed, Policy Manager goes to the devices and retrieves the ports which fit the pre−defined characteristics of the port group. Unlike the port lists for User−Defined
Port Groups, Pre−Defined Port Group port lists are not saved in a Policy Manager data (.pmd) file.
User−Defined Device Groups 140
NetSight Policy Manager Help
User−Defined Port Groups
Policy Manager also enables you to create your own port groups. When you create a user−defined port group, you can either select individual ports to add to the group, or specify a range of ports from all devices assigned
Network Resource Groups
Network Resource Groups provide a quick and easy way to define Layer 3 IP address traffic classification rules for groups of network resources such as routers, VoIP (Voice over IP) gateways, and servers. The Policy
Internet Proxy Servers and SAP Servers. You create a network resource group by defining a list of IP addresses for the devices that you want included in the group, or by choosing an IP subnet which comprises the group.
specified action (class of service and/or access control), for each IP address in the network resource group.
There are two ways to create a network resource group. The Network Resources Wizard leads you through all the steps required to create a network resource group and the Automated service with which to associate it, and also lets you apply the Automated service to a role. Or you can use the Create Network Resource window when you want to simply create and define a resource group that you will associate with an Automated service at a later time. Network resource groups are located in the Network Resources folder in the left−panel
Services tab. See How to Create a Network Resource Group for more information.
Verifying
The Verify feature lets you verify that the roles in your current domain have been enforced. Verify operations are performed only on the current domain. The Verify operation compares the roles currently in effect
(enforced) on your domain devices with the roles defined in the current Policy Domain.
NOTE:
If you perform a Verify operation following an Import Policy Configuration from
Device, the Verify may fail. This is because the import operation imports only roles and rules from the device, not the complete policy configuration. Also, when you import device−specific rules, these rules are converted to a Rule Type of "All
Devices," and this will cause Verify to fail. If you want the rules to be device−specific, you will have to change their Rule Type via the Rule General tab after the import and prior to Enforce.
of which verify the information on all the devices in the current domain. You can also selectively verify on individual devices or device groups in the domain by right−clicking the device or group in the left panel or in the right−panel Details View tab for the Devices folder or Device Group folder, and choosing Verify Role Set from the menu.
User−Defined Port Groups 141
NetSight Policy Manager Help
After verifying, you see a window that reports any discrepancies. The title bar of the window lets you know if the verify was done on all devices in the domain, or a subset of devices. From this window, you can select
role set would have, prior to actually enforcing.
Turning Off Verify on Startup
When Policy Manager is launched, it automatically performs the verify operation. However, this can take some time when you have many devices and roles. If it is not critical that Policy Manager and the devices be synchronized each time you launch Policy Manager, you can turn off the verify at launch by deselecting the
Verify on Startup option in the Options Startup view (Tools > Options).
Enforcing
In Policy Manager, enforcing means writing role information to a device or devices. Enforce operations are performed only on the current domain. Any time you add, make a change to, or delete a role or any part of it
(any of its services and/or rules), the devices in your current domain need to be informed of the change, otherwise the role will not take effect. To determine if the roles currently in effect on your domain devices
NOTE:
Setting up Profiles and Credentials for Enforce. All SNMP operations that are performed from the Policy Manager client use the SNMP credentials of the logged−in user. For example, when devices are identified, the credentials associated with the user’s group are used to communicate with the devices. However, the Enforce operation occurs on the server and uses the NetSight Administrator profile to communicate with devices. Because of this, the NetSight Administrator profile must have write privileges on the devices that users can enforce.
When an Enforce is initiated, the Policy Domain is locked to prevent other clients from enforcing at the same time. Different Policy Domains can be enforced at the same time, but if another user attempts to enforce the same domain at the same time, that user will be notified that the domain is already locked.
which write the information to all devices in the current domain. You can also selectively enforce on individual devices or device groups by right−clicking the device or group in the left panel or in the right−panel Details View tab for the All Devices folder or Device Group folder, and choosing Enforce Role
Set from the menu. Only users that have been assigned the Enforce capability are allowed to perform an
Enforce.
domain devices, before you actually enforce. This feature is particularly useful if you have devices that only support certain aspects of policy management. The Enforce Preview window appears whenever you initiate an enforce using one of the methods mentioned above, so that you always have a chance to review the effects of enforcing prior to actually performing the enforce. You can control whether or not this view automatically appears with the Show this view on Enforce checkbox on the Enforce Preview window, or in Options
window Optional Views (Tools > Options). You can also access this window from the File > Enforce
Preview menu option, and from the Enforce Preview button on the confirmation message that appears when
Turning Off Verify on Startup 142
NetSight Policy Manager Help
If you've made changes without enforcing and you attempt to close Policy Manager, you'll be asked if you want to enforce before closing. Also, if you have made changes that need to be enforced, the Enforce icon
appears on the status bar at the bottom of the Policy Manager window as a reminder. After enforcing, you see a window that reports any problems.
Controlling Client Interactions with Locks
Because Policy Manager uses a Client/Server architecture, it is important to maintain a proper sequence of client interactions to ensure a consistent view of Policy Domains among all clients. To do this, Policy
Manager uses Server Locks to manage user interactions. When a user begins editing a Policy Domain (for example by assigning devices or adding a role), a lock is acquired for that domain at the server. That lock is not released until the same user saves the domain data. This guarantees a consistent view of that domain for all clients. Users are given the option of revoking locks held by other users. This protects against the possibility that users may forget they have locked a domain and keep that lock for an extended period of time.
A domain is locked automatically when a user begins to edit the domain data or a user can lock/unlock a domain by clicking the Lock toolbar button. When a domain is locked, the title bar states that the policy data is being edited and specifies the user who has locked the domain. A lock icon also appears in the status bar.
Other Policy Manager clients are notified that the domain is locked and they will not be able to save their own domain changes until the lock is released.
Here are some important things to remember about locks:
•
Locks operate on individual Policy Domains. When a user edits a domain, a lock is acquired for that domain and it remains locked until the same user saves the domain data or the lock is revoked by
• another user. You cannot save a domain that is locked by another user.
During Enforce, a lock is acquired on the domain which is being enforced. This ensures a consistent
• view of the domain while it is being used by the server.
When devices are being assigned to a Policy Domain, multiple domains may be locked concurrently.
This will happen if devices from one domain are being reassigned to another domain. In this case,
• locks for both domains are acquired.
When a lock is revoked, the last domain save "wins." While consistency is always maintained by the server, the order of domain saves cannot be guaranteed when locks are revoked, and consequently work done by one user may be lost.
locks from this panel. For more information, see Viewing Locks.
Controlling Client Interactions with Locks 143
Packet Flow Diagram
Packet Flow Diagram 144
NetSight Policy Manager Help
Packet Flow Diagram 145
Traffic Classification Rules
Traffic Classification rules allow you to assign VLAN membership and/or class of service to your network traffic based on the traffic's classification type. Classification types are derived from Layers 2, 3, and 4 of the
OSI model, and all network traffic can be classified according to specific layer 2/3/4 information contained in each frame. In Policy Manager, rules are used to provide four key policy features: traffic containment, traffic filtering, traffic security, and traffic prioritization. Examples of how to design rules for each of these features are given below.
A Traffic Classification rule has two main parts: Traffic Description and Actions. The Traffic Description identifies the traffic classification type for the rule. The Actions specify whether traffic matching that classification type will be assigned VLAN membership, class of service, or both. When a frame arrives on a port, the switch checks to see if the frame's classification type matches the type specified in a rule. If it does,
and easily create a rule and define its traffic description and actions.
In Policy Manager, rules are created and then grouped together into Services, which are then used to define roles. A role is assigned to each port either through end user authentication or as the port's default role. This means that there can be multiple rules active on a port. When a frame is received on a port, if the frame's classification type matches more than one rule, classification precedence rules are used to determine which rule to use.
The following information is discussed in this file:
•
•
•
•
•
Classification Types and their Parameters
•
Layer 2 Data Link Classification Types
•
Layer 3 Network Classification Types
•
Layer 4 Application Transport Classification Types
•
Examples of How Rules are Used
•
•
•
•
•
Classification Rules Precedence
•
Traffic Descriptions
When you create a Traffic Classification rule in Policy Manager, you must define the rule's traffic description.
The traffic description identifies the traffic classification type for that rule. You must select a classification type, and then select or enter certain parameters or values for each type.
Classification types are grouped according to Layers 2, 3, and 4 of the OSI model and there are multiple classification types for each layer.
Traffic Classification Rules 146
NetSight Policy Manager Help
OSI Model
Layer 7 − Application
Layer 6 − Presentation
Layer 5 − Session
Layer 4 − Transport
Layer 3 − Network
Layer 2 − Data Link
Layer 1 − Physical
Specific Layer 2/3/4 information contained in the header of each frame is used to identify the frame's classification type. Each layer uses different information to classify frames.
•
Layer 2 Data Link −− classifies frames based on an exact match of the MAC address or specific
• protocol type of each frame.
Layer 3 Network −− classifies IP or IPX frames based on specific information contained within the
•
Layer 3 header.
Layer 4 Transport −− classifies IP frames based on specific Layer 4 TCP or UDP port numbers contained in the header.
Actions
When you create a Traffic Classification rule in Policy Manager, you must define the actions that the rule will perform. When a frame arrives on a port, the switch checks to see if the frame's classification type matches the type specified in a rule. If it does, then the actions defined in that rule will apply to the frame. Actions specify whether the frame will be assigned VLAN membership (access control) and/or priority (class of service).
VLAN Membership (Access Control)
In your network domains, you can create VLANs (Virtual Local Area Networks) that allow end systems connected to separate ports to send and receive traffic as though they were all connected to the same network segment. Using traffic classification rules, you can classify a frame based on the frame's classification type to have membership in a specific VLAN, providing important traffic containment, filtering, and security for your network.
For example, a network administrator could use rules to separate end−user traffic into VLANs according to protocol, subnet, or application. Rules could also be used to group geographically separate end systems into job specific workgroups.
Actions 147
Priority (Class of Service)
NetSight Policy Manager Help
Traffic Classification rules allow you to assign a transmission priority to frames received on a port based on the frame's classification type. For example, a network administrator could use rules to assign priority to one network application over another.
Priority is a value between 0 and 7 assigned to each frame as it is received on a port, with 7 being the highest priority. Frames assigned a higher priority will be transmitted before frames with a lower priority. Each of the priorities is mapped into a specific transmit queue by the switch or router. The insertion of the priority value
(0−7) allows all 802.1Q devices in the network to make intelligent forwarding decisions based on its own level of support for prioritization.
Policy Manager enables you to utilize priority by creating classes of service that each include an 802.1p
priority, and optionally an IP type of service (ToS/DSCP) value, rate limits, and transmit queue configuration.
You can then assign the class of service as a classification rule action, as part of the definition of an automated
service, or as a role default. See Getting Started with Class of Service for more information.
Classification Types and their Parameters
When you define a rule's traffic description, you select a classification type, and then select or enter certain parameters or values for each type. Classification types are grouped according to Layers 2, 3, and 4 of the OSI model and there are multiple classification types for each layer.
Layer 2 −− Data Link Classification Types
Layer 2 classification types allow you to define classification rules based on an exact match of the MAC address or specific protocol type of each frame.
Ethertype
This classification type is based on the specific protocol type of each frame defined in the two−byte
Ethertype field. Select an Ethertype from the list of well−known values, or select Other and manually enter a single value in hexadecimal form. You can enter a range of values, however range rules are only supported on Matrix N−Series Platinum devices and SecureStack C2/B2 devices. Well−known
Ethertypes and their values:
IP 0x0800
ARP 0x0806
Reverse ARP 0x8035
Novell IPX 1 0x8137
Novell IPX 2 0x8138
Banyan
AppleTalk
0x0bad
0x809b
AppleTalk ARP 0x80f3
Decnet Phase 4 0x6003
DSAP/SSAP
Priority (Class of Service) 148
NetSight Policy Manager Help
This classification type is based on the specific protocol type of each frame defined in the DSAP and
SSAP fields. Select a protocol from the list of well−known values, or select Other and manually enter the value in hexadecimal form. You can also enter advanced configurations, however these are only supported on Matrix N−Series Platinum devices. The DSAP and SSAP values are one byte each, and these values must match. They are combined to create one two−byte value (e.g., a DSAP value of e0 and an SSAP value of e0 are combined to create a two−byte value of e0e0). Well−known
DSAP/SSAP types and their values:
IP 0x0606
IPX
NetBIOS
0xe0e0
0xf0f0
Banyan Vines 0xbcbc
SNA 0x0404
SNAP 0xAAAA
Other a two−byte value
MAC Address Source, MAC Address Destination, MAC Address Bilateral
These classification types are based on an exact match of the source, destination, or bilateral (either source or destination) MAC address contained in an Ethernet frame. Enter a valid MAC address or click Select to open a window where you can select a MAC address read from your network devices.
You can specify a mask, however masking a MAC address is only supported on Matrix N−Series
Platinum devices.
VLAN ID
This classification type is based on an exact match of the VLAN tag contained within a frame. Select a VLAN ID (VID) from the list of VLANs defined in Policy Manager. If you select Other, you must enter a single VID or specify a range of VIDs in decimal form. Range rules are only supported on
Matrix N−Series Platinum devices.
Priority
This classification type is based on an exact match of the Priority tag contained within a frame. Select a Priority value 0 − 7 from the list of well−known values, or select Other and enter a value in decimal form.
Layer 3 −− Network Classification Types
Layer 3 Network classification types allow you to define classification rules based on specific information contained within the Layer 3 header of an IP or IPX frame.
IP Type of Service
This classification type is based on an exact match of the one−byte ToS/DSCP field contained in the
IP header of a frame. The ToS (Type of Service) or DSCP (Diffserve Codepoint) value is defined by an 8−bit hexadecimal number between 0 and FF. Enter a value or click Select to open a window where you can generate a hex value. For information on how to generate a ToS or DSCP value, see
ToS/DSCP Configuration window.
Type of Service can be used by applications to indicate priority and Quality of Service for each frame.
The level of service is determined by a set of service parameters which provide a three way trade−off
Layer 3 −− Network Classification Types 149
NetSight Policy Manager Help between low−delay, high−reliability, and high−throughput. The use of service parameters may increase the cost of service. In many networks, better performance for one of these parameters is coupled with worse performance on another. Except for very unusual cases, at most, two of the parameters should be set.
For a ToS value, the 8−bit hexadecimal number breaks down as follows:
Bits 0−2: Precedence
Bit 3: 0=Normal Delay, 1=Low Delay
Bit 4: 0=Normal Throughput, 1=High Throughput
Bit 5: 0=Normal Reliability, 1=High Reliability
Bits 6−7: Explicit Congestion Notification
The precedence bits (bits 0−2) break down as follows:
111 − Network Control
110 − Internetwork Control
101 − CRITIC/ECP
100 − Flash Override
011 − Flash
010 − Immediate
001 − Priority
000 − Routine
The Network Control precedence designation is intended to be used within a network only. The actual use and control of that designation is up to each network. The Internetwork Control designation is intended for use by gateway originators only.
For a DSCP value, the value represents codepoints for two Differentiated Services (DS)
Per−Hop−Behavior (PHB) groups called Expedited Forwarding (EF) and Assured Forwarding (AF).
For more information on these PHB groups, refer to RFC 2597 and RFC 2598.
IP Protocol Type
This classification type is based on the specific protocol type defined in a field contained in the IP header of each frame. Select a protocol from the list of well−known values, or select Other and manually enter the value in decimal form. You can enter a range of values, however range rules are only supported on Matrix N−Series Platinum devices and SecureStack C2/B2 and C3/B3 devices.
TIP:
You can define a new IP Protocol Type using the Pre−Defined Well−Known IDs window.
Once defined, it is available for selection from the list of well−known values when defining the rule's traffic classification type.
Well−known IP Protocol types and their values:
ICMP 1
IGMP 2
TCP 6
EGP
UDP
8
17
Layer 3 −− Network Classification Types 150
NetSight Policy Manager Help
IPv6 41
RSVP 46
GRE
ESP
47
50
AH 51
EIGRP 88
OSPF 89
PIM 103
VRRP 112
L2TP 115
Other 0−255
IP Address Source, IP Address Destination, IP Address Bilateral
These classification types are based on an exact match of the source, destination, or bilateral (either source or destination) IP address information contained within the IP header of each frame. Enter an
IP address in the Value field, and select a Mask. This Mask allows a switch to determine whether a classification is based on a specific IP address, IP subnet, or range within an IP subnet. For example, a user could define a rule where all frames from the 129.168.28.x network are classified into the Red
VLAN by setting the IP address of 129.168.28.0 with the mask of 255.255.255.0.
IP Socket Source, IP Socket Destination, IP Socket Bilateral
These classification types are based on an exact match of a specific source, destination, or bilateral
(either source or destination) IP address and a UDP/TCP port number (type) contained within the IP header of each frame. Enter an IP address in the Value field. In the next panel, select a UDP/TCP type from the list of well−known values, or select Other and manually enter the value in decimal form. (UDP/TCP port numbers are defined in RFC 1700.) If you select Other, you can also select a
Mask that will specify a range of ports for the IP address (masks are only supported on Matrix
N−Series Platinum devices and SecureStack C2/B2 and C3/B3 devices.)
TIP:
You can define a new value for a UDP or TCP port number using the Pre−Defined
Well−Known IDs window. Once defined, it is available for selection from the list of
well−known values when defining the rule's traffic classification type.
Well−known UDP/TCP types and their values:
FTP Data 20
FTP
SSH
21
22
Telnet
SMTP
TACACS
DNS
BootP Server
BootP Client
23
25
49
53
67
68
TFTP
Finger
HTTP
POP3
69
79
80
110
Layer 3 −− Network Classification Types 151
NetSight Policy Manager Help
Portmapper
NNTP
111
119
NTP
NetBIOS Name Service
123
137
NetBIOS Datagram Service 138
NetBIOS Session Service 139
IMAP2/IMAP4
SNMP
IMAP3
LDAP
HTTPS
R−Exec
443
512
143
161
220
389
R−Login
R−Shell
LPR
RIP
SOCKS
Citrix ICA
RADIUS
RADIUS Accounting
NFS
X11 (Range Start)
X11 (Range End)
Other
513
514
515
520
1080
1494
1812
1813
2049
6000
6063
0−65535
IP Fragment
This classification type is based on Layer 4 information in fragmented frames. IP supports frame fragmentation, where large frames are divided into smaller fragments and sent wrapped in the original
Layer 3 (IP) header. When a frame is fragmented, information that is Layer 4 and above is only present in the first fragment. For example, the first fragment may be classified to Layer 4, while subsequent fragments will be classified only to Layer 3. The Matrix product line does not support
Layer 4 classification for IP frames that have been fragmented, as the Layer 4 information is not present in these frames. Using the IP Fragment classification rule, any frame which is a fragment of a larger frame, is classified according to the information in the original frame. If the first fragment is classified to Layer 4, subsequent fragments will also be classified to Layer 4.
IPX Class of Service
This classification type is based on specific information contained within the Layer 3 header of an
IPX frame. This is a one−byte field used for transmission control (hop count) by IPX routers. Enter a valid IPX Class of Service in decimal form, 0−255. You can enter a range of values, however range rules are only supported on Matrix N−Series Platinum devices.
IPX Packet Type
This classification type is based on specific information contained within the Layer 3 header of an
IPX frame. Select an IPX Packet type from the list of well−known values or select Other and manually enter the value in decimal form. You can enter a range of values, however range rules are
Layer 3 −− Network Classification Types 152
NetSight Policy Manager Help only supported on Matrix N−Series Platinum devices. Well−known IPX Packet types and their values:
Hello/SAP 0
RIP
Echo Packet
1
2
Error Packet 3
NetWare 386 4
SeqPackProt 5
NetWare 286 17
Other 0−31
IPX Network Source, IPX Network Destination, IPX Network Bilateral
These classification types are based on specific information contained within the Layer 3 header of an
IPX frame. It is a four−byte user−defined value that represents the IPX source, destination, or bilateral (either source or destination) network number. This value must be a valid IPX network address in hexadecimal form. You can enter a range of values, however range rules are only supported on Matrix N−Series Platinum devices.
IPX Socket Source, IPX Socket Destination, IPX Socket Bilateral
These classification types are based on specific information contained within the Layer 3 header of an
IPX frame. It is a two−byte, user−defined value that represents the IPX source, destination, or bilateral (either source or destination) socket numbers. This value is used by higher layer protocols to target specific applications running among hosts. Select an IPX Socket type from the list of well−known values, or select Other and manually enter the value in decimal form. You can enter a range of values, however range rules are only supported on Matrix N−Series Platinum devices.
Well−known IPX Socket types and their values:
NCP 1105
SAP
RIP
1106
1107
NetBIOS 1109
Diagnostics 1110
NSLP
IPX Wan
Other
36865
56868
0−65535
ICMP
This classification type is based on an exact match of the ICMP (Internet Control Message Protocol) message contained in the ICMP tag within a frame. Select an ICMP well−known value type from the list of well−known values (some well−known value types also let you select a code), or select Other and manually enter the value in decimal form. You can enter a range of values, however range rules are only supported on Matrix N−Series Platinum devices and SecureStack C2/B2 and C3/B3 devices.
Well−known ICMP messages and their values:
Echo Reply 0
Destination Unreachable
Source Quench
Redirect
768−783
1024
1280−1283
Layer 3 −− Network Classification Types 153
NetSight Policy Manager Help
Alternate Host Address 1536
Echo Request (Ping Request) 2048
Router Advertisement
Router Solicitation
Time Exceeded
Parameter Problem
Timestamp
Timestamp Reply
Information Request
Information Reply
Address Mask Request
Address Mask Reply
2304
2560
2816−2817
3072−3073
3328
3582
3840
4096
4352
4608
Traceroute
Datagram Conversion Error
Mobile Host Redirect
IPv6 Where−Are−You
7680
7936
8192
8448
IPv6 I−Am−Here 8704
Mobile Registration Request 8960
Mobile Registration Reply
Domain Name Request
9216
9472
Domain Name Reply
SKIP
9728
9984
Photuris 10240
Layer 4 −− Application Transport Classification Types
Layer 4 IP classification types allow you to define classification rules based on specific Layer 4 TCP or UDP port numbers contained in the header of an IP frame. You can specify a specific port number or a range of port numbers.
Note: The Matrix product line does not support Layer 4 classification for IP frames that have been fragmented, as the Layer 4 information is not present in these frames. If a Matrix device has an FDDI HSIM installed, Layer 4 classification will not be supported for any frames larger than 1500 bytes. Frames larger than 1500 bytes are fragmented internally in the switch. When creating classification rules based on specific
according to the Layer 4 information contained in the original frame.
IP UDP Port Source, IP UDP Port Destination, IP UDP Port Bilateral
These classification types are based on specific Layer 4 UDP port numbers contained within the header of an IP frame. Select a UDP type from the list of well−known values, or select Other and manually enter the value in decimal form. (UDP port numbers are defined in RFC 1700.) You can enter a range of values, however range rules are only supported on Matrix N−Series Platinum and
Gold devices, SecureStack C2/B2 and C3/B3 devices, RoamAbout R2 and AP4000 devices, and
Industrial I3 devices. In the next panel, enter an IP address and select a Mask. (You will not see this
Layer 4 −− Application Transport Classification Types 154
NetSight Policy Manager Help panel if you have specified a range of values in the previous panel.) The Mask allows you to specify a range of IPs for a specific service (masks are only supported on Matrix N−Series Platinum devices.)
TIP:
You can define a new value for a UDP port number using the Pre−Defined Well−Known
IDs window. Once defined, it is available for selection from the list of well−known values
when defining the rule's traffic classification type.
Well−known UDP types and their values:
FTP Data 20
FTP
SSH
21
22
Telnet
SMTP
TACACS
DNS
BootP Server
BootP Client
23
25
49
53
67
68
TFTP
Finger
HTTP
POP3
Portmapper
NNTP
NTP
NetBIOS Name Service
NetBIOS Datagram Service 138
NetBIOS Session Service 139
IMAP2/IMAP4 143
111
119
123
137
69
79
80
110
SNMP
IMAP3
LDAP
HTTPS
R−Exec
R−Login
R−Shell
LPR
RIP
SOCKS
Citrix ICA
RADIUS
RADIUS Accounting
NFS
X11 (Range Start)
X11 (Range End)
1494
1812
1813
2049
6000
6063
512
513
514
515
161
220
389
443
520
1080
Layer 4 −− Application Transport Classification Types 155
NetSight Policy Manager Help
0−65535 Other
IP TCP Port Source, IP TCP Port Destination, IP TCP Port Bilateral
These classification types are based on specific Layer 4 TCP port numbers contained within the header of an IP frame. Select a TCP type from the list of well−known values, or select Other and manually enter the value in decimal form. (TCP port numbers are defined in RFC 1700.) You can enter a range of values, however range rules are only supported on Matrix N−Series Platinum and
Gold devices, SecureStack C2/B2 and C3/B3 devices, RoamAbout R2 and AP4000 devices, and
Industrial I3 devices. In the next panel, enter an IP address and select a Mask. (You will not see this panel if you have specified a range of values in the previous panel.) The Mask allows you to specify a range of IPs for a specific service (masks are only supported on Matrix N−Series Platinum devices.)
TIP:
You can define a new value for a TCP port number using the Pre−Defined
Well−Known IDs window. Once defined, it is available for selection from the list
of well−known values when defining the rule's traffic classification type.
Well−known TCP types and their values:
FTP Data 20
FTP
SSH
Telnet
21
22
23
SMTP
TACACS
DNS
BootP Server
BootP Client
TFTP
Finger
HTTP
POP3
Portmapper
NNTP
25
49
53
67
68
69
79
80
110
111
119
NTP
NetBIOS Name Service
123
137
NetBIOS Datagram Service 138
NetBIOS Session Service 139
IMAP2/IMAP4
SNMP
IMAP3
LDAP
HTTPS
R−Exec
443
512
143
161
220
389
R−Login
R−Shell
LPR
RIP
513
514
515
520
Layer 4 −− Application Transport Classification Types 156
SOCKS
Citrix ICA
RADIUS
RADIUS Accounting
NFS
X11 (Range Start)
X11 (Range End)
Other
NetSight Policy Manager Help
1080
1494
1812
1813
2049
6000
6063
0−65535
IP UDP Port Source Range, IP UDP Port Destination Range, IP UDP Port Bilateral Range
These classification types are based on Layer 4 UDP port numbers contained within the header of an
IP frame. When you select this type, you enter a range of UDP port numbers that the port number in the header will be matched against. Enter the start and end range values in decimal form. UDP port numbers are defined in RFC 1700.
IP TCP Port Source Range, IP TCP Port Destination Range, IP TCP Port Bilateral Range
These classification types are based on Layer 4 TCP port numbers contained within the header of an
IP frame. When you select this type, you enter a range of TCP port numbers that the port number in the header will be matched against. Enter the start and end range values in decimal form. TCP port numbers are defined in RFC 1700.
Examples of How Rules are Used
Traffic Classification rules are used to provide four key policy features: Traffic Containment, Traffic
Filtering, Traffic Security, and Traffic Priority.
Traffic Containment
Using classification rules, network administrators can group together users of a given protocol, subnet, or application, and control where their traffic can logically go on the network.
IP Traffic Containment
The figure above shows a configuration where the network administrator wants to separate end−user traffic into VLANs based on the assigned IP subnet of each department. This can easily be accomplished by creating
Examples of How Rules are Used 157
NetSight Policy Manager Help two Layer 3 classification rules based on the IP subnet range of the respective departments.
Rule 1 − Engineering, which uses the 132.181.28.x subnet, will be assigned to the Red
VLAN.
Rule 2 − Sales, which uses the 132.181.29.x subnet, will be assigned to the Blue VLAN.
Based on these two Layer 3 classification rules, the traffic from the Engineering VLAN will be isolated from the Sales VLAN. Since these rules are based on Layer 3 information, an Engineering user could enter the network from a connection in the Sales department, and that user would still be contained in the Engineering
VLAN.
Traffic Filtering
Classification rules can also be used to filter specific unwanted traffic. Filter criteria can include things such as broadcast routing protocols, specific IP addresses, or even applications such as HTTP or SMTP.
In filtering operations, the traffic to be filtered is assigned to the Discard VLAN. Since the Discard VLAN is not configured to exit the switch, the traffic will be discarded.
OSPF/RIP Traffic Filtering
The figure above shows a common configuration in which a routed backbone is using both RIP and OSPF for its routing protocols. The network administrator does not want the multicast OSPF and broadcast RIP frames propagated to the end stations. The network is designed so that only end users are attached to the Matrix devices.
To implement filtering in this scenario, a Layer 3 rule and a Layer 4 rule will be created.
Rule 1 (Layer 3) − Any frame received with an IP Protocol Type of 89 (OSPF) will be classified into the Discard VLAN.
Rule 2 (Layer 4) − Any frame received with a Bilateral UDP port number of 520 (RIP) will be classified into the Discard VLAN.
Traffic Filtering 158
NetSight Policy Manager Help
Based on this configuration, as long as the Discard VLAN is not configured to exit the switch, all RIP and
OSPF frames will be filtered from the end users.
Traffic Security
provided to a group of unknown users. There have been problems with these unknown users "hacking" into the router and altering the configuration. A simple classification rule can be put in place that will prevent these types of occurrences.
Router Traffic Security
In the figure above, the network components include a router and a Matrix E7. In this configuration end−users connect to the ports of the Matrix E7.
Since the end−users would never need to communicate directly to the router using the router's IP address, a
Layer 3 IP classification rule will be used.
Rule − Any frames received by the switch with a destination IP address of the router
(129.168.1.2) will be classified to the Discard VLAN. The Discard VLAN is configured so that it does not exit the switch.
The end result is that any frames from a user trying to "hack" into the router will be discarded before ever reaching the router.
Traffic Prioritization
Classification rules can be used to specify that certain network applications receive the highest transmission priority. For example, a network administrator wants to assign priority to three network applications, SAP
R/3, web traffic, and email, in that order.
Prioritization
Traffic Security 159
NetSight Policy Manager Help
To accomplish the prioritization goals in this example, there are two main steps required: creating the classification rules, and then configuring the priority−to−transmit queue mapping for the switch, if needed.
First, create one Layer 3 and two Layer 4 classification rules.
Rule 1, Layer 3 (SAP R/3) − All frames to or from the IP address of the SAP R/3 server will be tagged with a priority indicator of 7 (highest).
Rule 2, Layer 4 (Web) − All frames with a UDP port number of 80 (HTTP) will be tagged with a priority indicator of 5.
Rule 3, Layer 4 (email) − All frames with a UDP port number of 25 (SMTP) will be tagged with a priority indicator of 3.
Note: An IP address classification was selected for Rule 1 because it has been observed that SAP R/3 dynamically negotiates the TCP/UDP port used, so the port number selections vary from session to session. If this was not the case, a Layer 4 UDP classification could be used.
Then, configure the priority−to−transmit queue mappings. Each switch has default priority−to−transmit queue mappings. You can use these defaults or change the mappings using local management or NetSight Atlas
Console. In addition, Policy Manager provides the ability to configure transmit queues as part of the
Role−Based Rate Limits and Transmit Queue Configuration class of service mode. This functionality is available only on certain devices such as the Matrix N−Series Gold and Platinum devices (refer to the
Based on the default priority−to−traffic queue mapping for a Matrix E7, the priorities assigned above will work out so that each frame classification type will be mapped to the desired traffic queue. This means that no user configuration of the priority−to−transmit queue mapping would be required.
With the classification rules described above, the network traffic would be prioritized as shown in the table below:
Application
SAP R/3
Web
Classification Type
Bilateral IP
UDP Port Number
UDP Port Number
Desired Priority
High
Medium
Low
Priority Value
7
5
3
Matrix E7 Traffic
Queue
3
2
1
Traffic Security 160
NetSight Policy Manager Help
Classification Rules Precedence
When there is a role with multiple classification rules assigned to a port, the device must determine which rule takes precedence. The order of precedence is predefined in the device, and is not configurable. Network administrators should have a comprehensive understanding of classification precedence, as it can significantly
information for each role. For additional information on rule precedence, see your device hardware documentation.
The device determines the order of precedence based on the classification types. The Precedence Table details the order of precedence with 1 being the highest precedence, and 15 being the lowest.
Classification Rule Precedence
Matrix N−Series
Matrix
X−Series
Layer 2
Source MAC Address 1
2
13
13
14
15
1 (48 bit mask)
2 (24 bit mask)
*
6
*
7
*
Destination MAC Address
Ethertype Field
DSAP/SSAP Fields
VLAN ID
Priority
Layer 3
IP ToS / IPX CoS
IP Protocol Type
IPX Packet Type
Source IP Address Exact Match / Source IPX Network Number
Source IP Address Best Match / Destination IPX Network Number
Destination IP Address Exact Match
Destination IP Address Best Match
IP Fragment
Layer 3/4
IPX Socket Source / UDP Source Port / TCP Source Port
IPX Socket Destination
UDP Destination Port / TCP Destination Port
ICMP
Exact Match indicates a match of an explicitly defined address.
Best Match indicates a match of an entire subnet, or range within a subnet.
* indicates the rule type is not supported.
4
5
6
11
12
12
3
7
8
9
9
10
*
*
*
*
*
*
5
3
4
*
*
*
Classification Rules Precedence 161
NetSight Policy Manager Help
Note: The precedence of a rule based on a bilateral address match is determined frame by frame depending on whether the rule matches the destination or source address in the frame. A bilateral address rule which matches the source address has higher precedence than a rule which matches a destination address (or any other lower precedence rule).
Precedence Scenarios
The following scenarios illustrate the classification rule precedence on Matrix N−Series devices.
Scenario 1
A network administrator has defined two classification rules:
Rule 1− All frames with a UDP port number of 55(ISI Graphic Language) are assigned to the
Red VLAN.
Rule 2− All frames sourced from the 132.181.28.x subnet are assigned to the Blue VLAN.
If a frame is received with a source address of 132.181.28.99 and a UDP port number of 55, the frame will be
assigned to the Blue VLAN because as shown in the Precedence Table, a Layer 3 IP Address rule takes
precedence over a Layer 4 rule.
Scenario 2
A network administrator defines two classification rules:
Rule 1− All frames with an IP ToS value of AA are assigned a priority of 7.
Rule 2− All frames with a TCP port number of 80 (HTTP) are assigned a priority of 3.
If a frame is received with a ToS value of AA and a TCP port number of 80, the frame will be assigned a
over IP ToS classifications.
Precedence Scenarios 162
Getting Started with Class of Service
This Help topic provides an overview of Policy Manager's class of service functionality, including information about defining rate limits and configuring transmit queues. It also includes examples that outline the basic steps you must perform to create and configure these class of service components using Policy
Manager.
This guide includes the following information:
•
•
•
•
•
Class of Service Overview
Policy Manager supports Class of Service (CoS), which allows you to assign priority, modify rates, and change transmit queue behavior for your network traffic. Using Policy Manager, you can create multiple classes of service that can include one or more of the following components: an 802.1p priority, an IP type of service (ToS) value, rate limits, and transmit queue configuration. You can then assign a class of service as a classification rule action, a role default, or as part of the definition of an automated service.
When you first install Policy Manager, the left−panel Classes of Service folder is pre−populated with eight classes of service, each associated with one of the 802.1p priorities (0−7). You can use these classes of service as is, or configure them to include ToS/DSCP, rate limit, and/or transmit queue values. You can also create your own classes of service. After you have created and defined your classes of service, they are then
tab), or an automated service (General tab).
Policy Manager supports two modes of class of service, with each mode providing a different rate limit functionality. In addition, one class of service mode supports transmit queue configuration. The two modes are:
•
Priority−Based Rate Limits − These rate limits are associated with one or more 802.1p priorities, and
• are implemented based on the 802.1p priority assigned to a data packet appearing on a port.
Role−Based Rate Limits and Transmit Queue Configuration − These rate limits are defined within a class of service and associated with a specific role via a rule action or as a role default. They are implemented based on the role assigned to a port. This mode also allows transmit queue behavior to be configured for the class of service.
release notes for specific device/firmware class of service support. Only certain devices such as the Matrix
N−Series Gold and Platinum devices support both modes, but you cannot have both modes enabled at the
Getting Started with Class of Service 163
NetSight Policy Manager Help
General tab.
Rate Limits
Rate limits are one component of a Policy Manager class of service. They are used to control the transmit rate at which traffic enters and exits ports in your network. There are two class of service modes supported in
Policy Manager, and each mode uses a different kind of rate limit, either Priority−Based rate limits or
in the release notes for specific device/firmware rate limit support.
Priority−Based Rate Limits
Priority−based rate limits are rate limits that are associated with one or more of the eight 802.1p priorities
(0−7). When the associated priority is selected for a class of service, the rate limit becomes part of that class of service. These rate limits are written directly to each port (unless the port is specified in the rate limit's exclusion list), and are implemented based on the 802.1p priority assigned to a data packet appearing on that port. While priority−based rate limits are not tied directly to roles or rules, they are displayed with the associated priority when you select a class of service while creating a rule, automated service, or role.
When priority−based rate limiting is implemented, the combined rate of all traffic on the port that matches the priorities associated with the rate limit cannot exceed the configured limit. If the rate exceeds the configured limit, frames are dropped until the rate falls below the limit. Once a rate limit is associated with a priority, that priority will include rate limiting wherever and however it is used, until the rate limit is deleted from Policy
Manager. Also, once a priority−based rate limit is applied to a port, it will remain on the port even if the role that originally used the rate limit is no longer associated with the port. For example, if an untagged packet arrives on a port where there is no role or default priority, but the port's 802.1p priority includes a rate limit, that traffic will be rate limited. As another example, if the priority of a tagged packet matches a priority−based rate limit on a port, the traffic will be rate limited.
The configuration of a priority−based rate limit includes:
•
Rate Limit − The highest transmission rate at which traffic can enter or exit a port. The lower and upper limits vary according to the types of devices you have and how they are connected; refer to the
Firmware Feature Support tables in the release notes for minimum and maximum limits per device
• type.
Direction − The direction to which the limit applies (inbound or outbound traffic). In order to control traffic inbound and outbound on the same port, two rate limits must be configured (one inbound and one outbound). Inbound rate limiting takes place after a frame has been classified into one of the eight priorities. Outbound rate limiting takes place just before a frame is queued for transmission. A single frame may pass through inbound and outbound rate limits depending on the path it takes through the
• device and the rate limiting configuration on the device.
Priority − The 802.1p priority or priorities the rate limit is associated with.
•
Precedence − The order in which the rate limit will be written to devices that support it. Policy
Manager allows you to define as many rate limits as you wish; however, the number written to a device is restricted by the number of rate limits supported by the device. Each port on the device may
• utilize any or all of the defined rate limits up to the number of rate limits it supports.
Exclusion − The devices/ports you wish to be excluded from the rate limit. For example, rate limiting is most often used for edge devices; therefore, you might want to exclude a device group or port
Rate Limits 164
NetSight Policy Manager Help group containing non−edge devices or ports.
Here is an example of how a priority−based rate limit is created and implemented. This example is just to give you an idea of the sequence of steps you will take to define priority−based rate limits; for complete
University, and you want to rate limit web traffic so that it doesn't use up so much bandwidth. You would:
1. Enable the Priority−Based Rate Limits class of service mode on your devices via the device General tab or the Device Configuration wizard.
2. In the left−panel Classes of Service tab, create an inbound and outbound rate limit with a
3. Create a class of service using the priority that has the associated rate limits you created.
4. Create an HTTP rule that uses that class of service as an action. Add the rule to your Student role.
5. Perform an Enforce to write the rate limit and the role to your devices.
The rate limit would be implemented as follows:
1. A student authenticates on a port and is assigned the Student role.
2. The student sends (untagged) HTTP traffic to the port and it matches the rule.
3. The rule’s action assigns the traffic its priority and applies the rate limits to that port. All of the student's web traffic is rate limited. If it exceeds the rate, the traffic is dropped.
4. The priority−based rate limits will remain on the port even if the Student role is no longer active on the port. To remove the rate limits you must delete them from Policy Manager and enforce.
NOTE:
There are important differences in priority−based rate limit behavior on Matrix
Role−Based Rate Limits
Role−based rate limits are tied directly to roles and rules, and are written to a device when the role/rule is enforced. When role−based rate limits are implemented, all traffic on the port that matches the rule with the associated rate limit cannot exceed the configured limit. If the rate exceeds the configured limit, frames are dropped until the rate falls below the limit. The rate limit will remain on the port only as long as the role using the rate limit is active on the port either as the authenticated role or as the port's default role.
Role−based rate limiting provides the ability to create rate limit port groups. Creating rate limit port groups lets you group together ports with similar rate limiting requirements. Using these port groups, you can create a single class of service that assigns a different rate limit to each port group. For example you might want to create a class of service where your server ports would receive one rate limit while your access ports would receive a different rate limit. Rate limit port groups provide this kind of flexibility.
Rate limit port groups are based on the number of rate limits the ports support (for example, 8−rate limit port groups and 32−rate limit port groups) and the direction to which the rate limit applies (inbound or outbound traffic). Policy Manager currently supports only inbound role−based rate limits. Initially, all ports (on devices that support role−based rate limits) are grouped into a Default port group under the appropriate port type.
When you create new port groups, you add ports from the Default group into your newly defined port groups.
A port can be in only one group, and all ports added to a port group must match the port group's port type.
Role−Based Rate Limits 165
NetSight Policy Manager Help
After you have created your port groups, you must configure the rate limit index mappings for each group.
These mappings map logical rate limit indexes to the actual physical rate limits you have created in Policy
Manager. Each port group has its own set of index mappings. When you create your class of service you will select the one logical index that, when looked up in this mapping table, provides the desired physical rate limit for each port group. The graphic below shows an example of this.
Policy Manager supports a maximum of 32 logical rate limit indexes and each type of rate limit port group lets you map all 32 indexes. For 8−rate limit port groups, this means that the number of logical indexes is greater than the actual number of rate limits the ports support. This is because some devices may have a mix of ports that support 32 rate limits and ports that support eight rate limits. The 8−rate limit port groups will have 32 logical rate limit indexes (0−31), but they can only be mapped to a maximum of eight different physical rate limits. The 100−rate limit port groups will have only 32 logical rate limit indexes that can be mapped to 32 different physical rate limits, even though the ports support a maximum of 100 different physical rate limits.
The configuration of a role−based rate limit includes:
•
Rate Limit − The highest transmission rate at which traffic can enter or exit a port. The lower and upper limits vary according to the types of devices you have and how they are connected; refer to the
Firmware Feature Support tables in the release notes for minimum and maximum limits per device
• type.
Notification/Action − Whether you want a system log and/or audit trap generated when the rate is first exceeded, and whether you want the port disabled when the rate is exceeded.
Here is an example of how a role−based rate limit might be created and implemented. This example is just to give you an idea of the sequence of steps you will take to define role−based rate limits; for complete
Let's say that you are a network administrator at a company that employs a number of student interns, and you want to rate limit their web traffic. You would:
1. Select the Role−Based Rate Limits and Transmit Queue Configuration class of service mode on your devices via the device General tab or the Device Configuration wizard.
2. In the left−panel Classes of Service tab, create a rate limit port group called Interns and populate it with your student intern access ports.
3.
Create your rate limit with a role−based configuration.
4. For the Interns rate limit port group, map a logical index to the actual rate limit you created.
5. Create a class of service and select the rate limit logical index you used in step 4.
Role−Based Rate Limits 166
NetSight Policy Manager Help
6. Create an HTTP rule that uses that class of service as an action. Add the rule to your Student Intern role.
7. Enforce the role to your devices.
The rate limit would be implemented as follows:
1. A student intern authenticates on a port and is assigned the Student Intern role.
2. The intern sends (untagged) traffic to the port and it matches the HTTP rule.
3. The rule’s action applies the class of service to the port which includes the defined rate limit. All of the intern's web traffic is rate limited. If it exceeds the rate, it is dropped.
4. Depending on your configuration, a system log and/or audit trap would be generated when the rate limit is first exceeded, and the port could be disabled.
5. The rate limit will remain on the port until the Student Intern role is no longer active on the port.
Transmit Queues
Policy Manager provides the ability to configure transmit queues as part of the Role−Based Rate Limits and
Transmit Queue Configuration class of service mode. This functionality is available only on certain devices
release notes for specific device/firmware rate limit support).
Transmit queue configuration is defined within a class of service and associated with a specific role via a rule action or as a role default. It is implemented based on the role assigned to a port. All traffic received on a port and matching a rule with the associated class of service will be forwarded using the defined transmit queue configuration. The transmit queue configuration will remain on the port only as long as the role using the configuration is active on the port either as the authenticated role or as the port's default role.
Policy Manager supplies a default transmit queue configuration based on the 802.1p priority associated with the class of service. You can use the default transmit queue configuration as is, or change the configuration according to the special needs of your network.
The Role−Based Rate Limits and Transmit Queue Configuration class of service mode provides enhanced transmit queue configuration capabilities that allow you to:
•
Create transmit queue port groups that let you apply a high transmit queue priority to sensitive
• network traffic.
Configure the priority in which transmit queues are serviced by specifying the arbiter mode for each
• transmit queue port group.
Pace the rate at which traffic is transmitted out of a transmit queue by configuring transmit queue rate shaping.
Creating transmit queue port groups allows you to isolate certain kinds of sensitive network traffic so that you can give it a high transmit queue priority. For example, ports that are used for Voice over IP (VoIP) can be grouped together and given a higher transmit queue priority. As another example, ports on a router might be grouped together and configured with a specific rate shaping parameter.
Transmit queue port groups are based on the number of transmit queues the ports support, for example
4−queue port groups (queues 0−3) and 16−queue port groups (queues 0−15). An individual device might have
Transmit Queues 167
NetSight Policy Manager Help a combination of these port types. Initially, all ports (on devices that support transmit queue configuration) are grouped into a Default port group under the appropriate port type. When you create new port groups, you add ports from the Default group into your newly defined port groups. A port can be in only one group, and all ports added to a port group must match the port group's port type.
After you have created your port groups, you must configure the transmit queue index mappings for each group. These mappings map logical transmit queue indexes on the ports to the actual physical transmit queues you have configured in Policy Manager. Each port group has its own set of index mappings. When you create your class of service you will select the one logical index that, when looked up in this mapping table, provides the desired physical transmit queue for each port group. The graphic below shows an example of this.
For some port groups, the number of logical indexes will be greater than the actual number of transmit queues the ports support. This is because devices can have ports that support different numbers of transmit queues.
For example, a device may have some ports that support four transmit queues and some ports that support 16 transmit queues. The 4−transmit queue port groups will still have 16 logical transmit queue indexes, but they can only be mapped to a maximum of four different physical transmit queues.
You can select the transmit queue arbiter mode for each port group. The arbiter mode is the method used to determine the way that traffic in each queue is serviced. It is based on a percentage or weight (called a "slice") given to each queue. By default, ports are set to Strict mode, which means that queues are serviced by numerical priority from the highest numbered queue to the lowest, and all frames in the highest priority queue will be transmitted before the frames in lower priority queues. You can change the arbiter mode to Weighted
Fair Queuing, which lets you adjust the slice percentage for each queue, and prevents a lower priority queue from being starved.
Policy Manager lets you configure the rate shaping and low latency status for each transmit queue in a port group. Rate shaping paces the rate at which traffic is transmitted out of the transmit queue and sets the shaping algorithm which determines what will happen to traffic that exceeds the maximum amount of traffic the transmit queue can hold. Low latency status allows the queue to have a low transmit latency. This is typically used for traffic such as Voice over IP (VoIP). Not all transmit queues support the low latency setting.
Here is one example of how you might configure transmit queues for a class of service. This example is just to give you an idea of the sequence of steps you will take to configure transmit queues; for complete
queue priority for your Voice over IP (VoIP) ports. You would:
Transmit Queues 168
NetSight Policy Manager Help
1. Select the Role−Based Rate Limits and Transmit Queue Configuration class of service mode on your devices via the device General tab or the Device Configuration wizard.
2. In the left−panel Classes of Service tab, create a transmit queue port group called VoIP and populate it with your Voice over IP ports. For this example, let's say the port group is a 4−transmit queue port group. The transmit queues are numbered 0−3.
3. Specify the Strict arbiter mode for your VoIP port group which would give transmit queue 3 the highest transmit priority.
4. If desired, configure rate shaping values and low latency status for transmit queue 3. This would allow you to pace the rate at which traffic would be transmitted out the queue.
5. For the VoIP transmit queue port group, map a logical index to transmit queue 3.
6. Create a class of service and select the transmit queue logical index you used in step 5.
7. Create a VoIP rule (for example, an IP Type of Service or MAC Address Source rule) that uses that class of service as an action. Add the rule to your VoIP role.
8. Enforce the role to your devices.
The transmit queue would be implemented as follows:
1. A packet arrives on a VoIP port and matches the VoIP rule you created.
2. The rule's action applies the class of service to the port, which includes the transmit queue configuration.
3. The port belongs to the VoIP port group, so traffic is forwarded out transmit queue 3, using the Strict mode and any rate shaping parameters you configured for transmit queue 3.
Transmit Queues 169
Priority−Based Rate Limiting on Matrix N−Series
Platinum Devices
CAUTION:
Be aware that when rate limiting is enabled on Matrix N−Series Platinum devices,
Verify and Enforce operations that include those devices take a significant amount of time to perform. A workaround would be to disable rate limiting, perform the
Enforce or Verify operation, then re−enable rate limiting, and perform the Enforce or
Verify again.
Matrix N−Series Platinum devices support up to eight inbound priority−based rate limits and the behavior of inbound priority−based rate limiting is consistent with other devices. However, outbound priority−based rate limiting on N−series Platinum devices behaves differently by associating rate limits to transmit queues. The device maps a priority number to a specific transmit queue, and transmits frames based on what queue they are in. It is important that you are aware of this different behavior, because it can result in a difference between rate limits as you create them in Policy Manager and how they are actually enforced on the device.
Each outbound priority−based rate limit priority maps to one transmit queue. The number of transmit queues varies by port type. On ports with eight transmit queues, each priority maps to one transmit queue. On ports with fewer than eight transmit queues, multiple priorities are mapped to one transmit queue. A rate limit must include all the priorities from one and only one transmit queue. For example, the default priority mapping for a port with four transmit queues is: (0,3) (1,2) (4,5) (6,7). If you create a rate limit of 100 MB/S Outbound [1], the rate limit actually enforced on the port would be 100 MB/S Outbound [1,2] because priorities 1 and 2 are mapped together. The important point is that this results in a priority being rate limited on the device (priority
2) that will not show as being rate limited in Policy Manager.
If there is a conflict between rate limits, the lower threshold rate takes precedence. For example, if you create two rate limits:
100 MB/S Outbound [1]
150 MB/S Outbound [2] only one rate limit would be enforced:
100 MB/S Outbound [1,2]
Here is an example of priority−based rate limits for an N−Series Platinum port with four transmit queues and the default priority mapping of (0,3) (1,2) (4,5) (6,7). If you create the following rate limits in Policy
Manager:
100MB Inbound [0,1]
200MB Inbound [2,4]
100MB Outbound [1]
150MB Outbound [2,3]
300MB Outbound [4,5,6]
The following rate limits would be enforced on the port:
100MB Inbound [0,1]
200MB Inbound [2,4]
100MB Outbound [1,2]
150MB Outbound [0,3]
Priority−Based Rate Limitingon Matrix N−Series Platinum Devices 170
NetSight Policy Manager Help
300MB Outbound [4,5]
300MB Outbound [6,7]
Again, the important point is that two priorities are being rate limited on the device (priorities 0 and 7) that will not show as being rate limited in Policy Manager.
Priority−Based Rate Limitingon Matrix N−Series Platinum Devices 171
How to Use Policy Manager
The How To help folder contains help topics that give you instructions for performing tasks in Policy
Manager.
Double−click the How To help folder in the left panel to open the folder and navigate to a specific How
To help topic.
How to Use Policy Manager 172
How to Add and Delete Devices
The NetSight database contains all the devices in your network and displays them in the left−panel device tree. Console and Policy Manager share a common view of the device tree, except that only devices that support policy are displayed in the Policy Manager tree. Any changes you make to the devices are reflected in both trees.
Initially, you will want to perform a Console Discover to populate the database, or you can also use Console to import devices from a .ngf file. Once devices have been added to the NetSight database, you must assign
are automatically displayed in the Policy Manager device tree. Only devices assigned to the domain you are
currently viewing are displayed. For more information, see How to Create and Use Domains.
After you have initially added your devices, you can use Policy Manager's Add Device window to add a single device to the database and the current domain.
Instructions on:
•
Using Console to Discover Devices
•
Using Console to Import Devices
•
•
Deleting Devices from the Database
Using Console to Discover Devices
Console Discover lets you to discover your network devices and add them to the NetSight database. You can perform a discover on a specified range of IP addresses, or perform a CDP (Cabletron Discovery Protocol) discover for CDP−compliant devices. Discover automatically explores a specific network segment and creates a list of discovered devices. You can then save all or a subset of the discovered devices to the NetSight database.
For step−by−step instructions, see the How to Discover Devices help topic in your Console online help system.
After devices are added to the database via Console Discover, they must be assigned to a Policy Domain
(using Policy Manager) before they will be displayed in the Policy Manager tree. Once they have been
Network Elements device tree.
Using Console to Import Devices
The Console Import Devices feature imports device information and profiles for unique devices (ones that do not exist locally) from a .ngf file, and adds them to the NetSight database. For step−by−step instructions, see the Importing a Device List from a File section of the How to Export and Import a Device List help topic in your Console online help system.
After the devices are imported to the database, they must be assigned to a Policy Domain (using Policy
Manager) before they will be displayed in the Policy Manager tree. Once they have been assigned to a
How to Add and Delete Devices 173
NetSight Policy Manager Help
Elements device tree.
Adding a Single Device
add a device, it is assigned to the current domain and automatically listed in the left−panel device tree. You must specify the device's SNMP profile. This information is used by Policy Manager to access and manage the device.
1. Select the Network Elements tab.
2.
Select any folder in the left−panel tree, right−click and select Add Device from the menu. The Add
3. Enter the IP address of the device you want to add.
4. Use the drop−down list to select one of the SNMP profiles that have been defined for device access.
The Edit button lets you create a profile if one does not already exist.
5.
Select the checkbox and enter an SNMP context, if desired.
6.
Select whether to use the default nickname or click Specify to assign a unique nickname to this
device.
7. To add the device and leave the window open, click Apply. To add the device and close the window, click OK.
Deleting Devices from the Database
When a device is deleted from the NetSight database, it is removed from all groups where it is a member in both the Policy Manager and Console device tree (and any other NetSight plugin applications).
NOTE:
If you want to remove a device from a domain without deleting it from the database, you must use
the Assign Devices to Domain window. For more information, see Removing Devices from a
To delete devices from the NetSight database:
1. In the left−panel Network Elements tab, select the device being deleted.
2. Right−click the device and select Delete from the menu. A confirmation message advises that you are deleting the device from the NetSight database.
3. Click Yes to delete the device.
Adding a Single Device 174
How to Add Applications to the Applications Menu
The Applications menu is where you can launch NetSight Plugin applications. You can also customize the
Applications menu to launch your own applications by editing the
NetSight.properties
file.
1. Open the
NetSight.properties
file. On Windows systems, this is a text file located on the top level of your <install directory>. On Solaris and Linux systems, the properties file is located in the
/var/Enterasys_Networks
directory.
2. Each application that is added to the menu is defined by an Executable line. Enter the application information using the following format:
<Application Name>
.Executable=
<full path to the executable>
Where:
<Application Name> is the name that will be displayed on the Applications menu.
Windows Example:
My Program.Executable=C:\Program Files\MyFolder\MyProgram.exe
Solaris/Linux example:
My Program.Executable=/usr/local/MyDirectory/MyProgram
3. You can also define a specific icon for each plugin on the Applications menu using the following format:
<Application Name>
.Icon=
<full path to icon image −− must be a .gif file>
4. Exit and re−launch Policy Manager. You can now see the application name on the Applications menu.
How to Add Applications to the Applications Menu 175
How to Check for Updates
NetSight applications provide an easy way to access and download product updates using a web update operation. You can perform an immediate check for updates, or schedule a routine check for updates. If your network is behind a firewall, you must specify the HTTP Proxy server being used via the Web Update view in the Options window. You must be assigned the appropriate user capability to perform this function.
Instructions on:
•
Performing an Immediate Update
•
Performing an Immediate Update
You can perform an immediate check for updates. If your network is behind a firewall, you must specify the
HTTP Proxy server being used via the Web Update view in the Options window, prior to performing an update.
1. Select Help > Check for Updates in the menu bar.
2.
The Updates Available window opens where you can view the new updates that are available for
download. Use the checkboxes to select the updates you wish to download, and click Download to initiate the download operation.
3. After the download, a message is displayed stating that you must restart the NetSight server to install the updates. Click Restart to restart the server. (You can click Cancel if you wish to restart the server manually at a later time, but keep in mind that the updates will not be installed until you restart the server.)
4. When you restart the server, any client connections will be lost. The next time the client connects, any required client updates will be performed automatically.
Schedule a Check for Updates
You can schedule a routine check for updates.
1. Select Tools > Options in the menu bar. The Options window opens.
2. In the left−panel tree under Suite options, select the Web Update folder.
3. In the right−panel Schedule Updates section, select the desired schedule: Daily or Weekly.
4. If you have specified a Weekly check, use the drop−down list to select the day of the week you wish the check to be performed, and set the desired time. If you have specified a Daily update, set the desired time.
5. If your network is protected by a firewall, select the Specify Proxy Server checkbox and enter your proxy server address and port ID. Consult your network administrator for this information.
6. Click OK to set the options and close the window.
7. When the scheduled update check is performed, a message will inform you if updates are available.
Click Get Updates to update the files.
NOTE:
All connected clients will receive this message, but only one client can initiate the update operation. Only clients assigned the appropriate user capability will be able to perform an update.
How to Check for Updates 176
NetSight Policy Manager Help
8.
The Updates Available window opens where you can view the new updates that are available for
download. Use the checkboxes to select the updates you wish to download, and click Download to initiate the download operation.
9. After the download, a message is displayed stating that you must restart the NetSight server to install the updates. Click Restart to restart the server. (You can click Cancel if you wish to restart the server manually at later time, but keep in mind that the updates will not be installed until you restart the server.)
10. When you restart the server, any client connections will be lost. The next time the client connects, any required client updates will be performed automatically.
How to Check for Updates 177
How to Configure and Manage the NetSight Server
information, configuring the server, and managing the database. To access this window, select Tools > Server
Information from the menu bar. You must be assigned the appropriate user capability to access this view.
Instructions on:
•
•
•
•
Changing the Database Password
•
Changing the Database Connection URL
•
•
Restoring the Initial Database
•
•
•
•
•
•
•
•
•
•
Configuring the Server
Use the Configure Server window to configure various NetSight Server parameters. You can access this
window by clicking the Configure button in the Server Information window.
Changing Maximum Connections
for each installed plugin application, and lets you change the maximum number of connections allowed for each plugin and the NetSight Server.
1. Select Tools > Server Information from the menu bar. The Server Information window opens.
2. Click the Configure button. The Configure Server window opens.
3. Select Client Connections in the left panel.
4. In the right panel, you will see the number of current client connections for each installed plugin application. In the Total Allowed column, you will see the maximum number of client connections allowed by this plugin application. Select this column and use the arrows to change the number, if desired.
5. Below the table, the Number of Clients Allowed field shows the maximum number of concurrent client connections allowed by the NetSight Server. Use the arrows to change the number, if desired.
This number should be set to the total number of clients you want to allow to connect to the server.
How to Configure and Manage the NetSight Server 178
NetSight Policy Manager Help
6. Click OK.
Managing the Database
Use the Database tab in the Server Information window to change the database server password and
connection URL, as well as perform database backup, initialize, and restore operations. To access the tab, select Tools > Server Information from the menu bar. The Server Information window opens, where you can select the Database tab.
Changing the Database Password
Database server properties are used by the NetSight Server when it connects to the database. The database is secured via a credential comprised of a user name and password. Use the following steps to change the database password.
IMPORTANT:
When Console is installed, it automatically secures the MySQL database server by removing all the root and anonymous users from the MySQL user database. Console then adds one generic user name (user = netsight) and password (password = enterasys). It is recommended that you change this password, since all customers who install Console will know this generic password.
1. Select Tools > Server Information from the menu bar. The Server Information window opens.
2. Select the Database tab.
3. In the Database Server Properties section, select the Show Password checkbox to display the password, if desired.
4. Click Change to open a window where you can enter a new password. (The password is masked unless you selected the Show Password checkbox.) Click OK.
5. You must restart both the NetSight Server and client after you change the database password.
Changing the Database Connection URL
The Connection URL is the URL the NetSight Server uses when connecting to the database. For troubleshooting purposes, (for example, if you can't connect to the database) you may wish to enter a new connection URL using the following steps.
1. Select Tools > Server Information from the menu bar. The Server Information window opens.
2. Select the Database tab.
3. In the Database Server Properties section, enter a new URL in the following format: jdbc:mysql://[hostname]/<database> where [hostname] is optional. Click Apply.
4. You must restart both the NetSight Server and client after you change the database connection URL.
Performing a Database Backup
You can save the currently active database to a file on the NetSight Server workstation. If the NetSight Server is local, you can specify a directory path where you would like the backup file stored. If the server is remote, the database will be saved to the default database backup location.
1. Select Tools > Server Information from the menu bar. The Server Information window opens.
Managing the Database 179
NetSight Policy Manager Help
2. Select the Database tab.
3.
In the NetSight Data Set Operations section, click Backup. The Backup Database window opens.
4. The Database Path field displays the default database backup location. If the NetSight Server is local, you can specify an alternate backup directory by entering a path to the directory, or using the Browse button to navigate to the directory. If the server is remote, the database will be saved to the default database backup location.
5. In the Database Name field, enter a name for the database backup file.
6. Click Backup to begin the database backup operation.
Restoring the Initial Database
Restoring an initial database removes all data elements from the database and populates the NetSight
Administrator authorization group with the name of the logged−in user. This operation will cause all current client connections and operations in progress to be terminated.
1. Select Tools > Server Information from the menu bar. The Server Information window opens.
2. Select the Database tab.
3.
In the NetSight Data Set Operations section, click Restore. The Restore Database window opens.
4. Select the Restore Initial Database option.
5. Click Restore to begin the initialize database operation.
6. You must restart both the NetSight Server and the client following an initialize database operation.
Restoring a Saved Database
You can restore a saved database (from a database backup operation) using these steps. This operation will cause all current client connections and operations in progress to be terminated.
1. Select Tools > Server Information from the menu bar. The Server Information window opens.
2. Select the Database tab.
3.
In the NetSight Data Set Operations section, click Restore. The Restore Database window opens.
4. Select the Restore Saved Database option.
5. Specify the database you wish to restore or use the Browse button to navigate to the database. If the server is remote, you only have access to databases in the default database backup directory.
6. Click Restore to begin the database restore operation.
Viewing Client Connections
manage current client connections to this server, and also view a history of client connections. To access the tab, select Tools > Server Information from the menu bar. The Server Information window opens, where you can select the Client Connections tab.
Disconnecting a Client
Use the following steps to disconnect a client from the NetSight Server.
1. Select Tools > Server Information from the menu bar. The Server Information window opens.
2. Select the Client Connections tab.
Restoring the Initial Database 180
NetSight Policy Manager Help
3. In the Current Client Connections table, select the client that you want to disconnect and click the
Disconnect button.
4. The client being disconnected receives a message saying that their connection will be terminated in 30 seconds. Both tables on this tab update automatically when a client connects or disconnects.
Viewing Licenses
have been installed on this particular NetSight Server and their respective license information. To access the tab, select Tools > Server Information from the menu bar. The Server Information window opens, where you can select the License tab.
You can also use this tab to change a license. You would change a license in the event that you want to upgrade from an evaluation copy to a purchased copy, or upgrade to a license that supports more users/devices. You can also use the Change License functionality to upgrade a Console license from a
Standalone to a Client−Server configuration on UNIX or Linux systems only (see instructions below.)
Contact your Enterasys Networks Representative to purchase the software and receive a Licensed Product
Entitlement ID that allows you to generate a product license. Prior to changing a license, you must redeem your Entitlement ID for the new product license. Refer to the instructions included with the Entitlement that was sent to you. (For more information, see http://www.enterasys.com/products/management/
.)
NOTES:
1. To upgrade from a Client−Only configuration to either a Standalone or
Client−Server configuration, you must re−install with the upgraded license.
2. Installed server plugin license types must be compatible with the Console license type. In other words, if Console has a Small Enterprise (SE) license, other plugins must also have an SE license. If Console has an Unlimited (U) license, the plugins must also have a U license.
Changing a License
Use the following steps to change a license when upgrading from an evaluation copy to a purchased copy, or upgrading to a license that supports more users/devices.
1. Select Tools > Server Information from the menu bar. The Server Information window opens.
2. Select the License tab.
3. Select the license that you want to change and click Change License. The Change License window opens.
4. Read and accept the terms of the license agreement and click OK.
5. Enter the license text that you received when you generated the product license. (When you purchased your Enterasys software product, you received a License Entitlement ID that allows you to generate a product license. Refer to the instructions included with the License Entitlement ID that was sent to you.)
6. Click Update. The license file will be updated with the new license text.
Viewing Licenses 181
NetSight Policy Manager Help
Upgrading a Console License
On UNIX and Linux systems only, you can use the Change License function to upgrade a Console license from a Standalone to a Client−Server configuration without reinstalling. Windows systems require that you reinstall Console using a Client−Server license.
To upgrade your Console license from a Standalone to a Client−Server configuration on a UNIX or Linux system:
1. Navigate to the /var/Enterasys_Networks
2. Edit the run_conf.sh
file using your favorite text editor.
3. Modify the hostname line to read:
JBOSS_HOSTNAME=
4. Select Tools > Server Information from the menu bar. The Server Information window opens.
5. Select the License tab.
6. Select the license that you want to change and click Change License. The Change License window opens.
7. Read and accept the terms of the license agreement and click OK.
8. Enter the license text that you received when you generated the product license. (When you purchased your Console software, you received a License Entitlement ID that allows you to generate a product license. Refer to the instructions included with the License Entitlement ID that was sent to you.)
9. Click Update. The license file will be updated with the new license text.
10. Restart the server: a. Navigate to the <installdir>
/server b. Stop the server using the command:
stopserver.sh
c. Start the server using the command:
startserver.sh
NOTE:
You can set a Console licensed for a Client−Server configuration to allow only a local host to connect to the server by editing the hostname line to read:
JBOSS_HOSTNAME="127.0.0.1"
.
Restart the server after editing the run_conf.sh
file.
Viewing Locks
access the tab, select Tools > Server Information from the menu bar. The Server Information window opens, where you can select the Locks tab.
Operational locks are used to control the concurrency of certain client/server operations. They are used in two ways:
• to lock a device while a critical operation is being performed, such as a software download.
• to lock a certain function so that only one user can access it at a time. For example, only one user can have the Authorization/Device Access window open at a time.
The Locks tab provides information about each lock, such as who owns the lock, the duration of the lock, and a description of the lock. You can also cancel (revoke) a lock in this tab.
Upgrading a Console License 182
NetSight Policy Manager Help
Revoking a Lock
Use the following steps to revoke a lock.
1. Select Tools > Server Information from the menu bar. The Server Information window opens.
2. Select the Locks tab.
3. In the Current Locks table, select the lock you want to cancel and click Revoke.
4. A message is displayed on the user's machine informing them that their use of the locked functionality has been terminated. When the user acknowledges the message, the function closes.
Viewing the Server Log
server. To access the tab, select Tools > Server Information from the menu bar. The Server Information window opens, where you can select the Server Log tab.
A new Server Log is created every day. If the NetSight Server is local, you can view previous logs using the
Server Log entries are listed by date and time, with newer entries listed at the bottom.
Viewing Server Statistics
Use the Server Statistics window to view NetSight Server statistics such as CPU usage. You can also launch
Advanced statistics that are useful for troubleshooting purposes.
1. Select Tools > Server Information from the menu bar. The Server Information window opens.
2.
Click the Server Stats button. The NetSight Server Statistics window opens.
3.
Click the Advanced button to open the Advanced Statistics window. You must use the Refresh
button to display current statistical information in this window.
Revoking a Lock 183
How to Configure CEP
The CEP (Convergence End Point) feature provides support for CEP products such as IP phones. Using this feature, you can select the CEP product types supported on a device, and map a role for each type. Then, when a convergence endpoint (such as an IP phone) connects to the network, the device identifies the type of endpoint and applies the assigned role. In addition to configuring CEP on a device, you must also enable CEP protocols on each port. Once you have configured CEP on the device and each port, you can monitor CEP product activity using the Port Usage tabs.
Use the Device Configuration Wizard and Port Configuration Wizard to configure CEP on multiple
devices/ports, or follow these steps to enable it on a single device and port.
1.
panel.
2. In the Authentication Type section, select the appropriate CEP checkbox: Single User or Multi−User.
If the device does not support the CEP feature, the CEP checkboxes are grayed out.
3. For Authentication Status, select Enabled.
4. If you have configured Multi−User authentication types, set the authentication type precedence. This allows you to set the order in which the authentication types will be tried on the device, with the authentication type on the left having the highest precedence (it will be tried first). Select the authentication type you want to position, and use the left or right arrow to arrange the types in the desired order of precedence.
5. Click Apply to set any changes you have made in this section.
6. At the bottom of the window, click on the CEP tab.
7.
The CEP Detection sub−tab lists the CEP detection rules that are used to determine if a connecting
end−system is a CEP device, and what type of CEP device it is. This allows Policy Manager to assign the appropriate role to the port based on the type of CEP device detected. Click Add to open the Add
CEP Detection Rule window where you can create your detection rules. (For information on creating
rules, see the Add CEP Detection Rule window help topic.) Your rules will be added to the list. To
remove a rule from the list, select the rule and click Remove. To edit a rule, select the rule and click
Edit. The Edit CEP Detection Rule window opens where you can edit the rule's parameters.
8. Click Apply to set any changes you have made in the CEP Detection sub−tab.
9.
The CEP Role Mappings sub−tab lists the CEP types supported by the device and the role mapped to
each type. Click Add to open the Add CEP Mapping window where you can select a CEP product type and map a role for that type. Your selections will be added to the list. To remove a CEP type from the list, select the type and click Remove. To edit a CEP type in the list, select the type and click
Edit. The Edit CEP Mapping window opens where you can select a different CEP type and/or role.
10. Click Apply to set any changes you have made in the CEP Role Mappings sub−tab.
11. Now, select the right−panel Details View tab and expand a slot or ports grouping.
12. Right−click the desired port and select Properties from the menu. In the Port Properties window, select the Authentication Configuration tab (in the top row of tabs).
13.
Select the CEP Access sub−tab. The CEP Access table lists the protocols supported by this device.
14. Use the checkboxes to enable or disable CEP protocols for this port.
15. Click Apply to set any changes you have made in the tab.
16. Repeat steps 12 through 15 for each port on the device where you want to enable CEP support.
How to Configure CEP 184
How to Configure
Devices
network and are given customized access capabilities based on what role they serve in the organization. Policy
Manager uses a RADIUS server and an authentication−enabled switch to allow the active role on a port to be dynamically assigned, based on the user's login.
You can configure authentication for a single device or for multiple devices. You can also configure
enable authentication on the device before any port authentication settings will take effect.
You can configure devices in two ways:
•
Using the Device Configuration Wizard: The Device Configuration Wizard is a series of windows that lets you define a configuration, then apply it to the devices of your choosing. You can use this
• method to configure a single device, but it is especially useful for configuring multiple devices.
Using the Device Tabs: This method enables you to configure or modify the same options found in the Device Configuration Wizard, but for a selected device, using the right−panel device tabs.
Instructions on:
•
Using the Device Configuration Wizard
•
Using the Device Configuration Wizard
The Device Configuration Wizard is a series of windows enabling you to define an authentication configuration, then apply it to the devices of your choosing. You can elect to configure authentication settings only, RADIUS client/server communication settings, or both. You can also configure MAC Locking, Rule
Accounting, and CEP (Convergence End Point) Role Mapping for the devices, and a device−level role for
Matrix C1 devices only.
1. From the menu bar, select Tools > Device Configuration Wizard.
Select Options to Configure
2. In the Device Configuration window, select the components you wish to configure.
•
Authentication
Lets you specify the authentication type(s) you want to configure: Single User, Multi−User, or None. Some devices support multiple authentication types and multiple users (Multi−User
Authentication) per port, while others are restricted to only one or two authentication types
and a single user per port (Single User Authentication). Refer to the Policy
Manager/Firmware Feature Support tables in the Release Notes for information on the
authentication types supported by each device type. For more information on the different
types of authentication, see Authentication Types.
WARNING:
How to Configure Devices 185
NetSight Policy Manager Help
Switching Authentication Types, or changing the Authentication Status from Enabled to Disabled, will log off any currently authenticated users.
•
RADIUS
Select the options related to the RADIUS server(s) and RADIUS client devices that you want to configure.
•
RADIUS Authentication Server(s) − Lets you add or remove the RADIUS servers
• that will be used for authentication purposes.
RADIUS Accounting Server(s) − Lets you add or remove the RADIUS servers that
• will be used for accounting purposes.
RADIUS Authentication Client Settings − Lets you configure and enable communication between the device (RADIUS client) and a RADIUS server or
• servers, for the purposes of authentication.
RADIUS Accounting Client Settings − Lets you configure and enable communication between the device (RADIUS client) and a RADIUS server or
• servers, for the purposes of accounting.
Application Shared Secret − Lets you set up a password that encrypts communication between Policy Manager and the devices for retrieving and setting
•
RADIUS information.
RADIUS Response Conflict Resolution − Lets you specify which response to use if both a Filter ID (which specifies a role) and a VLAN Tunnel Attribute (RFC 3580)
•
General
are returned by the RADIUS server during authentication.
Select the general device options you want to configure.
•
MAC Locking − Lets you enable MAC Locking on devices that support it.
•
Device Level Role (C1 Only) − On Matrix C1 devices, you can set a device−level role that configures the services and rules for all ports on the device. Due to a limitation of the C1 devices, services and rules from the role returned from authentication cannot be applied to the port. The services and rules from this
• device−level role will be used instead.
Rule Accounting − Lets you enable Rule Accounting on devices that support it.
When rule accounting is enabled on a device, each rule keeps a list of the ports on
•
which it has been used. You can view this port information in the Rule Usage tab.
Class of Service Mode − Lets you select the Class of Service mode on the devices you are configuring. Classes of service can be assigned as a classification rule action,
• as part of the definition of an automated service, or as a role default.
Invalid Role Action − Lets you specify what happens to a user that gets an unknown
• or invalid role.
RFC3580 VLAN Authorization Status − Lets you enable or disable RFC 3580
VLAN Authorization on devices that support it.
Configure Settings
3. The sequence of windows you see next depends on the selections you made in the Device
Configuration window.
NOTE:
Each window provides the option to use the current configuration on the device(s), or set a new configuration. If you select Use Current
Configuration on Device(s), the default settings in the window are visible, but are unavailable for entry or editing. Keep in mind that these values do not necessarily reflect the current settings on the device.
Configure Settings 186
NetSight Policy Manager Help
If you have selected to configure Authentication
All the windows you could see are listed below, but only those related to the Authentication type(s) you selected will actually appear:
•
Authentication Configuration window
This window varies depending on the authentication types you have selected. Specify the authentication settings you want to configure:
General Authentication Settings
Lets you enable or disable authentication status.
Global Timeout Settings
Lets you set Session Timeout and Session Idle Timeout values.
Web−Based
Select the web−based authentication parameters you wish to configure. These parameters may
not be supported on every device. Refer to the Release Notes Policy Manager/Firmware
Feature Support tables for information on what features are supported on the various device
types.
•
Enhanced Login Mode − Lets you enable the Enhanced Login Mode which causes the authentication web page to be displayed regardless of whether the URL entered
• into the browser by the end user is the Web Authentication URL or not.
Web Authentication URL − Lets you enter the URL for your authentication web
• page.
Web Authentication IP Address − Lets you enter the IP address of your
• authentication web page server.
Web Page Banner − Lets you customize the banner the users see at the top of the authentication web page. For example, you might include your company name and information on what to do if the user has questions or problems. Because this banner also appears in messages that occur during successful login and failed authentication, as well as on the "Radius Busy" screen, it would not be appropriate to include
•
"Welcome to [Your Company]" in the banner.
Web Authentication Logo Display Status − Lets you specify whether to show or
• hide the Enterasys Networks logo on the Web Page Banner.
Guest Networking − Lets you enable guest networking which allows any user to access the network and obtain a guest policy without having to know a username or
• password.
Redirect Time − For devices with Enhanced Login Mode enabled. Lets you specify the amount of time (in seconds) before the end user is redirected from the
• authentication web page to their requested URL.
DNS Server Configuration − Lets you add your DNS domain name and server addresses to support the Enhanced Login Mode.
MAC−Based
Select the MAC authentication parameters you wish to configure:
•
MAC User Password − Lets you enter the password to be used for MAC
• authentication (1−32 characters).
MAC Mask − Lets you select a mask, however, masking a MAC address is only supported on Matrix N−Series Platinum devices.
CEP−Based
Select the CEP authentication parameters you wish to configure:
•
CEP Role Mapping − Lets you select the CEP product types supported on the device, and map a role for each type. Then, when a convergence endpoint (such as an
IP phone) connects to the network, the device identifies the type of endpoint and applies the assigned role.
Configure Settings 187
NetSight Policy Manager Help
•
CEP Detection − Lets you create CEP detection rules that are used to determine if a connecting end−system is a CEP device, and what type of CEP device it is. This allows Policy Manager to assign the appropriate role to the port based on the type of
CEP device detected.
•
General Authentication Settings window
Select whether to enable or disable the authentication type (Authentication Status) for the device(s). Leaving the status disabled gives you the ability to configure and reconfigure authentication settings without affecting your network until authentication configuration is complete. If you have selected multiple authentication types, all of the authentication types selected will be enabled or disabled with this one setting.
WARNING:
Switching Authentication Types, or changing the Authentication Status from Enabled to Disabled, will log off any currently authenticated users.
CAUTION:
Setting the authentication status to Enabled will affect communications through the front panel ports. Any front panel being used for management should be set to inactive/default mode before setting authentication status to
Enabled. If you elect to enable authentication, an Authentication Status window appears offering you choices for actions that will take effect on front panel ports after the wizard is finished. These options are described in detail in the Authentication Status window. (If you choose the Select Ports to set
to Inactive/Default Role option, the Set Authentication Port Mode to
Inactive/Default Role window will appear at the end of the wizard after
you've selected the devices to which the configuration will apply and clicked
Finish.) After making your selection, click OK to return to the
Authentication Settings window.
If you are configuring Multi−User Authentication, you can set the Authentication Type
Precedence. This allows you to set the order in which the authentication types will be tried on the device, with the authentication type on the left having the highest precedence (it will be tried first). Select the authentication type you want to position, and use the left or right arrow to arrange the types in the desired order of precedence.
•
Global Timeout Settings window
Specify session and idle timeout values for each of the authentication types.
−− Session Timeout: Enter the maximum number of seconds an authenticated session may last before automatic termination of the session. A value of zero indicates that no session timeout will be applied.
−−Session Idle Timeout: Enter The maximum number of consecutive seconds an authenticated session may be idle before automatic termination of the session. A value of zero indicates that no idle timeout will be applied.
These values may be superseded by a session timeout and an idle timeout value provided by the authenticating server. For example, if a session is authenticated by a RADIUS server, that server may send a session timeout or an idle timeout value in its authentication response.
•
Enhanced Login Mode window (web−based authentication only)
Enabling this feature causes the authentication web page to be displayed regardless of whether the URL entered into the browser by the end user is the Web Authentication URL or not.
Configure Settings 188
NetSight Policy Manager Help
•
Web Authentication URL window (web−based authentication only)
Enter the URL for your authentication web page. Users access the authentication web page from a browser using this URL. The http:// is supplied. Alphabetical characters, numerical characters and dashes are allowed as part of the URL, but dots are not. The default URL is secureharbour
. The URL needs to be mapped to the Web Authentication IP address in
DNS or in the hosts file of each client. It must be resolvable via DNS/WINS, either on the device or at corporate, assuming the Web Authentication mapping has been set up on the corporate DNS/WINS service. This option is grayed out if not supported by the device.
•
Web Authentication IP Address window (web−based authentication only)
Enter the IP address of your authentication web page server. If you have specified a Web
Authentication URL, the IP address needs to be mapped to the URL in DNS or in the hosts file of each client.
•
Login Web Page Banner window (web−based authentication only)
user has questions or problems. The Default button allows you to reset the banner to default text provided in a text file (pwa_banner.txt). Initially, the default banner text is the Enterasys contact information. However, you can customize the text for your network by editing the pwa_banner.txt file, located in the top level of the Policy Manager install directory.
•
Web Authentication Logo Display Status window (web−based authentication only)
Specify whether to show or hide the Enterasys Networks logo on your authentication web page.
•
DNS Server Configuration window (web−based authentication only)
Configure your DNS domain name and server addresses to support the Enhanced Login Mode on Matrix E1 devices. Enter your local DNS Domain Name (for example, Enterasys.com), and your local DNS Server IP addresses. Enter an IP address and click Add to add a server address. Select an address and click Remove to remove an address from the list. Addresses are used in the order they are listed.
•
Guest Networking window (web−based authentication only)
Guest networking allows any user to access the network and obtain a guest policy without having to know a username or password. The user accesses the authentication web page, where the username and password fields are automatically filled in, allowing them to log in as a guest. If the user does not want to log in as a guest, they can type in their valid username and password to log in.
NOTE:
Guest networking is designed for networks using web−based authentication, with
port mode set to Active/Discard.
Make the following guest networking selections:
−− Guest Networking Status: Use the drop−down list to specify guest networking status:
•
Disable −− Guest networking will be unavailable.
•
Local Auth −− Guest Networking will be enabled. The user accesses the authentication web page where the username field is automatically filled in with the
specified Guest Name. Once the user submits the login page using this guest name,
the default policy of that port becomes the active policy. The port mode must be set to Active/Discard mode.
Configure Settings 189
NetSight Policy Manager Help
•
RADIUS Auth −− Guest Networking will be enabled. The user accesses the login
web page, where the username field is automatically filled in with the specified Guest
authentication. Following successful authentication from the RADIUS server, the port will apply the policy returned from the RADIUS server. The port mode must be set to Active/Discard mode.
−− Guest Name: Enter the guest name. This is the username that Guest Networking will use to authenticate users, and is displayed automatically on the login web page.
−− Guest Password: If you have selected RADIUS Auth, enter the guest password that will be used for authentication.
•
Redirect Time window (web−based authentication only)
This setting applies to devices with Enhanced Login Mode enabled. Enter the amount of time
(in seconds) before the end user is redirected from the authentication web page to their requested URL. Click the Default button to enter the default value of 30 seconds.
An endstation using DHCP requires time to transition from the temporary IP address issued by the authentication process to the official IP address issued by the network. Redirect Time specifies the amount of time allowed for the end station to complete this process and begin using its official IP address. The default value of 30 seconds is adequate for most networks; however, some networks may require a longer or shorter time period. If the Redirect Time is not long enough, the browser times out while attempting to load the requested URL. In networks that only use static IP addresses, a Redirect Time of 5 to 10 seconds is usually sufficient; a value of less than 5 seconds is not recommended.
For example, if a user (in Enhanced Login Mode and a Redirect Time of 30 seconds) enters the URL of "http://enterasys.com", they will be presented the authentication web page. When the user successfully authenticates into the network, they will see a login success page that displays "Welcome to the Network. Completing network connections. You will be redirected to http://enterasys.com in approximately 30 seconds".
•
MAC Mask window
Select a MAC mask that will be used for MAC authentication. However, masking a MAC address is only supported on Matrix N−Series Platinum devices. Using a mask provides a way to authenticate end stations based on a portion of their MAC address. For example, you could specify a mask that would base authentication on the manufacturer's ID portion of the MAC address. The MAC Mask is passed to the RADIUS server for authentication after the primary attempt to authenticate using the full MAC address fails.
•
MAC User Password window
Enter the password that will be passed to the RADIUS server for MAC authentication (1−32 characters).
•
CEP Role Mapping window
Use the Add button to select the CEP product types supported on the device, and map a role for each type.
•
CEP Detection window
Use the Add button to create your CEP detection rules. (For information on creating rules,
see the Add CEP Detection Rule window help topic.)
Configure Settings 190
NetSight Policy Manager Help
If you have selected to configure RADIUS
All the windows you could see are listed below, but only those related to the RADIUS options you selected will actually appear:
•
RADIUS Authentication Server(s) window
Add or remove RADIUS servers to use for authentication purposes. The order in which the servers are listed is the order of priority for the servers; the device will try to communicate with the RADIUS server at the top of the list first.
devices and the RADIUS server.
−− To remove a RADIUS server: Select the server in the table and click Remove.
NOTE:
Setting a new configuration for RADIUS servers will remove/replace any
RADIUS servers currently configured on the device(s).
•
RADIUS Accounting Server(s) window
Add or remove RADIUS servers to use for accounting purposes. The order in which the servers are listed is the order of priority for the servers; the device will try to communicate with the RADIUS server at the top of the list first.
devices and the RADIUS server.
−− To remove a RADIUS server: Select the server in the table and click Remove.
NOTE:
Setting a new configuration for RADIUS servers will remove/replace any
RADIUS servers currently configured on the device(s).
•
RADIUS Authentication Client Settings window
Make the following RADIUS client selections:
−− RADIUS Client Status: Enable or disable the RADIUS client. If enabled, the device becomes a RADIUS client and will communicate with a RADIUS authentication server whenever a user logs on to a port on the device, as long as the port itself is enabled for authentication and the device is set up as a client on the RADIUS server.
−− Number of Retry Attempts: Enter the number of attempts the RADIUS client will make in contacting each RADIUS authentication server before giving up and trying the next
RADIUS server on the list. Valid values are 1−65535.
−− Retry Timeout Duration (seconds): Enter the number of seconds to wait for the
RADIUS authentication server to respond before trying again. Valid values are 1−65535.
•
RADIUS Accounting Client Settings window
Make the following RADIUS client selections:
−− Client Accounting Status: Enable or disable RADIUS Accounting for SNMPv3 devices that support it. RADIUS Accounting is used by a device (the RADIUS client) to save accounting data on a RADIUS server. If enabled, an accounting session starts after the user is successfully authenticated by a RADIUS authentication server.
−− Accounting Update Interval (minutes): Enter the number of minutes between accounting updates, when collected accounting data is sent from the device (RADIUS client) to the RADIUS accounting server. Valid values are 1−65535. It is recommended that the value be greater than 10 minutes, and careful consideration should be given to its impact on
Configure Settings 191
NetSight Policy Manager Help network traffic.
•
Application Shared Secret window
Select from the following choices the application shared secret you want to be used for
communication between Policy Manager and the device when setting or retrieving RADIUS information.
−− Auto−Generate an application shared secret: If you want the system to generate a
secure key automatically, select this button.
typically xxxx−xxxx−xxxx−xxxx−xxxx−xxxx−xxxx−xxxx.
non−default shared secret.
WARNING:
It is important to remember the Application Shared Secret, since the shared secret specified in Policy Manager must match the shared secret on the device in order to change the shared secret. If you delete and recreate the device model, you will have to supply the correct Application Shared Secret in the device's RADIUS tab in order to retrieve or input RADIUS settings in the RADIUS tab. If you're using an Auto−Generated or User−Defined
Application Shared Secret and you clear NVRAM on the device, you will need to go to the RADIUS tab for the device in Policy Manager and change the Application Shared Secret back to "Default" in order to regain access to the RADIUS information in that tab. Once Policy Manager and the device are using the same (Default) Application Shared Secret, then the
Application Shared Secret can be changed to be either Auto−Generated or
User−Defined.
•
RADIUS Response Conflict Resolution window
Select which response to use if both a Filter ID (which specifies a role) and a VLAN Tunnel
Attribute (RFC 3580) are returned by the RADIUS server during authentication.
−− Filter ID: The Filter ID (role) is used.
−− VLAN Tunnel Attribute: The VLAN Tunnel Attribute is used and the
Authentication−Based VLAN to Role Mappings are applied, if present.
−− Filter ID With VLAN Tunnel Attribute: Both attributes are applied in the following manner: the role is applied to the user, except that the VLAN Tunnel Attribute replaces the role's Default Access Control VLAN (if present). In this case, the Authentication−Based
VLAN to Role mappings are ignored (as the role was explicitly assigned). VLAN classification rules are still applied, as defined by the assigned role.
If you have selected General:
All the windows you could see are listed below, but only those related to the options you selected will actually appear:
•
MAC Locking window
Configure MAC Locking status on the device. Setting MAC Locking to Enabled will allow
the device to lock MAC addresses to all ports that have the MAC Locking feature enabled.
•
Device Level Role (C1 Only) window
Use the drop−down list to select a device−level role that configures the services and rules for
Configure Settings 192
NetSight Policy Manager Help all ports on the device. Select the Clear the current default role option to set the device−level role back to <None>.
•
Rule Accounting window
When rule accounting is enabled on a device, each rule keeps a list of the ports on which it
has been used. You can view this port information in the rule's Rule Usage tab. In addition,
you can enable certain auto−clear operations that determine when to clear ports from a rule's
Rule Usage tab.
•
Clear Rule Usage on Port Link−Status Change − Clears rule usage data when the port
• has a link−status change.
Clear Rule Usage Port Role Change − Clears rule usage data when the port's role
• changes.
Clear Rule Usage on Interval − Clears rule usage data at a set interval. Enter the desired interval (in minutes).
•
Class of Service Mode window
Select the Class of Service mode for the device. Policy Manager supports two modes of class
to disable rate limits on the devices you are configuring.
•
Rate Limits Disabled − Select this option if you want rate limits disabled on the device. This means that any priority−based rate limits will not be written to the device on enforce, and any role−based rate limits will not be included in roles written
• to the device on enforce.
Role−Based Rate Limits/Transmit Queue Configuration − Select this mode if you want to configure role−based rate limits and transmit queues on the device. See
Defining Role−Based Rate Limits and How to Configure Transmit Queues for more
• information.
Priority−Based Rate Limits − Select this mode if you want to configure priority−based rate limits on the device. Priority−based rate limits add to the amount of time it takes to enforce and verify roles. Once you've created your rate limits and enforced them, you may want to disable rate limits so that it takes less time to
enforce. See Defining Priority−Based Rate Limits for more information.
•
Invalid Role Action
Select the action you would like taken if an authenticated user is assigned an unknown or invalid role:
•
Apply Default − Apply the port's default role to the user.
•
Deny Traffic − Drop the packets for this user.
•
Permit Traffic − Forward traffic with the port's assigned VID.
•
RFC3580 VLAN Authorization Status window
Enable or disable RFC 3580 VLAN Authorization on the device. RFC 3580 VLAN
Authorization must be enabled on devices in networks where the RADIUS server has been configured to return a VLAN ID when a user authenticates. Enabling VLAN Authorization allows you to configure Authentication−Based VLAN to Role Mapping as a way to assign a role to a user during the authentication process, based on a VLAN Attribute. For more
information, see VLAN to Role Mapping in the Concepts Help topic. To configure
Configure Settings 193
NetSight Policy Manager Help
Authentication−Based VLAN to Role Mapping, use the role's Mappings tab and/or the
Select Devices
4.
In the Device Selection window, select the device(s) to which you want this configuration to apply.
5. Click Finish.
NOTE:
If you elected to enable authentication as part of the device configuration, and chose
complete the wizard.
Using the Device Tabs
Configuring a device using the device tabs enables you to set up or modify the same options found in the
Device Configuration Wizard, but for a selected device, using the right−panel device tabs.
To configure a device using the device tabs:
1. In the left−panel Network Elements tab, select the device you want to configure. Use the right−panel tabs to configure the device.
2.
tab you change.
3.
Select the RADIUS tab and fill out the tab as required.
4.
To enable MAC Locking, select the MAC Locking tab and configure the options as desired.
5.
or enable Rule Accounting as desired.
6.
Select the General tab and choose your Class of Service mode.
Select Devices 194
How to Configure
Ports
port, freeze or unfreeze a port, enable or disable the Drop VLAN Tagged Frames and MAC Locking features, enable CEP (Convergence End Point) protocols, and set other port settings. There are two ways to configure ports:
•
Using the Port Configuration Wizard: The Port Configuration Wizard is a series of windows that leads you through all the steps required to configure ports. You can configure a single port with the wizard, but it is even more useful for configuring multiple ports simultaneously. To configure
• authentication for a port in a Pre−Defined Port Group, you must use the Port Configuration Wizard.
Using the Port Properties Window: You can use the Port Properties window to configure port settings for a single port.
Instructions on:
•
Using the Port Configuration Wizard
•
Using the Port Properties Window
Using the Port Configuration Wizard
The Port Configuration Wizard is a series of windows that leads you through all the steps required to configure a port or ports, including setting the port mode, login settings, and default role. Use the Port
Configuration Wizard to configure single or multiple ports simultaneously. You must configure and enable
1. From the menu bar, select Tools > Port Configuration Wizard. The Port Configuration Wizard opens.
2. In the Port Configuration window, select the configurations you wish to perform:
•
Authentication
Specify the authentication type(s) you want to configure: Single User or Multi−User. Some devices support multiple authentication types and multiple users (Multi−User Authentication) per port, while others are restricted to only one or two authentication types and single users
device type. For more information on the different types of authentication, see Authentication
NOTE:
The authentication type(s) selected here must match exactly those set on the device(s) being configured.
•
General Settings
Select the general port options you want to configure.
•
Default Role & Drop VLAN Tagged Frames − Lets you assign a default role and enable the Drop VLAN Tagged Frames feature on the ports. A port's default role takes effect when an end user on a port fails to authenticate, or if authentication is
inactive on the port. See Default Role for more information. If you set a default role
How to Configure Ports 195
NetSight Policy Manager Help for the ports, it is recommended that you enable the Drop VLAN Tagged Frames feature. This feature lets you set the ports so that any packet already tagged with a
VLAN coming into the ports will be dropped. See Drop VLAN Tagged Frames for
• more information.
Frozen Status − Enables you to "lock" the ports so that no one can accidentally
reconfigure its sensitive attributes. See How to Freeze/Unfreeze a Port for more
• information.
MAC Locking − Lets you enable MAC Locking on ports, if the device on which the
• port is located supports it.
TCI Overwrite − Lets you enable TCI Overwrite on ports, if the device on which the
port is located supports it. TCI Overwrite is required for Tagged Packet VLAN to
•
Disable Traffic Classification Types − Lets you create a list of rule types that will
• be disabled on the ports.
RFC3580 VLAN Authorization − Lets you enable or disable RFC 3580 VLAN
•
Authorization on the ports and specify an egress state.
Tagged Packet VLAN to Role Mapping − Lets you configure Tagged Packet
VLAN to Role mappings on the ports. These mappings provide a way to let ports
• assign a role to network traffic, based on a VLAN ID.
MAC to Role Mapping − Lets you configure MAC to Role mappings on the ports.
These mappings provide a way to let ports assign a role to an end station based on its source MAC address.
3. The sequence of windows you see next depends on the selections you made in the Port Configuration window.
NOTE:
Each window provides the option to use the current configuration on the port(s), or set a new configuration. If you select Use Current Configuration on Port(s), the default settings in the window are visible, but are unavailable for entry or editing. Keep in mind that these values do not necessarily reflect the current settings on the port.
If you have selected to configure Authentication
All the windows you could see are listed below, but only those related to the Authentication type(s) you selected will actually appear:
•
Port Authentication Configuration window
The options presented in this window vary depending on the authentication type(s) you have selected. Select the authentication parameters you wish to configure.
•
Shared Settings
•
Port Mode (802.1X , MAC, Web−Based) − Defines whether or not end users are required to authenticate, and how unauthenticated traffic will be
•
handled. See Port Mode for more information.
Hold Time (802.1X, MAC, Web−Based) − (Also known as Quiet Period in web−based and MAC authentication.) Amount of time (in seconds) authentication will remain timed out after the specified Timeout Number has
• been reached.
Automatic Re−Authentication (802.1X, MAC) − Lets you enable the
• periodic automatic re−authentication of logged−in users.
Authenticated User Counts (802.1X, MAC, Web−Based) − The number of users that can be actively authenticated or have authentications in progress at one time on a port. This option is for ports on Matrix N−Series devices with
Multi−User as their configured authentication type.
•
802.1X Settings
How to Configure Ports 196
NetSight Policy Manager Help
•
Authentication Request Period − How often (in seconds) the device queries the port to see if there is a new user on it. If a user is found, the device then
• attempts to authenticate the user.
User Timeout − The amount of time (in seconds) the device waits for an
• answer when querying the port for the existence of a user.
Authentication Server Timeout − If a user is found on the port, the amount of time (in seconds) the device waits for a response from the authentication
• server before timing out.
Port Handshake Requests − The number of times the device tries to finalize the authentication process with the user, before the authentication request is considered invalid and authentication fails.
•
Web−Based Settings
•
Timeout Number − Number of times a user can attempt to log in before authentication fails and login attempts are not allowed.
•
CEP Settings
•
CEP Protocol Enable − Lets you enable various CEP (Convergence End
Point) protocols on ports, if the device on which the port is located supports
CEP. See How to Configure CEP for more information.
•
Port Mode window (802.1X, MAC, Web−Based)
Specify the desired port mode for ports. Port mode defines whether or not a user is required to authenticate on a port, and how unauthenticated traffic will be handled. It is a combination of
Authentication Behavior (whether or not authentication is enabled on a port), and
Unauthenticated Behavior (whether unauthenticated traffic will be assigned to a port's default
role or discarded). See Port Mode for a complete description of each port mode.
NOTES:
−− If you set the ports' Authentication Behavior to Active, it is
recommended that you enable the Drop VLAN Tagged Frames
feature on the ports.
−− For Single User 802.1X or 802.1X+MAC authentication: If you set port mode to Active/Default Role, then the selected default role will be automatically set on the configured ports. If you set port mode to Active/Discard, then any default role assigned to the ports will be automatically cleared.
In addition, the Port Mode window provides checkboxes that allow you to disable a specific authentication type at the port level. If the device is only configured with one authentication type, selecting the corresponding checkbox will result in the port Authentication Behavior being set to Inactive.
NOTE:
−− For Single User 802.1X+MAC authentication with Active/Default
Role as the selected port mode: Disabling 802.1X authentication also disables MAC authentication on the port. An end user connecting to the port will not be able to authenticate via 802.1X or MAC. The port will behave as if Inactive/Default Role is the selected port mode.
−− For Multi−User Web−Based authentication with Active/Discard as the selected port mode: The "Disable Web−Based authentication for specified port(s)" checkbox is automatically selected because multi−user web−based authentication does not support the
Active/Discard port mode.
How to Configure Ports 197
NetSight Policy Manager Help
•
Hold Time window (802.1X, MAC, Web−Based)
Enter the amount of time (in seconds) authentication will remain timed out after the specified
Timeout Number has been reached. Valid values are 0−65535. The default is 60. (Hold Time is also known as Quiet Period in web−based and MAC authentication.)
•
Authentication Request Period window (802.1X)
Enter how often (in seconds) the device should query the port to see if there is a new user on it. Valid values are 1−65535. The default is 30.
•
User Timeout window (802.1X)
Enter the amount of time (in seconds) the device should wait for an answer when querying the port for the existence of a user. Valid values are 1−300. The default is 30.
•
Authentication Server Timeout window (802.1X)
Enter the amount of time (in seconds) the device should wait for a response from the authentication server before timing out, if a user is found on the port. Valid values are 1−300.
The default is 30.
•
Port Handshake Requests window (802.1X)
Enter the number of times the device should try to finalize the authentication process with the user, before the authentication request is considered invalid and authentication fails. Valid values are 1−10. The default is 2.
•
Automatic Re−Authentication window (802.1X, MAC)
Enable or disable the automatic re−authentication feature by setting the Re−Authentication
Status to Active (enabled) or Inactive (disabled). This specifies whether or not the device should periodically repeat the authentication process for logged−in users on this port. If you activate automatic re−authentication, specify how often this should occur (Re−Authentication
Frequency), in seconds. Valid values are 1−2147483647. The default is 3600.
•
Authenticated User Counts window (802.1X, MAC, Web−Based)
This option is for ports on Matrix N−Series devices with Multi−User as their configured authentication type. Enter the maximum number of users that can be actively authenticated or have authentications in progress at one time on the specified ports. The maximum number allowed varies for different port types. If you set this value below the current number of users on the ports, end user sessions exceeding that number will be terminated. If you have selected MAC as a Multi−User authentication type, enter the maximum number of users that can be actively authenticated via MAC authentication, or have MAC authentications in progress at one time on this interface. The number of allowed MAC users cannot exceed the number of allowed users. If you set this value below the current number of users, end user sessions exceeding that number will be terminated.
•
Timeout Number window (Web−Based)
Enter the number of times a user can attempt to log in before authentication times out and further login attempts are not allowed. Valid values are 1−2147483647. Zero is not allowed.
The default is 2.
•
CEP Protocol Enable window
Enable or disable various CEP protocols for the ports being configured. The table lists all the
CEP protocols currently supported by Policy Manager. Use the checkboxes (or the Enable All and Disable All buttons) to enable or disable the desired CEP protocols. You must configure
How to Configure Ports 198
NetSight Policy Manager Help
and enable CEP on the device in addition to configuring CEP on the ports (see How to
If you have selected General Settings:
All the windows you could see are listed below, but only those related to the options you selected will actually appear:
•
Default Role window
Use the drop−down list to select a default role for the ports. If you already set the ports'
Authentication Behavior to Active and specified a default role in the Port Mode window, then this panel will be disabled. Select the Clear the current default role option to set the default role back to <None>. If you set a default role for the ports, it is recommended that you enable
the Drop VLAN Tagged Frames feature.
•
Drop VLAN Tagged Frames window
Choose whether or not you want packets already tagged with a VLAN to be dropped from the ports. Usually you would have this enabled for user ports and disabled for interswitch ports.
See Drop VLAN Tagged Frames for more information.
WARNING:
Enabling this feature on a CDP or Backplane port is likely to result in loss of contact with devices connected through the port.
•
Frozen Status window
Enables you to "lock" the ports so that no one can accidentally reconfigure its sensitive attributes. Select either the Set Frozen or Clear Frozen option.
•
MAC Locking window
Enable or disable MAC Locking for the ports being configured. You can also set the
maximum number of MAC addresses that are allowed to be locked dynamically or statically on a port. Use the Static Locked MAC Addresses table to create a list of locked MAC addresses, so that the ports only accepts traffic from those MAC addresses. Click Add to open the Enter Static Locked MAC window, where you can enter a MAC address to add to the list. Click Remove to remove a selected entry from the Locked MAC Addresses list.
•
TCI Overwrite window
Enable or disable TCI Overwrite functionality for the ports being configured. Enabling TCI
Overwrite causes the VLAN or class of service tag in a received packet to be overwritten by the VLAN (access control) and class of service characteristics defined in the port's current or default role. If there is no role assigned to the port, the port uses any static classification rules which exist. If there are no static rules, the port uses the PVID and default class of service for the port.
TCI Overwrite is required for Tagged Packet VLAN to Role Mapping, and can be enabled
either here at the port level, or for an individual role in the role's General tab.
•
Disable Traffic Classification Types window
Create a list of traffic classification rule types that will be disabled on the ports. For example, you can disable the VLAN ID traffic classification type to disable Tagged Packet VLAN to
Role Mapping on the ports you are configuring. Click Add to open the Traffic Classification
Type wizard where you can select the rule type you want to add to the list, or click Add All to
How to Configure Ports 199
NetSight Policy Manager Help add all rule types to the list. Adding all rule types would disable all traffic classification on the port, and the role's default class of service and/or default access control would take effect.
Click Remove to remove selected rule types from the list.
•
RFC3580 VLAN Authorization window
Enable or disable RFC 3580 VLAN Authorization for the ports being configured. VLAN
Authorization must be enabled in networks where the RADIUS server has been configured to return a VLAN ID when a user authenticates. When RFC 3580 VLAN Authorization is enabled:
• ports on devices that do not support policy, will tag packets with the VLAN ID.
•
ports on devices that do support policy and also support Authentication−Based
VLAN to Role Mapping, will classify packets according to the role that the VLAN
Attribute maps to.
You can also modify the VLAN egress list for the VLAN ID returned by the RADIUS server when a user authenticates on the port:
•
None − No modification to the VLAN egress list will be made.
•
Tagged − The port will be added to the list with the egress state set to Tagged (frames
• will be forwarded as tagged).
Untagged − The port will be added to the list with the egress state set to Untagged
•
(frames will be forwarded as untagged).
Dynamic − The port will use information returned in the RADIUS response to modify the VLAN egress list. This value is supported only if the device supports a mechanism through which the egress state may be returned in the RADIUS response.
The current egress settings for the port are displayed in the VLAN Oper Egress column in the
End User Sessions table on the Port Usage tabs.
•
Tagged Packet VLAN to Role Mapping
Create a list of Tagged Packet VLAN to Role mappings for the ports being configured. Click
Add to open the VLAN to Role Mapping Selection View, where you can select a VLAN and map it to a role. Click Remove to remove selected mappings from the list. When configuring
Tagged Packet VLAN to role mapping, you must also enable the TCI Overwrite attribute.
TCI Overwrite can be enabled either here at the port level, or for an individual role in the
role's General tab. You must have the Port Level Role Mappings feature enabled in Policy
Manager for these mappings to take effect. (From the menu bar, select the Edit > Port Level
Role Mappings checkbox.) If the feature is not enabled, the mappings will be ignored.
Mappings will not be added or removed to or from frozen ports. You must first clear the frozen state on a port in order to add or remove a mapping.
•
MAC to Role Mapping
Create a list of MAC to Role mappings for the ports being configured. Click Add to open the
Add MAC Address window, where you can select a MAC address and a MAC mask.
Masking a MAC address is only supported on Matrix N−Series Platinum devices. Click
Remove to remove selected mappings from the list. You must have the Port Level Role
Mappings feature enabled in Policy Manager for these mappings to take effect. (From the menu bar, select the Edit > Port Level Role Mappings checkbox.) If the feature is not enabled, the mappings will be ignored. Mappings will not be added or removed to or from frozen ports. You must first clear the frozen state on a port in order to add or remove a mapping.
WARNING:
Enforcing port−level MAC to Role mappings could potentially remove rules created by NetSight Automated Security Manager
(ASM) as an intrusion detection response.
How to Configure Ports 200
NetSight Policy Manager Help
4. In the Port Selection window, you can select the ports you want to include or exclude from this configuration.
NOTE:
For 802.1X devices that do not support Policy (such as the RoamAbout
AP3000):
−− FTM 1 Backplane ports must be excluded from the port selection when configuring this type of device.
−− The Active/Default Role port mode is not a valid configuration for this type of device. If you are configuring Active/Default Role port mode, these devices must be excluded.
a. In the Devices field, expand the folders and select the ports you want to configure.
b. Click Add Include to include the selected ports in this configuration or click Add Exclude to exclude the ports from the configuration. For example, you may want to configure all your
10/100 ports except printer ports. You would select the Pre−Defined Port Group of 10/100 ports and click Add Include. Then you would select a User−Defined Port Group of printer ports and click Add Exclude.
c. To remove a port from the Include Ports or Exclude Ports fields, select the port and click
Remove.
5. Click Finish. The settings will take effect.
NOTE:
You must configure and enable authentication on the device before any port
authentication settings will take effect (see How to Configure Devices).
Using the Port Properties Window
Configuring a port using the Port Properties window accomplishes the same things as the Port Configuration
Wizard, but also enables you to view the current configuration on the port. To configure authentication for a
port in a Pre−Defined Port Group, you must use the Port Configuration Wizard.
•
Assigning Default Roles to Ports
•
Clearing Default Roles from Ports
•
Disabling Traffic Classification Rules on Ports
•
•
Enabling Drop VLAN Tagged Frames
•
•
Locking MAC Addresses to Ports
•
•
Assigning Default Roles to Ports
You can assign a default role to a single port, or to multiple ports. If you set a default role for a port, it is
recommended that you enable the Drop VLAN Tagged Frames feature.
Single Port
1. Select a device in the left−panel Network Elements tab and expand a slot or ports grouping in the right−panel Details view.
Using the Port Properties Window 201
NetSight Policy Manager Help
2. Right−click the desired port and select Properties from the menu. In the Port Properties window,
select the General tab (in the top row of tabs).
3.
New to launch the Role Wizard and create a new role. Select the Clear the current default role
option to set the default role back to <None>. Click OK.
4. The default role configuration will take effect unless you have created a new role. Then, you must enforce the role before the default role configuration setting will take effect.
Multiple Ports
There are two ways to assign a default role to multiple ports:
•
Using the Default Role Window in the Port Configuration Wizard. Using the wizard is most useful
• when you want to do other port configuration tasks as well.
Assigning the default role to a device, a device group, or a pre−defined or user−defined port group, as follows:
1. For a device or device group: in the left−panel Network Elements tab, right−click the device or device group that includes the ports to which you want to assign the default role, and select
Set Default Role from the menu.
For a port group: in the left−panel Port Groups tab, right−click the group for the ports to which you want to assign the default role, and select Set Default Role from the menu.
2.
In the Selection View, select the role you want to assign as the default. You can also click
New to access the Role Wizard, create a new role to add to the list, then select it.
3. Click OK. The default role will take effect unless you have created a new role. Then, you must enforce the new role before the default role configuration setting will take effect.
Clearing Default Roles from Ports
You can clear the default role from a single port, or from multiple ports.
Single Port
1. Select a device in the left−panel Network Elements tab and expand a slot or ports grouping in the right−panel Details view.
2. Right−click the desired port and select Properties from the menu. In the Port Properties window,
select the General tab (in the top row of tabs).
3.
Select the Role Status sub−tab. Click the Select button to select a new default role. This opens the
back to <None>.
4. Click OK.
NOTE:
If you are replacing the current default role with another one, you don't need to clear the current default role. Selecting the new default role and clicking OK clears the previous default role automatically.
Multiple Ports
There are two ways to clear the default role from multiple ports:
Single Port 202
NetSight Policy Manager Help
•
Using the Clear the current default role option on the Default Role Window in the Port
Configuration Wizard. Using the wizard is most useful when you want to do other port configuration
• tasks as well.
Clearing the default role from a device, a device group, or a port group, as follows:
1. For a device or device group: in the left−panel Network Elements tab, right−click the device or device group that includes the ports to which you want to assign the default role, and select
Set Default Role from the menu.
For a port group: in the left−panel Port Groups tab, right−click the group of ports to which you want to assign the default role, and select Set Default Role from the menu.
2.
In the Selection View, select the Clear the current default role box.
3. Click OK.
NOTE:
If you are replacing the current default role with another one, you don't need to clear the current default role. Selecting the new default role and clicking OK clears the previous default role automatically.
Disabling Traffic Classification Rules on Ports
You can create a list of traffic classification rule types to disable on a port using the Port Properties window.
For example, you could disable the VLAN ID traffic classification type, which would disable Tagged Packet
VLAN to Role Mapping on the port.
1. Select a device in the left−panel Network Elements tab and expand a slot or ports grouping in the right−panel Details view.
2. Right−click the desired port and select Properties from the menu. In the Port Properties window,
select the General tab (in the top row of tabs).
3.
Select the Disabled Traffic Classification Types sub−tab.
4.
Use the Add button to open the Traffic Classification Type wizard and create the list of rules you
want to disable.
Enabling CEP Protocol
Properties window Authentication Configuration tab. (You can enable CEP protocols for multiple selected
How to Configure CEP for more information.
Enabling Drop VLAN Tagged Frames
When the Drop VLAN Tagged Frames feature is enabled, any packet already tagged with a VLAN coming into the port will be dropped. Usually you would enable this for user ports, and disable it for interswitch ports.
WARNING:
Enabling this feature on a CDP or Backplane port is likely to result in loss of contact with devices connected through the port.
1. Select a device in the left−panel Network Elements tab and expand a slot or ports grouping in the right−panel Details view.
2. Right−click the desired port and select Properties from the menu. In the Port Properties window,
select the General tab (in the top row of tabs).
Single Port 203
NetSight Policy Manager Help
3.
Select the Drop VLAN Tagged Frames sub−tab. In this tab, select the Enable button.
4.
Click Enforce on the toolbar, review the effects of enforcing in the Enforce Preview window if it is
enabled, then click Enforce on that window.
Freezing/Unfreezing Ports
See How to Freeze/Unfreeze a Port.
Locking MAC Addresses to Ports
See How to Lock MAC Addresses to Ports.
Setting Port Authentication
You can configure authentication settings for a selected port in the Port Properties window. Before any port
NOTE:
In order to configure authentication for a port in a Pre−Defined Port Group, you must
use the Port Configuration Wizard.
1. Select a device in the left−panel Network Elements tab and expand a slot or ports grouping in the right−panel Details view.
2. Right−click the desired port and select Properties from the menu. In the Port Properties window,
select the Authentication Configuration tab (in the top row of tabs).
3. Use the sub−tabs to make changes as required.
Terminating a Session
Terminating a session causes the port to be re−initialized. The user loses the access rights of the current role on the port and reverts to the access rights specified for unauthenticated behavior on the port, until he or she authenticates again.
With web−based authentication, the user must log in again using the authentication web page after the port re−initializes. With 802.1X authentication on Windows 2000, the user is prompted to log in again after the port re−initializes. With 802.1X authentication on the Windows XP platform, the user is automatically reauthenticated immediately after the port re−initializes, and no login prompt occurs.
You can terminate an authenticated session on a single port in the Port Properties Window or multiple ports in the Port Usage tab for a device, a device group, or a port group. If sequential multiple ports are selected, only
authenticated sessions whose Terminate Cause is "Not Applicable" are affected. You cannot terminate
sessions on frozen ports and you cannot terminate Role Override (IP) or Role Override (MAC) sessions that were created through the CLI (command line interface).
NOTE:
For 802.1X authentication on the Windows XP platform, if you terminate a user's session, the user is automatically reauthenticated, unless there has been a policy change or a change in the user's authentication status (e.g., the user has been removed from the authentication list).
Single Port 204
NetSight Policy Manager Help
Single Port
1. Select a device in the left−panel Network Elements tab and expand a slot or ports grouping in the right−panel Details view.
2. Right−click the desired port and select Properties from the menu. In the Port Properties window,
select the Port Usage tab (in the top row of tabs).
3.
Select the End User Sessions sub−tab. You must click Retrieve to display the port information in the
table.
4. Select an active session and click Terminate to end the session. If multiple sessions are selected, only
active sessions will be terminated. You cannot terminate a session on a frozen port and you cannot
terminate Role Override (IP) or Role Override (MAC) sessions that were created through the CLI
(command line interface).
5. Click Yes to confirm that you want to terminate.
Multiple Ports
Select the right panel Port Usage tab for one of the following left−panel selections, depending on the ports whose session(s) you want to terminate:
•
•
•
•
Single Port 205
How to Freeze/Unfreeze a Port
Freezing a port enables you to "lock" it so that no one can accidentally reconfigure sensitive attributes such as port authentication or default role settings. For example, if a port is frozen and the administrator later assigns a default role to the entire device, the frozen port will not receive the new default role. To reconfigure a frozen port, you must clear its frozen status, do the configuration, then freeze it again. One application of this feature would be to prevent interswitch link ports from being accidentally reconfigured. You can tell if a port is frozen or not by looking at the port icon
or by checking the Frozen Status on the Port Properties General tab.
The Frozen Port feature is a software feature available in Policy Manager. It does not freeze the ports in the switch firmware itself, but protects the user from making configuration changes to sensitive ports using the software application. Therefore, setting a port to be frozen in Policy Manager will not automatically set the port to be frozen in other NetSight applications.
can freeze or clear frozen ports on an individual or selected port basis.
You cannot terminate sessions on frozen ports.
Instructions on:
•
•
Freezing/Unfreezing a Port
To freeze or clear a single port:
The quickest way to freeze a single port or clear it is to select the port and use the right−click menu Set/Clear
Frozen option.
1. In the left−panel Network Elements tab, select the device where the port resides and expand the slot or ports grouping in the right−panel Details view.
2. Right−click the port you want to freeze or unfreeze, and select Set/Clear Frozen. If the port was frozen, it will be unfrozen. If it was unfrozen, it will be frozen.
You can also freeze a port or clear a port's frozen state on the Port Properties window General tab.
NOTE:
You can freeze multiple ports or clear them by holding down the Shift or Control key while selecting the ports in the right panel.
Freezing/Unfreezing a Device
You can freeze all the ports on a single device or clear them by selecting the device and using the right−click menu Set Frozen or Clear Frozen option.
How to Freeze/Unfreeze a Port 206
NetSight Policy Manager Help
To freeze or unfreeze an entire device:
1. In the left panel, select the Network Elements tab.
2. Right−click the device whose ports you want to freeze or unfreeze.
3. To freeze all the device's ports, select Set Frozen. To unfreeze all the device's ports, select Clear
Frozen.
How to Freeze/Unfreeze a Port 207
How to Lock MAC Addresses to Ports
MAC Locking ensures that only specific MAC addresses can access a port, and that traffic from any other
MAC addresses will be discarded. There are two kinds of MAC Locking: Dynamic and Static. When you enable Dynamic MAC Locking on a port, the next MAC address that authenticates or accesses the port (up to the maximum number of dynamic locked MAC addresses allowed) will have exclusive access to that port from that time on. Static MAC Locking lets you create a list of locked MAC addresses for a port so that the port only accepts traffic from those MAC addresses.
In order for MAC Locking to take effect on a port, it must be enabled on the port and at the device level. You
can also enable MAC Locking for multiple ports in the Port Configuration wizard. MAC Locking is only
available on devices that support it, and is not allowed on backplane and logical ports.
Instructions on:
•
•
Dynamic MAC Locking
When Dynamic MAC Locking is enabled on a port, the next MAC address that authenticates or accesses the port (up to the maximum number of dynamic locked MAC addresses allowed) will have exclusive access to
these steps to enable it on a single port.
1. Select a device in the left−panel Network Elements tab and expand a slot or ports grouping in the right−panel Details view.
2. Right−click on a port and select Properties from the menu. In the Port Properties window, select the
MAC Locking tab (in the top row of tabs).
3.
4. Enable MAC Locking on the port. If the device does not support MAC locking, this option is grayed out.
5. In the MAC Locking Limits area, set the maximum number of MAC addresses that can be locked dynamically on the port. The numbers in parentheses let you know the range of allowed values for the particular port.
6. Click Apply.
Static MAC Locking
Static MAC Locking lets you create a list of locked MAC addresses for a port so that the port only accepts traffic from those MAC addresses. You can add Static MAC Locking to a single port or multiple ports.
On a Single Port
1. Select a device in the left−panel Network Elements tab and expand a slot or ports grouping in the
How to Lock MAC Addresses to Ports 208
NetSight Policy Manager Help right−panel Details view.
2. Right−click on a port and select Properties from the menu. In the Port Properties window, select the
MAC Locking tab (in the top row of tabs).
3.
4. Enable MAC Locking on the port. If the device does not support MAC locking, this option is grayed out.
5. In the MAC Locking Limits area, set the maximum number of static MAC addresses that can be locked on the port. The numbers in parentheses let you know the range of allowed values for the particular device. Click Apply.
6. You can move all Dynamic Locked MAC addresses (with the Locking Cause of "First Arrival") to
Static Locked MAC addresses by clicking the Apply button in the Static MAC area. Make sure that the Maximum Number of Static Locked MAC Addresses is set to a large enough value to accommodate all the addresses.
7.
In the Locked MAC Addresses sub−tab, click Retrieve to populate the Locked MAC Addresses table
with a list of the MAC addresses currently locked on the selected port.
8.
Click the Add button to open the Add Static MAC window where you can add to the list of locked
MAC addresses for the port.
9. In the Add Static MAC window, the Detected MACs table lists the addresses detected on the selected port and their corresponding index number.
10.
In the Detected MACs table, select the desired MAC address(es) and click Add to list the address(es)
in the Statically Add MACs list. You can also enter a MAC address and index number, then click
Add to add the address to the Statically Add MACs list. To remove an address from the Statically
Add MACs table, select the address(es) and click Remove.
11. Click OK.
On Multiple Ports
1. In the Network Elements tab, select a single device, a device group, or the All Devices folder.
2. Select the MAC Locking tab in the right panel, and click Retrieve to display the current list of locked
MAC addresses for the selected device(s) or port group. (If the device does not support the MAC locking feature, the Retrieve and Add buttons are grayed out.)
3. You can move all Dynamic Locked MAC addresses (with the Locking Cause of "First Arrival") to
Static Locked MAC addresses by clicking the Apply button in the Static MAC area. To ensure that all
Dynamic Locked MAC addresses are changed to Static, make sure that the Maximum Number of
Static Locked MAC Addresses is set to a large enough value in the Port Properties window MAC
4.
Click the Add button to open the Add Static MAC window where you can create a list of locked
MAC addresses.
5. In the Add Static MAC window, the Detected MACs table lists the addresses detected on the selected device(s) and their corresponding index number and device IP address. (Only MAC addresses for devices that support MAC Locking are displayed.) If you have selected a single device in the left−panel tree, the Device column in the table is not displayed.
6.
In the Detected MACs table, select the desired MAC address(es) and click Add to list the address(es)
in the Statically Add MACs list. You can also enter a MAC address and index number, and select a device from the dropdown list, then click Add to add the address to the Statically Add MACs list. (If you have selected a single device in the left−panel tree, the Device dropdown list is not displayed.) To
remove an address from the Statically Add MACs table, select the address(es) and click Remove.
7. Click OK.
On Multiple Ports 209
NetSight Policy Manager Help
On Multiple Ports 210
How To Configure Profile/Device Mapping
Use the Profile/Device Mapping tab to specify which profile will be used by each Authorization Group when communicating with a specific device. The Read credential of the NetSight Administrator profile is used for device Discovery and status polling. All other SNMP communications will use the profiles specified here.
Instructions for:
•
Assigning Profiles to Devices
Devices selected in the left (tree) panel appear in the table in the right panel together with the current profile assignments associated with each Authorization Group. The Table Editor button activates the editing row where specific profile selections can be made.
To assign profiles:
1. Click or choose Authorization/Device Access from the Tools menu. Select the Profile/Device
Mapping tab in the Authorization/Device Access window.
2. Select one or more devices or device groups in the left (tree) panel.
3. Select one or more rows (devices) in the table and click Table Editor button.
4. Click in the Table Editor Row (at the bottom of the table) for the Authorization Group that you are configuring and select a profile from the drop−down list.
5. Repeat steps 3 and 4 until you have finished assigning profiles.
NOTE:
The NetSight Administrator column shows the profile used by the NetSight
Administrator group. The profile listed/selected for each Authorization Group column will be used by that group when communicating with the associated device and, as a result, defines the level of access granted to users that are members of that Authorization Group.
6. Click (Apply) to set the selected profiles for your Authorization Groups/devices.
How To Configure Profile/Device Mapping 211
How To Configure Profiles and Credentials
Use this tab to manage credentials that define the access privileges required for SNMPv1, SNMPv2c, and
SNMPv3, and profiles that use the credentials for various access levels. NetSight applications access devices to control certain device functions (SNMP sets) and retrieve information for device properties views,
FlexViews and periodic status polling (SNMP gets).
Instructions for:
•
•
•
•
•
•
•
•
Managing Credentials
Credentials define the SNMPv1/SNMPv2 community names and SNMPv3 values that will be used to access your network devices. Credentials can be created manually using the Add Credential button in the
Import from Device List feature.
To create a credential:
1. Click or choose Authorization/Device Access from the Tools menu. Select the
Profiles/Credentials tab in the Authorization/Device Access window.
2.
In the lower half of the tab, click Add Credential. The Add Credential window opens.
3. Type a name (up to 32 characters) for your new credential and select a SNMP version. If you select
SNMPv1 or SNMPv2, the window lets you enter a community name as the password for this credential. If you select SNMPv3, you can specify passwords for Authentication and Privacy.
SNMPv1/SNMPv2: a. Type a community name into the Community Name field.
SNMPv3: a. Type a user name into the User Name field. This is the User Name that will be used for device access.
b. Select an Authentication Type (MD5, SHA1, or None).
c. Type the same password (between 1 and 64 characters in length) into both the
Authentication Password and the Confirm Password fields. The password fields are disabled when the Authentication Type is set to None.
How To Configure Profiles and Credentials 212
NetSight Policy Manager Help d. Select a Privacy Type (DES or None). Privacy settings are disabled when the Authentication
Type is set to None.
e. Type the same password (between 1 and 64 characters in length) into both the Privacy
Password and the Confirm Password fields. The password fields are disabled when the
Privacy Type is set to None.
4. Click Apply. You can add another credential or click Close to dismiss the Add Credential window.
Your new credential appears in the SNMP Credentials table.
To edit a credential:
1. Click or choose Authorization/Device Access from the Tools menu. Select the
Profiles/Credentials tab in the Authorization/Device Access window.
2. In the lower half of the tab, select the credential that you are editing from the SNMP Credentials table.
3.
Click Edit. The Edit Credential window opens where you can modify the settings for the selected
credential.
4. Type a name (up to 32 characters) for your new credential and select a SNMP version. If you select
SNMPv1 or SNMPv2, the window accommodates entering a community name as the password for this credential. If you select SNMPv3, you can specify passwords for Authentication and Privacy.
SNMPv1/SNMPv2: a. Type a community name into the Community Name field.
SNMPv3: a. Type a user name into the User Name field. This is the User Name that will be used for device access.
b. Select an Authentication Type (MD5, SHA1, or None).
c. Type the same password (between 1 and 64 characters in length) into both the
Authentication Password and the Confirm Password fields. The password fields are disabled when the Authentication Type is set to None.
d. Select a Privacy Type (DES or None). Privacy settings are disabled when the Authentication
Type is set to None.
e. Type the same password (between 1 and 64 characters in length) into both the Privacy
Password and the Confirm Password fields. The password fields are disabled when the
Privacy Type is set to None.
5. Click Apply and Close. The changes to the selected credential appear in the SNMP Credentials table.
If the settings are changed for a credential that is currently being used with a profile that is applied to one or more devices, a confirmation dialog is opened to determine how the changes will be handled.
You will be asked if you want to change the password on the device(s). You can then select the devices where the password will be changed and, if this user is a valid user on the device(s), then the new password will be set on the device.
To delete a credential:
1. Click or choose Authorization/Device Access from the Tools menu. Select the
Profiles/Credentials tab in the Authorization/Device Access window.
2. In the lower half of the tab, select the credential that you are editing from the SNMP Credentials table.
3. Click Delete. The selected credential is removed from the table.
How To Configure Profiles and Credentials 213
NetSight Policy Manager Help
Managing Profiles
Profiles are assigned to device models in the NetSight database. They identify the credentials that are used for the various access levels when communicating with the device. Profiles are created using the Add Profile
Console's Import from Device List feature.
To create a profile:
1. Click or choose Authorization/Device Access from the Tools menu. Select the
Profiles/Credentials tab in the Authorization/Device Access window.
2.
In the upper half of the tab, click Add Profile. The Add Profile window opens.
3. Type a name (up to 32 characters) for your new profile and select an SNMP version. If you select
SNMPv1 or SNMPv2, you can select credentials for Read, Write, and Max Access. If you select
SNMPv3, you can select credentials and security levels for Read, Write, and Max Access.
SNMPv1/SNMPv2 − Select credentials for Read, Write, and Max Access.
SNMPv3 − Select credentials and security levels to be used for Read, Write, and Max Access.
4. Click Apply. You can add another profile or click Close to dismiss the Add Profile window. Your new profile(s) appears in the Device Access Profiles table.
To edit a profile:
1. Click or choose Authorization/Device Access from the Tools menu. Select the
Profiles/Credentials tab in the Authorization/Device Access window.
2. In the upper half of the tab, select the profile that you are editing from the Device Access Profiles table.
3.
4. Type a name (up to 32 characters) the selected profile. If you are editing a SNMPv1 or SNMPv2 profile, you can select credentials to be used for Read, Write, and Max Access. If you are editing a
SNMPv3 profile you can select credentials and security levels to be used for Read, Write, and Max
Access.
SNMPv1/SNMPv2 − Select credentials for Read, Write, and Max Access.
SNMPv3 − Select credentials and security levels to be used for Read, Write, and Max Access.
5. Click Apply and Close. The changes to the selected profile appear in the Device Access Profiles table.
To delete a profile:
1. Click or choose Authorization/Device Access from the Tools menu. Select the
Profiles/Credentials tab in the Authorization/Device Access window.
2. In the upper half of the tab, select the profile that you are deleting from the Device Access Profiles table.
Managing Profiles 214
NetSight Policy Manager Help
3. Click Delete. The selected profile is removed from the table.
Managing Profiles 215
How to Configure
Transmit Queues
functionality is available only on certain devices such as the Matrix N−Series Gold and Platinum devices
support). Configuring transmit queues lets you:
•
Create transmit queue port groups so that you can configure the transmit queues for all the ports in
• that group.
Specify the arbiter mode for each transmit queue port group, which lets you configure the priority in
• which the queues are serviced.
Configure transmit queue rate shaping, which lets you pace the rate at which traffic is transmitted out of a transmit queue.
Configuring a transmit queue consists of the following steps:
1. Creating your transmit queue port groups.
2. Specifying the arbiter mode for each transmit queue port group.
3. Configuring individual transmit queue rate shaping parameters.
4. Configuring transmit queue port group mappings.
5. Associating the transmit queue mapping index with a class of service.
Creating Transmit Queue Port Groups
Transmit queue port groups are based on the number of transmit queues the ports support, for example
4−queue port groups (queues 0−3) and 16−queue port groups (queues 0−15). An individual device might have a combination of these port types. If you expand the Transmit Queue Port Groups folder in the left−panel
Classes of Service tab, you will see a folder for port groups of each type.
Initially, all ports (on devices that support transmit queue configuration) are grouped into a Default port group under the appropriate port type. When you create new port groups, you add ports from the Default group into your newly defined port groups. A port can be in only one group, and all ports added to a port group must match the port group's port type.
Creating transmit queue port groups allows you to isolate certain kinds of sensitive network traffic so that you can give it a high transmit queue priority. For example, ports that are used for Voice over IP (VoIP) can be grouped together and given a higher transmit queue priority. As another example, ports on a router might be grouped together and configured with a specific rate shaping parameter.
Use these steps to create a transmit queue port group.
1. In the left−panel Classes of Service tab, expand the Transmit Queue Port Groups folder.
2. Right−click on the desired Port Groups folder (depending on the type of port group you want to create) and select Create Port Group. This expands the folder and creates a "New Port Group" item.
3. Type the port group name in the highlighted box and press Enter.
4.
Select the right−panel Ports tab.
How to Configure Transmit Queues 216
NetSight Policy Manager Help
5. Use the Add/Remove Ports button to add and remove ports to and from the group.
Specifying the Arbiter Mode
You can select the transmit queue arbiter mode for each port group, meaning that each port in the port group will use this mode. The arbiter mode is the method used to determine the way that traffic in each queue is serviced. It is based on a percentage or weight (called a "slice") given to each queue. By default, ports are set to Strict mode, which means that the highest priority queue (the highest numbered queue) is set to 100%. In
Strict mode, queues are serviced by numerical priority from the highest numbered queue to the lowest, and all frames in the highest priority queue will be transmitted before the frames in lower priority queues. You can change the arbiter mode to Weighted Fair Queuing, which lets you adjust the slice percentage for each queue, and prevents a lower priority queue from being starved.
NOTE:
Matrix N−Series Gold devices do not support arbiter mode and slice percentage configuration. Ports on these devices that are included in the port group will ignore these settings.
1. Select the transmit queue port group in the left−panel Classes of Service tab.
2.
Select the right−panel General tab.
3. Use the drop−down list to select either the Strict or Weighted Fair Queuing arbiter mode.
4.
If you select the Weighted Fair Queuing mode, click the Edit button to open the Edit Slice
Percentages window where you can configure the slice distribution for each queue.
Configuring Rate Shaping
You can configure the rate shaping and low latency status for each transmit queue in a port group. Rate shaping paces the rate at which traffic is transmitted out of the transmit queue and sets the shaping algorithm which determines what will happen to traffic that exceeds the maximum amount of traffic the transmit queue can hold. Low latency status allows the queue to have a low transmit latency. This is typically used for traffic such as Voice over IP (VoIP). Not all transmit queues support the low latency setting.
NOTE:
Matrix N−Series Gold devices do not support rate shaping.
1. Expand the transmit queue port group in the left−panel Classes of Service tab, and select the desired transmit queue.
2.
Select the right−panel General tab.
3. In the Rate Shaping section, specify the rate at which traffic will be transmitted out of the queue:
•
% − A percentage of the total bandwidth available
•
Kb/s − Kilobits per second
•
Mb/s − Megabits per second
•
Gb/s − Gigabits per second
4. Use the drop−down list to select the shaping algorithm this transmit queue will use. The shaping algorithm determines what will happen to traffic when the maximum amount of traffic the transmit queue can hold is exceeded.
•
Tail Drop − Discards the last entry in the queue in favor of new entries.
Specifying the Arbiter Mode 217
NetSight Policy Manager Help
•
Head Drop − Discards the first entry in the queue in favor of new entries.
•
Random Early Discard − Discards queued packets randomly. This algorithm is used to encourage TCP end stations to back off their transmission rates when the transmit queue is
• overflowing.
Weighted Random Early Discard − Verifies the priority of the packet before making a discard decision, and attempts to discard the lowest priority traffic first.
5. Enable or disable low latency queue status. Enabling this setting allows traffic assigned to this queue to have a low transmit latency. This is typically used for traffic such as Voice over IP (VoIP). Not all transmit queues support this setting.
Configuring Mappings
You can configure the transmit queue mappings for a transmit queue port group. Transmit queue mappings map a logical transmit queue index to an actual physical transmit queue you have configured in Policy
Manager. Changing the default mapping allows you to fine tune the transmit queue configuration according to
to the transmit queues.
For some port groups, the number of indexes will be greater than the actual number of transmit queues the ports support. This is because devices can have ports that support different numbers of transmit queues. For example, a device may have some ports that support four transmit queues and some ports that support 16 transmit queues. The 4−transmit queue port groups will still have 16 logical transmit queue indexes, but they can only be mapped to a maximum of four different physical transmit queues.
1. Select the transmit queue port group in the left−panel Classes of Service tab.
2.
Select the right−panel Mappings tab.
3. Use the drop−down lists to select the physical transmit queue you would like to map to each transmit queue index.
4. Use the Restore Defaults button if you wish to restore the default transmit queue mappings.
Associating with a Class of Service
Once you have configured your transmit queues, you can associate a transmit queue mapping index with a class of service.
1. Select the class of service under the Classes of Service folder in the left−panel Classes of Service tab.
(If you have not created the class of service, see How to Create a Class of Service.)
2.
Select the right−panel General tab.
3. Select the Transmit Queue sub−tab.
4. The priority you selected for the class of service will determine a default transmit queue mapping index. To change this index number, click Select to open the Transmit Queue selection view window.
This window lists all the possible transmit queues, organized by index number for each existing port type and group. Selecting one index number automatically includes all the transmit queues configured for that index number. Click OK.
5. Once you have selected the mapping index, the table below displays the actual transmit queues that will be used by each transmit queue port group for that class of service.
Configuring Mappings 218
6. Click Save on the toolbar.
NetSight Policy Manager Help
Configuring Mappings 219
How to Create a Class of Service
Policy Manager lets you define classes of service (CoS) that can include one or more of the following components: an 802.1p priority, an IP type of service (ToS) value, rate limits, and transmit queue configuration. You can then assign a class of service as a classification rule action, a role default, or as part of
before creating your classes of service.
When you install Policy Manager, the left−panel Classes of Service folder is pre−populated with eight classes of service, each associated with one of the 802.1p priorities (0−7). You can use these classes of service as is, or configure them to include ToS/DSCP, rate limit, and/or transmit queue values. You can also create your own classes of service. After you have created and defined your classes of service, they are then available
automated service (General tab).
Instructions on:
•
•
•
Creating a Class of Service
A class of service can include one or more of the following components: an 802.1p priority, an IP type of service (ToS) value, rate limits, and transmit queue configuration. There are two modes of class of service, with each mode providing a different rate limit functionality: Priority−Based Rate Limits and Role−Based
Rate Limits. In addition, the Role−Based Rate Limits mode includes the ability to configure transmit queues.
For more information on these two modes, see Getting Started with Class of Service.
release notes for specific device/firmware class of service support. Only certain devices such as the Matrix
N−Series Gold and Platinum devices support both modes, but you cannot have both modes enabled at the
General tab.
You can configure a class of service to include values for both class of service modes. The mode used would then depend on the device and the type of class of service it supports. For example, you could create a class of service with an 802.1p priority that has an associated priority−based rate limit, and then additionally configure the class of service to support role−based rate limits and transmit queue configuration. In your network, on an
N−Series Platinum device (with role−based rate limit mode selected) the class of service would include the role−based rate limits and transmit queue configuration, while on a Matrix E7 (which only supports priority−based rate limits) the class of service would include the priority−based rate limits. For an in−depth
Class of Service.
How to Create a Class of Service 220
NetSight Policy Manager Help
Preliminary Steps
If you will be using any of the following (optional) components in your class of service, they need to be created and configured prior to creating your class of service:
•
Priority−based rate limits − If your class of service will use a priority with an associated
•
Rate Limits for more information).
Role−based rate limits − If your class of service will include role−based rate limits, you must have
•
How to Create Role−Based Rate Limit Port Groups for more information.
Transmit queue configuration − If your class of service will include transmit queue configuration,
you must have your transmit queues and transmit queue port groups configured first. See How to
Configure Transmit Queues for more information.
Creating the Class of Service
The following instructions are for creating a new class of service. To modify one of the pre−populated classes
of services, use the procedures for Modifying a Class of Service to make the desired changes.
1. In the left panel, select the Classes of Service tab.
2.
Right−click the Classes of Service folder and select Create Class of Service. The Create Class of
3. In the Name field, enter the name for the class of service.
4. If the class of service includes an 802.1p priority, select this checkbox and use the drop−down list to select the 802.1p priority to associate with the class of service. Note that changing the 802.1p Priority will also change the Transmit Queue Index to the default index for the selected priority.
5. If desired, select the ToS option to associate an IP ToS (Type of Service) or DSCP (Diffserv
Codepoint) value with the class of service (see IP Type of Service for more information). You can
Codepoint) value.
6. If desired, use the Role−Based Rate Limit Configuration section to select the transmit queue index and inbound rate limit index to associate with the class of service. These index numbers are used by devices that support Role−Based Rate Limit and Transmit Queue Configuration as a class of service mode.
a. Transmit Queue Index numbers map logical transmit queue indexes on the ports to the actual physical transmit queues you have configured in Policy Manager. If you have selected an
802.1p priority for this class of service, a default transmit queue index is automatically specified based on the selected priority. You can use the default index or change it according to your own transmit queue configuration. Click Select to open the Transmit Queues selection view window, which lists all the possible transmit queues, organized by index number for each existing port type and group. Selecting an index automatically includes all the transmit queues configured for that index number.
b. Inbound Rate Limit Index numbers map logical rate limit indexes to the actual physical rate limits you have created in Policy Manager. Click Select to open the Inbound Rate Limits selection view window, which lists all the possible rate limits, organized by index number for each existing port type and group. Selecting an index includes all the rate limits configured for that index number.
Preliminary Steps 221
NetSight Policy Manager Help
7. Click OK. The class of service is created, and the IP type of service value (if any) appears in the left−panel IP Type of Service Values folder.
8. Click Save on the toolbar.
9.
characteristics, if necessary.
Modifying a Class of Service
also modify any of the pre−defined classes of service that Policy Manager provides. If you will be using any rate limit or transmit queue configuration components in your class of service, they need to be created and
configured first as outlined in the Preliminary Steps section above.
1. In the left panel, select the Classes of Service tab and expand the Classes of Service folder.
2. Select the class of service you want to modify, and display the General tab in the right panel.
3.
Modify the class of service as desired; see General Tab (Class of Service) for more information.
4. Click Save on the toolbar.
Renaming a Class of Service
1. In the left panel, select the Classes of Service tab and expand the Classes of Service folder.
2. Right−click the class of service whose name you want to change, and select Rename.
3. Type the new name for the class of service and press Enter.
4. Click Save on the toolbar.
Deleting a Class of Service
1. In the left panel, select the Classes of Service tab and expand the Classes of Service folder.
2. Right−click the class of service you want to remove, and select Delete.
3. Click OK to confirm that you want the class of service removed.
4. Click Save on the toolbar.
Modifying a Class of Service 222
How to Create a
Network Resource Group
Network Resource Groups are groups of network resources such as routers, VoIP (Voice over IP) gateways, and servers. You create a network resource group by defining a list of IP addresses for devices that you want included in the group, or by choosing an IP subnet which comprises the group. Once a network resource group
information). The Automated service automatically creates an IP address rule with a specified action (class of service and/or access control), for each IP address in the network resource group.
TIP:
The Policy Manager Demo.pmd file contains examples of network resource groups that you
might want to create, such as Internet Proxy Servers and SAP Servers.
There are two ways to create a network resource group:
•
Using the Network Resources Wizard: The Network Resources Wizard is a series of windows that leads you through all the steps required to create a network resource group and the Automated service
• with which to associate it.
Using the Create Network Resource Window: The Create Network Resource window lets you simply create and define a resource group. Then, once you've created the group, you can associate it
with an Automated service either via the Service wizard, or the Service tabs.
Instructions on:
•
Using the Network Resources Wizard
•
Using the Create Network Resource Window
•
Modifying a Network Resource Group
Using the Network Resources Wizard
The Network Resources Wizard is a series of windows that leads you through all the steps required to create a
the Automated service to a role.
1. In the Policy Manager left panel, select the Services tab.
2. Right−click on the Network Resources folder and select Network Resources Wizard.
3. In the Name window, type a name for the network resource group. (The group name is case−sensitive; therefore, Policy Manager sees "SAP Servers" and "sap servers" as two different group names.) Click Next.
4. In the IP Address window, define the devices you want in the group. You can either create a list of IP addresses for the group or specify an entire subnet.
•
Network Resource IP Address List:
Enter an IP address in the box below the list field and click Add. To remove an IP address
• from the group, select the IP Address in the list and click Remove.
Subnet:
Enter the IP address of the subnet you want to be in the network resource group and select the desired subnet mask from the drop−down list.
How to Create a Network Resource Group 223
NetSight Policy Manager Help
Click Next.
5. In the Name window, type a name for the Automated service that you are associating with the group.
Click Next.
6. In the Network Resources window, select the type of IP address rule you want to create (Bilateral,
Source, or Destination) for the IP addresses in the network resource group. Layer 3 IP address is the only rule type available for an Automated service. Click Next.
7. In the Actions window, define the actions to apply to the rule:
•
CoS: To assign a class of service to the traffic, select the CoS checkbox. This opens the
Classes of Service Selection View, where you can select a class of service for the traffic. (See
How to Create a Class of Service for more information.) Click OK to return to the Actions
• window.
Access Control: To assign access control (a VLAN), select the Access Control checkbox and
choose one of the following options (see Access Control for more information):
•
Permit Traffic: If you want to allow traffic to be forwarded with the port's assigned
•
VID, select this option and click Next.
Deny Traffic:
•
If you want to deny traffic and one Discard VLAN exists: Select this option
•
(the Discard VLAN is already selected), then click Next.
If you want to deny traffic and no Discard VLAN exists: Select this option,
then click New to create a new Discard VLAN, then select it from the list and
• click Next.
If you want to deny traffic and more than one Discard VLAN exists: Select this option and choose the appropriate VLAN from the list, then click Next.
•
Contain to VLAN: If you want to contain traffic for this rule, select this option, then select the appropriate VLAN from the list, and click Next.
8.
9. Click Finish. The network resource group will be listed under the Network Resources folder and the
Automated service will be listed under the Services folder in the left−panel Services tab.
Using the Create Network Resource Window
the Service wizard, or the Service tabs. To create a network resource group:
1. In the left panel, select the Services tab.
2. Right−click the Network Resources folder and select Create Network Resource.
3. In the window, define the devices you want in the group. You can either create a list of IP addresses for the group or specify an entire subnet.
•
Network Resource IP Address List:
Enter an IP address in the box below the list field and click Add. To remove an IP address
• from the group, select the IP Address in the list and click Remove.
Subnet:
Enter the IP address of the subnet you want to be in the network resource group and select the desired subnet mask from the drop−down list.
4. Click OK. The network resource group will be listed under the Network Resources folder.
Once a network resources group that has been created and defined, it can be associated with an Automated
Using the Create Network Resource Window 224
NetSight Policy Manager Help
service (see How to Create a Service for more information).
Modifying a Network Resource Group
You can add or delete IP addresses, or change the subnet for a network resource group.
1. In the left panel, select the Services tab and expand the Network Resources folder.
2. Select the network resource group you want to modify.
3. In the right−panel General tab, make the desired changes.
•
To add an IP address: In the box below the IP Address list, enter the IP address and click
•
Add.
To remove an IP address: In the IP Address list, select the IP address or addresses you want to remove. To select more than one address, hold down Ctrl (for non−sequential addresses)
• or Shift (for sequential addresses) while selecting. Click Remove.
To change the subnet: Click Change to open the Enter IP Subnet window, and enter the IP address of the subnet you now want to be in the network resource group. Use the drop−down list to change the IP subnet mask for the new subnet, if desired. Click OK.
Modifying a Network Resource Group 225
How to Create a Port Group
Policy Manager allows you to group ports into user−defined port groups, similar to the way you can group services into service groups. Port groups enable you to configure multiple ports on the same device or on different devices, simultaneously. A port can be a member of more than one group.
When you create a user−defined port group, you can either select individual ports to add to the group, or specify a range of ports on all devices assigned to the domain to be included in the group. You make this
choice on the user−defined port group General tab.
Policy Manager also provides you with Pre−Defined Port Groups which are automatically populated
according to the ports' characteristics. See Pre−Defined Port Groups for more information.
Instructions on:
•
•
•
•
Removing Ports from a Port Group
•
Removing Ranges from a Port Group
Creating a Port Group
1. In the left panel, click the Port Groups tab.
2. Right−click on the User−Defined Port Groups folder and select Create Port Group. This expands the folder and creates a "New Port Group" item.
3. Type the port group name in the highlighted box and press Enter.
4.
In the right panel, select the General tab for the port group.
5. For Type, choose one of the following:
•
If you want to add individual ports to the group: Select the Individual ports radio button and
•
go on to Adding Ports to a Port Group.
If you want to specify a range or ranges of ports on all devices to comprise the port group:
Select the Port range (all devices) radio button and go on to Adding Ranges to a Port Group.
Adding Ports to a Port Group
This procedure applies to user−defined port groups comprised of individual ports.
1. In the Port Groups tab, right−click the port group to which you wish to add ports, and select
Add/Remove Ports.
2. In the Add/Remove Ports window, select the ports you want to put into the port group, and click Add.
3. Click OK.
How to Create a Port Group 226
NetSight Policy Manager Help
Alternatively, you can drag and drop a single port from a list of ports in the left panel (e.g., the list that results from expanding another port group) to the port group, or copy and add single or multiple ports from the
selections in the right panel, hold down Ctrl (for non−sequential ports) or Shift (for sequential ports) while selecting the ports.
Adding Ranges to a Port Group
This procedure applies to user−defined port groups comprised of ranges of ports.
1. In the Port Groups tab, select the port group to which you wish to add ranges.
2.
Select the right−panel General tab.
3.
more information.
Removing Ports from a Port Group
This procedure applies to user−defined port groups comprised of individual ports.
1. In the left−panel Port Groups tab, right−click the port group from which you wish to remove a port, and select Add/Remove Ports.
2. In the Add/Remove Ports window, select the ports you want to remove from the port group, and click
Remove.
3. Click OK.
Alternatively, you can right−click a single port under the port group in the left panel or multiple ports in the right−panel Ports tab, and select Remove Port(s) from Group.
Removing Ranges from a Port Group
This procedure applies to user−defined port groups comprised of ranges of ports.
1. In the Port Groups tab, select the port group from which you wish to remove ranges.
2.
In the right−panel General tab, select the range(s) you want to remove and click Remove.
Adding Ranges to a Port Group 227
How to Create a Quarantine Role
The Quarantine role is used in conjunction with the Enterasys Dragon Defense System and the NetSight
Automated Security Manager to create an automatic response to threats detected on the network. The
Quarantine role is a highly restrictive role used to isolate users and restrict network access. Once the
Quarantine role has been enforced to the network, and both Dragon and the Automated Security Manager are properly configured, this role can be automatically set as the default role on any port where a threat has been detected.
The Quarantine role is created using Policy Manager's Quarantine Role Wizard. The wizard creates the
Quarantine role using the default settings imported from the Quarantine.pmd data file that comes with Policy
Manager. After you have created the role using the wizard, you can modify the role's default class of service and access control settings, and make changes to the role's services and rules using the right−panel tabs, just like any other role.
Normally, roles are applied to ports via authentication. In this case however, the Automated Security Manager determines a network threat, identifies the responsible port, and applies the Quarantine role to the port. You can also set the Quarantine role as a port's default role through Policy Manager if, for example, you have modified the role to provide some limited access and you want to use it as a "guest" role.
Instructions on:
•
Using the Quarantine Role Wizard to:
•
Create a Quarantine Role: When you create a new domain you will be prompted to use the
Quarantine Role Wizard to create a Quarantine role, or you can access the wizard at any time
• from the Tools menu.
Update a Quarantine Role: When a new Quarantine.pmd file becomes available (through the
Policy Manager Web Update feature), you can use the Quarantine Role Wizard to update your Quarantine role with the new Quarantine.pmd file settings.
•
Modifying the Quarantine Role: Use the right−panel tabs to modify the Quarantine role's default
• values and add or remove services.
Configuration wizard to set the Quarantine role as a default role on a port.
Using the Quarantine Role Wizard
will be prompted to use the wizard to create a Quarantine role, or you can access the wizard at any time from the Tools menu to create or update a Quarantine role.
Creating a Quarantine Role
Use the Quarantine Role Wizard to create a Quarantine role.
1. There are two ways to launch the wizard:
•
When creating a new domain, you will be asked if you want to run the Quarantine Role
•
Wizard. Click Yes.
In your current domain, select Tools > Quarantine Role Wizard from the menu bar.
How to Create a Quarantine Role 228
NetSight Policy Manager Help
The wizard opens.
2. Read the information in the first window and then click Next.
3. In the Quarantine Role Data window, review how the Quarantine role will exist in the current domain.
The window lists the default class of service and default access control settings, and any services for the role. Click Finish.
4.
To modify the Quarantine role's settings, use the right−panel tabs as outlined below.
5.
Be sure to perform an Enforce to write the new Quarantine role to the devices.
Updating a Quarantine Role
The Quarantine role is initially created using the settings imported from the Quarantine.pmd file that comes with Policy Manager. The Quarantine.pmd file can be updated through the Policy Manager Web Update feature. When a new Quarantine.pmd file becomes available, you can use the Quarantine Role Wizard to update your existing Quarantine role with the new Quarantine.pmd file settings.
1. From the menu bar, select Tools > Quarantine Role Wizard. The wizard opens.
2. Read the information in the first window, and click Next.
3. In the Quarantine Role Import window, select whether to update or overwrite the existing
Quarantine role with the services found in the new Quarantine .pmd. In both cases, the existing role defaults will be replaced with those from the new Quarantine.pmd file.
•
Update − Adds the services from the new Quarantine.pmd file to the existing list of services in the current Quarantine role. If a service exists in both the current and imported Quarantine
• roles, the imported one will be used.
Overwrite − Replaces all existing services in the Quarantine role with the services found in the Quarantine.pmd file. You can copy your existing Quarantine role to another role name before performing the overwrite. This saves your current Quarantine role to a different name and creates a new Quarantine role using the settings imported from the Quarantine.pmd file.
NOTE:
If an imported service has the same name as an existing service but contains different rules, the new service is renamed to "Service Name (1)" so that any other roles using the original service do not change in behavior. If the imported service has the same name and contains the same rules, then the service is not renamed. This is true of both the update and overwrite options. For examples of this service renaming behavior in both the Update
and Overwrite options, see below.
Click Next.
4. In the Quarantine Role Data window, review how the Quarantine role will exist in the current domain.
The window lists the default class of service and default access control settings, and any services for the role. Click Finish.
5.
To modify the Quarantine role's settings, use the right−panel tabs as outlined below.
6.
Be sure to perform an Enforce to write the new Quarantine role to the devices.
Here are two examples of updating a Quarantine role:
1. If the existing Quarantine Role contains:
Service 1
Service 2
And the new Quarantine Role (from Quarantine.pmd) contains:
Service 2 (same service name but different rules)
Updating a Quarantine Role 229
NetSight Policy Manager Help
Service 3
The resulting Quarantine Role will contain:
Update Option: Service 1, Service 2(1), Service 3
Overwrite Option: Service 2(1), Service 3
2. If the existing Quarantine Role contains:
Service 1
Service 2
And the new Quarantine Role (from Quarantine.pmd) contains:
Service 2 (same service name and same rules)
Service 3
The resulting Quarantine Role will contain:
Update Option: Service 1, Service 2, Service 3
Overwrite Option: Service 2, Service 3
Modifying the Quarantine Role
Once you've created a Quarantine role, you can change its characteristics by selecting the role in the Policy
Manager's left panel and using the associated tabs in the right panel.
NOTE:
Because it is used by the Automated Security Manager, you cannot rename the Quarantine role.
Modifying Default Values
and to add or edit a description.
1. Select the Quarantine Role in the left−panel Roles tab.
2. In the right−panel General tab, select the desired default class of service and default access control settings.
3. If desired, add or edit the role's description.
4.
Be sure to perform an Enforce to write the new Quarantine role to the devices.
Adding/Removing Services
Use the Services tab to add or remove services to the Quarantine role.
1. Select the Quarantine Role in the left−panel Roles tab.
2.
3. Make sure the Quarantine role is displayed in the Role selection box.
4. In the Groups and Services panel, select the services and/or service groups you wish to add to the role, and click Add. To remove services, select them in the Selected Services panel and click Remove.
Modifying the Quarantine Role 230
NetSight Policy Manager Help
NOTE:
Policy Manager checks for rule conflicts when more than one service is added.
See Conflict Checking for more information.
5. Click OK.
6.
Be sure to perform an Enforce to write the new Quarantine role to the devices.
Setting the Quarantine Role as the Default Role on a Port
When the Automated Security Manager detects a threat on the network, it automatically assigns the
Quarantine role as the default role on that port. However, there may be circumstances when you would like to use Policy Manager to assign the Quarantine role as the default role on one or more ports. For example, if you have modified the Quarantine role to provide limited access, you may want to use it as the default role for guest users on your network.
Setting the Quarantine Role as the Default Role on a Port 231
How to Create a Role
points in a policy−enabled network. A port takes on a user's role when the user authenticates.
There are two ways to create a role:
•
Using the Role Wizard: The Role Wizard is a series of windows that leads you through all the steps for creating a role, including the optional selection and enabling of default access control (default
VLAN) and/or class of service for the role, as well as specifying the existing services and service groups that will apply to the role. You can also create new services in the Role Wizard, which
encompasses the Service Wizard. If you want to associate a role with a default access control and/or
class of service only, without any services, it may be handier to create the role name with the Create
•
a Role menu option, and use the role General tab to set the defaults.
Using the Role Tabs: Creating a role using the role tabs consists of creating a name for the role with the Create Role menu option, then defining its characteristics (default class of service, default access control, and/or services) using the role's right−panel tabs. It accomplishes the same things as the Role
Wizard, but enables you to do only those parts of the procedure you want to do, when you want to do them. You might also use this method if you are creating a role for which there is default class of service and/or access control, but no services.
If you want to change the characteristics of a role, you can select the role in the left panel and use the right−panel tabs to modify it.
Instructions on:
•
•
•
•
Using the Role Wizard
The Role Wizard is a series of windows that leads you through all the steps for creating a role, including the optional selection and enabling of default access control and/or class of service for the role, as well as specifying the existing services and service groups that will apply to the role.
1. In the Policy Manager left panel, click the Roles tab.
2. Right−click on the Roles folder and select Role Wizard.
3. In the Name window, enter the name of the role. The name can be up to 64 characters in length, and special characters are allowed, with the exception of colons (:) and semicolons (;). Duplicate names are not allowed, regardless of case. For example, if you already have a role "Faculty" and you attempt to name the new role "Faculty" or "faculty," Policy Manager will create the role, but with the name
"New Role," or "New Role(n)" (where "n" is the sequence number, if there is more than one "New
Role"). You can then rename the new role. After entering the name, click Next.
4. In the Role Priority window, you can assign a default class of service to the role, if desired. Select the Enable Default Class of Service checkbox, then select the desired class of service in the list. If the priority for the class of service includes a priority−based rate limit, this will be noted in the class of
How to Create a Role 232
NetSight Policy Manager Help
service name (see How to Create a Class of Service for more information). Click Next.
NOTE:
If you select a CoS that is associated with a ToS/DSCP value, the ToS/DSCP value will be ignored. This is because ToS/DSCP rewrite works only for certain IP ToS
classification rules, not as a role default. See ToS/DSCP Rewrite for more information.
NOTE:
Once a rate limit is applied to a port, that port's bandwidth will be rate limited, even if the default or authenticated role that applied the rate limit is no longer associated with the port.
5. In the Role VLAN window, you can assign default access control to the role, if desired. Select the
Enable Access Control checkbox, then choose one of the following options. Click Next.
•
Permit (Using Existing Port VLAN) − This option allows traffic to be forwarded with the
• port's assigned VID.
Deny − If this option is selected, traffic will automatically be sent to a discard VLAN. Select
a VLAN from the list. If no discard VLAN exists, or if you want to create a new discard
•
VLAN to add to the list, click New.
Contain − This option contains traffic to a specific VLAN. Select the appropriate VLAN
from the list. If you want to create a new VLAN to add to the list, click New.
6.
a new service to add to the list before selecting, click New. Click Next.
NOTE:
Policy Manager checks for rule conflicts when more than one service is added.
See Conflict Checking for more information.
7. In the VLAN Egress window, you can add a VLAN to the Role's Egress list. Click Add to open the
Selection View (Egress VLANs) window, where you can select a VLAN and specify the egress
forwarding state: Tagged (frames will be forwarded as tagged), Untagged (frames will be forwarded as untagged), or Forbid Forwarding (frames will not be forwarded; they will be discarded). Ports that the selected role is active on will forward traffic belonging to the listed VLANs according to the specified forwarding state. Both the role's egress list and the VLAN egress list are checked for egress information. If the lists have duplications, the Forbid Forwarding state takes precedence. Click Next.
8. In the Tagged Packet VLAN to Role Mapping window, you can configure a list of VLANs to map to the role. Packets arriving on a port tagged with the specified VLAN will be assigned this role.
Tagged Packet VLAN to Role Mapping provides a way to let policy−enabled devices assign a role to
network traffic, based on a VLAN ID. (For more information, see VLAN to Role Mapping in the
Concepts Help topic.) Click Add to open the Selection View (VLANs) where you can select VLANs
to add. Click Next.
NOTE:
Tagged Packet VLAN to Role Mapping requires that the TCI Overwrite attribute be enabled. TCI Overwrite allows the VLAN or class of service tag in a received packet to be overwritten by the VLAN (access control) and class of service characteristics defined
in the mapped role. You can enable TCI Overwrite on a per−port basis in the Port
Properties window General tab, or for an individual role in the role's General tab.
9. In the Authentication Based VLAN to Role Mapping window, you can configure a list of VLANs to map to the role. Authentication−Based VLAN to Role Mapping provides a way to assign a role to a user during the authentication process, based on a VLAN Attribute. An end user connects to a policy−enabled device that supports 802.1X authentication using a RADIUS Server. During the authentication process, the RADIUS server returns a VLAN ID in its RADIUS VLAN Tunnel
Attribute. The device uses the Authentication−Based VLAN to Role mapping list to determine what role to assign to the end user, based on the VLAN Tunnel Attribute. (For more information, see
VLAN to Role Mapping in the Concepts Help topic.) Click Add to open the Selection View
(VLANs) where you can select VLANs to add. Click Next.
NOTE:
When configuring Authentication−Based VLAN to role mapping, you must enable
RFC3580 VLAN Authorization on the device via the device Authentication tab.
How to Create a Role 233
NetSight Policy Manager Help
10. In the MAC to Role Mapping window, you can configure a list of MAC addresses to map to the role. Mapping a MAC address to a role provides a way to assign a role to an end station based on its source MAC address. This allows you to create a specific role for a group of end stations (such as IP phones), and assign it to them based on their MAC address and a MAC mask. When the end stations connect to the network, the device identifies the source MAC address and applies the mapped role.
Click Add to open the Select MAC Address window, where you can select a MAC address and a
MAC mask to add to the table. Click Next.
11. In the IP to Role Mapping window, you can configure a list of IP addresses to map to the role.
Mapping an IP address to a role provides a way to assign a role to an end station based on its IP address. For example, in networks that haven't deployed authentication, this would allow you to map an individual IP address such as an administrator's laptop, to a specific role. When the end station connects to the network, the policy−enabled device identifies the IP address and applies the mapped role. Click Add to open the Select IP Address window, where you can select an IP address and an IP mask to add to the table.
12. Click Finish. Now that you have created the role, you can:
•
Add a description to the role on the right−panel General tab.
•
Assign the role as the default role for a port
•
13.
Enforce to write the new information to the devices.
Using the Role Tabs
Creating a role using the role tabs consists of creating a name for the role, then using the right−panel role tabs to specify the characteristics of the role (default class of service, default access control, and/or services).
1. In the Policy Manager left panel, select the Roles tab.
2. Right−click the Roles folder, and select Create Role.
3. Type the role name in the highlighted box. The name can be up to 64 characters in length, and special characters are allowed, with the exception of colons (:) and semicolons (;). Duplicate names are not allowed, regardless of case. For example, if you already have a role "Faculty" and you attempt to name the new role "Faculty" or "faculty," Policy Manager will create the role, but with the name
"New Role," or "New Role(n)" (where "n" is the sequence number, if there is more than one "New
Role"). You can then rename the new role. Press Enter after you've entered the name. (If you don't press Enter, the name will remain "New Role.")
4. To add a role description, assign a default class of service or access control (VLAN) to the role, or
enable TCI Overwrite, select the role and use the General tab in the right panel.
5. If you want to add services to the role, select the right panel Services tab and click Add/Remove
Services. This opens the role Add/Remove Services window.
NOTE:
Policy Manager checks for rule conflicts when more than one service is added.
See Conflict Checking for more information.
6.
To add a VLAN to the Role's Egress list, select the role and use the VLAN Egress tab in the right
panel.
7. To configure MAC, IP, and VLAN to role mapping lists for the role, select the role and use the
Mappings tab in the right panel.
8. Now that you have created the role, you can:
•
Assign the role as the default role for a port
•
Modify the role's characteristics
9.
Enforce to write the new information to the devices.
Using the Role Tabs 234
NetSight Policy Manager Help
Modifying a Role
Once you've created a role, you can change its characteristics by selecting the role in the Policy Manager's left panel and using the associated tabs in the right panel.
Instructions on:
•
•
Modifying a Role's Default Class of Service
•
Modifying a Role's Default Access Control
•
Modifying a Role's Description
•
•
Adding Services to Roles
There are two ways to add services to roles:
•
During the creation of a role, in the Role Wizard's Role Services window. See Creating a Role Using
•
the Role Wizard for instructions.
Accessing the Add/Remove Services window from the role Services tab. Use this method to add
services to existing roles. Instructions are below.
1. Access the role Services tab:
•
If you are in the left panel Services tab, expand the Services folder and click the service
whose role(s) you want to modify. Then, in the right panel, select the Roles tab. Here you
can view all the roles associated with this service. Select a role, then click View/Edit Role.
This opens the left panel Roles tab with the role selected. You can then access the Services
• tab in the right panel.
If you are elsewhere in Policy Manager, select the left panel Roles tab and expand the Roles folder. Select the role to which you want to add services, then select the Services tab in the right panel.
2.
Click Add/Remove Services. This opens the Add/Remove Services window.
3. Make sure the role to which you wish to add services is displayed in the Role selection box.
4.
and click Add. To remove services, select them in the Selected Services panel and click Remove.
NOTE:
Policy Manager checks for rule conflicts when more than one service is added.
See Conflict Checking for more information.
5. If you wish, you can select another role, and add or remove services from it.
6. Click OK.
7.
Enforce to write the new information to the devices.
Modifying a Role 235
NetSight Policy Manager Help
Removing Services from a Role
1. In the Policy Manager left panel, select the Roles tab and expand the Roles folder.
2. Select the role from which you want to remove services, then select the Services tab in the right panel.
3.
Click Add/Remove Services. This opens the Add/Remove Services window.
4. Make sure the role from which you wish to remove services is displayed in the Role selection box.
5.
role, and click Remove. To add services, select them in the Groups and Services panel and click Add.
6. If you wish, you can select another role, and remove services from or add services to it.
7. Click OK.
8.
Enforce to write the new information to the devices.
Modifying a Role's Default Class of Service
information to the devices.
Modifying a Role's Default Access Control
to the devices.
Modifying a Role's Description
database.
Modifying a Role's Ports
and use the View/Add Port button to get to the port's right−panel tabs, where you can change the default role for a port or make changes to the port settings themselves.
1. In the Policy Manager left panel, click the Roles tab.
2. Expand the Roles folder if necessary, and select the role whose ports you want to view.
3. In the right panel, select the Ports tab.
4. Click Retrieve to update the table with the most current information.
5. Select a port to which you want to make changes.
6. Click Port Properties. This takes you to the Port Properties window where you can:
•
Modify the default role for the port: Use the General tab (Role Status sub−tab).
•
Modify the port's authentication settings: Use the Authentication Configuration tab.
7.
Enforce to write the new information to the devices.
Removing Services from a Role 236
NetSight Policy Manager Help
Deleting a Role
1. In the left panel, click the Roles tab.
2. Expand the Roles folder.
3. Right−click the role you want to delete, and select Delete.
4. Click Yes to confirm. After a few seconds, a message appears reminding you of other tasks to perform if you are deleting a role.
5. Read the reminder, then click OK.
6. Click OK to clear the confirmation message.
7.
enabled), then click Enforce on that window.
8. Make sure you do the following, if they apply:
•
Change the default role on any ports that may be using the role. You can use the Port
Properties window General tab for the port to do this, or, if there are multiple ports to be
•
changed, use the Port Configuration Wizard.
Re−enable authentication on any ports that were disabled before you deleted the role. You
can use the Port Properties window Authentication Configuration tab for the port to do this,
or, if there are multiple ports to be reset, use the Port Configuration Wizard.
Deleting a Role 237
How to Create a Service
be handled by a network access device. A service might consist of only one rule governing, for example, email priority, or it might consist of a complex set of rules combining class of service, filtering, rate limiting, and access control (VLAN) assignment.
There are two types of services in Policy Manager:
•
Manual Service
− This service consists of one or more traffic classification rules that you create
• based on your requirements. Manual services are good for applying customized sets of rules to roles.
Automated Service
− This service automatically creates a Layer 3 IP address rule with a specified action (class of service and/or access control), for each device in a particular network resource group. You create a network resource group using a list of IP addresses or an IP subnet, and
then associate the group with the Automated service (see How to Create a Network Resource Group
for more information). You cannot create manual rules for an Automated service, and IP address is the only rule type available for Automated services.
There are two ways to create a service:
•
Using the Service Wizard: The Service Wizard is a series of windows that leads you through all the steps required to create either type of service, including defining the traffic classification rules that will apply to a Manual service. The first two Service Wizard windows ask you to provide a name for the service and specify whether it is a Manual or Automated service. The subsequent windows depend
on whether or not the service is Manual or Automated. If it is Manual, they are similar to the Rule
Wizard windows, except that you can create as many rules as you need without leaving the wizard.
•
Use the Service Wizard if you want to create all the rules for a service at once.
Using the Service Tabs: Creating a service using the service tabs consists of creating a name for the service using the Create Service menu option, and defining the service using the service General tab.
If you are creating a Manual service, you can then use the Classification Rule Wizard (or the Create
Rule menu option and the tabs for the rule) to define the rules for the service. Creating a service this way accomplishes the same things as the Service Wizard, but enables you to do only those parts of the procedure you want to do, when you want to do them. You can also use the service tabs and rule tabs to modify an existing service and its rules.
both Manual and Automated services.
Instructions on:
•
•
•
•
Saving Services to a .pmd File
•
How to Create a Service 238
NetSight Policy Manager Help
Using the Service Wizard
The Service Wizard is a series of windows that leads you through all the steps required to create a service.
NOTE:
The Service Wizard is accessed from the Role Wizard if you elect to create a new service while creating the role. The Service Wizard opens, then returns you to the Role Wizard after the service has been created. If you have accessed the Service Wizard from the Role
Wizard, you can skip the first two steps of the procedure below.
1. In the Policy Manager left panel, select the Services tab.
2. Right−click on the Services folder and select Service Wizard.
3. In the Name window, type a name for the service. (The service name is case−sensitive; therefore,
Policy Manager sees "Engineer" and "engineer" as two different service names.) Click Next.
4.
In the Service Type window, select either Manual or Automated, and click Next. The subsequent
windows depend on which type of service you are creating.
For a Manual service: a. In the rule Name window, type a name for the first rule you want to apply to this service, and click Next. You will now be creating the rule. For more information on what you will
encounter in the following windows, see Traffic Classification Rules and/or How to Create or
b. In the Rule Status window, you can elect to disable the rule at this time. If you disable the rule, it is temporarily unavailable for use by the current service, but it can still be copied to other services and enabled, or re−enabled at another time for the current service. Click Next to continue.
c. In the Rule Type window, specify the type of device the rule will apply to when enforced.
The recommended selection is All Devices, unless there is a specific need for a device−specific rule, such as when support for a traffic description and/or action is not available on all managed devices. In that case, you can create a rule specific to a certain device type.
d. In the Traffic Classification Layer window, select a Traffic Classification Layer and click
Next. Each layer has multiple Classification Types. See Classification Types and their
Parameters for a description of classification layers and types.
e. Select the desired Classification Type and click Next.
f.
and click Next.
g. In the Traffic Description Summary window, review the summary of the traffic description you have added to the rule.
•
If you are satisfied with the description, click Next.
•
To change the description, select it, then click Remove and Add. This returns you to the Traffic Classification Layer window. Repeat steps d through g.
h. In the Actions window, define the actions to apply to the rule, then click Next to continue.
•
CoS: To assign a class of service to the traffic, select the CoS checkbox. This opens
the Classes of Service Selection View, where you can select a class of service for the
traffic. (See How to Create a Class of Service for more information.) Click OK to
• return to the Actions window.
Access Control: To assign access control (a VLAN), select the Access Control
checkbox and choose one of the following options (see Access Control for more
Using the Service Wizard 239
NetSight Policy Manager Help information):
•
Permit Traffic: If you want to allow traffic to be forwarded with the port's
• assigned VID, select this option.
Deny Traffic:
•
If you want to deny traffic and one Discard VLAN exists: Select this
• option (the Discard VLAN is already selected).
If you want to deny traffic and no Discard VLAN exists: Select this
option, then click New to create a new Discard VLAN, then select it
• from the list.
If you want to deny traffic and more than one Discard VLAN exists:
Select this option and choose the appropriate VLAN from the list.
•
Contain to VLAN: If you want to contain traffic for this rule, select this option, then select the appropriate VLAN from the list.
•
Accounting: When rule accounting is enabled on a device, each rule keeps a list of the ports on which it has been used. Use these options to specify certain rule usage actions to take place when a "rule hit" is reported.
•
Generate System Log on Rule Hit: When this option is selected, a syslog
• message is generated when the rule is used.
Generate Audit Trap on Rule Hit: When this option is selected, an audit trap is generated when the rule is used.
•
Security: When rule accounting is enabled on a device, each rule keeps a list of the ports on which it has been used. If you select the Disable Port on Rule Hit option, any port reported as using this rule will be disabled.
i. In the Classification Rule Summary window, view the rule(s) for the service.
•
To remove a rule from the service, select it, then click Remove.
•
To add another rule to the service, click Add. This returns you to the rule Name window. Repeat steps a through i.
Note: When you add more than one rule to a service, Policy Manager checks for
conflicts with other rules in the service. See Conflict Checking for more information.
j. In the Service Role window, you can select the role(s) to which the service will apply. If you want to create a new role to add to the list before selecting, click New.
k.
If you are satisfied with the rule(s) for the service, click Finish and go on to step 5.
Note: If you came to the Service Wizard via the Role Wizard, you will return to the Role
Wizard when you click Finish.
For an Automated service: a. In the Network Resources window, select the network resource group to which the service will apply. You can add a new network resource group to the selections by clicking New,
filling out the Create Network Resource window, and clicking OK. Select the type of IP
address rule you want to create (Bilateral, Source, or Destination) for the IP addresses in the network resource group. IP address is the only rule type available for an Automated service.
Click Next.
b. In the Actions window, define the actions to apply to the rule, then click Next to continue.
•
CoS: To assign a class of service to the traffic, select the CoS checkbox. This opens
the Classes of Service Selection View, where you can select a class of service for the
traffic. (See How to Create a Class of Service for more information.) Click OK to
• return to the Actions window.
Access Control: To assign access control (a VLAN), select the Access Control
checkbox and choose one of the following options (see Access Control for more
information):
Using the Service Wizard 240
NetSight Policy Manager Help
•
Permit Traffic: If you want to allow traffic to be forwarded with the port's
• assigned VID, select this option.
Deny Traffic:
•
If you want to deny traffic and one Discard VLAN exists: Select this
• option (the Discard VLAN is already selected).
If you want to deny traffic and no Discard VLAN exists: Select this
option, then click New to create a new Discard VLAN, then select it
• from the list.
If you want to deny traffic and more than one Discard VLAN exists:
Select this option and choose the appropriate VLAN from the list.
•
Contain to VLAN: If you want to contain traffic for this rule, select this option, then select the appropriate VLAN from the list.
•
Accounting: When rule accounting is enabled on a device, each rule keeps a list of the ports on which it has been used. Use these options to specify certain rule usage actions to take place when a "rule hit" is reported.
•
Generate System Log on Rule Hit: When this option is selected, a syslog
• message is generated when the rule is used.
Generate Audit Trap on Rule Hit: When this option is selected, an audit trap is generated when the rule is used.
•
Security: When rule accounting is enabled on a device, each rule keeps a list of the ports on which it has been used. If you select the Disable Port on Rule Hit option, any port reported as using this rule will be disabled.
c. In the Service Role window, you can select the role(s) to which the service will apply. If you want to create a new role to add to the list before selecting, click New.
d.
Click Finish and go on to step 5.
Note: If you came to the Service Wizard via the Role Wizard, you will return to the Role
Wizard when you click Finish.
5. To add a detailed description for the service, select the service in the left panel and the General tab in the right panel. Type the description in the Description area.
6. Now that the service has been created, you can:
•
•
Add the service to a service group
7.
Enforce to write the new information to the devices.
Using the Service Tabs
The following steps depend on whether you are creating a Manual or an Automated service. For an
Automated service, you will create the service and select the network resource group to which the service will apply. Then you will use the General tab to define the class of service and/or access control (VLAN) for the
Create Rule menu option and the tabs for the rule) to define the rules for the service.
Creating an Automated Service
1. In the left panel, select the Services tab.
Using the Service Tabs 241
NetSight Policy Manager Help
2. Expand the Services folder. Right−click the Automated Services folder, and select Create
Service. This brings up the network resources Selection View. Select the network resource group
which will be associated with the service, and click OK. You can add a new network resource group
to the selections by clicking New, filling out the Create Network Resource window, and clicking OK.
You can also create an Automated service in a Service Group folder, in which case the service is automatically added to the Automated Services folder as well.
3. A New Service item is created in the left panel under the Automated Services folder, in a highlighted box.
4. Type the service name in the highlighted box. The service name is case−sensitive; therefore, Policy
Manager sees "Engineer" and "engineer" as two different service names. Press the Enter key. If you don't do this, the name will remain "New Service."
5.
for the service, and enter a description, if desired. You can also specify any actions you would like taken if the rules in this service are used on a port.
6.
Enforce to write the new information to your devices.
Creating a Manual Service
1. In the left panel, select the Services tab.
2. Expand the Services folder. Right−click the Services folder or Manual Services folder, and select
Create Service. This creates a New Service item in the left panel under the Manual Services folder, in a highlighted box. You can also create a Manual service in a Service Group folder, in which case the service is automatically added to the Manual Services folder as well.
3. Type the service name in the highlighted box. The service name is case−sensitive; therefore, Policy
Manager sees "Engineer" and "engineer" as two different service names. Press the Enter key. If you don't do this, the name will remain "New Service."
4.
5. Define rules for the service, as follows:
•
To associate an existing rule with the new service: In the left panel Services tab, open a service you know has the rule, then drag the rule to the new service. This creates a copy of the existing rule, with all its characteristics. To give the rule another name, right−click the copy,
• select Rename, then type the new name in the highlighted box.
To create new rules for the service: Use one of the following methods:
•
Using the Classification Rule Wizard
•
Note: When you add more than one rule to a service, Policy Manager checks for conflicts with other
rules in the service. See Conflict Checking for more information.
6.
Enforce to write the new information to your devices.
Modifying a Service
Once you've created a service, you can change its characteristics by selecting the service or its rules in the left−panel Services tab and using the menu options or associated right−panel tabs.
•
Modifying a Service Description
•
•
Modifying the Roles for a Service
•
Modifying the Rules for a Manual Service
Creating a Manual Service 242
NetSight Policy Manager Help
•
Modifying an Automated Service
Modifying a Service Description
database.
Modifying a Service Name
1. In the left panel, select the Services tab.
2. Expand the Services folder and select the service you want to modify.
Note: If the service is a member of a service group and it's more convenient, you can find the service under the service group in the Service Groups folder. Any change you make to the name there will also be reflected in the Services folder.
3. Right−click the service whose name you want to change, and select Rename.
4. Type the new name in the highlighted box.
5. Click Save to save the change to the database.
Modifying the Roles for a Service
Roles tab, do the following:
1. In the left−panel Services tab, select the service you want to modify.
2. In the right panel, select the Roles tab.
access from the service Roles tab as follows:
1. Select a role, then click View/Edit Role. This opens the left−panel Roles tab with the role selected. You can then access the Services tab in the right panel.
2.
On the role Services tab, click the Add/Remove Services button. This opens the role Add/Remove
Services window, where you can:
•
Add the service or any other service to any role.
•
Remove the service from the selected role or from any other role.
3.
Enforce to write the new information to your devices.
Modifying the Rules for a Manual Service
1. In the left panel, select the Services tab and locate the service you want to modify in the Manual
Services folder.
Note: If the service is a member of a service group and it's more convenient, you can find the service under the service group in the Service Groups folder. Any change you make to the rule there will also be reflected in the Manual Services folder.
2. Expand the service so that its rules are displayed.
3. Select the rule you want to change, then use the right−panel tabs to make your changes. See
Modifying a Rule for more information.
4.
Enforce to write the new information to your devices.
Modifying a Service Description 243
NetSight Policy Manager Help
Modifying an Automated Service
1. In the left panel, select the Services tab and locate the service you want to modify in the Automated
Services folder.
Note: If the service is a member of a service group and it's more convenient, you can find the service under the service group in the Service Groups folder. Any change you make to the service there will also be reflected in the Automated Services folder.
2.
Select the General tab in the right panel
3. To change the Network Resources with which the service is associated, click the Network Resources
Select button, select the network resource group, and click OK.
4. Modify the remaining characteristics of the Automated service as required.
5.
Enforce to write the new information to your devices.
Saving Services to a .pmd File
Policy Manager enables you to save a service or services to a Policy Manager database (.pmd) file, allowing you to import the services into another database. When you create a file name, keep the following in mind:
•
Special characters such as / \ : ? " < > | are not allowed.
•
On the Windows platform, the file name is not case−sensitive; therefore, Policy Manager sees X.pmd
• and x.pmd as the same file name.
On the Solaris platform, the file name is case−sensitive; therefore, Policy Manager sees X.pmd and x.pmd as two different file names.
To save a single service:
1. In the left panel, select the Services tab.
2. Expand the Services folder.
3. Right−click the service in the left panel and select Save Service(s) As.
4. In the File name field, enter a name for the .pmd file.
5. Click Save, then click OK to clear the confirmation message.
To save multiple services:
1. In the left panel, select the Services tab.
2. Select the Services folder (or select the Service Groups folder and then a service group).
3. In the right Details View panel, hold down the Shift key (for sequential services) or Ctrl key (for non−sequential services) key and select the services.
4. Right−click the services and select Save Service(s) As.
5. In the File name field, enter a name for the .pmd file.
6. Click Save, then click OK to clear the confirmation message.
Deleting a Service
Deleting a service removes the service and its rules. If copies of the rules exist for other services, those copies are not affected by the deletion. However, deleting the service removes it from any service groups and roles
Modifying an Automated Service 244
NetSight Policy Manager Help with which it was associated, so be sure the service is not needed before you delete it.
1. In the left panel, select the Services tab.
2. Expand the Services folder.
Note: If the service is a member of a service group and it's more convenient, you can alternatively find the service under the service group in the Service Groups folder. Deleting the service there also deletes the service wherever else it exists.
3. Right−click the service you want to delete, and select Delete.
4. Click Yes to confirm, then OK to clear the confirmation message.
5.
Enforce to write the change to your devices.
Modifying an Automated Service 245
How to Create a Service Group
Policy Manager enables you to create categories into which you can group services. A service can be a part of more than one group.
Instructions on:
•
•
Adding Services to a Service Group
•
Removing Services from a Service Group
Creating a Service Group
1. In the left panel, click the Services tab.
2. Right−click on the Service Groups folder and select Create Service Group. This expands the Service
Groups folder and creates a "New Service Group" item.
3.
Type the service group name in the highlighted box and press Enter. You can now add services to the
service group.
Adding Services to a Service Group
You can add services to a service group in two ways:
•
left panel (e.g., the list that results from expanding the Automated or Manual Services folder) to the service group, or drag and drop single or multiple services from the right−panel Details View with the
Automated Services folder or Manual Services folder selected. To make multiple selections in the right panel, hold down Ctrl (for non−sequential devices) or Shift (for sequential devices) while
• selecting the devices.
Using the Add/Remove Services menu option:
1. Select the Services tab in the left panel, and double−click the Service Groups folder to expand it.
2. Right−click the service group to which you wish to add services, and select Add/Remove
Services.
3. In the Add/Remove Services window, select the services you want to put into the service group, and click Add.
4. Click OK.
Removing Services from a Service Group
The following procedure removes the service from the service group only. If you remove a service from a group, the services that have already been applied to a role using the service group are not affected. In order
How to Create a Service Group 246
NetSight Policy Manager Help the service group.
Removing a service from a service group does not delete the service itself. If you want to delete the service
itself, see Deleting a Service.
1. Select the Services tab in the left panel, and double−click the Service Groups folder to expand it.
2. Right−click the service group from which you wish to remove services, and select Add/Remove
Services.
3. In the Add/Remove Services window, select the services you want to remove from the service group, and click Remove.
4. Click OK.
Alternatively, you can right−click a single service under the service group in the left panel, or right−click
from Group. To make multiple selections in the right panel, hold down Ctrl (for non−sequential services) or
Shift (for sequential services) while selecting the services.
How to Create a Service Group 247
How to Create a VLAN
Policy Manager VLANs which can be used for access control are displayed on the VLANs tab in the left
VLANs and Local VLANs. Otherwise, only the Global VLANs folder is displayed. For more information on
Local VLANs and Policy VLAN Islands, see How to Create a Policy VLAN Island.
Policy Manager provides you with one global Default VLAN, which is available when you first start using
Policy Manager. You can create additional VLANs using the Create VLAN option available from the right mouse button when you select the global or local VLANs folder, or from the Tools > Create VLAN menu option when you are on the VLANs tab in the left panel.
Once a VLAN is created, you can use it as follows:
•
as the default access control for a role, using the role General Tab or Role Wizard
•
as an access control action for a rule using the rule Actions tab or Rule Wizard
•
as an access control action for an automated service, using the service General Tab or Service
•
in a Policy VLAN Island, if that feature is enabled
You can view the roles and services associated with a VLAN on the Roles and Services tabs that are displayed when you select the VLAN in the left panel. You can also make role and service changes from these tabs.
See Create VLAN Window and Roles for additional information.
Instructions on:
•
•
•
•
Turning Off Getting VLANs on Startup
Creating a VLAN
1. Click the VLANs tab in the left panel.
2. Right click the global or local VLANs folder and select Create VLAN from the menu.
3.
Fill out the Create VLAN Window to your specifications.
4. To create the VLAN and close the Create VLAN window, click OK. To create a VLAN and leave the window open, click Apply.
5.
Enforce to write the new information to the devices.
Editing a Local VLAN ID
Note: If the VLAN IDs are recalculated (for example, if you change the base or offset for the VLAN island), any changes you made to local VLAN IDs will be lost.
How to Create a VLAN 248
NetSight Policy Manager Help
1. In the left panel, select the Network Elements tab, expand the Policy VLAN Islands folder, and select the Policy VLAN Island with which the local VLAN is associated.
2. Select the VLANs tab in the right panel.
3. Select the local VLAN and click Edit Local VLAN ID.
4. Enter the new VLAN ID and click OK.
5.
Enforce to write the new information to the devices.
Deleting a VLAN
Deleting a VLAN removes it and its associations with any roles and services from the Policy Manager database and from the devices.
WARNING:
The delete operation will immediately remove the VLAN(s) from the devices in the Network Elements tab and could result in serious consequences if the VLANs are used outside the scope of Policy Manager.
1. Click the VLANs tab in the left panel.
2. Right click on the VLAN you wish to delete and select Delete from the menu. A confirmation window opens.
3. Click Yes to delete the VLAN.
4.
Enforce to write the new information to the devices.
Turning Off Getting VLANs on Startup
When Policy Manager is launched, it automatically reads the VLANs from the devices. However, this can take some time when you have many VLANs and devices. If it is not required that Policy Manager and the devices be synchronized each time you launch Policy Manager, you can turn off the reading of VLANs at
launch by deselecting the Get VLANs on Startup option in the Options Startup view (Tools > Options).
Deleting a VLAN 249
How to Create a Policy VLAN Island
VLAN islands enable you to set up, for example, a guest VLAN that restricts the guests in one facility from
more information.
Instructions on:
•
Enabling/Disabling Policy VLAN Islands
•
Using the Policy VLAN Islands Configuration Wizard
•
•
Enabling/Disabling Policy VLAN Islands
In order to create local VLANs and use Policy VLAN Islands, you must first enable the Policy VLAN Islands feature. To do this, select Edit from the menu bar and check the Policy VLAN Islands Enabled checkbox.
This enables Policy VLAN Islands for the current domain, and creates a Policy VLAN Islands folder and one
Default VLAN Island on the left panel VLANs tab. Also, on the left panel VLANs tab, a Local VLANs folder is created.
To disable Policy VLAN Islands for the current domain, select Edit from the menu bar and uncheck the
Policy VLAN Islands Enabled checkbox. This removes the Policy VLAN Islands folder, and the information within it, from the VLANs tab. It also removes the Local VLANs folder from the VLANs tab, and any local
VLANs you have created are converted to global VLANs, using the corresponding VIDs from the VLAN island.
Since Policy VLAN information is lost if you disable the Policy VLAN Islands feature, if you plan to re−enable Policy VLAN Islands at a later time, you may wish to save the domain containing the VLAN islands and local VLANs to a .pmd file (File > Export to File).
Using the Policy VLAN Islands
Configuration Wizard
The Policy VLAN Islands Configuration Wizard is a series of windows that leads you through the steps required to create and configure VLAN islands.
Note: VLANs used in VLAN islands must be Local VLANs. If you want to use an existing Global VLAN as
a Local VLAN, change it on the VLAN's General tab before starting the wizard.
1. On the Edit menu, select the Policy VLAN Islands Enabled checkbox.
2. In the left panel, select the VLANs tab.
3. Right−click the Policy VLAN Islands folder and select Policy VLAN Islands Configuration Wizard
How to Create a Policy VLAN Island 250
NetSight Policy Manager Help from the menu.
4.
In the Island Base ID window, enter the VLAN ID at which the creation of VIDs for the local
5.
In the Island Offset window, enter the number of VLANs you want to allocate for each VLAN
island. Click Next.
6.
In the Local VLAN Naming Convention window, choose a format for the island VLAN names.
Click Next.
7. In the VLAN Islands window, add or remove VLAN Islands as needed. (The Default Island that is created when you enable the Policy VLAN Islands feature cannot be removed.) To add an island, enter the name to the left of the Add button and click Add. To remove an island, highlight it in the table and click Remove. When you have finished adding/removing islands, click Next.
8.
In the Local VLANs window, if you want to add any new local VLANs to use in VLAN islands,
click New to open the Create VLAN window. Clicking OK on the Create VLAN window returns you
to the wizard. When you have finished adding local VLANs, click Next.
9.
10. Click Finish.
11.
You can add a description of a VLAN island on the island's General tab.
Modifying a VLAN Island
Once you've created a VLAN island, you can change its characteristics using the right−panel tabs as follows:
•
To change a VLAN island name: Right−click the island in the left−panel VLANs tab and select
•
Rename.
To change a VLAN island description: Use the island's General tab.
•
To edit the Local VLAN for an island: Use the View/Edit Local VLAN button on the island's VLANs
•
To edit a Local VLAN ID: Use the Edit Local VLAN ID button on the island's VLANs tab.
•
To change a VLAN Island Configuration (Base ID, Offset, Naming Convention): Use the Policy
•
VLAN Islands folder General tab.
To add or remove devices from a VLAN island: Use the VLAN Islands Add/Remove Devices window.
Deleting a VLAN Island
You cannot delete the Default Island.
1. Select the VLANs tab in the left panel and expand the Policy VLAN Islands folder.
2. Right−click the island you want to delete and select Delete.
3. Click Yes to confirm the deletion.
Modifying a VLAN Island 251
How to Create and Use
Domains
Policy Manager provides the ability to create multiple policy configurations by allowing you to group your roles and devices into Policy Domains. A Policy Domain contains any number of roles and a set of devices that are uniquely assigned to that particular domain. For example, a university may have a Dormitory domain with a policy configuration created for students, and an Administration domain with a policy configuration for staff members.
You can create multiple domains and easily switch from one domain to another. You can also export policy domain configuration data to a .pmd file, (one file per domain) for backup and troubleshooting purposes, and you can import data from a .pmd file into a policy domain.
In order for your network devices to be displayed in the Policy Manager Network Elements tree, they must be assigned to a Policy Domain. Initially, you must use Console to add your devices to the NetSight database.
Once your devices are in the database, you can assign the devices to a Policy Domain. As soon as the devices are assigned to a domain, they are automatically displayed in the Policy Manager Network Elements tree.
Only devices that support policy are displayed in the Policy Manager tree.
Policy Manager automatically locks the current Policy Domain when you begin to edit the domain configuration. Other Policy Manager clients are notified that the domain is locked and they will not be able to
viewing that domain of the change, and automatically update their view with the new configuration.
Instructions on:
•
•
•
•
Removing Devices From a Domain
•
Importing a File into a Domain
•
•
•
•
•
•
Creating a New Domain
Use these steps to create a new Policy Domain.
1. Select Domain > Create.
2. Enter the name for the new domain and click OK.
3. A new (blank) Policy Manager Domain opens.
4.
Proceed with assigning devices to the domain and then configuring the desired policies.
How to Create and Use Domains 252
NetSight Policy Manager Help
Opening a Domain
In Policy Manager, you work in one current domain at a time. To change to a different domain, use the
Domain menu to select the desired domain. If you have made changes to the current domain, you will be prompted to update the database with the current domain configuration prior to opening the new domain.
Assigning Devices to a Domain
added to the database, you must assign the devices to a Policy Domain. A device can exist in only one Policy
Domain. As soon as the devices are assigned to a domain, they are automatically displayed in the Policy
Manager Network Elements tree. Only devices that are assigned to the Policy Domain you are currently viewing are displayed in the tree.
Use these steps to assign devices to a Policy Domain.
1.
If necessary, open the domain that you want to assign devices to.
2.
Select Domain > Assign Devices to Domain. The Assign Devices to Domain window opens.
3. Devices that are in the database but not assigned to a domain are listed in the left−panel Unassigned folder (including devices that do not support policy). The left panel also displays any other domains and the devices assigned to those domains. Use the drop−down list to select a single domain or All
Other Domains. If you select All Other Domains, use the bottom panel to view which domain each device is assigned to.
4. The right panel displays the current domain and the devices assigned to that domain. To add a device to the current domain, select the device in the left panel and click Add. You can also select and add multiple devices.
5. To remove a device from the current domain, select the device and click Remove. This removes the device from the current domain and places it back in the device tree as either unassigned or as a member of the domain it came from. It does not delete the device from the NetSight database.
6. Click OK. You will be prompted to save the domain. (When you save the domain, all clients that are viewing that domain will be notified of the change and their view of the domain will be automatically updated with the new configuration.)
7. The selected devices are assigned to the current domain and displayed in the Policy Manager Network
Elements tree. (Only devices that support policy are assigned to the domain and displayed in the
Policy Manager tree.)
Removing Devices From a Domain
Removing a device from a domain, removes the device from the Policy Manager Network Elements tree and places it in the Unassigned folder in the Assign Devices to Domain window.
NOTE:
Removing a device from a domain does not delete the device from the NetSight database. To
delete a device from the database, right−click on the device in the left−panel Network Elements
tab, and select Delete from the menu. When a device is deleted from the database, it is automatically removed from the Console and Policy Manager device tree.
1.
If necessary, open the domain that you want to remove devices from.
2.
Select Domain > Assign Devices to Domain. The Assign Devices to Domain window opens.
Opening a Domain 253
NetSight Policy Manager Help
3. The right panel displays the current domain and the devices assigned to that domain. To remove a device from the current domain, select the device and click Remove. This removes the device from the current domain and places it back in the device tree as either unassigned or as a member of the domain it came from. It does not delete the device from the NetSight database.
4. Click OK. You will be prompted to save the domain. (When you save the domain, all clients that are viewing that domain will be notified of the change and their view of the domain will be automatically updated with the new configuration.)
Importing a File into a Domain
You can import policy data from a .pmd file into a Policy Domain.
1. Make sure that the domain you want to import a file into is your current domain.
2.
Select File > Import > Import From File. The Import from File window opens.
3. Enter the name and path for the data file (.pmd) you want to import, or navigate to the file.
4. Select the specific data elements you want to import or click Select All to select all the data import
options at once. See Data Elements to Import for important information on each element and how
they will be imported.
5. Select how you want the imported data applied to your current domain. Click on the links below for detailed information on how each specific action affects the import of certain data elements.
•
Append data to existing elements
•
Update existing data with elements from domain
•
6. Click OK. The data elements will be imported and you will see a message regarding import status.
NOTE:
If you decide that you want to return to the previous configuration (that the import overwrote), you can perform a File > Read Policy Domain operation to restore the configuration, as long as you have not saved the data you imported.
Exporting a Domain to a File
You can export policy data from a Policy Domain to a .pmd file.
1.
If necessary, open the domain that you want to export to a file.
2. Select File > Export to File.
3. Navigate to the directory where you want to save the .pmd file.
4. In the File name field, enter the name of the file with the .pmd extension. Special characters such as /
\ : ? " < > | are not allowed in the file name. On the Windows platform, the file name is not case−sensitive; therefore, Policy Manager sees X.pmd and x.pmd as the same file name. On the
Solaris and Linux platforms, the file name is case−sensitive; therefore, Policy Manager sees X.pmd
and x.pmd as two different file names.
5. From the Files of type drop−down list, select Policy Manager Database files (*.pmd).
6. Click Save.
Importing Data from a Domain
You can import policy configuration data from one policy domain into another.
1. Make sure that the domain you want to import data into is your current domain.
Importing a File into a Domain 254
NetSight Policy Manager Help
2. Select File > Import > Import From Domain. (This menu option is not available if only one domain
exists, as there are no other domains from which to import data.) The Import from Domain window
opens.
3. Use the drop−down list to select the domain whose data you want to import.
4. Select the specific data elements you want to import or click Select All to select all the data import
options at once. See Data Elements to Import for important information on each element and how
they will be imported.
5. Select how you want the imported data applied to your current domain. Click on the links below for detailed information on how each specific action affects the import of certain data elements.
•
Append data to existing elements
•
Update existing data with elements from domain
•
6. Click OK. The data elements will be imported and you will see a message regarding import status.
NOTE:
If you decide that you want to return to the previous configuration (that the import overwrote), you can perform a File > Read Policy Domain operation to restore the configuration, as long as you have not saved the data you imported.
Saving a Domain
After a Policy Domain has been changed, you must save the domain to notify all clients that are viewing that domain of the change and automatically update their view with the new configuration. A Save icon is displayed in the status bar when you have made changes to the domain that need to be saved. You can save a
Policy Domain by selecting File > Save Policy Domain or by clicking the Save toolbar button.
Reading a Domain
Reading a Policy Domain lets you update your current Policy Domain with the latest saved domain data. You can read a Policy Domain by selecting File > Read Policy Domain or by clicking the Read toolbar button.
Renaming a Domain
You can rename the current Policy Domain by selecting Domain > Rename and entering a new name.
Deleting a Domain
You can delete one or more Policy Domains by selecting Domain > Delete.
Saving a Domain 255
How to Create or Modify a Rule
Traffic Classification rules allow you to assign a class of service and/or access control (VLAN membership) to network traffic, depending on the traffic's classification type. Classification types are based on layers 2, 3, and 4 of the OSI model, and traffic is classified according to specific layer 2/3/4 information contained in
each frame. For more information, see Traffic Classification Rules.
A rule has two main parts: Traffic Description and Actions. The Traffic Description identifies the type of traffic to which the rule will pertain. Actions specify whether that traffic will be assigned class of service, access control, or both.
There are two ways to create a rule:
•
Using the Classification Rule Wizard: The Classification Rule Wizard is a series of windows that leads you through all the steps required to create a rule, including defining the traffic description and
• the actions that will apply to it.
Using the Rule Tabs: Creating a rule manually consists of creating a name for the rule using the
Create Classification Rule menu option, then using the rule's right panel tabs to specify its characteristics. Creating a rule using this method accomplishes the same things as the Classification
Rule Wizard, but enables you to do only those parts of the procedure you want to do, when you want to do them. You can also use the right−panel tabs to modify an existing rule.
In order to create a rule, you must first create a service with which to associate it.
Instructions on:
•
Using the Classification Rule Wizard
•
•
•
Modifying General Rule Characteristics
•
Modifying Rule Traffic Descriptions
•
•
•
Using the Classification Rule Wizard
The Classification Rule Wizard is a series of windows that lead you through all the steps required to create a new rule.
1. In the Policy Manager left panel, select the Services tab.
2. Expand either the Service Groups or Services folder and select the service for which you want to create a rule.
3. From the menu bar, select Tools > Classification Rule Wizard. You can also right−click on the service and select the option from the menu. The Rule Wizard opens.
4. In the Name window, enter a name for the rule and click Next.
How to Create or Modify a Rule 256
NetSight Policy Manager Help
5. In the Rule Status window, you can elect to disable the rule at this time. If you disable the rule, it is temporarily unavailable for use by the current service, but it can be re−enabled at any time or copied
to other services and enabled. See Disabling a Rule for more information. Click Next to continue.
6. In the Rule Type window, specify the type of devices to which you wish this rule to apply when
enforced. See Rule Type for more information on the consequences of your choice. Click Next to
continue.
7. In the Traffic Classification Layer window, select a Traffic Classification Layer and click Next.
Each layer has multiple Classification Types. See Classification Types and their Parameters for a
description of classification layers and types.
8. In the Traffic Classification Type window for your previous selection, choose the desired
Classification Type and click Next.
9.
Next.
10. In the Traffic Description Summary window, review the summary of the traffic description you have added to the rule.
•
If you are satisfied with the description, click Next.
•
To change the description, select it, then click Remove and Add. This returns you to the
Traffic Classification Layer window. Repeat steps 6−9.
Note: If you modify an enabled rule's traffic descriptions, Policy Manager checks for conflicts with
other rules in the services and roles with which the newly modified rule is associated. See Conflict
Checking for more information.
11. In the Actions window, define the actions to apply to the rule, then click Next to continue.
•
CoS: To assign a class of service to the traffic, select the CoS checkbox. This opens the
Classes of Service Selection View, where you can select a class of service for the traffic.
•
Click OK to return to the Actions window.
Access Control: To assign access control (a VLAN), select the Access Control checkbox and
choose one of the following options (see Access Control for more information):
•
Permit Traffic: If you want to allow traffic to be forwarded with the port's assigned
•
VID, select this option.
Deny Traffic:
•
If you want to deny traffic and one discard VLAN exists: Select this option
•
(the discard VLAN is already selected).
If you want to deny traffic and no Discard VLAN exists: Select this option,
•
then click New to create a new discard VLAN, then select it from the list.
If you want to deny traffic and there is more than one Discard VLAN, or you want to contain traffic for this rule, select this option and choose the appropriate VLAN from the list.
•
Contain to VLAN: If you want to contain traffic for this rule, select this option, then select the appropriate VLAN from the list.
•
Accounting: When rule accounting is enabled on a device, each rule keeps a list of the ports on which it has been used. Use these options to specify certain rule usage actions to take place when a "rule hit" is reported.
•
Generate System Log on Rule Hit: When this option is selected, a syslog message
• is generated when the rule is used.
Generate Audit Trap on Rule Hit: When this option is selected, an audit trap is generated when the rule is used.
•
Security: When rule accounting is enabled on a device, each rule keeps a list of the ports on which it has been used. If you select the Disable Port on Rule Hit option, any port reported as using this rule will be disabled.
12. Click Finish.
How to Create or Modify a Rule 257
NetSight Policy Manager Help
13.
Enforce to write the new information to the devices.
Using the Rule Tabs
When you create a rule using the rule tabs, you first create and name the rule using the Create Classification
Rule menu option, then define its characteristics in the right panel rule tabs.
1. In the Policy Manager left panel, select the Services tab.
2. Expand either the Service Groups or Services folder and click on the service for which you want to create a rule.
3. Right−click on the service and select Create Classification Rule.
4. In the left panel, type the name of the rule in the highlighted box, and press Enter.
5.
Fill out the Create Classification Rule window and click OK. You can now use the associated
right−panel tabs to define the rule.
6.
status and device types for the rule.
7.
In the Traffic Description tab, define the traffic description for the rule.
a. Click Add to open the Traffic Description Wizard.
b. In the Traffic Classification Layer window, select a Traffic Classification Layer and click
Next. Each layer has multiple Classification Types. See Classification Types and their
Parameters for a description of classification layers and types.
c. In the Traffic Classification Type window, select the desired Classification Type and click
Next.
d.
and click Finish.
8.
In the Actions tab, select class of service and access control (VLAN assignment) actions that will
apply to the rule, if applicable. You can also specify any actions you would like taken if the rule is used on a port.
9.
Enforce to write the new information to the devices.
Modifying a Rule
Once you've created a rule, you can change its characteristics by selecting the rule in the Policy Manager's left panel and using the associated tabs in the right panel.
•
Modifying General Rule Characteristics
•
Modifying Rule Traffic Descriptions
•
Modifying General Rule Characteristics
The rule General tab allows you to create or modify a description for the rule.
1. In the Policy Manager left panel, select the Services tab.
2. Expand either the Service Groups or Services folder.
3. Expand the Service and click on the rule you want to modify, and make sure the General tab is selected in the right panel.
Using the Rule Tabs 258
NetSight Policy Manager Help
4. Modify the rule's properties as desired.
5.
Enforce to write the new information to the devices.
Modifying Rule Traffic Descriptions
change the classification type or edit the values using the steps in this section. When you modify an enabled rule's traffic description, Policy Manager checks for conflicts with other rules in the services and roles with
which the newly modified rule is associated. See Conflict Checking for more information.
1. In the Policy Manager left panel, select the Services tab.
2. Expand either the Service Groups or Services folder.
3. Expand the Service and click on the rule you want to modify.
4. Click on the Traffic Description tab and select the traffic description in the right panel.
5. To change the classification type or edit the values: a.
Click Edit to open the Edit Rule window.
b.
Select or enter the desired parameters and/or values. See Classification Types and their
Parameters for parameter information. Click OK.
6.
Enforce to write the new information to the devices.
Modifying Rule Actions
in this section. When you modify an enabled rule's actions, Policy Manager checks for conflicts with other
more information.
1. In the Policy Manager left panel, select the Services tab.
2. Expand either the Service Groups or Services folder.
3. Expand the Service and click on the rule you want to modify. Its associated tabs appear in the right panel, with the General tab open.
4. Click on the Actions tab and change the class of service and/or access control actions for the rule, as
required (see Actions tab for more information). You can also change the actions you would like
taken if the rule is used on a port.
5.
Enforce to write the new information to the devices.
Disabling/Enabling a Rule
In Policy Manager, you can disable and enable individual or multiple rules. You can also disable and enable all the rules associated with a service, or all the rules for all the services in a service group. The rule icon in the left panel displays a red X if the rule is disabled.
Disabling a rule is an alternative to deleting and recreating it. If you disable a rule, it is temporarily unavailable for use by the service with which it is associated. However, the rule can be copied to another service and enabled for that service.
Disabling/Enabling an Individual Rule
Modifying Rule Traffic Descriptions 259
NetSight Policy Manager Help
right−clicking on the rule and selecting Disable Rule(s) or Enable Rule(s).
1. In the Policy Manager left panel, select the Services tab.
2. Expand the Services folder and the service, to locate the rule you want to disable or enable. (If the rule is part of a service that is also a member of a service group, you can expand the Service Groups folder to find the rule.)
3.
Select the rule you want to disable or enable, and select the General tab in the right panel.
4. In the Status area, select Enable or Disable to enable or disable the rule. Disabling the rule turns on the red X on the rule icon in the left panel, and re−enabling it turns it off.
5.
Enforce to write the new information to the devices.
Disabling/Enabling Multiple Rules
These are instructions for disabling and enabling multiple rules in a single operation.
1. In the Policy Manager left panel, select the Services tab.
2. Expand the Services or Service Group folder and select the service containing the rules you want to disable or enable.
3. In the right−panel Details View, multi−select the desired rules. Right−click and select Disable
Rule(s) or Enable Rule(s).
4. Click Yes to confirm the change.
5.
Enforce to write the new information to the devices.
Disabling/Enabling the Rules for a Service or Service Group
If a service is associated with more than one service group, disabling or enabling the rules for the service in one service group will disable/enable the rules for the service in the other service groups of which the service is a part.
1. In the Policy Manager left panel, select the Services tab.
2. Expand the Services or Service Group folder.
3. Right−click the service or service group containing the rules you want to disable or enable and select
Disable Rule(s) or Enable Rule(s).
4. Click Yes to confirm the change.
5.
Enforce to write the new information to the devices.
Deleting a Rule
Deleting a rule removes the rule from a service. If the service is also part of a service group, the rule is deleted there as well, so be sure the rule is not needed before you delete it.
1. In the Policy Manager left panel, click the Services tab.
2. Expand the Services folder and the service to locate the rule you want to delete. (If the rule is part of a service that is also a member of a service group, you can expand the Service Groups folder to find the rule.)
3. Right−click the rule you want to delete, and select Delete.
4. Click Yes to confirm, then OK to clear the confirmation message. The rule is deleted wherever it exists.
5.
Enforce to write the new information to the devices.
Deleting a Rule 260
NetSight Policy Manager Help
Deleting a Rule 261
How to Create
Role−Based Rate Limit
Port Groups
with similar rate limiting requirements. With rate limit port groups, you can create a single class of service that assigns a different rate limit to each port group. For example you might want to create a class of service where your server ports would receive one rate limit while your access ports would receive a different rate limit. Rate limit port groups provide this kind of flexibility.
Only certain devices such as the Matrix N−Series Gold and Platinum devices support role−based rate limits;
support.
Instructions on:
•
Creating Rate Limit Port Groups
•
Configuring Rate Limit Mappings
•
Associating Rate Limits with a Class of Service
Creating Rate Limit Port Groups
Role−based rate limit port groups are based on the number of rate limits the ports in the group support, for example 8−rate limit port groups and 32−rate limit port groups. An individual device might have a combination of these port types. Initially, all ports (on devices that support role−based rate limits) are grouped into a Default port group under the appropriate port type. When you create new port groups, you add ports from the Default group into your newly defined port groups. A port can be in only one group, and all ports added to a port group must match the port group's port type. If you expand the Rate Limits Port Groups folder in the left−panel Classes of Service tab, you will see a folder for port groups of each type.
NOTE:
Policy Manager currently supports only inbound role−based rate limits.
Use these steps to create a role−based rate limit port group.
1. In the left−panel Classes of Service tab, expand the Role−Based Rate Limit Port Groups folder and then the Inbound Rate Limit (IRL) Port Groups folder.
2. Right−click on the desired port groups folder (depending on the type of port group you want to create) and select Create Port Group. This expands the folder and creates a "New Port Group" item.
3. Type the port group name in the highlighted box and press Enter.
4.
Select the right−panel Ports tab.
5.
Click the Add/Remove Ports button. This opens the Add/Remove Ports window where you can add
and remove ports to and from the group. Click OK. The ports will be listed in the Ports tab.
How to CreateRole−Based Rate LimitPort Groups 262
NetSight Policy Manager Help
Configuring Rate Limit Mappings
After you have created your port groups, you must configure the rate limit index mappings for each group.
These mappings map a logical rate limit index to an actual physical rate limit created in Policy Manager.
When you create your class of service you will select one mapping index that gives you the desired physical rate limit for each port group.
Policy Manager supports a maximum of 32 logical rate limit indexes and each type of rate limit port group lets you map all 32 indexes. For 8−rate limit port groups, this means that the number of logical indexes is greater than the actual number of rate limits the ports support. This is because some devices may have a mix of ports that support 32 rate limits and ports that support eight rate limits. The 8−rate limit port groups will have 32 logical rate limit indexes (0−31), but they can only be mapped to a maximum of eight different physical rate limits. The 100−rate limit port groups will have only 32 logical rate limit indexes that can be mapped to 32 different physical rate limits, even though the ports support a maximum of 100 different physical rate limits.
NOTE:
You must have your rate limits created in Policy Manager before configuring your rate
limit mappings. See How to Define Rate Limits for instructions on creating rate limits.
1. Select the rate limit port group in the left−panel Classes of Service tab.
2.
Select the right−panel Mappings tab.
3.
Click Edit to open the Edit Rate Limit Mappings window.
4. In the Edit Rate Limit Mappings window, select a rate limit and then use the checkboxes to select the logical index(es) that you want to map to the selected rate limit. Use the Apply button to map all your indexes without having to re−open the window. Click OK to close the window. The Mappings tab will display your index to rate limit mapping configuration.
Associating Rate Limits with a Class of Service
After you have configured the rate limit mappings for a port group, you can associate a rate limit mapping index with a class of service. When you create your class of service you will select one mapping index that gives you the desired physical rate limit for each port group.
1. Select the class of service under the Classes of Service folder in the left−panel Classes of Service tab.
(If you have not created the class of service, see How to Create a Class of Service.)
2.
Select the right−panel General tab.
3. Select the Role−Based IRL sub−tab.
4. Select the inbound rate limit index you want to associate with this class of service. Click Select to open the Inbound Rate Limits selection view window. This window lists all the possible rate limits, organized by index number for each existing port type and group. Selecting one index number automatically includes all the rate limits configured for that index number. Click OK.
5. Once you have selected the mapping index, the table below displays the actual rate limits that will be used by each rate limit port group for that class of service.
6. Click Save on the toolbar.
Configuring Rate Limit Mappings 263
How to Define
Rate Limits
are used to control the transmit rate at which traffic enters and exits ports in your network. Policy Manager supports two types of rate limits: Priority−Based rate limits and Role−Based rate limits. When you create a rate limit you can configure it with both priority−based and role−based parameters, but only one type of rate limiting will be used on a device. The rate limit configuration used will depend on the device and the type of
Support tables in the release notes for specific device/firmware rate limit support.
Rate limits are disabled by default on devices. You must specify the type of rate limits you want to use on a
rate limits, but you cannot have both types enabled at the same time.
Instructions on:
Defining Priority−Based Rate Limits
Defining Role−Based Rate Limits
Defining Priority−Based Rate Limits
Priority−based rate limits are associated with one or more of the eight 802.1p priorities (0−7). When the associated priority is selected for a class of service, the rate limit becomes part of that class of service. When priority−based rate limiting is implemented, the combined rate of all traffic on the port that matches the priorities associated with the rate limit cannot exceed the configured limit. If the rate exceeds the configured limit, frames are dropped until the rate falls below the limit.
Defining a priority−based rate limit includes specifying the highest speed at which traffic is allowed to travel, the direction to which the limit applies (inbound or outbound traffic), and the 802.1p priority or priorities with which the rate limit is to be associated. You can also set the precedence for the rate limit, and exclude selected network elements from being affected by the rate limit. The rate limits you define are displayed with the associated priority when you select a class of service while creating a rule, automated service, or role. In order to control traffic inbound and outbound on the same port, two rate limits must be configured (one inbound and one outbound).
1. Select the left−panel Classes of Service tab.
2. Expand the CoS Components folder.
3. Right−click the Rate Limits folder and select Create Rate Limit.
4.
In the Create Rate Limit window:
a. Specify the desired rate limit.
b. In the Priority−Based Configuration section select Inbound or Outbound direction, depending
How to Define Rate Limits 264
NetSight Policy Manager Help on whether the rate limit is for inbound or outbound traffic.
c. Select the 802.1p priority or priorities with which the rate limit will be associated. Each
802.1p priority can have only one inbound and one outbound rate limit; therefore, if a priority is already being utilized for the selected direction, it is grayed out.
d. If you are creating a rate limit to be used on SecureStack C2/B2 10/100 ports, select either
Low to associate the rate limit with priorities 0−3 or High to associate the rate limit with priorities 4−7. You can select both Low and High if you want to associate the rate limit with priorities 0−7. If the Low or High priority is already being utilized for another rate limit, it will be grayed out. Because SecureStack C2/B2 10/100 ports only support inbound rate limits, this section will be grayed out if you have selected Outbound for your rate limit
Direction.
e.
If you want this rate limit to include role−based configuration, follow the instructions in step
f. Click OK.
The rate limit will be created under the left−panel Rate Limits folder.
5.
Select the rate limit and display the General tab in the right panel.
6. In the Priority−Based Configuration sub−tab, click the Precedence Edit button. This opens the
devices that support them.
7. If you want to specify any network elements to which this rate limit will not apply, go to the
Exclusion area, click Edit, and make your selection from the list of network elements. Click OK.
8. In the Description area, enter a description for the rate limit.
9. Verify that priority−based rate limiting is enabled in the Class of Service Modes section of the device
General tab or via the Device Configuration Wizard.
10.
enabled), then click Enforce on that window.
Priority−based rate limits add to the amount of time it takes to enforce and verify roles. Once you've created your rate limits and enforced them, you may want to disable rate limits so that it takes less time to enforce.
You can disable rate limits in the Class of Service Mode section of the device General tab.
Once a rate limit is associated with a priority, that priority will include rate limiting wherever and however it is used, until the rate limit is deleted from Policy Manager. Also, once a priority−based rate limit is applied to a port, it will remain on the port even if the role that originally used the rate limit is no longer associated with the port.
NOTE:
There are important differences in priority−based rate limit behavior on Matrix
Defining Role−Based Rate Limits
Role−based rate limits are defined within a class of service and associated with a specific role via a rule action or as a role default. When role−based rate limits are implemented, all traffic on the port that matches the rule with the associated rate limit cannot exceed the configured limit. If the rate exceeds the configured limit, frames are either dropped or reprioritized to another class of service until the rate falls below the limit. As another option, you can create a role−based rate limit that simply counts all the traffic that matches the rule with the associated rate limit. The rate limit will remain on the port only as long as the role using the rate limit
Defining Role−Based Rate Limits 265
NetSight Policy Manager Help is active on the port either as the authenticated role or as the port's default role.
After you have defined your role−based rate limit, you must configure rate limit mappings for your Default rate limit port groups and any port groups you have created. This will allow you to associate the rate limit
with a class of service. See How to Create Role−Based Rate Limit Port Groups for more information.
NOTE:
Policy Manager currently supports only inbound role−based rate limits.
1. Select the left−panel Classes of Service tab.
2. Expand the CoS Components folder.
3. Right−click the Rate Limits folder and select Create Rate Limit.
4.
Fill out the Create Rate Limit window:
a. Specify the desired rate limit.
b. In the Role−Based Configuration section, select the notification type(s) and/or action you would like performed if the rate limit is exceeded:
•
Generate System Log on Rate Violation − a syslog message is generated when the
• rate limit is first exceeded.
Generate Audit Trap on Rate Violation − an audit trap is generated when the rate
• limit is first exceeded.
Disable Port on Rate Violation − the port is disabled when the rate limit is first exceeded.
NOTE:
Matrix N−Series Gold devices do not support rate limit notification.
c. If you want this rate limit to include priority−based configuration, follow the instructions in
d. Click OK.
The rate limit will be created under the left−panel Rate Limits folder.
5.
Select the rate limit and display the General tab in the right panel.
6.
7. In the Description area, enter a description for the rate limit.
8. Role−based rate limits are written to your devices when you enforce the role that includes them. You must have Role−Based Rate Limits / Transmit Queue Configuration enabled in the Class of Service
Modes section of the device General tab or via the Device Configuration Wizard when you enforce.
Modifying a Rate Limit
You can change the definition of the rate limit on the rate limit General tab.
1. Select the left−panel Classes of Service tab.
2. Expand the CoS Components folder and the Rate Limits folder.
3.
Select the rate limit you want to change and display the General tab in the right panel.
4. Make any changes to the rate limit and the priority−based or role−based configuration sections as desired.
5.
6.
enabled), then click Enforce on that window.
Modifying a Rate Limit 266
NetSight Policy Manager Help
Removing a Rate Limit
The steps for removing a rate limit from Policy Manager varies slightly depending on whether the rate limit is being used with a priority−based or role−based configuration.
Removing a Priority−Based Rate Limit
Once a priority−based rate limit is associated with a priority, that priority will include rate limiting wherever and however it is used, until the rate limit is deleted from Policy Manager. In addition, once the rate limit is applied to a port, it remains on the port even if the role that originally used the rate limit is no longer associated with the port. To remove a priority−based rate limit, you must delete it from Policy Manager and then perform an Enforce with priority−based rate limiting enabled. This will remove the rate limit from any ports it was applied to.
1. Select the left−panel Classes of Service tab.
2. Expand the CoS Components folder and the Rate Limits folder.
3. Right−click the rate limit you want to remove, and select Delete from the menu.
4. Verify that priority−based rate limiting is enabled in the Class of Service Mode section on the device
General tab or via the Device Configuration Wizard.
5.
enabled), then click Enforce on that window.
Removing a Role−Based Rate Limit
Role−based rate limits remain on a port only as long as the role using the rate limit is active on the port either as the authenticated role or as the port's default role. To remove a role−based rate limit, you must delete it from Policy Manager and then enforce. This will remove the rate limit from any roles it was associated with.
1. Select the left−panel Classes of Service tab.
2. Expand the CoS Components folder and the Rate Limits folder.
3. Right−click the rate limit you want to remove, and select Delete from the menu.
4. Verify that role−based rate limiting is enabled in the Class of Service Mode section on the device
General tab or via the Device Configuration Wizard.
5.
enabled), then click Enforce on that window.
Removing a Rate Limit 267
How to Define Traffic Descriptions
Traffic Classification rules allow you to assign VLAN membership and/or transmission priority to network traffic based on the traffic's classification type. Traffic descriptions are the part of a rule that defines this classification type. Classification types are based on layers 2, 3, and 4 of the OSI model, and traffic is classified according to specific layer 2/3/4 information contained in each frame. For more information, see
The Traffic Description Wizard is used to define traffic descriptions for new rules, and to edit traffic descriptions of existing rules.
Instructions on:
•
Accessing the Traffic Description Wizard
•
•
•
Using the Traffic Description Wizard
Accessing the Traffic Description Wizard
How you access the Traffic Description Wizard depends on whether you are defining a traffic description for a new rule or an existing rule.
For a New Rule
1. In the Policy Manager left panel, select the Services tab.
2. Expand either the Service Groups or Services folder and click on the service for which you want to create a rule.
3. From the menu bar, select Tools > Create Classification Rule. You can also right−click on the service and select the option from the menu.
4. Type the rule name in the highlighted box and press Enter. You can now use the associated right−panel tabs to define the rule.
5. Click on the Traffic Description tab.
6. Click Add to open the Traffic Description Wizard.
For an Existing Rule
1. In the Policy Manager left panel, select the Services tab.
2. Expand either the Service Groups or Services folder.
3. Expand the Service and click on the rule you want to modify. Its associated tabs appear in the right panel, with the General tab open.
4. Click on the Traffic Description tab and select the traffic description in the right panel. Click Remove to delete the traffic description.
5. Click Add to open the Traffic Description Wizard.
How to Define Traffic Descriptions 268
NetSight Policy Manager Help
Using the Traffic Description Wizard
The Traffic Description Wizard is a series of windows that lead you through all the steps required to define a traffic description for a rule. Use the steps above to access the Wizard.
Note: If you modify an enabled rule's traffic descriptions, Policy Manager checks for conflicts with other
more information.
1. In the Traffic Classification Layer window, select a Traffic Classification Layer and click Next. Each
layer has multiple Classification Types. See Classification Types and their Parameters for a
description of classification layers and types.
2. In the Traffic Classification Type window, select the desired Classification Type and click Next.
3.
Parameters for parameter information. Select and/or enter the required parameters and click Finish.
4. To apply the rule you have created or modified, click the Enforce button on the Policy Manager main
Enforce on that window.
Using the Traffic Description Wizard 269
How to Define Well−Known IDs
You can edit the pre−defined list of well−known identifiers (IDs) used when creating Policy Manager rules in
the Pre−Defined Well−Known IDs window. You can define a new ID for a TCP/UDP port number (Layer 4
Application Transport traffic classification type) or for an IP Protocol Type (Layer 3 Network traffic classification type). Once defined, these IDs are available for selection from the list of well−known values when defining the rule's traffic classification type.
Use the following instructions to add, remove, or change IDs on the pre−defined list:
1. Select Edit > Pre−Defined Well−Known IDs from the menu bar. The Pre−Defined Well−Known
IDs window opens.
2. Select the IP Protocol tab to define an ID that maps to an IP protocol, or select the Port tab to define an ID that maps to a TCP/UDP port protocol.
Adding a new Well−Known ID
a. Enter the Port Number or IP Protocol and an associated Protocol ID.
b. Click Add. The new ID appears in the table.
Removing a Well−Known ID
a. In the table, select the ID(s) that you wish to remove. You can make multiple consecutive selections by holding the left mouse button while swiping the mouse pointer over the table rows or by holding the Shift key while clicking. Hold the Control key while clicking to make non−consecutive selections.
b. Click Remove. The selected IDs are deleted from the table.
Changing a Well−Known ID
First remove the ID, then add it with the desired changes.
How to Define Well−Known IDs 270
How to Enable Rule Accounting
The Rule Accounting feature provides the ability to monitor traffic classification rule usage on your network.
When rule accounting is enabled on a device, each rule keeps a list of the ports on which it has been used.
You can view this rule information and also configure specific actions to take place when a certain rule is used.
Instructions on:
•
•
Viewing Rule Usage Information
Configuring Rule Accounting
Enable rule accounting on a device, and configure specific actions to take place when a certain rule is used. (If a device does not support the Rule Accounting feature, these options are grayed out.)
1.
2. In the Rule Accounting section, enable the Rule Accounting Status. You can also enable any desired auto−clear options and specify the ports the clear operations will be performed on.
•
Clear Rule Usage on Port Link−Status Change − Clears the specified ports from any rule's
•
Rule Usage tab when the port has a link−status change.
Clear Rule Usage Port Role Change − Clears the specified ports from any rule's Rule Usage
•
tab when the port's role changes.
Clear Rule Usage on Interval − Clears the specified ports from any rule's Rule Usage tab at a
set interval. Enter the desired interval (in minutes) and click Apply.
If you have enabled any of the clear rule usage options, use the Rule Usage Auto Clear Ports list to specify the ports on the device that the clear operations will be performed on. Click Add to open the
Add Ports window where you can select ports to add to the list. Click Apply to set any changes you
have made.
TIP:
Use the Device Configuration Wizard to enable Rule Accounting on multiple
devices.
3.
Accounting and Security sections, select the desired actions to take place when this rule is used (when a "rule hit" is reported):
•
Generate System Log on Rule Hit − A syslog message is generated when the rule is used.
•
Generate Audit Trap on Rule Hit − An audit trap is generated when the rule is used.
•
Disable Port on Rule Hit − Any port reported as using this rule will be disabled.
TIP:
You can also specify these rule usage actions when you create a rule using the Rule Wizard.
Viewing Rule Usage Information
You can view a variety of rule usage information:
•
To view the ports that a specific rule has been used on:
rule type does not include any devices that support rule accounting, this tab will be grayed out.) Click
How to Enable Rule Accounting 271
NetSight Policy Manager Help the Retrieve button to display the rule usage information. Use the Clear button to clear selected port(s) from the rule's usage list. You can set up auto−clear functionality on a per−port basis in the
•
To view the rules that have been used for a specific role or service, or on a specific device or port.
panel. Click the Retrieve button to display the rule usage information. Use the Clear button to clear selected port(s) from the associated rule's usage list.
•
To view any ports on a device that have been disabled due to rule usage.
Click the Retrieve button to display any disabled ports. Use the Clear button to clear any selected disabled ports, and re−enable them. Keep in mind that if the port continues to receive traffic that matches the rule, and the rule is still configured to disable the port, then the port will almost immediately reappear in the table.
How to Enable Rule Accounting 272
How to Filter, Find, and Sort
Use the following instructions to perform filter, find, and sort operations on column entries in Policy Manager right−panel tables.
NOTE:
Some Policy Manager tables use a set of Table Tools to find, filter, sort, print, and export information in a table. You can access these Table Tools by clicking the Table Tools
button in the upper left corner of the table. For more information, see Table Tools.
Instructions on:
•
•
•
Filtering
When the information in the right panel is presented in a column format, you can perform a filter so that only those entries matching your filter criteria will be displayed. You can filter the entries in a single column or in all columns, and you can apply consecutive filters.
1. Select View > Filter. You can also right−click on a column header, and select Filter. The Filter window opens.
2. In the Filter field, enter the numeric value or text you want to filter.
3. Click the Case Sensitive check box to filter based on the exact case of the text entered in the Filter field.
4. Click the Match Whole Word check box to filter based on the entire value or text entered in the
Filter field.
5. From the Column drop−down list, select the column you want to filter. If you select All Columns, the filter criteria will be applied to all entries.
6. If you have already performed a filter, click the Whole Table option to perform a new filter on all entries instead of just the filtered entries. Or, click the Current Table option to perform a new filter on the results of the previous filter.
7. Click Filter.
All entries that do not match the filter criteria will be removed. You can apply additional filters by repeating steps 2 − 7, or revert to the unfiltered entries by selecting Show All.
Finding
When the information in the right panel is presented in a column format, you can search for a specific value in a single column or in all columns. You can search forward or backward from your current position, and also restrict your search to match the exact case and/or whole word of the entry.
How to Filter, Find, and Sort 273
NetSight Policy Manager Help
1. Select Edit > Find. You can also right−click on a column header, and select Find. The Find window opens.
2. In the Find field, enter the value or text you want to search for.
3. Click the Case Sensitive check box to search based on the exact case of the text entered in the Find field.
4. Click the Match Whole Word check box to search based on the entire value or text entered in the
Find field.
5. In the Direction box, select the direction in which you want to search: Forward (top to bottom) or
Backward (bottom to top).
6. From the Column drop−down list, select the column you want to search. Select All Columns to search all entries.
7. Click Find.
The matching entry is highlighted in the right panel. Click Find again to search for another entry matching the search, or select Clear to clear the value in the Find field and enter a new search criteria.
Sorting
When the information in the right panel is presented in a column format, you can sort the column entries in ascending or descending order. Text fields are sorted alphabetically, numeric fields are sorted numerically, and mixed fields are sorted alpha−numerically.
1. Select View > Sort. The Sort window opens.
2. From the Column drop−down list, select the column you want to sort.
3. In the Direction box, select the order in which you want to sort the list: Ascending or Descending.
4. Click Sort.
The entries will be reordered based on the sort criteria.
Tip: You can also sort a column by right−clicking on a column header and selecting Sort Ascending or Sort
Descending.
Sorting 274
How to Freeze/Unfreeze a Port
Freezing a port enables you to "lock" it so that no one can accidentally reconfigure sensitive attributes such as port authentication or default role settings. For example, if a port is frozen and the administrator later assigns a default role to the entire device, the frozen port will not receive the new default role. To reconfigure a frozen port, you must clear its frozen status, do the configuration, then freeze it again. One application of this feature would be to prevent interswitch link ports from being accidentally reconfigured. You can tell if a port is frozen or not by looking at the port icon
or by checking the Frozen Status on the Port Properties General tab.
The Frozen Port feature is a software feature available in Policy Manager. It does not freeze the ports in the switch firmware itself, but protects the user from making configuration changes to sensitive ports using the software application. Therefore, setting a port to be frozen in Policy Manager will not automatically set the port to be frozen in other NetSight applications.
can freeze or clear frozen ports on an individual or selected port basis.
You cannot terminate sessions on frozen ports.
Instructions on:
•
•
Freezing/Unfreezing a Port
To freeze or clear a single port:
The quickest way to freeze a single port or clear it is to select the port and use the right−click menu Set/Clear
Frozen option.
1. In the left−panel Network Elements tab, select the device where the port resides and expand the slot or ports grouping in the right−panel Details view.
2. Right−click the port you want to freeze or unfreeze, and select Set/Clear Frozen. If the port was frozen, it will be unfrozen. If it was unfrozen, it will be frozen.
You can also freeze a port or clear a port's frozen state on the Port Properties window General tab.
NOTE:
You can freeze multiple ports or clear them by holding down the Shift or Control key while selecting the ports in the right panel.
Freezing/Unfreezing a Device
You can freeze all the ports on a single device or clear them by selecting the device and using the right−click menu Set Frozen or Clear Frozen option.
How to Freeze/Unfreeze a Port 275
NetSight Policy Manager Help
To freeze or unfreeze an entire device:
1. In the left panel, select the Network Elements tab.
2. Right−click the device whose ports you want to freeze or unfreeze.
3. To freeze all the device's ports, select Set Frozen. To unfreeze all the device's ports, select Clear
Frozen.
How to Freeze/Unfreeze a Port 276
How to Import From Device
Use the Import From Device Wizard to import roles and rules from a selected device or devices into your
Policy Domain configuration. This feature is useful when:
• you need to rebuild a domain configuration. You can import roles and rules already enforced on a
• device into a new domain.
you are creating your first domain configuration. You can import existing static classification rules on a device into the domain, saving the time it would take to duplicate the rules through Policy Manager.
Using the wizard, you can import roles and rules, and easily organize the rules into services. You can create new services, and merge the imported rules into these new services or into any existing services in your current domain.
Using the Import From Device Wizard
1. Select File > Import > Policy Configuration From Device. The Import From Device Wizard opens.
Import From Device
2. Select whether you would like to import roles and/or rules from the device(s):
•
Roles −− Select this option to import roles, including the role's name, description, default
•
VLAN (access control), and default class of service.
Rules −− Select this option to import the traffic classification rules associated with any roles on the device. If you select this option, you can also select whether to import any static traffic classification rules configured on the device.
NOTE:
When importing a rule that has a class of service (CoS) defined, any rate limiting characteristics of that CoS are not imported. Also, if you import a device−specific rule, it will be converted to a rule type of "All Devices." If you want the rules to be device−specific, you will have to change their Rule type via the Rule General tab after the import and prior to Enforce.
3. Click Next.
Device Selection
4. The Devices panel on the left side of the window displays all the devices and device groups in the current domain. Select the devices that you would like to import from, and click Add to list them in the Selected Devices panel.
5. Click Next.
Read From Device
6. This view displays all the roles and rules available for import into your domain. Using the checkboxes in the Selected columns, select the roles and rules that you want to add to your domain. You can sort the tables by clicking on a column heading.
How to Import From Device 277
NetSight Policy Manager Help
Role Panel
The top panel lists all the roles you can select from, along with information on the role's default access control and class of service. If the role already exists in your domain, it cannot be imported. In addition, any differences between the existing role in your domain and the same role on the device will be indicated using red text, except device−level and port−level mappings.
•
Selected −− Use the checkboxes to select the roles you want to add to your domain. Roles that already exist in your current domain display "exists" in this column, and cannot be
• selected.
Name −− The name of the role.
•
Access Control −− The default access control associated with the role. If the role does not
• have default access control, the column will display N/A.
CoS −− The default class of service associated with the role. If the role does not have default
• class of service, the column will display N/A.
Device(s) of Origin −− The device(s) the role exists on.
Rule Panel
•
Selected −− Use the checkbox to select the rules you want to add to your domain. Rules that
• already exist in your current domain display "exists" in this column, and cannot be selected.
Name −− The name of the rule, generated from the rule's actions, type, value, and mask.
•
Cleanup Static −− If you are importing static rules, select this checkbox if you want the wizard to clear the static rule from the port tables on the device. It is recommended that you
• cleanup static rules so they do not interfere with the rules set through Policy Manager.
Type −− The Classification Type for the rule.
•
Value −− The classification value.
•
Mask −− The mask for the classification value, if applicable.
•
Access Control −− The VLAN ID (VID) and name of the VLAN associated with the rule. If
• the rule does not specify a VLAN, this column will display N/A.
CoS −− The class of service associated with the rule. If the rule does not specify a class of service, this column will display N/A.
7. Click Next.
Organize and Update
8. The wizard provides a selection of common ways to organize the rules into services. Select one of these options:
•
All Rules in one Service −− Organize all the imported rules into one new service.
•
Rules placed in Services by Action −− Organize all imported rules by their action: Deny,
•
Permit, Contain, or Prioritize
Rules placed in Services by Classification Layer −− Organize all imported rules by their
•
Traffic Classification Layer: Layer 2, Layer 3, or Layer 4.
Rules placed in Services by Classification Type −− Organize all imported rules by their
•
Traffic Classification Type.
Rules placed in Services by Role of Origin −− Organize all imported rules by the name of the role they originated from. If desired, you can add these services to the corresponding role in the domain by selecting the Add Generated Services to Matching Role checkbox.
9. In the Role Update section, select the checkbox if you would like to update the existing roles in your domain with any conflicting role information read from the device(s). If the role already exists in your domain, it cannot be imported. However, this option lets you update the existing role in your domain
Organize and Update 278
NetSight Policy Manager Help with the values of the same role read from the device(s). These differences were highlighted in the
Read From Device role panel in red text. (Device−level and port−level mappings will be imported
even though they are not highlighted as differences.)
10. Click Next.
Merge Rules
11. In this view, the panel on the left shows the rules organized into generated services as specified in the previous view. The panel on the right shows the current set of services available in your domain. You can merge the rules into your available services, or leave the rules as organized in the previous view.
To merge the rules: a. In the left panel, select the rules and/or services you want to merge.
b. In the right panel, select the service you want to merge the rules into.
c. Click the Add button. The rules will be reorganized under the service.
d. If desired, you can create a new service. Click Create Service to open a window where you can name a service and add it to the Available Services panel.
12. Because you are importing new rules into existing services, there is a possibility of conflicts between the new rules and any existing rules in a service. For example, two rules might have the same traffic descriptor but forward traffic to different VLANs, or have different priorities. If the two rules are applied to the same service, or to the same role via two different services, unpredictable and undesired behavior could result. Click Check for Conflicts, and Policy Manager will check rule traffic descriptions and action values, and provide a message if conflicts are found. This gives you an opportunity to resolve the conflicts prior to importing. Any conflicting rules that are not resolved will be disabled when the import is performed.
13. When your rules are organized as desired, click Finish to perform the import.
NOTE:
Because the import operation imports only roles and rules from the device (not the complete policy configuration), a Verify operation performed following the import may fail. Also, when you import device−specific rules, these rules are converted to a
Rule Type of "All Devices," and this will cause Verify to fail. If you want the rules to be device−specific, you will have to change their Rule Type via the Rule General tab after the import and prior to Enforce.
Merge Rules 279
How to Initialize the Policy Manager Database
Policy Manager provides a way for you to initialize only the Policy Manager components in the NetSight
Database. The initialize operation removes all Policy Manager domains and domain data from the database including:
•
Roles, services, service groups, and rules
•
Devices assigned to the domains (the devices are not deleted from Console)
•
Port groups
•
VLANs
•
User−defined classes of service (CoS) and rate limiting
other NetSight plugin data elements in the database.
NOTE:
As a precaution, it is recommended that you make a backup of your NetSight Database prior to
performing the initialize operation using the Backup Database window accessed from the Server
Information window.
1.
Make a backup of your database using the Backup Database window accessed from Database tab in
the Server Information window (Tools > Server Information.)
2. Select File > Database > Initialize PM Components to begin the initialize operation. You will see a message asking if you want to delete all Policy Manager data in the server's database. Click OK.
How to Initialize the Policy Manager Database 280
How to Lock MAC Addresses to Ports
MAC Locking ensures that only specific MAC addresses can access a port, and that traffic from any other
MAC addresses will be discarded. There are two kinds of MAC Locking: Dynamic and Static. When you enable Dynamic MAC Locking on a port, the next MAC address that authenticates or accesses the port (up to the maximum number of dynamic locked MAC addresses allowed) will have exclusive access to that port from that time on. Static MAC Locking lets you create a list of locked MAC addresses for a port so that the port only accepts traffic from those MAC addresses.
In order for MAC Locking to take effect on a port, it must be enabled on the port and at the device level. You
can also enable MAC Locking for multiple ports in the Port Configuration wizard. MAC Locking is only
available on devices that support it, and is not allowed on backplane and logical ports.
Instructions on:
•
•
Dynamic MAC Locking
When Dynamic MAC Locking is enabled on a port, the next MAC address that authenticates or accesses the port (up to the maximum number of dynamic locked MAC addresses allowed) will have exclusive access to
these steps to enable it on a single port.
1. Select a device in the left−panel Network Elements tab and expand a slot or ports grouping in the right−panel Details view.
2. Right−click on a port and select Properties from the menu. In the Port Properties window, select the
MAC Locking tab (in the top row of tabs).
3.
4. Enable MAC Locking on the port. If the device does not support MAC locking, this option is grayed out.
5. In the MAC Locking Limits area, set the maximum number of MAC addresses that can be locked dynamically on the port. The numbers in parentheses let you know the range of allowed values for the particular port.
6. Click Apply.
Static MAC Locking
Static MAC Locking lets you create a list of locked MAC addresses for a port so that the port only accepts traffic from those MAC addresses. You can add Static MAC Locking to a single port or multiple ports.
On a Single Port
1. Select a device in the left−panel Network Elements tab and expand a slot or ports grouping in the
How to Lock MAC Addresses to Ports 281
NetSight Policy Manager Help right−panel Details view.
2. Right−click on a port and select Properties from the menu. In the Port Properties window, select the
MAC Locking tab (in the top row of tabs).
3.
4. Enable MAC Locking on the port. If the device does not support MAC locking, this option is grayed out.
5. In the MAC Locking Limits area, set the maximum number of static MAC addresses that can be locked on the port. The numbers in parentheses let you know the range of allowed values for the particular device. Click Apply.
6. You can move all Dynamic Locked MAC addresses (with the Locking Cause of "First Arrival") to
Static Locked MAC addresses by clicking the Apply button in the Static MAC area. Make sure that the Maximum Number of Static Locked MAC Addresses is set to a large enough value to accommodate all the addresses.
7.
In the Locked MAC Addresses sub−tab, click Retrieve to populate the Locked MAC Addresses table
with a list of the MAC addresses currently locked on the selected port.
8.
Click the Add button to open the Add Static MAC window where you can add to the list of locked
MAC addresses for the port.
9. In the Add Static MAC window, the Detected MACs table lists the addresses detected on the selected port and their corresponding index number.
10.
In the Detected MACs table, select the desired MAC address(es) and click Add to list the address(es)
in the Statically Add MACs list. You can also enter a MAC address and index number, then click
Add to add the address to the Statically Add MACs list. To remove an address from the Statically
Add MACs table, select the address(es) and click Remove.
11. Click OK.
On Multiple Ports
1. In the Network Elements tab, select a single device, a device group, or the All Devices folder.
2. Select the MAC Locking tab in the right panel, and click Retrieve to display the current list of locked
MAC addresses for the selected device(s) or port group. (If the device does not support the MAC locking feature, the Retrieve and Add buttons are grayed out.)
3. You can move all Dynamic Locked MAC addresses (with the Locking Cause of "First Arrival") to
Static Locked MAC addresses by clicking the Apply button in the Static MAC area. To ensure that all
Dynamic Locked MAC addresses are changed to Static, make sure that the Maximum Number of
Static Locked MAC Addresses is set to a large enough value in the Port Properties window MAC
4.
Click the Add button to open the Add Static MAC window where you can create a list of locked
MAC addresses.
5. In the Add Static MAC window, the Detected MACs table lists the addresses detected on the selected device(s) and their corresponding index number and device IP address. (Only MAC addresses for devices that support MAC Locking are displayed.) If you have selected a single device in the left−panel tree, the Device column in the table is not displayed.
6.
In the Detected MACs table, select the desired MAC address(es) and click Add to list the address(es)
in the Statically Add MACs list. You can also enter a MAC address and index number, and select a device from the dropdown list, then click Add to add the address to the Statically Add MACs list. (If you have selected a single device in the left−panel tree, the Device dropdown list is not displayed.) To
remove an address from the Statically Add MACs table, select the address(es) and click Remove.
7. Click OK.
On Multiple Ports 282
NetSight Policy Manager Help
On Multiple Ports 283
How to Manage SNMP Passwords
Use this tab to collectively manage the credentials that have been set on your network's devices.
Instructions for:
•
•
Setting SNMPv1/2 Credentials
When a SNMPv1 or SNMPv2 credential is selected from the drop−down list above the table, the table lists the devices where that credential is set and you can define a New Community Name for access to the devices in the table.
To set SNMPv1 or SNMPv2 credentials on your devices:
1. Click or choose Authorization/Device Access from the Tools menu. Select the Manage SNMP
Passwords tab in the Authorization/Device Access window.
2. Select an SNMPv1 or SNMPv2 credential from the Credential drop−down list. The table will list all of the devices where the selected credential can be used.
3. Type the new community name that you want to set on the devices listed in the table.
4. Click Test to verify that the credential in the "Use for Set" column can access the applicable MIBs on the device.
5. If the Test Results are acceptable, click Apply to set the community name on the devices.
Setting SNMPv3 Credentials
When an SNMPv3 credential is selected, you can define a new Authentication password and Privacy password for access to the devices in the table.
To set an SNMPv3 credential on your devices:
1. Click or choose Authorization/Device Access from the Tools menu. Select the Manage SNMP
Passwords tab in the Authorization/Device Access window.
2. Select an SNMPv3 credential from the Credential drop−down list. The table will list all of the devices where the selected credential can be used.
3. Type the new Authentication and Privacy passwords that you want to set on the devices listed in the table.
4. Click Test to verify that the credential in the "Use for Set" column can access the applicable MIBs on the device.
5. If the Test Results are acceptable, click Apply to set the passwords on the devices.
How to Manage SNMP Passwords 284
NetSight Policy Manager Help
Buttons
Test
This button lets you test to verify that the credential in the "Use for Set" column can access the applicable MIBs on the device.
Apply
Sets your credential changes on the devices in the table.
How to Manage SNMP Passwords 285
How to Manage Users and Groups
Use the Users and Groups tab (via the Authorization/Device Access tool) to specify users who are authorized to access the NetSight database, and assign those users to authorization groups that define their access privileges to application features. Access privileges (called Capabilities) are associated with authorization groups. Based on their membership in a particular authorization group, users are granted specific capabilities in the application. For example, you may have an authorization group called "IT Staff" that grants access to a wide range of capabilities, while another authorization group called "Guest" grants a very limited range of capabilities.
Begin by creating your authorization groups and specifying the capabilities for that group. Then, create a list of your authorized users and assign each user to a specific group.
Instructions for:
•
•
•
•
•
•
Selecting an Automatic Authorization Group
•
•
•
Managing Authorization Groups
A user's access to specific capabilities and features in the application is determined by what authorization group that user belongs to. So, it makes sense to begin managing user access by creating one or more groups that define the access and capabilities that will be granted to users.
To create a group:
1. Click or choose Authorization/Device Access from the Tools menu. The
Authorization/Device Access window opens with the Users/Groups tab selected.
2.
In the lower half of the tab, click Add Group. The Add Group window opens where you can define
the capabilities for this group.
a. Type a name for your new group into the Authorization Group field.
b. Select the Capabilities tab and expand the tree, and select the capabilities that will be granted to users that are members of this group.
c. Select the Settings tab and choose a SNMP Redirect option:
•
Allow Users to Configure SNMP Redirect in Options − lets users in this group determine when it is appropriate to have SNMP requests performed by the server.
•
Refer to the Client/Server SNMP Redirection in the Options window.
Always Redirect SNMP to the NetSight Server − all SNMP requests always go through the server.
How to Manage Users and Groups 286
NetSight Policy Manager Help
•
Never Redirect SNMP to the NetSight Server − SNMP requests are always made from the client system.
These settings have no effect when both the client and server are running on the same system.
d. Click Apply to confirm your selections and Close to dismiss the Add Group window.
Your new group now appears in the Authorization Groups table.
To edit a group:
1. Click or choose Authorization/Device Access from the Tools menu. The
Authorization/Device Access window opens with the Users/Groups tab selected.
2. Select a group from the Authorization Groups table in the lower half of the tab.
3.
Click Edit Group. The Edit Group window opens where you can change the capabilities for the
selected group.
a. Select the Capabilities tab and expand the tree, and select the capabilities that will be granted to users that are members of this group.
b. Select the Settings tab and choose a SNMP Redirect option:
•
Allow Users to Configure SNMP Redirect in Options − lets users in this group determine when it is appropriate to have SNMP requests performed by the server.
•
Refer to the Client/Server SNMP Redirection in the Options window.
Always Redirect SNMP to the NetSight Server − all SNMP requests always go
• through the server.
Never Redirect SNMP to the NetSight Server − SNMP requests are always made from the client system.
These settings have no effect when both the client and server are running on the same system.
NOTE:
The capabilities and settings for the NetSight Administrator group cannot be changed.
c. Click Apply to confirm your selections and Close to dismiss the Add Group window.
Your edited group now appears in the Authorization Groups table.
To delete a group:
1. Click or choose Authorization/Device Access from the Tools menu. The
Authorization/Device Access window opens with the Users/Groups tab selected.
2. Select the group(s) to be deleted from the Authorization Groups table in the lower half of the tab.
3. Click Delete. The selected groups are removed from the table.
NOTE:
The capabilities and settings for the NetSight Administrator group cannot be deleted.
Managing Users
The top half of the Users/Groups tab is where you can create, edit, and delete users, and assign each user to an authorization group. The Automatic User Membership feature lets you specify an authorization group for users that log in without having been previously assigned to a group.
Selecting an Automatic Authorization Group
Managing Users 287
NetSight Policy Manager Help
1. Click or choose Authorization/Device Access from the Tools menu. The Authorization/Device
Access window opens with the Users/Groups tab selected.
2. Check Enable to activate the Automatic User Membership − Authorization Group drop−down list.
3. Select a group that will determine the capabilities granted to users who were not previously created as an authorized user. When any of these users log in, they are automatically created as an authorized user as a member of the selected group.
To create a user:
1. Click or choose Authorization/Device Access from the Tools menu. The Authorization/Device
Access window opens with the Users/Groups tab selected.
2.
Click Add User. The Add User window opens where you can define a new Authorized User and
assign it a group membership.
3. Type the user's name and the domain/hostname that will be used to authenticate to the NetSight database
4. Select an authorization group where this user will be a member.
5. Click Apply to confirm your selections and Close to dismiss the Add User window.
To edit a user:
1. Click or choose Authorization/Device Access from the Tools menu. The Authorization/Device
Access window opens with the Users/Groups tab selected.
2. Select a user from the Authorized Users table.
3.
Click Edit User. The Edit User window opens.
4. Select a new authorization group where this user will be a member.
NOTE:
You cannot change group membership for a selected user if the user is the only member of the NetSight Administrator group.
5. Click Apply to confirm your changes and Close to dismiss the Edit User window.
To delete a user:
1. Click or choose Authorization/Device Access from the Tools menu. The Authorization/Device
Access window opens with the Users/Groups tab selected.
2. Select the user(s) to be deleted from the Authorized Users table.
3. Click Delete. The selected users are removed from the table.
NOTE:
The last user that is a member of the NetSight Administrator group cannot be deleted.
Managing Users 288
How to Select on
Add/Remove Windows
Policy Manager includes several Add/Remove windows in which you can add items from a left panel to a right panel, and remove items from the right panel. The following procedures explain how to make single and multiple selections in the panels and move the selections to the opposite panel.
Instructions on:
Selecting multiple sequential items
Selecting multiple non−sequential items
Selecting single items
To select one item from the left panel and add it to the right panel, use one of these methods:
•
Double−click the item.
•
Click the item, then click Add.
•
Click and drag the item to the right panel.
To remove one item from the right panel, use one of these methods:
•
Double−click the item.
•
Click the item, then click Remove.
Selecting multiple sequential items
To select a sequence of items in the left panel and add them to the right panel:
1. Hold down the Shift key and click the first and last (or last and first) items in the sequence.
2. Click Add.
To remove a sequence of items from the right panel:
1. Hold down the Shift key and click the first and last (or last and first) items in the sequence.
2. Click Remove.
Selecting multiple non−sequential items
To select multiple non−sequential items in the left panel and add them to the right panel:
1. Hold down the Ctrl key and click each item you want to add.
2. Click Add.
To remove multiple non−sequential items from the right panel:
How to Select on Add/Remove Windows 289
NetSight Policy Manager Help
1. Hold down the Ctrl key and click each item you want to remove.
2. Click Remove.
How to Select on Add/Remove Windows 290
Server Configuration Considerations
This Help topic provides configuration information for the NetSight Server, such as running the server in a non−DNS environment, limiting client connections to the server, adding memory to the server, and firewall considerations.
Instructions on:
•
Running the Server on a non−DNS Enabled Solaris System
•
Limiting Client Connections on Solaris and Linux
•
Accepting Connection from Local Client Only
•
Limiting Connections to a Specific IP Address
•
Adding Memory to the Server on Solaris and Linux
•
Running the Server on a non−DNS Enabled Solaris System
By default, the NetSight Server obtains the local system's IP address by performing a hostname resolution when the Console Client is launched. For Solaris systems that are not configured with hostnames (e.g. the hostname command returns localhost or localhost.localdomain), or are not registered in DNS, use the following steps to start the server with an IP address.
1. Open the server's run.sh file located in <installdir>
/server/jboss/bin/run.sh
.
2. Edit the HOSTNAME variable at the top of the file to:
HOSTNAME=
"<server IP address>"
For example, HOSTNAME="123.123.123.123"
Limiting Client Connections on Solaris and Linux
Use the steps in this section to configure the server to accept connections only from the local system and/or limit client connections to a specific IP address.
Accepting Connection from Local Client Only
By default, the NetSight Server accepts connections from any client system. To limit connections to clients connecting from the local system only, use the following steps:
1. Open the server's run.sh file located in <installdir>
/server/jboss/bin/run.sh
.
2. Edit the HOSTNAME variable at the top of the file to:
HOSTNAME="127.0.0.1"
Limiting Connections to a Specific IP Address
By default, the NetSight Server will accept connections on all IP addresses supported by the server host. If your server supports multiple IP addresses, it may be desirable to limit client connections to a specific IP address. To specify an IP address:
1. Open the server's run.sh file located in <installdir>
/server/jboss/bin/run.sh
.
Server Configuration Considerations 291
NetSight Policy Manager Help
2. Edit the HOSTNAME variable at the top of the file to:
HOSTNAME=
"<server IP address>"
For example, HOSTNAME="123.123.123.123"
Clients must use the exact IP address to connect to the server. Clients can no longer use localhost, 127.0.0.1, or any DNS name that translates to anything but the specified IP address.
Adding Memory to the Server on Solaris and Linux
By default, the NetSight Server is configured to use a maximum of 512 MB of virtual memory. On large server systems and in large deployments, you can increase the amount of memory. Keep in mind that if the server attempts to access more memory than it is configured for, it will terminate.
1. Open the server's run.sh file located in <installdir>
/server/jboss/bin/run.sh
.
2. Edit the MAXMEMORY variable at the top of the file to the desired value:
MAXMEMORY=
"<number of MB>"
Firewall Considerations
The NetSight Server runs on a set of non−standard ports. These ports (4530−4533) need to be accessible through firewalls for clients to connect to the server.
4530/4531 −− JNP (JNDI)
4532 −− JRMP (RMI)
4533 −− UIL (JMS)
Adding Memory to the Server on Solaris and Linux 292
How to Set Options
Use the Options window to set options for NetSight functions on a suite−wide and per−application basis. The
Options window has a right−panel view that changes depending on what you have selected in the left−panel tree. Each view allows you to set different options. You can access the Options window using Tools >
Options in the menu bar.
Instructions on setting the following options:
•
Suite Options
•
Client/Server SNMP Redirection
•
Data Display
•
Date/Time Format
•
Device Display Name
•
Event Logs
•
Services for NetSight Server
•
SMTP Email Server
•
Status Polling
•
Web Update
•
•
•
•
•
•
•
How to Set Options 293
How to Set
Policy Manager Options
Use the Options window (Tools > Options) to set options for the Policy Manager application. In the Options window, the right−panel view changes depending on what you have selected in the left−panel tree. Expand the Policy Manager folder in the tree to view all the different options you can set.
Instructions on setting the following Policy Manager options:
•
•
•
•
•
•
Ports
launch Policy Manager. This setting applies only to the logged−in user on this client.
The Hide Logical Ports feature lets you hide the display of logical ports in Policy Manager. Logical ports include SmartTrunk ports and LEC (LAN emulation client) ports, which can be seen in Policy Manager even if they are not yet configured or connected. If there are too many of these logical ports, they can cause unwanted clutter in your Policy Manager port list displays.
1. Select Tools > Options in the menu bar. The Options window opens.
2. In the left−panel tree, expand the Policy Manager folder and select Ports. The right−panel Ports view is displayed.
3. Use the checkbox to enable or disable the Hide Logical Ports feature, as desired.
4. Click OK to set options and close the window. Click Apply to set options and leave the window open.
Optional Views
only to the logged−in user on this client.
1. Select Tools > Options in the menu bar. The Options window opens.
2. In the left−panel tree, expand the Policy Manager folder and select Optional Views. The right−panel
Optional Views view is displayed.
3. Select the Show Getting Started at startup checkbox if you want the Getting Started Help topic to open whenever you start Policy Manager.
4.
Select the Show Enforce Preview on Enforce checkbox if you want the Enforce Preview window to
on and off on the Enforce Preview window itself.
How to Set Policy Manager Options 294
NetSight Policy Manager Help
5. Click OK to set options and close the window. Click Apply to set options and leave the window open.
Dialog Boxes
course of using Policy Manager. It also enables you to turn on the message dialog boxes that you have turned off on individual dialog box(es). These settings apply only to the logged−in user on this client.
1. Select Tools > Options in the menu bar. The Options window opens.
2. In the left−panel tree, expand the Policy Manager folder and select Dialog Boxes. The right−panel
Dialog Boxes view is displayed.
3. In the Informational Dialog Boxes section, select the option to show or hide all non−critical message dialog boxes displayed in the course of using Policy Manager. Warning messages that are considered crucial to the successful operation of Policy Manager are not affected by this action and will continue to be shown.
4. In the Ignored Dialog Boxes section, click the Re−Show All button to turn on the display of messages that have been turned off in individual message dialog box(es).
5. Click OK to set options and close the window. Click Apply to set options and leave the window open.
Startup
automatically performs certain actions, including reading the VLANs from all reachable devices and verifying that the roles on the devices match those in the current Policy Manager domain. However, when you have many VLANs and roles, these procedures can take some time. If it is not required that Policy Manager and the devices be synchronized each time you launch Policy Manager, you can turn off these actions in the Startup view. This lets Policy Manager launch more quickly. These settings apply only to the logged−in user on this client.
1. Select Tools > Options in the menu bar. The Options window opens.
2. In the left−panel tree, expand the Policy Manager folder and select Dialog Boxes. The right−panel
Dialog Boxes view is displayed.
3. Deselect the Verify on Startup/Database Read/Import checkbox to stop Policy Manager from performing the verify operation at the time it is launched, or when you perform a database read or import.
4. Deselect the Get VLANs on Startup checkbox to stop Policy Manager from the reading the VLANs from the devices at the time it is launched.
5. Click OK to set options and close the window. Click Apply to set options and leave the window open.
Dialog Boxes 295
NetSight Policy Manager Help
Launch in Tab
By default, the Roles tab is displayed the first time you start Policy Manager; this option lets you select which tab will be displayed in subsequent startups. There is also an option to display the same tab you were using when you last closed Policy Manager. These settings apply only to the logged−in user on this client.
1. Select Tools > Options in the menu bar. The Options window opens.
2. In the left−panel tree, expand the Policy Manager folder and select Launch in Tab. The right−panel
Launch in Tab view is displayed.
3. In the Select Tab section, select the left−panel tab you would like displayed when you launch Policy
Manager: Roles Tab, Services Tab, Network Elements Tab, VLANs Tab, or Classes of Service Tab.
For more information on each tab, see Left Panel.
4. Select the Remember Tab During Close checkbox if you would like to display the same tab you were using when you last closed Policy Manager.
5. Click OK to set options and close the window. Click Apply to set options and leave the window open.
SNMP Options
These settings apply to all users on all clients.
1. Select Tools > Options in the menu bar. The Options window opens.
2. In the left−panel tree, expand the Policy Manager folder and select SNMP Options. The right−panel
SNMP Options view is displayed.
3. Under Server SNMP, specify SNMP polling parameters for the Policy Manager server. These settings apply to all users on all clients.
•
SNMP Retries − The number of times the server will attempt to contact a device after the first attempt fails. The default setting is 3 retries, which means that the server retries a timed−out
• request three times, making a total of four attempts to contact a device.
SNMP Timeout − The amount of time (in seconds) that the server waits before re−trying to contact a device.
4. Under Client SNMP, specify SNMP polling parameters for the Policy Manager client. These settings apply to the logged−in user on this client.
•
SNMP Retries − The number of times the client will attempt to contact a device after the first attempt fails. The default setting is 3 retries, which means that the client retries a timed−out
• request three times, making a total of four attempts to contact a device.
SNMP Timeout − The amount of time (in seconds) that the client waits before re−trying to contact a device.
5. Click OK to set options and close the window. Click Apply to set options and leave the window open.
Launch in Tab 296
How to Stop and Start the NetSight Server
This Help topic provides steps for manually stopping and starting the NetSight server.
Instructions on:
•
Stopping and Starting the Server on Solaris
•
Stopping and Starting the Server on Linux
•
Stopping and Starting the Server on Windows
Stopping and Starting the Server on Solaris
Stopping the Server
The NetSight Server can be stopped using the command:
<installdir>/server/stopserver.sh
Starting the Server
The NetSight Server can be started using the command:
<installdir>/server/startserver.sh
Stopping and Starting the Server Components
The NetSight Server components (NetSight Database and NetSight Server) can be individually controlled using their own stop/start/restart scripts:
<installdir>/server/netsightdatabase.sh {start|stop|restart}
<installdir>/server/netsightserver.sh {start|stop|restart}
Stopping and Starting the Server on Linux
When installed as a service on Linux, the NetSight Server can be controlled using tools such as the Red Hat
Service Configuration Tool.
Stopping and Starting the Server on Windows
You can manually stop and start the NetSight Server from the NetSight Services Manager.
1. Go to the Taskbar Notification Area of your desktop (on the lower right of your screen, unless you've relocated your Taskbar).
2. Right−click the Services Manager icon .
3. Select the appropriate NetSight Server menu option.
•
Stop Server and Database − Stops both the NetSight Server and Database.
How to Stop and Start the NetSight Server 297
NetSight Policy Manager Help
•
Stop Server − Stops only the NetSight Server.
•
Restart Server − Stops the server and then starts it up again immediately, or just starts the server if the server is already stopped. If the NetSight Database is not running, it will also be started.
The color of the arrow on the NetSight Services Manager icon indicates the state of the NetSight Server and
Database:
•
•
•
•
−− A green arrow indicates the NetSight Server and Database are running.
−− A yellow arrow indicates the NetSight Database is running but the Server is down.
−− A red arrow indicates the NetSight Server and Database are both down.
−− An orange arrow indicates the NetSight Server is running but the Database is down. This is an error condition and requires that you restart both the NetSight Server and Database.
How to Stop and Start the NetSight Server 298
Policy Classification Rules Window
The Policy Classification Rules window provides a way to view all of the Policy Manager rules that exist in either the currently active domain or all domains, and displays information about each rule. Access this window by selecting one of the following options from the menu bar.
•
View > Policy Classification Rules − to view all the rules that exist in the currently active domain
•
Domain > Show All Rules for All Domains − to view all the rules that exist in all your domains
Information on the following Policy Classification Rules views:
•
•
Rules for the Current Domain
This window lets you view all the Policy Manager rules that exist in the currently active domain. To access the window, select View > Policy Classification Rules from the menu bar. Clicking on a column heading sorts the column. Use the buttons at the bottom of the window to export or print the table.
Click the graphic for more information.
Name of Rule
The name assigned to the rule. If a rule has been applied to a specific device type (see Rule Type),
that device type will precede the rule name, in brackets.
Rule Status
The status of the rule: Enabled or Disabled. If a rule is disabled, it is unavailable for use by the service
Policy Classification Rules Window 299
NetSight Policy Manager Help with which it is associated, but can still be copied to other services and enabled. Disabling a rule is an alternative to deleting and recreating it. The rule icon in the left panel displays a red X if the rule
is disabled. For more information, see Disabling/Enabling a Rule.
Rule Type
The rule type selected when the rule was created. Rule type specifies the type of device to which the rule is applied when enforced, or all devices. If the rule is device−specific, the rule icon displays a small switch
. See Rule Type for more information.
Traf Desc Type
The traffic description (classification type) defined for the rule. The traffic description identifies the
type of traffic to which the rule will pertain. See Classification Types and their Parameters for a
description of classification layers and types.
Traf Desc Value
Each traffic description (classification type) requires certain parameters and/or values. See
Classification Types and their Parameters for parameter information.
Traf Desc Mask
The mask for the rule's classification type, if applicable.
Access Control
The access control (VLAN assignment) defined for the rule. The rule's access control specifies whether to:
•
Permit Traffic − traffic will be forwarded with the port's assigned VID
•
Deny Traffic − traffic will be denied altogether
•
Contain to VLAN − traffic is contained to a specified VLAN
For more information, see Access Control.
CoS
The class of service associated with the rule. A class of service includes an 802.1p priority, and optionally an IP type of service (ToS/DSCP) value, rate limits, and transmit queue configuration. See
Getting Started with Class of Service and How to Create a Class of Service for more information.
Sys Log
Indicates whether a syslog message is generated when the rule is used, as set in the Actions tab for
the rule.
Trap
rule.
Disable Port
rule.
Service Name
Lists any services the rule belongs to.
Policy Classification Rules Window 300
NetSight Policy Manager Help
Service Group
Lists any service groups the rule belongs to.
In Role
Lists any roles the rule belongs to.
Rules for All Domains
This window lets you view all the rules that exist in all your domains. To access the window, select Domain >
Show All Rules for All Domains from the menu bar. Clicking on a column heading sorts the column. Use the buttons at the bottom of the window to export or print the table.
Click the graphic for more information.
Domain
The name of the domain the rule exists in.
In Role
Lists any roles the rule belongs to.
Name of Rule
The name assigned to the rule. If a rule has been applied to a specific device type (see Rule Type),
that device type will precede the rule name, in brackets.
Rule Status
The status of the rule: Enabled or Disabled. If a rule is disabled, it is unavailable for use by the service with which it is associated, but can still be copied to other services and enabled. Disabling a rule is an
Rules for All Domains 301
NetSight Policy Manager Help alternative to deleting and recreating it. The rule icon displays a red X if the rule is disabled. For
more information, see Disabling/Enabling a Rule.
Rule Type
The rule type selected when the rule was created. Rule type specifies the type of device to which the rule is applied when enforced, or all devices. If the rule is device−specific, the rule icon displays a small switch
. See Rule Type for more information.
Traf Desc Type
The traffic description (classification type) defined for the rule. The traffic description identifies the
type of traffic to which the rule will pertain. See Classification Types and their Parameters for a
description of classification layers and types.
Traf Desc Value
Each traffic description (classification type) requires certain parameters and/or values. See
Classification Types and their Parameters for parameter information.
Traf Desc Mask
The mask for the rule's classification type, if applicable.
Access Control
The access control (VLAN assignment) defined for the rule. The rule's access control specifies whether to:
•
Permit Traffic − traffic will be forwarded with the port's assigned VID
•
Deny Traffic − traffic will be denied altogether
•
Contain to VLAN − traffic is contained to a specified VLAN
For more information, see Access Control.
CoS
The class of service associated with the rule. A class of service includes an 802.1p priority, and optionally an IP type of service (ToS/DSCP) value, rate limits, and transmit queue configuration. See
Getting Started with Class of Service and How to Create a Class of Service for more information.
Sys Log
Indicates whether a syslog message is generated when the rule is used, as set in the Actions tab for
the rule.
Audit Trap
rule.
Disable Port
rule.
Service Name
Lists any services the rule belongs to.
Service Group
Rules for All Domains 302
NetSight Policy Manager Help
Lists any service groups the rule belongs to.
Buttons
Event Log
Export Table
Exports the information in this window to an HTML file. Clicking Export Table opens a Save as Web
Page window where you can name your exported file, and navigate to a folder/directory where you want to place the file.
Update View
Updates the information in the window.
Prints the information in the window.
Rules for All Domains 303
Left Panel
The left panel of the Policy Manager main window contains tabs for Roles, Services, Network Elements, Port
Groups, VLANs, and Classes of Service. These tabs display hierarchical representations of the roles, services, service groups, devices, device groups, port groups, network resources, Policy VLAN Islands, VLANs, and classes of service in your network. What you select in the left panel determines what is displayed in the right panel.
startups. There is also an option to display the same tab you were using when you last closed Policy Manager.
Features of the left panel include:
•
Expanding and collapsing items in the hierarchy: Double−click the item or its icon, or single−click
• the turner to the left of the icon.
Right−click menus: Right−click a folder or other item in the left panel, and a menu of the options you
• can perform on your selection appears.
Drag and drop: Populate port groups, services, and service groups by using drag and drop in the left panel. You can also drag and drop multiple selections from right−panel Details View tab lists in the
Services tab.
Information on the left−panel tabs:
•
•
•
•
•
•
Roles Tab
The Roles tab is displayed in the left panel when you open Policy Manager, and lists the roles defined for the
policy−enabled network.
Click the tree items for more information.
Roles Folder
Left Panel 304
NetSight Policy Manager Help
This folder contains the roles defined for the current domain. See How to Create a Role for more
information.
Role
Individual roles are listed by name. Select a role in the left panel, and view information about that role
in the right−panel tabs. Only Quarantine roles are displayed with a red icon
.
Services Tab
rules that define how network traffic for a particular network service or application should be handled by a
network access device. The tab also displays your network resource groups.
Click the tree items for more information.
Service Groups Folder
Policy Manager lets you create categories into which you can group services. This folder contains the
service groups defined for the current domain. For more information, see How to Create a Service
Services Tab 305
NetSight Policy Manager Help
Service Group
Individual service groups are listed by name. Expand the service group to see the services in that group.
Services Folder
This folder contains the services defined for the current domain. For more information, see How to
Automated Services Folder
This folder contains your currently defined Automated services. For more information, see How to
Automated Service
Individual Automated services are listed under the Automated Services Folder or within a service group in the Service Groups folder.
Manual Services Folder
Manual Service
Individual Manual services are listed under the Manual Services Folder or within a service group in the Service Groups folder. Expand the service to see the rules associated with it.
Rule
Individual rules are listed by name. If the rule is disabled, the rule icon displays a red X . If the rule is device−specific, the rule icon displays a small switch .
Network Resources Folder
This folder contains any network resource groups you have created for the current domain. For more
information, see How to Create a Network Resource Group.
Network Resource Group
Individual network resource groups are listed by name. Select a group in the left panel, and view information about that group in the right−panel tabs.
Network Elements Tab
This tab displays the devices that are assigned to the current domain, organized into groups.
Click the tree items for more information.
Network Elements Tab 306
NetSight Policy Manager Help
My Network
My Network displays the system−created device groups and any user−created device groups (that you created through NetSight Console). Each device group name is followed by the total number of devices in that group and any subgroups, in parentheses.
All Devices Folder
This folder contains all the devices that are assigned to the current domain. For information on adding
devices to the domain, see How to Add and Delete Devices.
Grouped By Folder
The top−level Grouped By folder contains five system−created groups: Chassis, Contact, Device
Type, IP, and Location. When a device is assigned to a domain, it automatically becomes a member of the appropriate group. System−created groups are displayed with blue folders.
Chassis Folder
Contains subgroups for specific chassis in the domain.
Contact Folder
Contains subgroups of the devices in a domain based on the system contact. Sub−groups in this folder are automatically created based on the Contact value in the Console Properties (Device) tab. For example, a contact defined as NOC/Andover/Jones will automatically create a hierarchy of three sub−groups under the Grouped By > Contact folder. The Contact sub−groups are removed when the last device with a particular contact is deleted.
Device Type Folder
Contains subgroups for the specific product families and device types in the domain.
IP Folder
Contains subgroups based on the IP subnets in the domain.
Location Folder
Network Elements Tab 307
NetSight Policy Manager Help
Contains subgroups of the devices in a domain based on the system location. Sub−groups in this folder are automatically created based on the Location value in the Console Properties (Device) tab.
For example, a location defined as Andover/Building 3/Floor 1 will automatically create a hierarchy of three sub−groups under the Grouped By > Location folder. The Location sub−groups are removed when the last device for a particular location is deleted.
User−created Device Groups
You can add your own device groups and subgroups (displayed with yellow folders) using NetSight
Console.
Device
This icon represents an individual device that has been assigned to the current domain. It appears below the Devices folder and also below any device group of which it is a member.
Port Groups Tab
This tab displays the pre−defined and user−defined port groups for the current domain.
Click the tree items for more information.
Port Groups Folder
This folder contains the Pre−Defined and User−Defined Port Groups for the current domain. Policy
Manager allows ports to be combined into groups, similar to the way devices are combined into device groups. Port groups enable you to configure multiple ports on the same device or on different
devices simultaneously, or to retrieve port information from them. For more information, see How to
Pre−Defined Port Groups Folder
Policy Manager provides you with several commonly used port groups for your convenience. Expand
this folder to see the pre−defined port groups. For more information, see Pre−Defined Port Groups.
User−Defined Port Groups Folder
Port Groups Tab 308
NetSight Policy Manager Help
Policy Manager lets you create your own port groups. When you create a user−defined port group, you can either select individual ports to add to the group, or specify a range or ranges of ports from all
devices to be included in the group. See General Tab (User−Defined Port Group) for more
information.
Port Group
Select a port group in the left panel and view information about that group in the right−panel tabs.
VLANs Tab
This tab displays the Global VLANs for the current domain. If you have enabled Policy VLAN Islands, it also
displays your Local VLANs and Policy VLAN Islands.
Click the tree items for more information.
Global VLANs Folder
This folder contains your currently defined global VLANs for this domain.
VLAN
The VLAN icon indicates the access control for the VLAN−− if it is a Discard VLAN, the icon displays a red X . Otherwise, it is a Contain VLAN.
Local VLANs Folder
This folder appears only when the Policy VLAN Islands feature is enabled, and contains your
currently defined local VLANs for this domain.
Policy VLAN Islands Folder
This folder appears only when the Policy VLAN Islands feature is enabled, and contains your
currently defined VLAN islands. When you enable Policy VLAN Islands, this folder is pre−populated with a Default Island containing all the devices in the domain.
VLAN Island
Click on a VLAN island to see the devices associated with it listed in the right−panel Details View
tab. The Default Island is created by Policy Manager when you enable Policy VLAN Islands, and it cannot be deleted.
VLANs Tab 309
NetSight Policy Manager Help
Classes of Service Tab
This tab displays your Classes of Service defined for the current domain. Classes of Service prioritize traffic with an 802.1p priority, and optionally an IP type of service (ToS/DSCP) value, rate limits, and transmit queue configuration. You can then assign the class of service as a classification rule action, as part of the
Click the tree items for more information.
Classes of Service Folder
When you first install Policy Manager, the left−panel Classes of Service folder is pre−populated with eight classes of service, each associated with one of the 802.1p priorities (0−7). You can use these classes of service as is, or configure them to include ToS/DSCP, rate limit, and/or transmit queue values. You can also create your own classes of service. After you have created and defined your classes of service, they are then available when you make a class of service selection for a rule action
(Actions tab), a role default (General tab), or an automated service (General tab).
Class of Service
Classes of Service Tab 310
NetSight Policy Manager Help
Select a Class of Service in the left panel, and view information about that service in the right−panel
tabs. For more information, see How to Create a Class of Service.
CoS Components Folder
This folder contains subfolders of the possible components of a class of service (802.1p Priorities, IP
Type of Service Values, Rate Limits, Role−Based Rate Limit Port Groups, and Transmit Queue Port
Groups).
802.1p Priorities Folder
This folder contains the eight 802.1p priorities. Select a priority in the left panel, and view information about that priority in the right−panel tabs.
IP Type of Service Values Folder
This folder contains the currently defined IP type of service values. An IP type of service value appears in this folder when it has been selected for use by a class of service in the class of service
Rate Limits Folder
This folder contains the currently defined rate limits, listed in the order of precedence. For more
information, see How to Define Rate Limits.
Role−Based Rate Limit Port Groups
This folder contains subfolders that include the currently defined role−based inbound rate limit port groups. Select a port group in the left panel and view information about that group in the right−panel
tabs. For more information, see How to Create Role−Based Rate Limit Port Groups.
Transmit Queue Port Groups Folder
This folder contains subfolders that include the currently defined transmit queue port groups and the
transmit queues defined for each group. For more information, see How to Configure Transmit
Classes of Service Tab 311
Right−Panel Tabs
The Policy Manager main window is divided into two panels: a left panel and a right panel.
The right panel displays different tabs and information depending on the item selected in the left−panel tree.
Help topics for right−panel tabs are named in a manner to reflect this. For example, the help topic named
Details View Tab (Device Group), provides information on the right−panel Details View tab when a device group is selected in the left−panel tree.
In the Help Contents, double−click the Right−Panel Tabs. Under the Tabs folder, you will see folders and topics for the different right−panel tabs such as Details View and General. Expand the folders and navigate to topics describing a tab for a particular item selected in the left panel.
Right−Panel Tabs 312
Actions Tab
(Rule)
The Actions tab allows you to view and change the actions associated with a rule. A rule has two main parts:
Traffic Description and Actions. Traffic Description identifies the type of traffic to which the rule pertains.
Actions specify whether the traffic will be assigned class of service, access control (VLAN membership), or both.
When rule accounting is enabled on a device, each rule keeps a list of the ports on which it has been used.
This tab also lets you specify certain rule usage actions to take place when a "rule hit" is reported.
enabled rule's actions, Policy Manager checks for conflicts with other rules in the services and roles with
which the newly modified rule is associated. See Conflict Checking for more information.
To display the Actions tab, select a rule in the left panel's Services tab, and select the Action tab in the right panel.
Click the graphic for more information.
Class of Service
Use this area to select a class of service to associate with the rule. Policy Manager lets you define classes of service that each include an 802.1p priority, and optionally an IP type of service (ToS/DSCP) value, rate limits, and transmit queue configuration. You can then assign a class of service as a classification rule action.
See Getting Started with Class of Service and How to Create a Class of Service for more information.
Actions Tab (Rule) 313
NetSight Policy Manager Help
service, click the CoS Select button, select a class of service, and click OK.
CoS
When checked, traffic defined in the rule's Traffic Description is assigned to the selected class of service. When not checked, class of service is disabled.
Select
the rule, or change the current class of service.
Access Control
Use this area to assign access control (a VLAN) to be associated with the rule.
Access Control
To enable access control for the rule, select this checkbox. You can permit traffic to be forwarded, deny traffic altogether, or contain traffic to a VLAN.
Permit Traffic
This option allows traffic to be forwarded with the port's assigned VID.
Deny Traffic
If this option is selected, traffic will automatically be sent to a discard VLAN. If no discard VLANs
exist, a blank Discard VLANs Selection View appears. There you can create and select a new discard
VLAN to use. If there is more than one discard VLAN from which to choose, the Deny Traffic Select
button is available. This opens the Discard VLANs Selection View, where you can choose a different
default discard VLAN.
Select Button (Deny)
This button is available if you have selected Deny Traffic and there is more than one Discard VLAN
from which to choose. It opens the Discard VLANs Selection View, where you can select a different
Discard VLAN.
Contain To VLAN
This option contains traffic to a specific VLAN. It automatically opens the VLANs Selection View,
where you can choose a contain VLAN. If a contain VLAN is already selected, you can select another one by clicking the Contain To VLAN Select button.
Select Button (Contain)
Lets you change the VLAN specified for the Contain to VLAN option. Opens the Contain VLANs
Selection View, where you can choose a different VLAN.
Accounting
When rule accounting is enabled on a device, each rule keeps a list of the ports on which it has been used. Use these options to specify certain rule usage actions to take place when a "rule hit" is reported.
Generate System Log on Rule Hit
When this checkbox is selected, a syslog message is generated when the rule is used.
Actions Tab (Rule) 314
NetSight Policy Manager Help
Generate Audit Trap on Rule Hit
When this checkbox is selected, an audit trap is generated when the rule is used.
Security
When rule accounting is enabled on a device, each rule keeps a list of the ports on which it has been used. Use this option to specify a security action to take place when a "rule hit" is reported.
Disable Port on Rule Hit
When this checkbox is selected, any port reported as using this rule will be disabled. Ports that have
been disabled due to this option are displayed in the device Role/Rule tab.
Actions Tab (Rule) 315
Authentication Tab
(Device)
device. Authentication must be configured and enabled on the device in order for individual port
authentication settings to take effect (see How to Configure Ports).
To access this tab, select a device on the left panel's Network Elements tab, then click the Authentication tab in the right panel.
Click the graphic for more information.
Authentication Tab (Device) 316
NetSight Policy Manager Help
General Settings
Authentication Type
Select the appropriate single user or multi−user authentication types, or None. Only options supported by the selected device will be available for selection. Some devices support multiple authentication types and multiple users (Multi−User Authentication) per port, while others are restricted to only one or two authentication types and single users per port (Single User Authentication). Deselect all options to see what authentication types are supported by this device, or refer to the Policy
Manager/Firmware Feature Support tables in the Release Notes for information on the authentication
types supported by each device type. When you choose an authentication type, the sections unrelated
Authentication Tab (Device) 317
NetSight Policy Manager Help
to that type of authentication are grayed out on this tab and on the Port Properties Authentication
the device. For more information on the different types of authentication, see Authentication Types.
WARNING:
Switching Authentication Types, or changing the Authentication Status from Enabled to Disabled, will log off any currently authenticated users.
NOTE:
SecureStack C2/B2 Devices. Because SecureStack C2/B2 devices let you enable all three authentication types at the device level, use the Multi−User section to configure authentication types even though the device only supports a single user (and an optional IP phone) per port. The order in which authentication types are enabled at the device level may affect authentication settings that are already configured on the port. Because of this, it is important to configure authentication types at the device level first, and then configure your port−level authentication settings second.
If you are configuring a single user and an IP phone, be sure to set the port−level "number of users allowed" setting to 2. You can do this via the Port
Configuration Wizard or the Port Properties Authentication Configuration tab,
Authenticated User Counts subtab.
Authentication Status
If you've selected an authentication type other than None, you can enable it here. The default is
Disabled. Leaving Authentication Status disabled gives you the ability to configure and reconfigure authentication settings without affecting your network until authentication configuration is complete.
If you have selected multiple authentication types, all of the authentication types selected will be enabled or disabled with this one setting.
CAUTION:
Setting the authentication status to Enabled will affect communications through the front panel ports. Any front panel port being used for management should be set to inactive/default mode before setting authentication status to Enabled. If you select the Enabled button, an
Authentication Status window appears, offering you choices for actions that will take effect on front panel ports when authentication status is enabled. These options are described in detail on the Authentication
Status window. (If you choose the Select Ports to set to
Inactive/Default Role option, the Set Authentication Port Mode to
Inactive/Default Role window appears, where you can select the ports
you wish to set to Inactive/Default Role.)
Maximum Number of Users
For devices with Multi−User as their configured authentication type. The maximum number of users that can be actively authenticated or have authentications in progress at one time on this device. You
can specify the maximum number of users per port on the port's Port Properties Authentication
Current Number of Users
For devices with Multi−User as their configured authentication type. The current number of users that are actively authenticated or have authentications in progress, or that the device is keeping authentication termination information for. Any unauthenticated traffic on the port is not included in this count.
Authentication Tab (Device) 318
NetSight Policy Manager Help
Multi−User Authentication Type Precedence
Allows you to set the order in which the authentication types will be tried on the device, with the authentication type on the left having the highest precedence (it will be tried first). Select the authentication type you want to position, and use the left or right arrow to arrange the types in the desired order of precedence. The order determined here is also reflected in the position of the options
NOTE:
On Matrix E1 and Matrix E6/E7 devices, if both 802.1X and MAC authentication are enabled, it is possible for the device to receive a start or response 802.1X packet while a MAC authentication is in progress. If this happens, the device immediately terminates the MAC authentication, and the
802.1X authentication proceeds to completion. Regardless of the success of the 802.1X login attempt, no new MAC authentication logins may occur on the port until 1) the link is toggled; 2) the user executes an 802.1X logout; or 3) the 802.1X session is terminated administratively.
Apply
Saves any change you made to the General settings.
RFC3580 VLAN Authorization
RFC 3580 VLAN Authorization must be enabled on devices in networks where the RADIUS server has been configured to return a VLAN ID when a user authenticates. When RFC 3580 VLAN Authorization is enabled:
• devices that do not support policy, will tag packets with the VLAN ID.
•
devices that do support policy and also support Authentication−Based VLAN to Role Mapping, will
classify packets according to the role that the VLAN ID maps to.
You can also enable and disable VLAN Authorization at the port level using the Port Properties
VLAN Authorization Status
Allows you to enable and disable RFC 3580 VLAN Authorization for the selected device.
Apply
Saves any change you made to the VLAN Authorization setting.
Global Authentication Settings Tab
This tab lets you set session timeout and session idle timeout values for each authentication type.
Click the graphic for more information.
Authentication Tab (Device) 319
NetSight Policy Manager Help
Session Timeout
The maximum number of seconds an authenticated session may last before automatic termination of the session. A value of zero indicates that no session timeout will be applied. This value may be superseded by a session timeout value provided by the authenticating server. For example, if a session is authenticated by a RADIUS server, that server may send a session timeout value in its authentication response.
NOTE:
Non−zero values are rounded to the nearest non−zero multiple of 10 by the device.
Session Idle Timeout
The maximum number of consecutive seconds an authenticated session may be idle before automatic termination of the session. A value of zero indicates that no idle timeout will be applied. This value may be superseded by an idle timeout value provided by the authenticating server. For example, if a session is authenticated by a RADIUS server, that server may send an idle timeout value in its authentication response.
Apply
Saves any change you made to the Global Authentication Settings tab.
Web Authentication Settings Tab
For users of web−based authentication, this tab lets you specify web authentication parameters using four
sub−tabs: General, Guest Networking, Web Login, and DNS.
General Tab
where it resides. It also lets you enable certain web authentication features such as Enhanced Login Mode, on devices that support those features.
Click the graphic for more information.
Authentication Tab (Device) 320
NetSight Policy Manager Help
Enhanced Login Mode
Enabling the Enhanced Login Mode causes the authentication web page to be displayed regardless of whether the URL or IP address entered into the browser by the end user is the designated Web
Authentication URL or IP address. This option is grayed out if the device does not support the mode.
Logo Display Status
Specifies whether the Enterasys Networks logo is displayed or hidden on the authentication web page window. This option is grayed out if not supported by the device.
WINS/DNS Spoofing
Allows you to enable and disable WINS/DNS spoofing for the selected device. Spoofing allows the end user to resolve the Web Authentication URL name to the IP address using WINS/DNS. The default is Disabled. This option is grayed out if not supported by the device.
Authentication Protocol
Authentication protocol being used (PAP or CHAP). PAP (Password Authentication Protocol) provides an automated way for a PPP (Point−to Point Protocol) server to request the identity of user, and confirm it via a password. CHAP (Challenge Handshake Authentication Protocol), the more secure of the two protocols, provides a similar function, except that the confirmation is accomplished using a challenge and response authentication dialog.
Web Authentication URL
URL for your authentication web page. Users wishing to receive network services access the web page from a browser using this URL. The http:// is supplied. Alphabetical characters, numerical characters and dashes are allowed as part of the URL, but dots are not. The default URL is secureharbour
. The URL needs to be mapped to the Web Authentication IP address in DNS or in the hosts file of each client. It must be resolvable via DNS/WINS, either on the device or at corporate, assuming the Web Authentication mapping has been set up on the corporate DNS/WINS service. This option is grayed out if not supported by the device.
Web Authentication IP Address
IP address of your authentication web page server. If you have specified a Web Authentication URL, the IP address needs to be mapped to the URL in DNS or in the hosts file of each client.
Apply
Saves any change you made to the General tab.
Authentication Tab (Device) 321
NetSight Policy Manager Help
Guest Networking Tab
The Guest Networking tab lets you configure guest networking, a feature that allows any user to access the network and obtain a guest policy without having to know a username or password. The user accesses the authentication web page, where the username and password fields are automatically filled in, allowing them to log in as a guest. If the user does not want to log in as a guest, they can type in their valid username and password to log in.
NOTE:
Guest networking is designed for networks using web−based authentication, with port mode set to
Active/Discard.
Click the graphic for more information.
Guest Networking Status
Use the drop−down list to specify guest networking status:
•
Disable −− Guest networking will be unavailable.
•
Local Auth −− Guest Networking will be enabled. The user accesses the authentication web
page where the username field is automatically filled in with the specified Guest Name. Once
the user submits the web page using this guest name, the default policy of that port becomes
• the active policy. The port mode must be set to Active/Discard mode.
RADIUS Auth −− Guest Networking will be enabled. The user accesses the authentication
web page, where the username field is automatically filled in with the specified Guest Name,
and the password field is masked out with asterisks. Once the user submits the web page
using these credentials, the value of the Guest Password will be used for authentication.
Following successful authentication from the RADIUS server, the port will apply the policy
(role) returned from the RADIUS server. The port mode must be set to Active/Discard mode.
Guest Name
The username that Guest Networking will use to authenticate users. The guest name is displayed automatically on the authentication web page. If the user does not want to log in as a guest, they can type in their valid username to override the guest username.
Guest Password
The password that Guest Networking will use to authenticate users when RADIUS Auth is selected.
Apply
Saves any change you made to the Guest Networking tab.
Authentication Tab (Device) 322
NetSight Policy Manager Help
Web Login Tab
The Web Login tab allows you to customize the banner end users see at the top of the authentication web page and set a Redirect Time, if applicable.
Click the graphic for more information.
Web Page Banner
Use this area to create a banner that end users will see at the top of the authentication web page. For example, you might include your company name and information on what to do if the user has questions or problems. Because this banner also appears in messages that occur during successful login and failed authentication, as well as on the "Radius Busy" screen, it would not be appropriate to include "Welcome to [Your Company]" in the banner.
The Default button allows you to reset the banner to default text provided in a text file
(pwa_banner.txt). Initially, the default banner text is the Enterasys contact information. However, you can customize the text for your network by editing the pwa_banner.txt file, located in the top level of the Policy Manager install directory. Then, when you click the Default button, the new text will be displayed in the Web Page Banner area.
The default authentication web page looks like this:
Authentication Tab (Device) 323
NetSight Policy Manager Help
Redirect Time
For devices with Enhanced Login Mode enabled. Specifies the amount of time (in seconds) before the
end user is redirected from the authentication web page to their requested URL.
An endstation using DHCP requires time to transition from the temporary IP address issued by the authentication process to the official IP address issued by the network. Redirect Time specifies the amount of time allowed for the end station to complete this process and begin using its official IP address. The default value of 30 seconds is adequate for most networks; however, some networks may require a longer or shorter time period. If the Redirect Time is not long enough, the browser times out while attempting to load the requested URL. In networks that only use static IP addresses, a Redirect
Time of 5 to 10 seconds is usually sufficient; a value of less than 5 seconds is not recommended.
For example, if a user (in Enhanced Login Mode and a Redirect Time of 30 seconds) enters the URL of "http://enterasys.com", they will be presented the authentication web page. When the user
Authentication Tab (Device) 324
NetSight Policy Manager Help successfully authenticates into the network, they will see a login success page that displays "Welcome to the Network. Completing network connections. You will be redirected to http://enterasys.com in approximately 30 seconds".
Default
Resets the authentication web page banner text to the default text provided in the text file, pwa_banner.txt. The default banner text is the Enterasys contact information. However, you can customize the text for your network by editing the pwa_banner.txt file, located in the top level of the
Policy Manager install directory. Clicking Default also sets the Redirect Time field to the default value of 30 seconds.
Apply
Saves any change you made to the Web Login tab.
DNS Tab
on Matrix E1 devices. Enhanced Login Mode must be enabled in order to use this tab. The DNS servers are used to resolve URLs to IP addresses.
Click the graphic for more information.
DNS Domain Name
Enter your local DNS Domain Name, for example, Enterasys.com.
DNS Server Addresses
List your local DNS Server Addresses. Enter an IP address and click Add to add a server address.
Select an address and click Remove to remove an address from the list. Addresses are used in the order they are listed.
Apply
Saves any change you made to the DNS tab.
MAC Authentication Settings Tab
to work, you must also configure the RADIUS server with the MAC password as well as the MAC addresses which are allowed to authenticate.
Authentication Tab (Device) 325
NetSight Policy Manager Help
Click the graphic for more information.
MAC User Password
The password that will be passed to the RADIUS server for MAC authentication (1−32 characters).
MAC Mask
You can select a mask, however, masking a MAC address is only supported on Matrix N−Series
Platinum devices. Using a mask provides a way to authenticate end stations based on a portion of their
MAC address. For example, you could specify a mask that would base authentication on the manufacturers ID portion of the MAC address. The MAC Mask is passed to the RADIUS server for authentication after the primary attempt to authenticate using the full MAC address fails.
Apply
Saves any change you made to the MAC Authentication Settings tab.
CEP Tab
This tab provides a way to identify Convergence End Points (IP phones) that are connecting to the device, and apply a role to the endpoint based on the type of endpoint detected. The CEP Detection sub−tab lets you create detection rules for identifying the endpoints, and the CEP Role Mappings sub−tab lets you map a role to each CEP product type.
TIP:
You can configure CEP for multiple devices using the Device Configuration
In addition to configuring CEP on the device, you must also enable CEP protocols on each port using the CEP
Once you have configured CEP on the device and each port, you can monitor CEP usage on the Port Usage
Tab (Port) or Port Usage Tab (Device).
CEP Role Mappings Tab
This tab lets you select the CEP product types supported on the device, and map a role for each type. Then, when a convergence endpoint (such as an IP phone) connects to the network, the device identifies the type of endpoint (using CEP detection rules) and applies the assigned role.
Click the graphic for more information.
Authentication Tab (Device) 326
NetSight Policy Manager Help
CEP Role Mappings
Lists the CEP types supported by the device and the role mapped to each type. Click Add to add a
CEP type and role to the list.
Add
Opens the Add CEP Mapping window where you can select a CEP product type supported on the device, and map a role for that type. Your selections will be added to the CEP Role Mappings list.
Remove
To remove a CEP type in the CEP Role Mappings list, select the type and and click Remove.
Edit
To edit a CEP type in the CEP Role Mappings list, select the type and click Edit. The Edit CEP
Mapping window opens where you can select a different CEP type and/or role.
Apply
Saves any changes you have made in the CEP Role Mappings tab.
CEP Detection Tab
Use this tab to create CEP detection rules that are used to determine if a connecting end−system is a CEP device, and what type of CEP device it is. This allows Policy Manager to assign the appropriate role to the port based on the type of CEP device detected.
NOTE:
CEP detection rules apply only to Siemens, H.323, and SIP (Session Initiation Protocol) phone detection. Cisco detection uses CiscoDP as its detection method.
CEP detection rules are based on two detection methods:
•
TCP/UDP Port Number detection − Many CEP vendors use specific TCP/UDP port numbers for call setup on their IP phones. You can create detection rules that identify CEP devices based on specific
TCP/UDP port numbers. By default, Siemens Hi−Path phones will be detected on TCP/UDP port
•
4060.
IP Address detection − H.323 phones use a reserved IP multicast address and UDP port number for call setup. You can create detection rules that will detect an IP phone based on its IP address in combination with an IP address mask. By default, H.323 phones will be detected using the multicast
Authentication Tab (Device) 327
NetSight Policy Manager Help address 224.0.1.41 and the TCP/UDP ports 1718, 1719, and 1720. SIP phones will be detected using the multicast address 224.0.1.75 and the TCP/UDP port 5060. H.323 and SIP phones will also be detected using only their respective multicast addresses without the TCP/UDP ports.
Click the graphic for more information.
Priority
The rule priority with one (1) being the highest priority. The rule with the highest priority will be used first, so it is recommended that the highest priority be given to the predominate protocol in the network to provide for greater efficiency.
Address
If the rule is based on IP address detection, this field displays the IP address that incoming packets will be matched against. By default, H.323 will use 224.0.1.41 as its IP address, SIP will use
224.0.1.75 as its IP address, and Siemens will have no IP address configured.
Address Mask
If the rule is based on IP address detection, this field displays the IP address mask that incoming packets will be matched against.
End Point Type
Specifies the endpoint type that will be assigned (H.323, Siemens, or SIP) if incoming packets match this rule.
Protocol
If the rule is based on TCP/UDP port detection, this field displays the protocol type used for matching, using a port range defined with the Port Low and Port High values:
•
UDP + TCP − Match the port number for both UDP and TCP frames.
•
TCP − Match the port number only for TCP frames.
•
UDP − Match the port number only for UDP frames.
Port Low
The low end of the port range defined for detection on UDP and/or TCP ports.
Authentication Tab (Device) 328
NetSight Policy Manager Help
Port High
The high end of the port range defined for detection on UDP and/or TCP ports.
Add
Opens the Add CEP Detection Rule window where you can create CEP detection rules.
Remove
To remove a CEP detection rule, select the entry and and click Remove.
Edit
To edit a CEP detection rule, select the rule and click Edit. The Edit CEP Detection Rule window
opens where you edit the rule's parameters.
Apply
Saves any changes you have made in the CEP Detection tab.
Authentication Tab (Device) 329
Authentication Tab
(Device Group)
device group. To access this tab, select a device group in the left−panel Network Elements tab, then click the
Authentication tab in the right panel.
TIP:
Use the device Authentication tab to configure authentication settings for an individual
device.
Click the graphic for more information.
Device
Name or IP address of the device.
Type
Authentication type(s) for the device (802.1x, MAC, or Web−Based), or None. If the value is None, authentication is disabled. For devices that support multiple authentication types (such as the Matrix
N−Series), the authentication types are displayed in order of precedence, with the authentication type on the left having the highest precedence (it will be tried first). You can specify authentication type
precedence on the device's Authentication tab.
Status
Indicates whether or not authentication is enabled on the device. If multiple authentication types are configured on the device, this status applies to all authentication types.
WINS/DNS Spoofing
For web−based authentication, the WINS/DNS spoofing status of the device (Enabled or Disabled).
Spoofing allows the end user to resolve the Web Authentication URL name to the IP address using
WINS/DNS.
Protocol
For web−based authentication, the authentication protocol being used (PAP or CHAP). PAP
(Password Authentication Protocol) provides an automated way for a PPP (Point−to Point Protocol) server to request the identity of user, and confirm it via a password. CHAP (Challenge Handshake
Authentication Tab (Device Group) 330
NetSight Policy Manager Help
Authentication Protocol), the more secure of the two protocols, provides a similar function, except that the confirmation is accomplished using a challenge and response authentication dialog.
Current Number of Users
For Matrix N−Series devices. The current number of users that are actively authenticated or have authentications in progress, or that the device is keeping authentication termination information for.
Maximum Number of Users
For Matrix N−Series devices. The maximum number of users that can be actively authenticated or have authentications in progress at one time. You can specify the maximum number of users per port
on the Port Properties Authentication Configuration tab.
Web Authentication URL
For web−based authentication, the authentication login web page address.
Web Authentication IP
For web−based authentication, the IP address of the system where the authentication login web page resides.
Web Authentication Logo Display
For web−based authentication, indicates whether the Web Authentication Logo is displayed (show) or hidden (hide) on your Login Web Page Banner window. If the device does not support this option, the column will read N/A.
Enhanced Login Mode
For web−based authentication, indicates whether Enhance Login Mode is enabled or disabled on the device. When Enhanced Login Mode is enabled, it causes the authentication web page to be displayed regardless of whether the URL entered into the browser by the end user is the Web Authentication
URL or not.
Button
Retrieve
Retrieves the latest authentication information from the devices and displays it in the table.
Authentication Tab (Device Group) 331
Authentication Tab
(My Network/All Devices Folder)
access this tab, select either the My Network or the All Devices folder in the left−panel Network Elements tab, then click the Authentication tab in the right panel.
TIP:
Use the device Authentication tab to configure authentication settings for an individual
device.
Click the graphic for more information.
Device
Name or IP address of the device.
Type
Authentication type(s) for the device (802.1X, MAC, or Web−Based), or None. If the value is None, authentication is disabled. For devices that support multiple authentication types (such as the Matrix
N−Series), the authentication types are displayed in order of precedence, with the authentication type on the left having the highest precedence (it will be tried first). You can specify authentication type
precedence on the device's Authentication tab.
Status
Indicates whether or not authentication is enabled on the device. If multiple authentication types are configured on the device, this status applies to all authentication types.
WINS/DNS Spoofing
For web−based authentication, the WINS/DNS spoofing status of the device (Enabled or Disabled).
Spoofing allows the end user to resolve the Web Authentication URL name to the IP address using
WINS/DNS.
Protocol
For web−based authentication, the authentication protocol being used (PAP or CHAP). PAP
(Password Authentication Protocol) provides an automated way for a PPP (Point−to Point Protocol) server to request the identity of user, and confirm it via a password. CHAP (Challenge Handshake
Authentication Protocol), the more secure of the two protocols, provides a similar function, except
Authentication Tab (My Network/All Devices Folder) 332
NetSight Policy Manager Help that the confirmation is accomplished using a challenge and response authentication dialog.
Current Number of Users
For Matrix N−Series devices. The current number of users that are actively authenticated or have authentications in progress, or that the device is keeping authentication termination information for.
Maximum Number of Users
For Matrix N−Series devices. The maximum number of users that can be actively authenticated or have authentications in progress at one time. You can specify the maximum number of users per port
on the Port Properties Authentication Configuration tab.
Web Authentication URL
For web−based authentication, the authentication login web page address.
Web Authentication IP
For web−based authentication, the IP address of the system where the authentication login web page resides.
Web Authentication Logo Display
For web−based authentication, indicates whether the Web Authentication Logo is displayed (show) or hidden (hide) on your Login Web Page Banner window. If the device does not support this option, the column will read N/A.
Enhanced Login Mode
For web−based authentication, indicates whether Enhance Login Mode is enabled or disabled on the device. When Enhanced Login Mode is enabled, it causes the authentication web page to be displayed regardless of whether the URL entered into the browser by the end user is the Web Authentication
URL or not.
Button
Retrieve
Retrieves the latest authentication information from the devices and displays it in the table.
Authentication Tab (My Network/All Devices Folder) 333
Port Properties
Authentication Configuration Tab
settings for a port. Authentication must be configured and enabled on the device in order for individual port authentication settings to take effect. Only those areas of the tab that relate to the authentication type configured on the device are available for editing.
There are two ways to access the Authentication Configuration tab:
•
Select a device in the left−panel Network Elements tab and expand a slot or ports grouping in the right−panel Details view. Right−click on a port and select Properties from the menu. In the Port
•
Properties window, select the Authentication Configuration tab (in the top row of tabs).
Select a port in the left−panel Port Groups tab, then select the Authentication Configuration tab in the right panel.
The Authentication Configuration tab has six sub−tabs:
•
•
RFC3580 VLAN Authorization Tab
•
•
Automatic Re−Authentication Tab
•
•
General Tab
This tab displays general authentication and port mode information about the port.
Click the graphic for more information.
Port PropertiesAuthentication Configuration Tab 334
NetSight Policy Manager Help
Device Authentication Type(s)
Authentication type(s) configured on the device (802.1X, Web−Based, MAC, or None). Some devices
support multiple authentication types and multiple users (Multi−User authentication) per port, while others are restricted to only one or two authentication types and single users per port (Single User authentication). If the value is None, all types of authentication are disabled at the device level, and port authentication settings cannot be configured and will not take effect.
Device Authentication Status
Indicates whether or not the authentication type(s) configured on the device are enabled or not. If multiple authentication types are configured on the device, this status applies to all authentication types. If Authentication Status is disabled at the device level, port authentication settings will not take effect.
Port Mode
This area displays the current port mode for the port, and allows you to change the settings if desired. Port mode defines whether or not a user is required to authenticate on a port, and how unauthenticated traffic will be handled. It is a combination of Authentication Behavior (whether or not authentication is enabled on the port), and Unauthenticated Behavior (whether unauthenticated traffic will be assigned to the port's default role
or discarded). See Port Mode for a complete description of each port mode.
In addition, this section provides checkboxes that allow you to disable a specific authentication type at the port level.
Authentication Behavior
Select an option to specify whether or not authentication is enabled on the port. (See Port Mode for
more information.) If you set the port's Authentication Behavior to Active (i.e., you enable
authentication for the port), it is recommended that you enable the Drop VLAN Tagged Frames
feature.
Port Mode 335
NetSight Policy Manager Help
NOTE:
On Matrix N−Series devices, Authentication Behavior must be set to Active for authentication to be allowed using CEP Protocols.
Unauthenticated Behavior
NOTE:
For Single User 802.1X and 802.1X+MAC authentication types:
−− Active/Default Role mode requires that a default role be set on the port.
−− Active/Discard mode requires that any default role set on the port is cleared.
For Multi−User Web−based authentication:
−− Active/Discard mode is not supported.
Disable 802.1X Authentication for this port
Select this checkbox to disable 802.1X authentication at the port level. If the device is only configured with 802.1X authentication, selecting this checkbox will result in the port Authentication Behavior being set to Inactive.
NOTE:
For Single User 802.1X+MAC authentication with Active/Default Role as the selected port mode: Disabling 802.1X authentication also disables MAC authentication on the port. An end user connecting to the port will not be able to authenticate via 802.1X or
MAC. The port will behave as if Inactive/Default Role is the selected port mode.
Disable Web−Based Authentication for this port
Select this checkbox to disable web−based authentication at the port level. If the device is only configured with web−based authentication, selecting this checkbox will result in the port
Authentication Behavior being set to Inactive.
NOTE:
For Multi−User Web−Based authentication with Active/Discard as the selected port mode: This checkbox is automatically selected because multi−user web−based authentication does not support the Active/Discard port mode.
Disable MAC Authentication for this port
Select this checkbox to disable MAC authentication at the port level. If the device is only configured with MAC authentication, selecting this checkbox will result in the port Authentication Behavior being set to Inactive.
Disable CEP protocols in the CEP Access tab
Use the CEP Access tab to disable CEP protocols at the port level.
Apply Button
Applies any Port Mode changes to the port.
RFC3580 VLAN Authorization Tab
This tab lets you enable or disable RFC 3580 VLAN Authorization on the port and specify an egress state.
RFC 3580 VLAN Authorization must be enabled in networks where the RADIUS server has been configured to return a VLAN ID when a user authenticates. When RFC 3580 VLAN Authorization is enabled:
• ports on devices that do not support policy, will tag packets with the VLAN ID.
•
ports on devices that do support policy and also support Authentication−Based VLAN to Role
Mapping, will classify packets according to the role that the VLAN ID maps to.
RFC3580 VLAN Authorization Tab 336
NetSight Policy Manager Help
If the device does not support RFC 3580, this tab will be grayed out.
Click the graphic for more information.
RFC3580 VLAN Authorization
VLAN Authorization Status
Allows you to enable and disable RFC 3580 VLAN Authorization for the selected port. This option is grayed out if not supported by the device.
VLAN Authorization Admin Egress
Allows you to modify the VLAN egress list for the VLAN ID returned by the RADIUS server when a user authenticates on the port:
•
None − No modification to the VLAN egress list will be made.
•
Tagged − The port will be added to the list with the egress state set to Tagged (frames will be
• forwarded as tagged).
Untagged − The port will be added to the list with the egress state set to Untagged (frames
• will be forwarded as untagged).
Dynamic − The port will use information returned in the RADIUS response to modify the
VLAN egress list. This value is supported only if the device supports a mechanism through which the egress state may be returned in the RADIUS response.
The current egress settings for the port are displayed in the VLAN Oper Egress column in the End
User Sessions table on the Port Usage tabs. These options are grayed out if not supported by the device.
Apply Button
Saves any change you made to the VLAN Authorization settings.
RFC3580 VLAN Authorization 337
NetSight Policy Manager Help
Login Settings Tab
This tab displays the current login settings for the port and allows you to change the settings if desired. The options available depend on what type(s) of authentication are enabled on the device.
Click the graphic for more information.
Login Settings
Number of Attempts Before Timeout
Number of times a user can attempt to log in before authentication fails and login attempts are not allowed. For web−based authentication, valid values are 1−2147483647, zero is not allowed, and the default is 2. For 802.1X and MAC authentication, this value is permanently set to 1.
Hold Time (seconds)
Amount of time (in seconds) authentication will remain timed out after the specified Number of
Attempts Before Timeout has been reached. Valid values are 0−65535. The default is 60. (Hold Time is also known as Quiet Period in web−based and MAC authentication.)
Authentication Request Period
For 802.1X authentication, how often (in seconds) the device queries the port to see if there is a new user on it. If a user is found, the device then attempts to authenticate the user. Valid values are
1−65535. The default is 30.
User Timeout
For 802.1X authentication, the amount of time (in seconds) the device waits for an answer when querying the port for the existence of a user. Valid values are 1−300. The default is 30.
Authentication Server Timeout
Login Settings Tab 338
NetSight Policy Manager Help
For 802.1X authentication, if a user is found on the port, the amount of time (in seconds) the device waits for a response from the authentication server before timing out. Valid values are 1−300. The default is 30.
Port Handshake Requests Before Failure
For 802.1X authentication, the number of times the device tries to finalize the authentication process with the user, before the authentication request is considered invalid and authentication fails. Valid values are 1−10. The default is 2.
Apply Button
Applies the Login Settings changes to the port.
Automatic Re−Authentication Tab
This tab is grayed−out if only web−based authentication is enabled on the device. For 802.1X and MAC authentication, the Automatic Re−Authentication tab lets you set up the periodic automatic re−authentication of logged−in users on this port. Without disrupting the user's session, the device repeats the authentication process using the most recently obtained user login information, to see if the same user is still logged in.
Authenticated logged−in users are not required to log in again for re−authentication, as this occurs "behind the scenes."
Click the graphic for more information.
Automatic Re−Authentication
Re−Authentication Status
If Active is selected, the re−authentication feature is enabled. If Inactive is selected, the re−authentication feature is disabled.
Automatic Re−Authentication Tab 339
NetSight Policy Manager Help
Re−Authentication Frequency
How often (in seconds) the device checks the port to re−authenticate the logged in user. Valid values are 1−2147483647. The default is 3600.
Apply Button
Applies the Automatic Re−Authentication changes to the port.
Authenticated User Counts Tab
This tab provides authenticated user count information for devices with Multi−User as their configured
type.
Click the graphic for more information.
Authenticated User Counts
Current Number of Users
The current number of users that are actively authenticated or have authentications in progress on this interface. If multi−user authentication is disabled, this number will be 0 (zero). Any unauthenticated traffic on the port is not included in this count.
Number of Users Allowed (up to n)
Displays the number of users (up to the maximum number allowed) that can be actively authenticated or have authentications in progress at one time on this interface, and allows you to change the number if desired. If you set this value below the current number of users, end user sessions exceeding that number will be terminated.
NOTE:
SecureStack B2/C2 Devices. If you are configuring a single user and an IP phone per port, set this value to 2.
Authenticated User Counts Tab 340
NetSight Policy Manager Help
Number of MAC Users Allowed (up to n)
Displays the number of users (up to the maximum number allowed) that can be actively authenticated via MAC authentication, or have MAC authentications in progress at one time on this interface, and allows you to change the number if desired. The number of MAC users allowed cannot exceed the number of users allowed. If you set this value below the current number of users, end user sessions exceeding that number will be terminated. If MAC is not selected as a Multi−User authentication type
on the device Authentication tab, this field will be grayed out.
Apply Button
Applies User Counts changes to the port.
CEP Access Tab
This tab lists all the CEP (Convergence End Point) protocols supported by the device that the port resides on, and lets you enable or disable them for that port. For devices that do not support CEP, the tab will be blank.
NOTE:
On Matrix N−Series devices, Port Mode Authentication Behavior must be set to Active
(on the General sub−tab) for authentication to be allowed using these CEP Protocols.
protocols on the port, you must also configure CEP for the device the port resides on. You can configure CEP
Click the graphic for more information.
CEP Access
Lists all the CEP protocols supported by the device that the port resides on. Use the checkboxes to enable or disable CEP protocols on this port. If the device does not support the CEP feature, this area
CEP Access Tab 341
NetSight Policy Manager Help is blank.
Enable All Button
Selects all the checkboxes and enables all the CEP protocols for this port.
Disable All Button
Deselects all the checkboxes and disables all the CEP protocols for this port.
Apply Button
Applies CEP access changes to the port.
CEP Access Tab 342
Details View Tabs
Some Details View tabs display a simple list of items for the current selection in the left panel. However, other Details View tabs present more complex tables of information. To access Help topics on those tabs, expand the Details View Tabs folder in the Policy Manager Help Table of Contents. The Help topics are named to reflect the item selected in the left−panel tree. For example, the Help topic for the Details View tab with a device selected in the left panel is named Details View Tab (Device).
Most Details View tabs provide the following features:
•
Right−click menus: Right−click an item for a menu of options.
•
Drag and drop: Populate services and service groups in the left panel by dragging and dropping multiple selections from the right−panel Details View lists. For example, in the right panel Details
•
View for a service, you can select a rule and drag it into another service in the left panel.
Sorting, filtering and finding: Clicking on column headings sorts the column. Right−clicking on
•
column headings opens a menu enabling you to perform sort, filter, and find operations.
Double−click opening: Double−clicking an item opens a tab containing more information about the item, often the Details View tab detailing the components of the item, or the General tab for the item.
Details View Tabs 343
Details View Tab
(802.1p Priorities
Folder)
This tab appears when you select the 802.1p Priorities folder in the left−panel Classes of Service tab. It displays a table of information about the eight priorities defined in the 802.1p specifications, and how they are being used in Policy Manager.
The listed priorities have values of 0−7 (with 7 being the highest priority), and are used to determine the order
Priority−Based Rate Limits for more information.
Click the graphic for more information.
Name
Name of the 802.1p priority.
Priority
Priority ranking of the 802.1p priority (0−7, with 7 being the highest priority).
Roles
Number of roles associated with the 802.1p priority.
Defined Rules
Total number of rules utilizing this 802.1p priority. This includes rules that are enabled and are part of at least one role (applied rules), as well as rules not yet assigned to any roles.
Applied Rules
Number of rules utilizing this 802.1p priority that are enabled and are part of at least one role.
Inbound Rate Limit
The priority−based inbound rate limit associated with the priority, if any. Otherwise, N/A. The rate limit sets the highest rate of speed at which traffic can enter a port before packets will be dropped.
Details View Tab (802.1p Priorities Folder) 344
NetSight Policy Manager Help
Outbound Rate Limit
The priority−based outbound rate limit associated with the priority, if any. Otherwise, N/A. The rate limit sets the highest rate of speed at which traffic can exit a port before packets will be dropped.
Details View Tab (802.1p Priorities Folder) 345
Details View Tab
(Automated Services Folder)
available for Manual services, IP address is the only rule type available for Automated services.
To access this tab, select the Automated Services folder on the left−panel Services tab. To see a menu of options available for a service, right−click the service.
TIP:
You can easily add a service to a service group by dragging and dropping a service from this
Details View tab to a service group in the left−panel tree.
Click the graphic for more information.
Name
Name of the service.
Number of Rules
Automated services automatically create an IP address rule for each IP address in the selected network resource group. This column indicates the number of those IP address rules associated with this service.
Included in Roles
Number of roles the service is a part of.
Service Type
Indicates that the service is an Automated service.
Network Resources
The network resource group to which the service applies.
VLAN
Name of the VLAN with which the service is associated, if applicable.
Class of Service
Name of the class of service with which the service is associated, if applicable.
Details View Tab (Automated Services Folder) 346
NetSight Policy Manager Help
Details View Tab (Automated Services Folder) 347
Details View Tab
(Rate Limits Folder)
This tab lists information on any rate limits that have been defined in Policy Manager. To access this tab, select the Rate Limits folder in the left−panel Classes of Service tab, then select the Details View tab in the
right panel.. See How to Define Rate Limits for more information.
Click the graphic for more information.
Name
Name of the rate limit.
Precedence
Order in which priority−based rate limits will be written to devices that support them. Policy Manager allows you to define as many priority−based rate limits as you wish; however, the number written to a
information.
NOTE:
Although all rate limits have a precedence and show up in this list, only rate limits that include a priority−based configuration will actually be written to a device.
Direction
Indicates whether the rate limit is for inbound or outbound traffic.
802.1p Priorities
Rate limits with a priority−based rate limit configuration will display the 802.1p priorities (0−7, with
7 being the highest priority) associated with the rate limit. Rate limits with only a role−based rate limit configuration will display "None."
Details View Tab (Rate Limits Folder) 348
Details View Tab
(Classes of Service Folder)
This tab appears when you select the Classes of Service folder on the left−panel Classes of Service tab. It displays a table of information about the classes of service defined in the current domain.
When you first install Policy Manager, this folder is pre−populated with eight classes of service, each associated with one of the 802.1p priorities (0−7). You can use these predefined classes of service or create your own classes of service. After you have created and defined your classes of service, you can assign them
Started with Class of Service and How to Create a Class of Service for more information.
Click the graphic for more information.
Name
Name of the class of service.
Priority
Priority associated with the class of service.
Priority−Based IRL
If the priority is associated with a priority−based inbound rate limit (IRL), this column displays the limit. This rate limit indicates the highest rate of speed (in kilobits, megabits, or gigabits per second)
at which incoming traffic will be accepted by the port before packets will be dropped. See Defining
Priority−Based Rate Limits for more information.
Priority−Based ORL
If the priority is associated with a priority−based outbound rate limit (ORL), this column displays the limit. This rate limit indicates the highest rate of speed (in kilobits, megabits, or gigabits per second) at which outgoing traffic will be transmitted from the port before packets will be dropped. See
Defining Priority−Based Rate Limits for more information.
ToS Value
more information.
Details View Tab (Classes of Service Folder) 349
NetSight Policy Manager Help
Transmit Queue Index
The transmit queue index associated with this class of service, if any. An index, when looked up in
the mapping table, provides the desired physical transmit queue for each port group. See How to
Create a Class of Service for more information.
Role−Based IRL Index
The role−based inbound rate limit index associated with this class of service, if any. An index, when
Details View Tab (Classes of Service Folder) 350
Details View Tab
(CoS Components Folder)
This tab appears when you select the CoS Components folder in the left−panel Classes of Service tab. It lists
information about these components.
Click the graphic for more information.
Name
Name of the class of service component.
Details View Tab (CoS Components Folder) 351
Details View Tab
(Device)
This tab appears when you select a device in the left−panel Network Elements tab. Multi−module devices such as the Matrix N−Series will display slot numbers according to which slots have modules in them, and a
Logical Ports grouping (if you have the Hide Logical Ports feature deselected in the Options view.)
Stand−alone devices and single−module devices will simply display a Ports grouping. Expand a slot or ports grouping to display a table of information about the ports on the device. To see a menu of options available for a port, right−click the port.
Click the graphic for more information.
Slot
Multi−module devices display slot numbers according to which slots have modules in them, and a
Logical Ports grouping (if you have the Hide Logical Ports feature deselected in the Options view.)
Stand−alone devices and single−module devices will simply display a Ports grouping.
Port
Name of the port, constructed of the name or IP address of the device and either the port index number or the port interface name.
Port Index
The index value assigned to the port interface.
Default Role
See Default Role in the Concepts topic for information on default roles. For additional information,
Details View Tab (Device) 352
NetSight Policy Manager Help
Current Role
Current role assigned to the port, through successful authentication or assignment of the default role.
This is determined by the device, based on the configuration settings that have been applied to the
port (Port Properties Authentication Configuration tab).
Interface Name
A description of the port.
Port Type
Type of port. Possible values include: Access, CDP, CDP FTM 1 Backplane, FTM 1 Backplane, and
Logical.
Port Speed
Speed of the port. Possible values include: 10/100, speed in megabits per second (for example, 800.0
Mbps), Unknown (displayed for logical ports).
User Name
User ID of the user currently or most recently authenticated on the port.
Port Mode
unable to determine the port mode (e.g., for logical ports), Unknown is displayed.
Authentication State
Current state of the port with regard to authentication. If "None," authentication is not enabled on the device. Matrix N−Series devices that support multiple authenticated users per port will display N/A
(Not Applicable) for this column.
For web−based authentication:
•
Disconnected − There is no end user currently logged in on the port.
•
Authenticating − An end user is in the process of logging in and being authenticated.
•
Authenticated − An end user is currently logged in and authenticated.
•
Held − The port is locked and authentication attempts are not allowed. Occurs when, for example, an end user tries to log in several times with an incorrect password.
For 802.1X authentication:
•
Initialize − The port is initializing. One reason for this is that the device has been reset.
•
Disconnected − There is no end user currently logged in on the port.
•
Connecting − The port is establishing communication with an end user.
•
Authenticating − An end user is in the process of logging in and being authenticated.
•
Authenticated − An end user is currently logged in and authenticated.
•
Aborting − The authentication procedure is being prematurely terminated due to, for
• example, a re−authentication request or an authentication timeout.
Held − The port is locked and authentication attempts are not allowed. Occurs when, for
• example, an end user tries to log in several times with an incorrect password.
Default Role − An end user has connected and is using the port's default role. Occurs when
•
the port mode is set to Inactive/Default (see Port Mode for more information).
No Authentication − No end user can be authenticated because the port mode is set to
Inactive/Discard (see Port Mode for more information).
Details View Tab (Device) 353
NetSight Policy Manager Help
NOTE:
RoamAbout R2 devices always show "Authenticating" as their Authentication State.
Because R2 devices can have multiple users authenticated to the same port,
"Authenticating" simply denotes that the port is currently open for users to authenticate.
Last Login Result
(Web−based authentication only) Indicates the result (success/failure) of the last attempt to log in to this port. Possible results are as follows:
•
Not logged in since last reset − No login in since reset.
•
Authentication accepted − User logged in successfully.
•
Authentication rejected
•
Username or password mismatch
•
User misconfiguration (e.g. Deny Remote Permission in Active Directory Users).
or, when two RADIUS servers are configured in the device:
•
Mismatched Shared Secret in a primary RADIUS server or both RADIUS servers.
•
Unsupported protocol (e.g. CHAP) configured on the device.
•
Unknown policy − No policy (Role) defined in the device.
•
Unknown authentication server response − When one RADIUS server is configured in the device:
•
Wrong Authentication UDP port number defined.
•
Mismatched Shared Secret.
•
RADIUS server is not contactable, or RADIUS server is down.
•
Unsupported protocol (e.g. CHAP) configured on the device.
•
Unknown authentication client error − User enters no username and password.
•
Auth client disabled or unavailable − RADIUS server is disabled in the device.
•
Port authentication pending − Port is in the process of authenticating.
•
Port held for too many failed attempts − User reached the maximum number of failed
• attempts to log in.
Port held: Max attempts exceeded − User exceeded the maximum number of failed
• attempts to log in once the port has been held.
Authentication server timeout − When two RADIUS servers are configured in the device:
•
Wrong Authentication UDP port number defined in a primary RADIUS server or
• both RADIUS servers.
RADIUS servers are not contactable
•
Unsupported protocol (e.g. CHAP) configured on the device.
Drop VLAN Tagged Frames
Indicates whether or not the Drop VLAN Tagged Frames feature is enabled on the port.
TCI Overwrite
Indicates whether or not TCI Overwrite is enabled on the port. TCI Overwrite is required for Tagged
Packet VLAN to Role Mapping. Ports on devices that do not support TCI Overwrite will display N/A
(Not Applicable) for this column.
MAC Locking
Indicates whether or not MAC locking is enabled on the port.
Details View Tab (Device) 354
Details View Tab
(Device Group)
This tab is displayed when you select a device group from the left−panel Network Elements tab. It displays a table of information about the devices in the device group. If you right−click a device in the table, a menu of available options appears.
Click the graphic for more information.
Name
Name of the device, or its IP address if it does not have a name.
IP Address
The device's IP address.
Status
The device's current operational status.
Device Type
Indicates the type of device. Certain devices may be listed as "Authentication Only" (supports 802.1X
and RFC 3580 only; does not support Policy).
Firmware Version
Shows the current firmware revision for this device.
Details View Tab (Device Group) 355
Details View Tab
(IP Type of Service Values
Folder)
This tab appears when you select the IP Type of Service Values folder on the left panel's Classes of Service tab. It lists the currently defined IP type of service values. IP type of service values appear in this folder when
they have been created for a class of service (see How to Create a Class of Service).
Click the graphic for more information.
Name
Name of the IP type of service value (see IP Type of Service for more information).
Details View Tab (IP Type of Service Values Folder) 356
Details View Tab
(Manual Services Folder)
traffic for a particular network service or application) should be handled. Manual services consist of one or
applying customized sets of rules to roles.
To display this tab, select the Manual Services folder on the left−panel Services tab. To see a menu of options available for a service, right−click the service.
TIP:
You can easily add a service to a service group by dragging and dropping a service from this
Details View tab to a service group in the left−panel tree.
Click the graphic for more information.
Name
Name of the service.
Number of Rules
Number of Traffic Classification Rules associated with the service.
Included in Roles
Number of roles the service is a part of.
Service Type
Indicates that the service is a Manual service.
Network Resources
This column is not applicable for Manual services.
VLAN
This column is not applicable for Manual services.
Class of Service
This column is not applicable for Manual services.
Details View Tab (Manual Services Folder) 357
NetSight Policy Manager Help
Details View Tab (Manual Services Folder) 358
Details View Tab
(My Network/All Devices Folder)
This Details View tab displays a table of information about all the devices in the current domain. To access this tab, select either the My Network or the All Devices folder in the left−panel Network Elements tab. The
Details View is displayed in the right panel. To see a menu of options available for a device, right−click the device.
Click the graphic for more information.
Name
Name of the device, or its IP address if it does not have a display name.
IP Address
The device's IP address.
Status
The device's current operational status.
Device Type
Indicates the type of device. Certain devices may be listed as "Authentication Only" (supports 802.1X
and RFC 3580 only; does not support Policy).
Firmware Version
Shows the current firmware revision for this device.
Details View Tab (My Network/All Devices Folder) 359
Details View Tab
(Network Resources Folder)
This tab displays a table of information about the network resource groups in the current domain. To access this tab, select the Network Resources folder in the left−panel Services tab. The Details View tab is displayed in the right panel.
Click the graphic for more information.
Name
Name of the network resource group.
Type
Network resource group type: IP Address List or Subnet.
Subnet
For a subnet network resource group, the IP subnet comprising the group. For an IP address list network resource group, N/A.
Mask
For a subnet network resource group, the IP subnet mask for the subnet. For an IP address list network resource group, N/A.
IP Address List
For an IP address list network resource group, the IP addresses of the devices in the list. For a subnet network resource group, N/A.
Details View Tab (Network Resources Folder) 360
Details View Tab
(Policy VLAN Islands
Folder)
tab, select the Policy VLAN Islands folder in the left−panel VLANs tab. To see a menu of options for an island in the table, right−click the island.
Click the graphic for more information.
Name
Name of the VLAN island.
Local VLAN ID Range
Range of VLAN IDs available in the VLAN island to be used for local VLANs. This range is calculated from the base VID and offset specified during the creation of the VLAN island.
Number of Devices
Number of devices in the VLAN island.
Details View Tab (Policy VLAN Islands Folder) 361
Details View Tab
(Roles Folder)
This tab displays information about all the existing roles in the current domain. To see a menu of options available for a role, right−click the role. To access this tab, select the Roles folder in the left panel's Roles tab and click the Details View tab in the right panel.
Click the graphic for more information.
Name
The name of the role.
Access Control
The default access control associated with the role. Possible values are Permit Traffic, Deny Traffic,
Contain to VLAN, or None.
CoS
The default class of service associated with the role. Possible values are the name of a class of service or None.
Number of Rules
The number of traffic classification rules the role includes.
Details View Tab (Roles Folder) 362
Details View Tab
(Service)
Manual service in the left panel's Services tab and select the Details View tab in the right panel. Right−click a rule in the table to see a menu of available options.
TIP:
You can easily add a rule to a Manual service by dragging and dropping a rule from this Details
View tab to a service in the left−panel tree.
Click the graphic for more information.
Name
Name of the rule.
Rule Status
Indicates whether the rule is currently available for use by this service (Enabled), or not (Disabled), as
set in the General tab for the rule, or in the Rule Status window of the Service Wizard or
Classification Rule Wizard. If the rule is disabled, the rule icon displays a red X
.
Rule Type
Indicates the device types to which the rule applies. (See Create Classification Rule Window for
more information.)
Traf Desc Type
Traffic classification type for the rule. (See Classification Types and their Parameters for more
information.)
Traf Desc Value
Parameters for more information.)
Details View Tab (Service) 363
NetSight Policy Manager Help
Traf Desc Mask
Parameters for more information.)
Access Control
VLAN action associated with the rule.
CoS
Class of service action associated with the rule.
Sys Log on Rule Hit
for the rule.
Trap on Rule Hit
the rule.
Disable Port on Rule Hit
for the rule.
Details View Tab (Service) 364
Details View Tab (Service Group)
This tab lists information about the services in a service group. To display this tab, select a service group in the left−panel Services tab. To see a menu of options available for a service, right−click the service.
TIP:
A service can be a member of more than one service group. Use drag and drop to quickly copy a service from this Details View tab to another service group in the left−panel tree.
Click the graphic for more information.
Name
Name of the service.
Number of Rules
Number of rules associated with the service.
Included in Roles
Number of roles the service is a part of.
Service Type
Indicates whether the service is Manual or Automated.
Network Resources
If the service is Automated, the network resource group to which it applies. Otherwise, N/A (Not
Applicable).
VLAN
If the service is Automated, the name of the VLAN with which the service is associated, if
applicable. Otherwise, N/A (Not Applicable).
Class of Service
applicable. Otherwise, N/A (Not Applicable).
Details View Tab (Service Group) 365
Details View Tab
(Service Groups Folder)
This tab appears when you select the Service Groups folder on the left panel's Services tab. It displays a table of information about the existing service groups. To see a menu of options available for a service group, right−click the service group.
Click the graphic for more information.
Name
Name of the service group.
Included in Roles
Number of roles the service group is a part of.
Details View Tab (Service Groups Folder) 366
Details View Tab
(User−Defined
Port Groups Folder)
This tab appears when you select the User−Defined Port Groups folder on the left−panel Port Groups tab. It displays a table of information about the existing port groups. To see a menu of options available for a port group, right−click the port group.
Click the graphic for more information.
Name
Name of the port group.
Number of Ports
Number of ports in the user−defined port group.
Details View Tab (User−Defined Port Groups Folder) 367
Details View Tab
(VLAN Island)
the Policy VLAN Islands folder in the left−panel VLANs tab and select the VLAN island. (You must have
Policy VLAN Islands enabled on the Edit menu.) To see a menu of options for a device in the table, right−click the device.
Click the graphic for more information.
Name
Name of the device, or its IP address if it does not have a display name.
IP Address
The device's IP address.
Status
The device's current operational status.
Device Type
Indicates the type of device.
Firmware Version
Shows the current firmware revision for this device.
Details View Tab (VLAN Island) 368
Details View Tab
(VLANs Folder)
This tab appears when you select the Global or Local VLANs folder on the left panel's VLANs tab. It displays a table of information about the existing VLANs. If you right−click an item in the table, a menu of available options appears.
Click the graphic for more information.
Name
Name of the VLAN.
VLAN ID
Unique number assigned to the VLAN, also called VID (for VLAN ID). For Global VLANs, this ID
was either assigned by an administrator or assigned automatically by the system when the VLAN was created. The value can be anywhere between 1 and 4094, with VID 1 being reserved for the
DEFAULT VLAN (a name for a particular VLAN, not to be confused with a role's assigned default
VLAN). Local VLANs are conceptual and do not have actual VIDs (see Policy VLAN Islands for
more information).
Status
Indicates whether this VLAN is being used to deny traffic (Discard), or contain traffic (Contain). The icon for a Discard VLAN displays a red X .
Dynamic Egress
Indicates whether the Dynamic Egress feature is on (Enabled) or off (Disabled) for the VLAN. The default is Enabled; therefore, this column will display Enabled unless a user has turned it off for a particular VLAN.
Always Write to Device(s)
If enabled, the VLAN will be written to the device whether or not it is being used in a rule or role.
Roles
Total number of roles associated with the VLAN.
Defined Rules
Total number of rules associated with the VLAN, including Applied Rules, as well as those not yet
assigned to any roles.
Details View Tab (VLANs Folder) 369
NetSight Policy Manager Help
Applied Rules
Number of rules associated with this VLAN that are enabled and are part of at least one role.
Details View Tab (VLANs Folder) 370
Device Support Tab
(Role)
Use the role Device Support tab to view the classification rule information that would be written to your
type, and is particularly useful if you have devices that only support certain aspects of policy management.
To access this tab, select a role in the left panel Roles tab, then select the Device Support tab in the right panel.
Click the graphic for more information.
Devices Area
This section displays folders for different device types. Expand the folders to see your network devices and device groups organized according to device type. The icon alerts you that there are certain things that
Device Support Tab (Role) 371
NetSight Policy Manager Help will not be written to this device type if you enforce, that you might want to investigate (e.g. rules that are not supported on the device).
Select a specific device type to display the classification rules that will and/or will not be written to those
devices when you enforce the selected role.
Classification Rules Area
Based on the device type selected, this section displays the classifications rules that will be included or excluded when you enforce the selected role.
Excluded
Lists any unsupported classification rules. These rules will not be included when you enforce the selected role.
NOTE:
Disabled rules are always listed as
Excluded.
Included
Lists any supported classification rules. These rules will be included when you enforce the selected role.
NOTE:
On N−Series Platinum devices, range classification rules are achieved through applying subnet masks to values. As such, in order to achieve a user−specified range, the device may need multiple rules with subnets applied to encompass that range. So, although the user created only one rule with a range, this list may show multiple instances of that rule with the name of the rule followed by the portion of the over−all range it applies to.
Excluded Table/Included Table
Name
The name of the service the rule belongs to, followed by the name of the rule.
Precedence
The rule's precedence, with 1 being the highest precedence and 15 being the lowest. Rule precedence is based on classification type. When a role has multiple classification rules assigned to a port, rule
precedence must be determined. For more information on precedence, see Classification Rules
Precedence. This column is only displayed in the Included table.
Traffic Description Type
Traffic Description Value
Mask
The mask for the classification type, if applicable.
Access Control
Device Support Tab (Role) 372
NetSight Policy Manager Help
The access control (VLAN membership) action specified for the rule.
CoS
The class of service (CoS) action specified for the rule.
Unmatched Frames
This section displays the role's default Class of Service (CoS) and Access Control that will be applied to traffic received on the device that does not match any of the classification rules. These default actions can be
viewed and edited in the role's General tab.
Device Support Tab (Role) 373
Device Support Tab
(Rule)
Use the rule Device Support tab to see whether or not the selected rule would be written to a device if you
they do or do not support the rule. Device groups to which the devices belong are also displayed. This tab is particularly useful if you have devices that only support certain aspects of policy management.
To access this tab, select a rule in the left−panel Services tab, then select the right−panel Device Support tab.
NOTE:
For Layer 2 MAC Address, Layer 3, and Layer 4 rules, a Matrix E1 device will appear in the Rule Supported folder if the rule's Access Control is set to Permit Traffic or Deny
Traffic, but if the Access Control is set to Contain to VLAN, then the Matrix E1 will appear in the Rule Not Supported folder.
Click the graphic for more information.
Rule Not Supported
The selected rule is not supported on these devices, and will not be written to them when you enforce.
Rule Fully Supported
The selected rule is supported on these devices, and will be written to them when you enforce.
Device Support Tab (Rule) 374
Device Support Tab
(Service)
Use the service Device Support tab to view the classification rule information that will be written to your
The information is displayed according to device type, and is particularly useful if you have devices that only support certain aspects of policy management.
To access this tab, select a service in the left−panel Services tab, then select the Device Support tab in the right panel.
Click the graphic for more information.
Top Panel
This section displays folders for different device types. Expand the folders to see your network devices and
Device Support Tab (Service) 375
NetSight Policy Manager Help device groups organized according to device type. The icon alerts you that there are certain things that will not be written to this device type if you enforce, that you might want to investigate (e.g. rules that are not supported on the device).
Select a specific device type to display the classification rules that will and/or will not be written to those devices when you enforce a role to which the selected service has been applied.
Classification Rules Area
Based on the device type selected in the top panel, this section displays the classifications rules that will be included or excluded for the selected service, should you decide to enforce a role to which the service has been applied.
Excluded
Lists any unsupported classification rules that have been applied to the selected service. These rules will not be included when the associated roles are written to the devices.
NOTE:
Disabled rules are always listed as
Excluded.
Included
Lists any supported classification rules that have been applied to the selected service. These rules will be included when the associated roles are written to the devices.
NOTE:
On Matrix N−Series Platinum devices, range classification rules are achieved through applying subnet masks to values. As such, in order to achieve a user−specified range, the device may need multiple rules with subnets applied to encompass that range. So, although the user created only one rule with a range, this list may show multiple instances of that rule with the name of the rule followed by the portion of the over−all range it applies to.
Device Support Tab (Service) 376
General Tabs
A General tab is available in the right panel of the Policy Manager main window for many items selected in the left−panel tab. It provides general properties information about the selected item.
Help topics for the right−panel General tabs are named to reflect the item selected in the left−panel tree. For example, the help topic for the General tab with a device selected in the left panel is named General Tab
(Device). For more complete information on the different General tabs, expand the General Tabs folder and select the desired tab.
General Tabs 377
General Tab
(802.1p Priority)
The 802.1p priority General tab provides information about the number of roles, services, and rules associated with the selected 802.1p priority, and lets you add or modify the priority's description. It also provides information about any priority−based rate limits associated with the priority. To access this tab, select an
802.1p priority in the left−panel Classes of Service tab and select the General tab in the right panel.
Click the graphic for more information.
Name
Name of the selected 802.1p priority.
Priority−Based Rate Limits
This section provides information about any priority−based rate limits associated with the priority. See
Defining Priority−Based Rate Limits for more information.
Rate Limit Inbound
The priority−based inbound rate limit associated with the priority, if any. Otherwise, N/A. The rate limit sets the highest rate of speed at which traffic can enter a port before packets will be dropped.
Rate Limit Outbound
The priority−based outbound rate limit associated with the priority, if any. Otherwise, N/A. The rate limit sets the highest rate of speed at which traffic can exit a port before packets will be dropped.
Usage
This section provides information about the number of roles, services, and rules associated with the 802.1p
General Tab (802.1p Priority) 378
NetSight Policy Manager Help priority.
Roles
Number of roles associated with the 802.1p priority.
Services
Number of services associated with the 802.1p priority.
Defined Rules
Total number of rules utilizing this 802.1p priority. This includes rules that are enabled and are part of at least one role (applied rules), as well as rules not yet assigned to any roles.
Applied Rules
Number of rules utilizing this 802.1p priority that are enabled and are part of at least one role.
Description
In this area you can enter or modify the description of the selected 802.1p priority.
General Tab (802.1p Priority) 379
General Tab
(Rate Limit)
This tab lets you view and configure the parameters for a rate limit. Rate limits are components of a Policy
Manager class of service, and are used to control the transmit rate at which traffic enters and exits ports in your network. Policy Manager supports two types of rate limits: Priority−Based rate limits and Role−Based rate limits. When you create a rate limit you can configure it with both priority−based and role−based parameters, but only one type of rate limiting will be used on a device. Rate limit support varies by device
support.
NOTE:
Rate limits are disabled by default on devices. You can specify the type of rate limits used on a
device in the Class of Service Mode section on the device General tab or using the Device
Configuration wizard. Only certain devices such as the Matrix N−Series Gold and Platinum
devices support both types of rate limits, but you cannot have both types enabled at the same time.
In order to access this tab, the rate limit must already exist in the Rate Limit folder in the left−panel Classes of
in the right panel. If you make a change on this tab, you need to enforce in order for it to take effect.
Click the graphic for more information.
General Tab (Rate Limit) 380
NetSight Policy Manager Help
Name
Name of the selected rate limit.
Configuration
Rate Limit
Specify the highest transmission rate at which traffic can enter or exit a port before packets will be rate limited:
•
% − A percentage of the total bandwidth available (not available for priority−based rate
• limits)
PPS − Packets per second (not available for priority−based rate limits)
•
Kb/s − Kilobits per second
•
Mb/s − Megabits per second
•
Gb/s − Gigabits per second
NOTE:
The lower and upper limits vary according to the types of devices you have and
how they are connected; refer to the Firmware Feature Support tables in the
release notes for minimum and maximum limits per device type.
Description
Enter or modify a description of the selected rate limit.
General Tab (Rate Limit) 381
NetSight Policy Manager Help
Priority−Based Configuration Tab
Use this tab to configure priority−based parameters for the rate limit. The rate limit is associated with one or more of the eight 802.1p priorities (0−7). When the associated priority is selected for a class of service, the rate limit becomes part of that class of service. When applied to a port, the combined rate of all traffic on the port that matches the priorities associated with the rate limit cannot exceed the configured limit. If the rate exceeds the configured limit, frames are dropped until the rate falls below the limit. Once a rate limit is associated with a priority, that priority will include rate limiting wherever and however it is used, until the rate limit is deleted from Policy Manager. Also, once a priority−based rate limit is applied to a port, it will remain on the port even if the role that originally used the rate limit is no longer associated with the port.
You must have priority−based rate limiting enabled if you want priority−based rate limits to be written to your devices when you perform an enforce. Priority−based rate limits add to the amount of time it takes to enforce and verify roles. Once you've created your rate limits and enforced them, you may want to disable rate limits so that it takes less time to enforce. You can enable or disable rate limits in the Class of Service Mode section
NOTE:
There are important differences in priority−based rate limit behavior on Matrix
N−Series Platinum devices. For more information, see Priority−Based Rate Limiting on
Matrix N−Series Platinum Devices.
Click the graphic for more information.
Direction
Select Inbound or Outbound, depending on whether the rate limit is for inbound or outbound traffic.
In order to control traffic inbound and outbound on the same port, two rate limits must be configured
(one inbound and one outbound). Inbound rate limiting takes place after a frame has been classified into one of the eight priorities. Outbound rate limiting takes place just before a frame is queued for transmission.
Precedence
General Tab (Rate Limit) 382
NetSight Policy Manager Help
The order in which priority−based rate limits will be written to devices that support them. Click Edit
to open the Precedence tab, where you can change the order in which rate limits will be applied.
802.1p Priorities
Select the 802.1p priority or priorities with which the rate limit will be associated. Each 802.1p
priority can have only one inbound and one outbound rate limit; therefore, if a priority is already being utilized for the selected direction, it is grayed out.
SecureStack C2/B2 10/100 Priority
SecureStack C2/B2 10/100 ports support two rate limits (inbound only). If you are creating a rate limit to be used on SecureStack C2/B2 10/100 ports, select either Low to associate the rate limit with priorities 0−3 or High to associate the rate limit with priorities 4−7. You can select both Low and
High if you want to associate the rate limit with priorities 0−7. If the Low or High priority is already being utilized for another rate limit, it will be grayed out. Because SecureStack C2/B2 10/100 ports only support inbound rate limits, this section will be grayed out if you have selected Outbound for
your rate limit Direction. SecureStack C2/B2 Gigabit ports support eight rate limits (inbound only);
for those ports, select the 802.1p priorities as you would for other ports.
Exclusion
Specify the network elements to which this rate limit will not apply. For example, rate limiting is most often used for edge devices; therefore, you might want to exclude a device group or port group
element from the exclusion list, select it and click Remove.
Role−Based Configuration Tab
Use this area to configure notification parameters for a role−based rate limit and view a list of ports where the rate limit has been exceeded. Role−based rate limits are defined within a class of service and associated with a specific role via a rule action or as a role default. When role−based rate limits are implemented, all traffic on the port that matches the rule with the associated rate limit cannot exceed the configured limit. If the rate exceeds the configured limit, frames are dropped until the rate falls below the limit.
You must have role−based rate limiting enabled if you want role−based rate limits to be included in roles written to your devices when you perform an enforce. You can enable or disable rate limits in the Class of
using the rate limit is active on the port either as the authenticated role or as the port's default role. Role−based rate limit functionality is available only on certain devices such as the Matrix N−Series Gold and Platinum
limit support.)
Click the graphic for more information.
General Tab (Rate Limit) 383
NetSight Policy Manager Help
Notification
Select the notification type(s) you would like this rate limit to use:
•
Generate System Log on Rate Violation − a syslog message is generated when the rate limit is
• first exceeded.
Generate Audit Trap on Rate Violation − an audit trap is generated when the rate limit is first
• exceeded.
Disable Port on Rate Violation − the port is disabled when the rate limit is first exceeded.
NOTE:
Matrix N−Series Gold devices do not support rate limit notification.
Port Violations Table
This table lists the ports where the rate limit has been exceeded.
Port
Name of the port, constructed of the name or IP address of the device and either the port index number or the port interface name.
Retrieve Button
Retrieves the most recent information about ports in violation.
Clear Button
Clears the violations table. If port traffic continues to exceed the rate limit, ports will reappear in the table.
View/Edit Port Button
Select a port in the table and click this button to access the port's General tab where you can view and edit port information.
General Tab (Rate Limit) 384
General Tab
(Class of Service)
This tab lets you view and configure the components of a class of service (CoS). To access this tab, the class
right panel.
Once you have created and defined a class of service, you can then apply it as a classification rule action, as
Click the graphic for more information.
Name
Name of the selected class of service.
General Tab (Class of Service) 385
NetSight Policy Manager Help
802.1p Priority
The 802.1p priority associated with the class of service, if any. The checkbox lets you enable or disable the priority, and the drop−down list lets you choose a different 802.1p priority, if desired. If the 802.1p priority is associated with a particular inbound and/or outbound priority−based rate limit, that rate limit information will be displayed below. Changing the 802.1p priority will also change the
the eight classes of service provided by Policy Manager (Priority 0−7), because the 802.1p priority cannot be disabled or changed.
Enable ToS
Some IP rules allow a ToS/DSCP value to be written to the ToS/DSCP field in the IP header of incoming packets. This checkbox lets you enable or disable the IP ToS (Type of Service) or DSCP
(Diffserv Codepoint) rewrite value with this class of service. The IP/ToS value appears in the
left−panel IP Type of Service Values folder. See ToS/DSCP Rewrite for more information.
NOTE:
If you apply a class of service with a ToS/DSCP value as a role default, the ToS/DSCP value will be ignored. This is because ToS/DSCP rewrite works only for certain IP ToS classification rules, not as a role default.
Value
The IP type of service value is an 8−bit hexadecimal number between 0 and FF (see IP Type of
Service for more information). You can either enter this value in the Value 0x text box, or click
Select to open the ToS/DSCP Configuration window, where you can automatically configure a ToS
(Type of Service) or DSCP (Diffserv Codepoint) value.
Mask
The ToS mask controls which bits in the ToS/DSCP field of incoming packets will be overwritten.
Masking a ToS value is only supported on Matrix N−Series devices. Devices that do not support the mask will ignore this field.
Transmit Queue Tab
This tab lets you view and change the transmit queue index associated with the class of service. This index number is used by devices that support Role−Based Rate Limit and Transmit Queue Configuration as a class of service mode. Once you have selected the index, the table below displays the actual transmit queues that will be used by each transmit queue port group for that class of service.
Click the graphic for more information.
General Tab (Class of Service) 386
NetSight Policy Manager Help
Transmit Queue Index
Transmit Queue Index numbers map logical transmit queue indexes on the ports to the actual physical transmit queues you have configured in Policy Manager. If you have selected an 802.1p priority for this class of service, a default transmit queue index is automatically specified based on the selected priority. You can use the default index or change it according to your own transmit queue configuration. Click Select to open the Transmit Queues selection view window, which lists all the possible transmit queues, organized by index number for each existing port type and group. Selecting an index automatically includes all the transmit queues configured for that index number.
Table
Displays information about the selected transmit queue mapping index:
•
Port Type − the type of port group, based on the number of transmit queues the ports support:
• for example, 4−queue port groups (queues 0−3) and 16−queue port groups (queues 0−15)
Port Group − the name of the port group.
•
Transmit Queue − the actual physical transmit queue that will be used by that port group for this class of service.
View/Edit Port Group
add and remove ports to and from the group.
View/Edit Transmit Queue
Opens the transmit queue General tab where you can configure the selected transmit queue.
Role−Based IRL Tab
This tab lets you view and change the role−based inbound rate limit (IRL) index associated with the class of service. This index number is used by devices that support Role−Based Rate Limit and Transmit Queue
Configuration as a class of service mode. Once you have selected the index, the table below displays the actual rate limits for each port type and port group for that index.
NOTE:
Policy Manager currently supports only inbound role−based rate limits.
Click the graphic for more information.
General Tab (Class of Service) 387
NetSight Policy Manager Help
Inbound Rate Limit Mapping Index
Inbound Rate Limit Index numbers map logical rate limit indexes to the actual physical rate limits you have created in Policy Manager. Click Select to open the Inbound Rate Limits selection view window, which lists all the possible rate limits, organized by index number for each existing port type and group. Selecting an index includes all the rate limits configured for that index number.
Table
Displays information about the selected rate limit mapping index.
•
Port Type − the type of port group, based on the number of rate limits the ports support.
•
Port Group − the name of the port group.
•
Rate Limit − the actual rate limit that will be used by that port group for this class of service.
View/Edit Port Group
add and remove ports to and from the group.
View/Edit Rate Limit
Opens the rate limit General tab where you can configure the selected rate limit.
Description
Use this area to enter or modify the description of the selected class of service.
General Tab (Class of Service) 388
General Tab
(Device)
The device General tab provides identification information for the selected device. To access this tab, select a device on the left panel's Network Elements tab and click the General tab in the right panel.
Click the graphic for more information.
General
Name
Name of the device, or its IP address, if it does not have a name.
IP Address
IP address of the device.
MAC Address
Media access connection (hardware) address of the device.
System Description
Description of the device, including its manufacturer, model number and firmware revision number.
Device Type
Indicates the type of device. Certain devices may be listed as "Authentication Only" (supports 802.1X
and RFC 3580 only; does not support Policy).
General Tab (Device) 389
NetSight Policy Manager Help
Policy VLAN Island
Policy VLAN Island with which the device is associated. This field appears only when the Policy
VLAN Islands feature is enabled.
View/Edit VLAN Island Button
Opens the left−panel VLANs tab, with the Details View for the Policy VLAN Island selected. From
there you can access the other tabs for the VLAN island, and make changes if required.
Profiles
This section displays the profiles assigned to the device via the Profile/Device Mapping tab in the
Authorization/Device Access window.
NetSight Server Profile
The profile assigned to the device for the NetSight Administrator group. The Read Credential of this profile is used to determine contact status for this device.
Authorization Group Profile
The profile assigned to the user's Authorization Group. The credentials of this profile define the user's access privileges for SNMP communication with the device.
Class of Service Mode
Policy Manager supports two modes of class of service, with each mode providing a different rate limit functionality:
•
Priority−Based Rate Limits − These rate limits are associated with one or more 802.1p priorities, and
• are implemented based on the 802.1p priority assigned to a data packet appearing on a port.
Role−Based Rate Limits / Transmit Queue Configuration − These rate limits are defined within a class of service and associated with a specific role via a rule action or as a role default. They are implemented based on the role assigned to a port. This mode also allows transmit queue behavior to be configured for the class of service.
Use this area to select the class of service mode that will be used on the device or select the option to disable rate limits on the device. Only certain devices such as the Matrix N−Series Gold and Platinum devices support both modes, but you cannot have both modes enabled at the same time. If a mode is not supported on the
Rate Limits Disabled
Select this option if you want rate limits disabled on the device. This means that any priority−based rate limits will not be written to the device on enforce, and any role−based rate limits will not be included in roles written to the device on enforce.
Role−Based Rate Limits/Transmit Queue Configuration
Select this mode if you want to configure role−based rate limits and transmit queues on this device.
See Defining Role−Based Rate Limits and How to Configure Transmit Queues for more information.
Priority−Based Rate Limits
Select this mode if you want to configure priority−based rate limits on this device. Priority−based rate limits add to the amount of time it takes to enforce and verify roles. Once you've created your rate limits and enforced them, you may want to disable rate limits on the device so that it takes less time to
enforce. See Defining Priority−Based Rate Limits for more information.
General Tab (Device) 390
NetSight Policy Manager Help
General Tab (Device) 391
General Tab
(IP Type of Service
Value)
The IP type of service value General tab provides an area to enter or edit a description of the selected IP type of service value. An IP type of service value appears in the left−panel IP Type of Service Values folder when
select an IP type of service value in the left−panel Classes of Service tab, then select the General tab in the right panel.
Click the graphic for more information.
Name
Name of the selected IP type of service value.
Description
In this area you can enter or modify a description of the selected IP type of service value.
General Tab (IP Type of Service Value) 392
General Tab
(Network Resource Group)
This tab lets you configure a network resource group, which is a group of network resource devices that can
of the group, or choose an IP subnet which comprises the network resource group. Once a network resource
Service for more information).
To access this tab, select a network resource group in the left−panel Services tab and the General tab in the right panel. This tab is also displayed when you click the Automated Service Settings View/Edit button on the
Click the graphic for more information.
Name
Name of the network resource group selected in the left panel.
Network Resource IP Address List
Select this option to specify the IP addresses you want to be a part of the network resource group. To add an
IP address, type the address in the box below the list and click Add. To remove an IP address (or addresses) from the group, select the address and click Remove.
Remove
Removes any IP addresses selected in the IP address list. To select more than one address to remove, hold down Ctrl (for addresses not in sequence) or Shift (for addresses in sequence) while selecting.
General Tab (Network Resource Group) 393
NetSight Policy Manager Help
Add
Adds the IP address in the box to the left of the button to the IP address list.
Subnet
This option lets you create a network resource group that consists of an entire IP subnet. When you select this option, the Enter IP Subnet Window appears, where you can specify the IP subnet and mask. If you want to change the existing subnet or subnet mask for the network resource group, click Change. This opens the Enter
IP Subnet Window, where you can change the subnet or its mask.
Subnet
Displays the subnet that currently makes up the network resource group.
Mask
Displays the subnet mask for the subnet that makes up the network resource group.
Change
Click this button to change the currently specified IP subnet, or its mask.
Description
In this area, you can add or modify the description of the network resource group.
General Tab (Network Resource Group) 394
General Tab
(Policy VLAN Islands
Folder)
Policy VLAN Islands folder in the left−panel VLANs tab. To change one of the values on this window, click
Change, edit the desired value, then click Set.
Click the graphic for more information.
Island Configuration
Base ID
VLAN ID at which the creation of VLAN IDs for the VLAN islands will start. This value is used in conjunction with the Offset value to determine the range of VIDs that can be used in each VLAN island.
Offset
Number of VLAN IDs you want to allocate for each VLAN island. This value is used in conjunction with the Base ID value to determine the range of VIDs that can be used in each VLAN island. For example, if the Base ID is 100, and the Offset is 10, and there are three VLAN islands, the range of possible VIDs for each island would be as follows:
•
Island 1 − 100−109
•
Island 2 − 110−119
•
Island 3 − 120−129
Be sure to provide an offset value large enough to accommodate the number of local VLANs you anticipate needing at each location.
VLAN Naming Convention
Format for the names of the VLANs in the VLAN islands. Possible naming conventions are listed below, along with examples of each. The assumptions for the examples are as follows:
• the local VLAN is Guest
• there are two island names: Northern Campus and Southern Campus
• the Island−ID (starting VID for the island's VID range) is 500
• the offset is 50
General Tab (Policy VLAN Islands Folder) 395
NetSight Policy Manager Help
The VLANs yielded for the different formats would be as follows:
•
VLAN_Island−Name − Guest_Northern Campus, Guest_Southern Campus
•
VLAN_Offset_Island−ID − Guest_50_500, Guest_50_550
•
VLAN_Island−ID − Guest_500, Guest_550
•
VLAN_Island−ID_Offset − Guest_500_50, Guest_550_50
Buttons
Change/Set
Click this button to edit any of the configuration settings. When you click Change, the button changes to Set. When you have completed the changes, click Set.
General Tab (Policy VLAN Islands Folder) 396
Port Properties
General Tab
The Port Properties General tab provides general information about the selected port, and also lets you view and change various port configuration settings.
There are two ways to access the General tab:
•
Select a device in the left−panel Network Elements tab and expand a slot or ports grouping in the right−panel Details view. Right−click on a port and select Properties from the menu. In the Port
•
Properties window, select the General tab (in the top row of tabs).
Select a port in the left−panel Port Groups tab, then select the General tab in the right panel.
The General tab has four sub−tabs:
•
•
•
•
•
Disabled Traffic Classification Types Tab
General Tab
This tab displays general information about the port and indicates whether it is a frozen port or if TCI
Overwrite is enabled on the port.
Click the graphic for more information.
Port Properties General Tab 397
NetSight Policy Manager Help
General
Name
Name of the port, constructed of the name or IP address of the device and either the port index number or the port interface name.
Index
The index value assigned to the port interface.
Interface Name
A description of the port.
Port Type
Type of port. Possible values include: Access, CDP, CDP FTM 1 Backplane, FTM 1 Backplane, and
Logical.
Port Speed
Speed of the port. Possible values include: 10/100, speed in megabits per second (for example, 800.0
Mbps), Unknown (displayed for logical ports).
Frozen (Prevents Port Modifications)
Enables you to freeze (check) the port or clear (uncheck) the frozen status on the port. Freezing a port
"locks" it so that no one can accidentally reconfigure sensitive attributes such as port authentication or
default role settings, or terminate sessions that are authenticated on the port. See How to
Freeze/Unfreeze a Port for more information.
TCI Overwrite
Enable or disable TCI Overwrite functionality for the port. (This option will be grayed out if the device on which the port is located does not support TCI Overwrite.) Enabling TCI Overwrite causes the VLAN or class of service tag in a received packet to be overwritten by the VLAN (access control) and class of service characteristics defined in the port's current or default role. If there is no role assigned to the port, the port uses any static classification rules which exist. If there are no static rules, the port uses the PVID and default class of service for the port. TCI Overwrite is required for Tagged
Packet VLAN to Role Mapping, and can be enabled either here on a per−port basis, or for an
individual role in the role's General tab.
Role Status Tab
This tab displays the default and current role on the port, and lets you select a new default role. The default role is the role assigned to the port if no other role has been authenticated on it. The current role is the role currently active on the port (either the default role or the currently logged−in and authenticated user's role). If the port was not assigned a role when the end user logged in (authenticated), or if authentication is disabled on a port, then the port's default role will take effect. If you set a default role for the port, it is recommended that
you enable the Drop VLAN Tagged Frames feature.
Click the graphic for more information.
General 398
NetSight Policy Manager Help
Role Status
Default Role
See Default Role in the Concepts topic for information on default roles. Click the Select button to
change the default role. For additional information, see Port Mode.
Current Role
Displays the role currently active on the port. This current role is either the role assigned to the port when an end user logs in (authenticates), or it is the default role on the port. For ports on devices that
each end user login (authentication) session on the port.
Select Button
Click Select to select a new default role for the port. This opens the Selection View (Roles) where
you can select an existing role or click New to launch the Role Wizard and create a new role. Select
the Clear the current default role option to set the default role back to <None>.
Mappings Tab
This tab allows you to create port−level MAC to Role mappings and Tagged Packet VLAN to Role mappings.
A mapping does not have to exist at the device level to be created at the port level, and port−level mappings
order to take effect.
NOTES:
−− You must have the Port Level Role Mappings feature enabled in Policy Manager for the mappings to take effect. (From the menu bar, select the Edit > Port Level Role
Mappings checkbox.) If the feature is not enabled, the mappings will be ignored and any mappings listed here will be grayed out.
−− Port−level mappings cannot be added or removed to or from frozen ports . You
Role Status 399
NetSight Policy Manager Help must clear the frozen state on a port in order to add or remove a mapping. Once you have created a mapping, you can freeze the port. The port−level mappings of the frozen port will still be enforced and verified.
WARNING:
Enforcing port−level MAC to Role mappings could potentially remove rules created by
NetSight Automated Security Manager (ASM) as an intrusion detection response.
Click the graphic for more information.
MAC to Role Mapping
MAC to Role mapping provides a way to assign a role to an end station based on its source MAC address. In this section, you can create a list of MAC addresses and map each of them to a specific role. If the listed mappings are grayed out, it means that the Port Level Role Mappings feature is not enabled (Edit > Port Level
Role Mappings).
MAC Address
The MAC addresses that are mapped to a role. Click Add to add a mapping to the list.
Mask
The mask associated with each MAC address. Masking a MAC address is only supported on Matrix
N−Series Platinum devices. Using a mask provides an easy way to select end stations based on a portion of their MAC address. For example, you could select one MAC address, then use a mask based on the manufacturers ID portion of the MAC address to specify all your Siemens IP Phones.
MAC to Role Mapping 400
NetSight Policy Manager Help
Role
The role that is mapped to a MAC address. Click Add to add a mapping to the list.
Add Button
Opens the Add MAC Address window, where you can select a MAC address and mask, and map it to a role.
Remove Button
Select a MAC address and click Remove to remove the MAC address from the mapping list.
Tagged Packet VLAN to Role Mapping
Tagged Packet VLAN to Role Mapping provides a way to assign a role to network traffic, based on a VLAN
ID. In this section, you can create a list of VLANs and map each of them to a specific role. If the listed mappings are grayed out, it means that the Port Level Role Mappings feature is not enabled (Edit > Port Level
Role Mappings). For more information, see VLAN to Role Mapping in the Concepts Help topic.
NOTE:
When configuring Tagged Packet VLAN to role mapping, you must also enable the TCI
Overwrite attribute. TCI Overwrite allows the VLAN or class of service tag in a
received packet to be overwritten by the VLAN (access control) and class of service characteristics defined in the mapped role. You can enable TCI Overwrite on a per−port
basis in the Port Properties General tab, or for an individual role in the role's General
VLAN
The VLANs (VLAN ID and name) that are mapped to a role. Click Add to add a mapping to the list.
Role
The role that is mapped to a VLAN. Click Add to add a mapping to the list.
Add Button
Opens the VLAN to Role Mapping Selection View, where you can select a VLAN and map it to a role.
Remove Button
Select a VLAN and click Remove to remove the VLAN from the mapping list.
Drop VLAN Tagged Frames Tab
This tab lets you enable or disable the Drop VLAN Tagged Frames feature on this port. When the Drop
VLAN Tagged Frames feature is enabled, any packet already tagged with a VLAN coming into the port will be dropped. This provides extra security in that it prevents users from, for example, coming in with a card capable of VLAN tagging and attempting to access the network. In most cases, you would enable this feature on user ports because you don't want users to be tagging their own traffic, and you would disable it on interswitch link ports, where you want tagged packets to be accepted.
It is recommended that you enable the Drop VLAN Tagged Frames feature when you set a default role on a port or when you enable authentication on a port, because these things indicate that the port is a user port that should not be transmitting tagged packets. You can enable Drop VLAN Tagged Frames for a single port here,
Tagged Packet VLAN to Role Mapping 401
NetSight Policy Manager Help
VLAN Tagged Frames, this tab is grayed out.
WARNING:
Enabling this feature on a CDP or Backplane port is likely to result in loss of contact with devices connected through the port.
Disabled Traffic Classification Types Tab
Use this tab to specify rule types that will be disabled on the port. You can disable specific classification rule types on an individual port as a way to disable policy−assignment rules used in VLAN to Role Mapping, IP to
Role Mapping, MAC to Role Mapping, and Role Override. For example, you can disable the VLAN ID traffic classification type to disable Tagged Packet VLAN to Role Mapping on the port. You can also disable all traffic classification types, which effectively turns off policy on the port.
Click the graphic for more information.
Disabled Traffic Classification Types Tab 402
NetSight Policy Manager Help
Disabled Traffic Classification Types
Use the Add or Add All button to create a list of rule types that will be disabled on the port.
Add Button
want to disable on the port and add it to the list.
Add All Button
Adds all traffic classification types to the list. This would disable all traffic classification on the port, and the role's default class of service and/or default access control would take effect.
Remove Button
Removes the selected traffic classification type from the list.
Apply Button
Applies the list of disabled traffic classification types to the port.
Disabled Traffic Classification Types 403
General Tab
(Role)
You can also enable TCI Overwrite functionality for the role, and enter or edit the description of the role. To access this tab, select a role in the left panel's Roles tab, then select the General tab in the right panel. Any
additions or changes you make to this tab must be enforced in order to take effect.
Click the graphic for more information.
Name
Name of the role selected in the left panel.
Default Class of Service
CoS
Policy Manager lets you define classes of service that each include an 802.1p priority, and optionally an IP type of service (ToS/DSCP) value, rate limits, and transmit queue configuration. You can then
Create a Class of Service for more information.
General Tab (Role) 404
NetSight Policy Manager Help
To choose a default class of service for the role, select the CoS checkbox. This opens the Classes of
Service Selection View, where you can choose a default class of service for the role or create a new
one. If you want to change an existing default class of service, click the CoS Select button, select a class of service, and click OK.
NOTE:
If you select a CoS with a ToS/DSCP value, the ToS/DSCP value will be
ignored, because ToS/DSCP rewrite works only for certain IP ToS
classification rules, not as a role default.
Select Button (CoS)
Opens the Classes of Service Selection View, where you can choose a default Class of Service for the
role.
Default Access Control
Access Control
To enable default access control (a default VLAN), select this checkbox. You can permit traffic to be forwarded, deny traffic altogether, or contain traffic to a VLAN.
Permit (Use Existing Port VLAN)
This option allows traffic to be forwarded with the port's assigned VID.
Deny Traffic
If this option is selected, traffic will automatically be sent to a discard VLAN. If no discard VLANs
exist, a blank Discard VLANs Selection View appears. There you can create and select a new discard
VLAN to use. If there is more than one discard VLAN from which to choose, the Deny Traffic Select
button is available. This opens the Discard VLANs Selection View, where you can choose a different
default discard VLAN.
Contain To VLAN
This option contains traffic to a specific VLAN. It automatically opens the VLANs Selection View,
where you can choose a contain VLAN. If a contain VLAN is already selected, you can select another one by clicking the Contain To VLAN Select button.
Select Button (Deny)
This button is available if you have selected Deny Traffic and there is more than one Discard VLAN
from which to choose. It opens the Discard VLANs Selection View, where you can select a different
Discard VLAN.
Select Button (Contain)
Lets you change the VLAN specified for the Contain to VLAN option. Opens the Contain VLANs
Selection View, where you can choose a different VLAN.
TCI Overwrite
In this area, you can enable or disable TCI Overwrite functionality for the role. Enabling TCI Overwrite allows the VLAN (access control) and class of service characteristics defined in this role to overwrite the
Description
In this area, you can add or modify the description of the role.
General Tab (Role) 405
NetSight Policy Manager Help
General Tab (Role) 406
General Tab
(Roles Folder)
This tab provides a place for you to enter a description of the domain's roles. To access this tab, select the
Roles folder in the left panel's Roles tab and click the General tab in the right panel.
General Tab (Roles Folder) 407
General Tab
(Rule)
The rule General tab displays information about the rule selected in the left−panel Services tab and enables you to change it. To write changes to the devices, click the Enforce button on the Policy Manager main toolbar.
Click the graphic for more information.
Name
Displays the name of the rule.
Rule Type
Lets you select the types of devices to which you wish this rule to apply when enforced. The recommended selection is All Devices, unless there is a specific need for a device−specific rule. If this need arises, the Rule Type feature allows services to be customized to contain rules specific to a device's type when support for a traffic description and/or action may not be available on all managed devices.
For device−specific rules, only those traffic descriptions that are supported on the device will be
available when you define a traffic description on the rule Traffic Description tab, or in the
must be aware that you cannot enforce the rule to a device which does not support it. The Enforce
General Tab (Rule) 408
NetSight Policy Manager Help
Preview window and the Device Support tabs for roles, services, and rules enable you to see what
rules will and will not be written to the device.
Status
Lets you disable the rule, or enable it if it's already disabled. If the rule is disabled, it is unavailable for use by the current service, but can still be copied to other services and enabled, or re−enabled at another time for the current service. Disabling a rule is an alternative to deleting and recreating it.
You can also disable/enable rules in the Rule Status window of the Service Wizard or Classification
Rule Wizard. The rule icon in the left panel displays a red X if the rule is disabled.
Description
In this area you can view, add, or modify a description of the rule.
General Tab (Rule) 409
General Tab
(Service)
For Automated services, use the service General tab to define settings for the service. For Manual services,
panel. The General tab for an Automated service is shown below.
Click the graphic for more information.
Name
Name of the selected service.
Automated Service Settings
Use this area to provide the specifications for an automated service. You will need to specify the network resource group to which the service will apply, select the IP address rule type, and define the class of service
(CoS) and/or access control (VLAN) for the service. This section is not displayed for a Manual service.
General Tab (Service) 410
NetSight Policy Manager Help
Network Resources
The network resource group associated with the automated service. Use the Select button to select a
different network resource group. For more information, see How to Create a Network Resource
Select Button (Network Resources)
Opens the network resources Selection View, where you can select the network resource group to
associate with the automated service. Click OK to return to the service General tab.
View/Edit Button
Opens the network resource group General tab, where you can view or change the IP addresses
contained in the selected network resource group.
IP Rule Type
Select the type of IP address rule you want to create (Bilateral, Source, or Destination) for the IP addresses in the network resource group. Although other rule types are available for Manual services,
IP address is the only rule type available for an Automated service.
Action
Use this area to define the access control and/or a class of service for an Automated service. This section is not displayed for a Manual service.
CoS
Select this checkbox to specify a class of service for the Automated service. Select a CoS from the
tab.
Select Button (CoS)
If a class of service is already selected, you can click this button to open the Classes of Service
Selection View, where you can choose a different class of service.
Access Control
Select this checkbox to specify access control (a VLAN) for the Automated service. You can permit traffic to be forwarded, deny traffic altogether, or contain traffic to a VLAN.
Permit Traffic
This option allows traffic to be forwarded with the port's assigned VID.
Deny Traffic
If this option is selected, traffic will be denied altogether for the service. Traffic will automatically be
sent to a Discard VLAN. If no discard VLANs exist, a blank Discard VLANs Selection View
appears. There you can create and select a new discard VLAN to use. If there is more than one discard
VLAN from which to choose, the Deny Traffic Select button is available. This opens the Discard
VLANs Selection View, where you can choose a different default discard VLAN.
Select Button (Deny)
This button is available if you have selected Deny Traffic and there is more than one Discard VLAN
from which to choose. It opens the Discard VLANs Selection View, where you can select a different
Discard VLAN.
General Tab (Service) 411
NetSight Policy Manager Help
Contain To VLAN
This option contains traffic to a specific VLAN. It automatically opens the VLANs Selection View,
where you can choose a contain VLAN. If a contain VLAN is already selected, you can select another one by clicking the Contain To VLAN Select button.
Select Button (Contain)
Lets you change the VLAN specified for the Contain to VLAN option. Opens the Contain VLANs
Selection View, where you can choose a different VLAN.
When rule accounting is enabled on a device, each rule keeps a list of the ports on which it has been used. The next three options allow you to specify certain rule usage actions to take place when a "rule hit" is reported.
These actions apply to all the rules in the service.
Generate System Log on Rule Hit
When this checkbox is selected, a syslog message is generated when a rule in the service is used.
Generate Audit Trap on Rule Hit
When this checkbox is selected, an audit trap is generated when a rule in the service is used.
Disable Port on Rule Hit
When this checkbox is selected, any port reported as using a rule in the service will be disabled. Ports
that have been disabled due to this option are displayed in the device Role/Rule tab.
Description
In this area you can add or modify a description of the selected service.
General Tab (Service) 412
General Tab
(Transmit Queue)
This tab lets you view and configure the rate shaping and low latency queue status settings for the selected transmit queue. Rate shaping paces the rate at which traffic is transmitted out of the transmit queue and sets the shaping algorithm which determines what will happen to traffic that exceeds the maximum amount of traffic the transmit queue can hold. Low latency status allows the queue to have a low transmit latency. This is typically used for traffic such as Voice over IP (VoIP). Not all transmit queues support the low latency setting.
To access this tab, expand a transmit queue port group in the left panel's Classes of Service tab and select a transmit queue, then select the General tab in the right panel.
Click the graphic for more information.
Enable Rate Shaping
Rate shaping paces the rate at which traffic is transmitted out of the selected transmit queue. Rate shaping is disabled by default. Use the checkbox to enable rate shaping for the selected transmit queue.
NOTE:
Matrix N−Series Gold devices do not support rate shaping.
Rate
Specify the rate at which traffic will be transmitted out of the queue. The ranges for each rate are listed.
•
% − A percentage of the total bandwidth available
•
Kb/s − Kilobits per second
•
Mb/s − Megabits per second
•
Gb/s − Gigabits per second
Shaping Algorithm
Use the drop−down list to select the shaping algorithm this transmit queue will use. The shaping algorithm determines what will happen to traffic when the maximum amount of traffic the transmit queue can hold is exceeded.
•
Tail Drop − Discards the last entry in the queue in favor of new entries.
•
Head Drop − Discards the first entry in the queue in favor of new entries.
•
Random Early Discard − Discards queued packets randomly. This algorithm is used to encourage TCP end stations to back off their transmission rates when the transmit queues are
General Tab (Transmit Queue) 413
NetSight Policy Manager Help
• overflowing.
Weighted Random Early Discard − Verifies the priority of the packet before making a discard decision, and attempts to discard the lowest priority traffic first.
Low Latency Queue Status
Use this area to enable or disable low latency queue status. Enabling this setting allows traffic assigned to this queue to have a low transmit latency. This is typically used for traffic such as Voice over IP (VoIP). Not all transmit queues support this setting.
General Tab (Transmit Queue) 414
General Tab
(Transmit Queue Port Group)
The transmit queue port group General tab lets you configure the transmit queue arbiter mode for the selected port group. Transmit queue port groups are based on the number of transmit queues the ports support, for example 4−queue port groups (queues 0−3) and 16−queue port groups (queues 0−15). The graphic below shows a General tab for a 4−queue port group.
The arbiter mode is the method used to determine the way that traffic in each queue is serviced. It is based on a percentage or weight (called a "slice") given to each queue. By default, ports are set to Strict mode, which means that the highest priority queue (the highest numbered queue) is set to 100%. In Strict mode, queues are serviced by numerical priority from the highest numbered queue to the lowest, and all frames in the highest priority queue will be transmitted before the frames in lower priority queues. You can change the arbiter mode to Weighted Fair Queuing, which lets you adjust the slice percentage for each queue, and prevent a lower priority queue from being starved.
NOTE:
Matrix N−Series Gold devices do not support arbiter mode and slice percentage configuration. Ports on these devices that are included in the port group will ignore these settings.
To access this tab, select a transmit queue port group in the left−panel Classes of Service tab, then select the
General tab in the right panel.
Click the graphic for more information.
General Tab (Transmit Queue Port Group) 415
NetSight Policy Manager Help
Name
Name of the selected port group.
Transmit Queue Arbiter Mode
The transmit queue arbiter mode determines the way that traffic in each queue is serviced. Use the drop−down list to select a mode:
•
Strict − The highest priority queue (the highest numbered queue) is set to 100%. In strict mode, queues are serviced by numerical priority from the highest numbered queue to the lowest. Queues are serviced until empty or until a higher priority queue requires servicing.
For example, in strict mode, all frames in Transmit Queue 3 will be transmitted before the
• frames in Transmit Queue 0.
Weighted Fair Queuing − Queues are serviced according to the percentage or weight you assign to each queue. This prevents a lower priority queue from being starved. Percentages must add up to 100%. Configuring 100% for the highest priority queue sets the port to Strict mode.
Slice Configuration
Percentages window where you can configure the slice distribution for each queue.
General Tab (Transmit Queue Port Group) 416
NetSight Policy Manager Help
Edit Button
Opens the Edit Slice Percentages window where you can configure the slice distribution for each
queue.
Slice Distribution
Displays the distribution of slice percentages in a graphical format. Use the Edit button to change the configuration.
General Tab (Transmit Queue Port Group) 417
General Tab
(User−Defined Port Group)
When you create a user−defined port group, you can either select individual ports to add to the group, or specify a range or ranges of ports from all devices to be included in the group. The user−defined port group
General tab is where you make this choice.
The Individual ports selection is the default. If you choose the Individual type of port group, you simply add
listed under the port group in the left panel.
If you select the Port ranges (all devices) choice, you can enter range(s) of ports on all devices to the list of ports comprising the group. This enables you to enforce port configurations on, and retrieve port information from, specified ranges of ports on all devices. You can also add individual ports for all devices to the list. For example, say you had ten devices and you created a port group that included port ranges 1−3 and 10−12, and port 30. If you went to the Ports tab for the port group and clicked Retrieve, information would be displayed for ports 1−3, 10−12 and port 30 on Device 1; ports 1−3, 10−12 and port 30 on Device 2; ports 1−3, 10−12 and port 30 on Device 3, and so on, up through Device 10. If you choose the Port ranges (all devices) option, no ports appear under the port group in the left panel.
To access this tab, create or select a user−defined port group in the left−panel Port Groups tab, then select the
General tab.
Click the graphic for more information.
Name
Name of the user−defined port group selected in the left panel.
General Tab (User−Defined Port Group) 418
NetSight Policy Manager Help
Type
group.
Port Group Ranges
This area displays the port ranges currently selected to comprise the user−defined port group. To add a range, enter the lowest port number of the range in the left Port range box, the highest in the right box, and click
Add. To add an individual port, type the port number in the left box and click Add. To remove an entry from the table, select it and click Remove. To select more than one entry to remove, hold down Ctrl (for entries not in sequence) or Shift (for entries in sequence) while selecting.
Remove
Removes the entry or entries selected in the Port Group Ranges list.
Add
Adds the range or port in the box(es) to the Port Group Ranges list.
Description
In this area, you can add or modify the description of the user−defined port group.
General Tab (User−Defined Port Group) 419
General Tab
(VLAN)
The VLAN General tab displays information about the VLAN selected in the left panel and lets you configure certain VLAN parameters. To access this tab, select a VLAN in the left panel's VLANs tab and click the
General tab in the right panel. If you make a change on this tab, you need to enforce it using the Enforce button on the toolbar.
Click the graphic for more information.
General
This area provides general information about the VLAN.
Name
Name of the VLAN selected in the left panel.
VLAN Scope
Scope of the VLAN (Local or Global).
VLAN ID
Unique number assigned to the VLAN, also called VID (for VLAN ID). This ID was either assigned by an administrator or assigned automatically by the system when the VLAN was created. The value can be anywhere between 1 and 4094, with VID 1 being reserved for the DEFAULT VLAN (a name for a particular VLAN, not to be confused with a role's assigned default VLAN).
Configuration
This area allows you to configure the VLAN.
This VLAN is intended as a Discard VLAN only
If this VLAN is to be used to deny traffic, select this box. If it is to be used to contain traffic, leave the
General Tab (VLAN) 420
NetSight Policy Manager Help box unchecked.
Dynamic Egress Enabled
Dynamic Egress is enabled by default in Policy Manager. If you want to disable Dynamic Egress,
uncheck the box. See Dynamic Egress for more information.
NOTE:
GVRP (GARP VLAN Registration Protocol) is automatically enabled the first
time you enforce a Dynamic Egress VLAN in Policy Manager. If you do not
want GVRP enabled on your network, you can disable it by selecting the Policy
Manager Edit > GVRP Disabled menu option. If necessary, you can then manually configure the interswitch ports to do what GVRP does automatically, using local management to set up your interswitch links as Q trunks. The trunk ports will be automatically added to the egress lists of all the VLANs at the time of trunk configuration.
NOTE:
If GVRP is already enabled on your network and you enforce, the GVRP status of
ports on which you have disabled GVRP will not change.
Always write VLAN to device(s)
If the box is checked, the VLAN will be written to the device whether the VLAN is being used in a rule or role, or not. If it is not checked, the VLAN will not be written to the device unless it is being used in a rule or role. Enabling this option is a way of ensuring that the device is aware of a VLAN that is being used for something other than policy configuration, and it allows you to configure that
VLAN for Dynamic Egress. If the Default VLAN (VID=1) is selected in the left panel, this option is checked and cannot be edited, as the default VLAN is always on the device.
General Tab (VLAN) 421
General Tab
(VLAN Island)
access this tab, select the island in the left panel VLANs tab, then select the General tab in the right panel.
Click the graphic for more information.
Name
Name of the VLAN island selected in the left panel.
Local VLAN ID Range
Range of VLAN IDs available in the island to be used for local VLANs. This range is calculated from the base VID and offset specified when the VLAN island is created.
Description
In this area, you can enter or modify the description of the VLAN island.
General Tab (VLAN Island) 422
IRL Port Groups Tab
(Rate Limit)
This tab lists all the role−based rate limit port groups using this rate limit, along with their rate limit mapping information. Rate limit mapping maps a logical rate limit index to an actual physical rate limit on a port. You
can configure rate limit port group mappings on the Mappings tab.
To access this tab, select a rate limit in the left−panel Classes of Service tab, then select the IRL Port Groups tab in the right panel.
Click the graphic for more information.
Port Type
The type of role−based rate limit port group. Rate limit port groups are based on the number of rate limits the ports support (for example, 8−rate limit port groups and 32−rate limit port groups) and the direction to which the rate limit applies (inbound or outbound traffic). Policy Manager currently supports only inbound role−based rate limits.
Port Group
The name of the port group.
Rate Limit Index
The logical rate limit index number. Keep in mind that for some port groups, the number of logical rate limit indexes may be greater or less than the actual number of rate limits the ports support.
Rate Limit
The actual rate limit that the rate limit index is mapped to. In this case, it will be the rate limit selected in the left−panel tab.
IRL Port Groups Tab(Rate Limit) 423
Islands Tab
being used. To access this tab, select the local VLAN on the left panel VLANs tab and the Islands tab in the right panel. You can access information about a specific VLAN island by selecting the VLAN island in the table and clicking the View/Edit VLAN Island button.
Click the graphic for more information.
Island Name
Name of the VLAN island in which the local VLAN is being used.
Island VLAN Name
VLAN name created on the device in the VLAN island, using the naming convention specified during the creation of the VLAN island.
Island VLAN ID
VLAN ID created on the device in the VLAN island. This VID is within the range calculated from the base VID and offset specified during the creation of the VLAN island.
Buttons
View/Edit VLAN Island
Selecting an island in the table and clicking this button opens the selected VLAN island's Details
Islands Tab 424
MAC Locking Tab
(Device)
The device MAC Locking tab lets you enable the MAC Locking feature on devices that support it. You can also view and change a list of MAC addresses that are currently locked on the selected device. (Click the
Retrieve button to display this information.) To access this tab, select a device that supports MAC Locking on the left−panel Network Elements tab, and click the MAC Locking tab in the right panel.
MAC addresses will be discarded. In order for MAC Locking to take effect on a port, it must first be enabled
at the device level. You can do this on this tab, or in the Device Configuration wizard.
Click the graphic for more information.
MAC Locking Status
Lets you enable or disable the MAC Locking feature on this device. If the device does not support the
MAC locking feature, this option is grayed out.
Static MACs
Click Apply to change all Dynamic Locked MAC addresses (with the Locking Cause of "First
Arrival") to Static Locked MAC addresses. To ensure that all Dynamic Locked MAC addresses are changed to Static, make sure that the Maximum Number of Static Locked MAC Addresses is set to
a large enough value in the Port Properties MAC Locking Tab.
Locked MAC Addresses
MAC Locking Tab (Device) 425
NetSight Policy Manager Help
Retrieve
Populates the Locked MAC Addresses table with a list of the MAC addresses currently locked on the selected device.
Add
Opens the Add Static MAC window, where you can create a list of locked MAC addresses for this
device.
Remove
Select a Static locked MAC address and click Remove to remove the selected entry from the Locked
MAC Addresses table.
Device
Identifies the device selected in the left panel.
Port IfName
A description of the port on which the MAC address is locked.
Index
The index value of the port on which the MAC address is locked.
MAC Address
The MAC address that is locked.
Locking Cause
Indicates why the MAC address is locked:
•
Authentication − Locked as the result of authentication
•
First Arrival − Locked because it was the first MAC address to access the port
•
Static − MAC address was added to the list administratively
MAC Locking Tab (Device) 426
MAC Locking Tab
(Device Group)
This tab displays a list of MAC addresses that are currently locked in a device group, and lets you add and remove addresses on the list. To access this tab, select a device group on the left−panel Network Elements tab and click the MAC Locking tab in the right panel. To populate the table, click Retrieve.
MAC Locking ensures that only a specific MAC address can access a port, and that traffic from any other
MAC addresses will be discarded. See MAC Locking for more information.
Click the graphic for more information.
Static MACs
Static MACs
Click Apply to change all Dynamic Locked MAC addresses (with the Locking Cause of "First
Arrival") to Static Locked MAC addresses. To ensure that all Dynamic Locked MAC addresses are changed to Static, make sure that the Maximum Number of Static Locked MAC Addresses is set to a
large enough value in the Port Properties MAC Locking Tab.
Locked MAC Addresses
Retrieve
Populates the Locked MAC Addresses table with a list of the MAC addresses currently locked in the device group.
Add
Opens the Add Static MAC window, where you can create a list of locked MAC addresses for the
device group.
Remove
Removes the selected entry from the Locked MAC Addresses table.
MAC Locking Tab (Device Group) 427
NetSight Policy Manager Help
Device
Device on which the MAC address is locked.
Port IfName
A description of the port on which the MAC address is locked.
Index
The index value of the port on which the MAC address is locked.
MAC Address
The MAC address that is locked.
Locking Cause
Indicates why the MAC address is locked:
•
Authentication − Locked as the result of authentication
•
First Arrival − Locked because it was the first MAC address to access the port
•
Static − MAC address was added to the list administratively
MAC Locking Tab (Device Group) 428
MAC Locking Tab
(My Network/All Devices Folder)
This MAC Locking tab displays a list of MAC addresses that are currently locked on all the devices in the current domain, and lets you add and remove addresses on the list. To access this tab, select either the My
Network or the All Devices folder in the left−panel Network Elements tab, and click the MAC Locking tab in the right panel. You must click Retrieve to display the MAC Locking information in the table.
MAC Locking ensures that only a specific MAC address can access a port, and that traffic from any other
MAC addresses will be discarded. See MAC Locking for more information.
Click the graphic for more information.
Static MACs
Static MACs
Click Apply to change all Dynamic Locked MAC addresses (with the Locking Cause of "First
Arrival") to Static Locked MAC addresses. To ensure that all Dynamic Locked MAC addresses are changed to Static, make sure that the Maximum Number of Static Locked MAC Addresses is set to a
large enough value in the Port Properties MAC Locking Tab.
Locked MAC Addresses
Device
Device on which the MAC address is locked.
Port IfName
A description of the port on which the MAC address is locked.
Index
MAC Locking Tab (My Network/All Devices Folder) 429
NetSight Policy Manager Help
The index value of the port on which the MAC address is locked.
MAC Address
The MAC address that is locked.
Locking Cause
Indicates why the MAC address is locked:
•
Authentication − Locked as the result of authentication
•
First Arrival − Locked because it was the first MAC address to access the port
•
Static − MAC address was added to the list administratively
Retrieve Button
Populates the Locked MAC Addresses table with a list of the MAC addresses currently locked on the devices in the folder.
Add Button
Opens the Add Static MAC window, where you can create a list of locked MAC addresses for the
Devices folder.
Remove Button
Removes the selected entry from the Locked MAC Addresses table.
MAC Locking Tab (My Network/All Devices Folder) 430
Port Properties
MAC Locking Tab
port, if the device supports it. You can also view and change a list of MAC addresses that are currently locked on the port.
There are two ways to access the MAC Locking tab:
•
Select a device in the left−panel Network Elements tab and expand a slot or ports grouping in the right−panel Details view. Right−click on a port and select Properties from the menu. In the Port
•
Properties window, select the MAC Locking tab (in the top row of tabs).
Select a port in the left−panel Port Groups tab, then select the MAC Locking tab in the right panel.
In order for MAC Locking to take effect on a port, it must be enabled at the device level. You can do this
for selected ports in the Port Configuration wizard. The MAC Locking tab provides two sub−tabs:
•
•
General Tab
This tab lets you enable/disable MAC Locking on the port as well as view the MAC locking status on the device. You can also set MAC locking limits and change all dynamic MACs (with a locking cause of "First
Arrival) to statically locked MACs.
Click the graphic for more information.
Port PropertiesMAC Locking Tab 431
NetSight Policy Manager Help
Device MAC Locking Status
Shows whether the MAC Locking feature is enabled or disabled the device. If the device does not
support MAC locking, this option is grayed out. In order for MAC Locking to take effect on a port, it
must be enabled at the device level. You can do this using the device MAC Locking tab.
MAC Locking
Lets you to enable or disable the MAC Locking feature on this port. If the device does not support
MAC locking, this option is grayed out.
MAC Locking Limits
Maximum Number of Dynamic Locked MAC Addresses
Allows you to set the maximum number of MAC addresses that can be locked dynamically on the port. The numbers in parentheses let you know the range of allowed values for the particular device.
When you enable Dynamic MAC Locking on a port, the next MAC address that authenticates or accesses the port (up to the maximum number of dynamic locked MAC addresses) will have exclusive access to that port from that time on. If you are using static locked MAC addresses, the maximum number of dynamic locked MAC addresses is usually set to 0.
Maximum Number of Static Locked MAC Addresses
Allows you to set the maximum number of MAC addresses that can be locked administratively on the port. The numbers in parentheses let you know the range of allowed values for the particular device.
Static MAC Locking lets you create a list of locked MAC addresses for a port so that the port only accepts traffic from those MAC addresses.
Apply Button
Applies the MAC limits you've set.
MAC Locking Limits 432
NetSight Policy Manager Help
Static MACs
Static MACs
Click Apply to change all Dynamic Locked MAC addresses (with the Locking Cause of "First
Arrival") to Static Locked MAC addresses. To ensure that all Dynamic Locked MAC addresses are
changed to Static, make sure that the Maximum Number of Static Locked MAC Addresses is set to a
large enough value.
Locked MAC Addresses Tab
This tab lets you view a list of the MAC addresses currently locked on the selected port. You must click the
Retrieve button to display this information.
Click the graphic for more information.
Locked MAC Addresses
MAC Address
MAC address that is locked.
Locking Cause
Indicates why the MAC address is locked:
•
Authentication − Locked as the result of authentication
•
First Arrival − Locked because it was the first MAC address to access the port
•
Static − MAC address was added to the list administratively
Retrieve Button
Static MACs 433
NetSight Policy Manager Help
Populates the Locked MAC Addresses table with a list of the MAC addresses currently locked on the selected port.
Add Button
Opens the Add Static MAC window, where you can create a list of locked MAC addresses for this
port.
Remove Button
Removes the selected entry from the Locked MAC Addresses table.
Static MACs 434
MAC Locking Tab
(Port Group)
This tab displays a list of MAC addresses that are currently locked in a port group, and lets you add and remove addresses on the list. To access this tab, select a port group on the left−panel Port Groups tab and click the MAC Locking tab in the right panel. To populate the table, click Retrieve.
.
MAC Locking ensures that only a specific MAC address can access a port, and that traffic from any other
MAC addresses will be discarded. See MAC Locking for more information
Click the graphic for more information.
Static MACs
Static MACs
Click Apply to change all Dynamic Locked MAC addresses (with the Locking Cause of "First
Arrival") to Static Locked MAC addresses. To ensure that all Dynamic Locked MAC addresses are changed to Static, make sure that the Maximum Number of Static Locked MAC Addresses is set to a
large enough value in the Port Properties MAC Locking Tab.
Locked MAC Addresses
Retrieve Button
Populates the Locked MAC Addresses table with a list of the MAC addresses currently locked in the port group.
Add Button
MAC Locking Tab (Port Group) 435
NetSight Policy Manager Help
Opens the Add Static MAC window, where you can create a list of locked MAC addresses for this
port group.
Remove Button
Removes the selected entry from the Locked MAC Addresses table.
Device
Device on which the MAC address is locked.
Port IfName
A description of the port on which the MAC address is locked.
Index
The index value of the port on which the MAC address is locked.
MAC Address
The MAC address that is locked.
Locking Cause
Indicates why the MAC address is locked:
•
Authentication − Locked as the result of authentication
•
First Arrival − Locked because it was the first MAC address to access the port
•
Static − MAC address was added to the list administratively
MAC Locking Tab (Port Group) 436
Mappings Tab
(Rate Limit Port Group)
This tab lets you view and configure the rate limit mappings for a role−based rate limit port group. Rate limit mappings map a logical rate limit index to an actual physical rate limit you have created in Policy Manager.
Each port group has its own set of index mappings. When you create your class of service you will select the one logical index that, when looked up in this mapping table, provides the desired physical rate limit for each port group.
Policy Manager supports a maximum of 32 logical rate limit indexes and each type of rate limit port group lets you map all 32 indexes. For 8−rate limit port groups, this means that the number of logical indexes is greater than the actual number of rate limits the ports support. This is because some devices may have a mix of ports that support 32 rate limits and ports that support eight rate limits. The 8−rate limit port groups will have 32 logical rate limit indexes (0−31), but they can only be mapped to a maximum of eight different physical rate limits. The 100−rate limit port groups will have only 32 logical rate limit indexes that can be mapped to 32 different physical rate limits, even though the ports support a maximum of 100 different physical rate limits.
To access this tab, select a rate limit port group in the left−panel Classes of Service tab, then select the
Mappings tab in the right panel.
Click the graphic for more information.
Mappings Tab(Rate Limit Port Group) 437
NetSight Policy Manager Help
Acceptable Rate Limit Ranges
This section displays the acceptable rate limit units and ranges for this port group type. When mapping rate limits to logical indexes, you must select a rate limit that is in the valid range for the port group.
Inbound Rate Limit Index Mapping
This section displays the actual rate limit (the rate limit precedence followed by the rate limit name)
that is mapped to each rate limit index. Click Edit to open the Edit Rate Limit Mappings window
where you can specify a rate limit for each index.
Mappings Tab(Rate Limit Port Group) 438
Mappings Tab (Role)
This tab lets you view and configure four different mapping lists for the selected role:
•
MAC to Role Mapping − Lets you assign the role to an end user based on the user's MAC address.
•
IP to Role Mapping − Lets you assign the role to an end user based on the user's IP address.
•
Tagged Packet VLAN to Role Mapping − Lets you assign the role to network traffic based on the
• traffic's VLAN ID.
Authentication−Based VLAN to Role Mapping − Lets you assign the role to an end user during the authentication process, based on a VLAN Attribute.
To access this tab, select a role in the left panel's Roles tab and click the Mappings tab in the right panel. Any
additions or changes you make to this tab must be enforced in order to take effect.
Click the graphic for more information.
Mappings Tab (Role) 439
NetSight Policy Manager Help
MAC to Role Mapping
MAC to Role mapping provides a way to assign a role to an end station based on its source MAC address.
This allows you to create a specific role for a group of end stations (such as IP phones), and assign it to them based on their MAC address and a MAC mask. When the end stations connect to the network, the policy−enabled device identifies the source MAC address and applies the mapped role.
This table lists any device−level (all devices) or port−level MAC to Role mappings that have been configured for this role. Use the Add button to create a new device−level mapping for this role. Port−level mappings can
device−level mappings.
NOTES:
−− You must have the Port Level Role Mappings feature enabled in Policy Manager for port−level mappings to take effect. (From the menu bar, select the Edit > Port Level Role
Mappings checkbox.) If the feature is not enabled, the mappings will be ignored and any mappings listed here will be grayed out.
−− Port−level mappings cannot be added to or removed from frozen ports . You must clear the frozen state on a port in order to add or remove a mapping. Once you have created a mapping, you can freeze the port. The port−level mappings of the frozen port will still be enforced and verified.
Device/Port Level
This column indicates whether the mapping is a device−level mapping (all devices) or a port−level mapping (IP address and port description).
MAC Address
The MAC addresses mapped to this role. Click Add to add a MAC address and mask to the list.
Mask
The mask associated with each MAC address. Masking a MAC address is only supported on Matrix
N−Series Platinum devices. Using a mask provides an easy way to select end stations based on a portion of their MAC address. For example, you could select one MAC address, then use a mask based on the manufacturers ID portion of the MAC address to specify all your Siemens IP Phones.
Add
Opens the Add MAC Address window, where you can select a MAC address and a MAC mask.
Remove
Select a MAC address and click Remove to remove the mapping from the list.
IP to Role Mapping
IP to Role mapping provides a way to assign a role to an end station based on its IP address. For example, in networks that haven't deployed authentication, this would allow you to map an individual IP address such as an administrator's laptop, to a specific role. When the end station connects to the network, the policy−enabled device identifies the IP address and applies the mapped role.
This table lists any IP to Role mappings that have been configured for this role. Use the Add button to create a new mapping for this role.
IP Address
Mappings Tab (Role) 440
NetSight Policy Manager Help
The IP addresses mapped to this role. Click Add to add an IP address and mask to the list.
Mask
The mask associated with each IP address. Masking an IP address is only supported on Matrix
N−Series Gold and Platinum devices.
Add
Opens the Add IP Address window, where you can select an IP address and an IP mask.
Remove
Select an IP address and click Remove to remove the mapping from the list.
Tagged Packet VLAN to Role Mapping
Tagged Packet VLAN to Role mapping provides a way to let policy−enabled devices assign a role to network traffic, based on a VLAN ID. When a device receives network traffic that has been tagged with a VLAN ID
(tagged packet) it uses the Tagged Packet VLAN to Role mapping list to determine what role to assign the
This table lists any device−level (all devices) or port−level Tagged Packet VLAN to Role mappings that have been configured for this role. Use the Add button to create a new device−level mapping for this role.
Port−level mappings can be added via the Port Properties General tab, Mappings Sub−tab. Port−level
mappings will override any device−level mappings.
NOTES:
−− You must have the Port Level Role Mappings feature enabled in Policy Manager for port−level mappings to take effect. (From the menu bar, select the Edit > Port Level Role
Mappings checkbox.) If the feature is not enabled, the mappings will be ignored and any mappings listed here will be grayed out.
−− Port−level mappings cannot be added to or removed from frozen ports . You must clear the frozen state on a port in order to add or remove a mapping. Once you have created a mapping, you can freeze the port. The port−level mappings of the frozen port will still be enforced and verified.
NOTE:
When configuring Tagged Packet VLAN to role mapping, you must also enable the TCI
Overwrite attribute. TCI Overwrite allows the VLAN or class of service tag in a received packet to be overwritten by the VLAN (access control) and class of service characteristics defined in the
* − Primary Securestack C2/B2/C3/B3 mapping
Use this column to select the device−level VLAN to role mapping that will be used for SecureStack
C2/C3 and B2/B3 devices (C2 firmware version 03.02.xx and higher/B2 firmware version 02.00.16
and higher). These devices only support one device−level VLAN to role mapping. If you do not make a selection, there will be no device−level mapping for C2/C3 and B2/B3 devices. Use the Mappings
tab in the Enforce Preview window to quickly see which VLAN to role mapping is selected for C2/C3
and B2/B3 devices.
Device/Port Level
This column indicates whether the mapping is a device−level mapping (all devices) or a port−level mapping (IP address and port description).
Mappings Tab (Role) 441
NetSight Policy Manager Help
VLAN
The VLAN ID and name of the VLANs mapped to this role. Click Add to add a VLAN to the list.
Add
Opens the VLANs Selection View, where you can choose a VLAN to map to the role.
Remove
Select a VLAN and click Remove to remove the mapping from the list.
Authentication−Based VLAN to Role Mapping
Authentication−Based VLAN to Role mapping provides a way to assign a role to a user during the authentication process, based on a VLAN Attribute. An end user connects to a policy−enabled device that supports 802.1X authentication using a RADIUS Server. During the authentication process, the RADIUS server returns a VLAN ID in its RADIUS VLAN Tunnel Attribute. The device uses the Authentication−Based
VLAN to Role mapping list to determine what role to assign to the end user, based on the VLAN Tunnel
Attribute. Use this table to view and configure the VLANs that will map to the selected role. For more
information, see VLAN to Role Mapping in the Concepts Help topic.
This table lists any Authentication−Based VLAN to Role mappings that have been configured for this role.
Use the Add button to create a new mapping for this role.
NOTE:
When configuring Authentication−Based VLAN to role mapping, you must enable RFC3580
VLAN Authorization on the device via the device Authentication tab.
VLAN
The VLAN ID and name of the VLANs mapped to this role. Click Add to add a VLAN to the list.
Add
Opens the VLANs Selection View, where you can choose a VLAN to map to the role.
Remove
Select a VLAN and click Remove to remove the VLAN from the list.
Mappings Tab (Role) 442
Mappings Tab
(Transmit Queue Port Group)
This tab lets you view and configure the transmit queue mappings for a transmit queue port group. Transmit queue mappings map a logical transmit queue index to an actual physical transmit queue you have configured in Policy Manager. When you first open this tab you will see the default mapping for the port group's transmit queues. Changing this mapping allows you to fine tune the transmit queue configuration according to the
the transmit queues.
For some port groups, the number of indexes will be greater than the actual number of transmit queues the ports support. This is because devices can have ports that support different numbers of transmit queues. For example, in the graphic below you can see the default mappings for a 4−queue port group: 16 transmit queue indexes are mapped to four physical queues (0−3).
To access this tab, select a transmit queue port group in the left−panel Classes of Service tab, then select the
Mappings tab in the right panel.
Click the graphic for more information.
Transmit Queue Index Mapping
Use the drop−down lists to select the physical transmit queue you would like to map to each transmit queue index.
Restore Defaults
Click this button to restore the default transmit queue mappings for the port type.
Mappings Tab(Transmit Queue Port Group) 443
NetSight Policy Manager Help
Mappings Tab(Transmit Queue Port Group) 444
Mappings Tab
(VLAN)
role. To access this tab, select a VLAN in the left−panel VLANs tab and click the Mappings tab in the right panel. If you make a change on this tab, you need to enforce it using the Enforce button on the toolbar.
Click the graphic for more information.
Tagged Packet VLAN to Role Mapping
Tagged Packet VLAN to Role Mapping provides a way to let policy−enabled devices assign a role to network
This area displays what role (if any) the VLAN is mapped to at both the device−level and port−level, and lets you configure mappings, if desired.
NOTE:
When configuring Tagged Packet VLAN to role mapping, you must also enable the TCI
Overwrite attribute. TCI Overwrite allows the VLAN or class of service tag in a received packet to be overwritten by the VLAN (access control) and class of service characteristics defined in the
Mapped to Role
Mappings Tab (VLAN) 445
NetSight Policy Manager Help
The role the VLAN is mapped to at the device level (all devices). To select a role, click Select, choose a role, and click OK.
Select
Opens the role Selection View, where you can choose a role to associate with the VLAN at the device
level.
Port Level Mappings
This table lists any port−level Tagged Packet VLAN to Role Mappings that have been configured for this VLAN. Port−level mappings will override any device−level mapping.
NOTES:
−− You must have the Port Level Role Mappings feature enabled in Policy Manager for the mappings to take effect. (From the menu bar, select the Edit > Port Level Role
Mappings checkbox.) If the feature is not enabled, the mappings will be ignored and any mappings listed here will be grayed out.
−− Port−level mappings cannot be added or removed to or from frozen ports . You must clear the frozen state on a port in order to add or remove a mapping. Once you have created a mapping, you can freeze the port. The port−level mappings of the frozen port will still be enforced and verified.
Add/Remove Mappings
Opens the Add/Remove Mappings window where you can add or remove port−level mappings. You
can also configure port−level mappings using the Mappings sub−tab in the Port Properties General
tab.
Authentication−Based VLAN to Role Mapping
Authentication−Based VLAN to Role Mapping provides a way to assign a role to a user during the
the Concepts help topic.) This area displays what role (if any) the VLAN is mapped to (at the device−level) and lets you configure a mapping, if desired.
NOTE:
When configuring Authentication−Based VLAN to role mapping, you must enable RFC3580
VLAN Authorization on the device via the device Authentication tab.
Mapped to Role
The role the VLAN is mapped to. To select a role, click Select, choose a role, and click OK.
Select
Opens the role Selection View, where you can choose a role to associate with the VLAN.
Mappings Tab (VLAN) 446
Ports Tab (Device)
The device Ports tab displays a table of information about the selected device's ports. To access this tab, select a device on the left panel's Network Elements tab and click the Ports tab in the right panel. Right−click an item in the table to see a menu of available options.
Click the graphic for more information.
Name
Name of the port, constructed of the name or IP address of the device and either the port index number or the port interface name.
Index
The index value assigned to the port interface.
Default Role
See Default Role in the Concepts topic for information on default roles. For additional information,
Current Role
Current role assigned to the port, through successful authentication or assignment of the default role.
This is determined by the device, based on the configuration settings that have been applied to the
port (Port Properties Authentication Configuration tab).
Interface Name
A description of the port.
Port Type
Type of port. Possible values include: Access, CDP, CDP FTM 1 Backplane, FTM 1 Backplane, and
Logical.
Port Speed
Speed of the port. Possible values include: 10/100, speed in megabits per second (for example, 800.0
Mbps), Unknown (displayed for logical ports).
Ports Tab (Device) 447
NetSight Policy Manager Help
User Name
User ID of the user currently or most recently authenticated on the port.
Port Mode
to determine the port mode (e.g., for logical ports), Unknown is displayed.
Authentication State
Current state of the port with regard to authentication. If "None," authentication is not enabled on the device. Matrix N−Series devices that support multiple authenticated users per port will display N/A
(Not Applicable) for this column.
For web−based authentication:
•
Disconnected − There is no end user currently logged in on the port.
•
Authenticating − An end user is in the process of logging in and being authenticated.
•
Authenticated − An end user is currently logged in and authenticated.
•
Held − The port is locked and authentication attempts are not allowed. Occurs when, for example, an end user tries to log in several times with an incorrect password.
For 802.1X authentication:
•
Initialize − The port is initializing. One reason for this is that the device has been reset.
•
Disconnected − There is no end user currently logged in on the port.
•
Connecting − The port is establishing communication with an end user.
•
Authenticating − An end user is in the process of logging in and being authenticated.
•
Authenticated − An end user is currently logged in and authenticated.
•
Aborting − The authentication procedure is being prematurely terminated due to, for
• example, a re−authentication request or an authentication timeout.
Held − The port is locked and authentication attempts are not allowed. Occurs when, for
• example, an end user tries to log in several times with an incorrect password.
Default Role − An end user has connected and is using the port's default role. Occurs when
•
the port mode is set to Inactive/Default (see Port Mode for more information).
No Authentication − No end user can be authenticated because the port mode is set to
Inactive/Discard (see Port Mode for more information).
NOTE:
RoamAbout R2 devices always show "Authenticating" as their Authentication State.
Because R2 devices can have multiple users authenticated to the same port,
"Authenticating" simply denotes that the port is currently open for users to authenticate.
Last Login Result
(Web−based authentication only) Indicates the result (success/failure) of the last attempt to log in to this port. Possible results are as follows:
•
Not logged in since last reset − No login in since reset.
•
Authentication accepted − User logged in successfully.
•
Authentication rejected
•
Username or password mismatch
•
User misconfiguration (e.g. Deny Remote Permission in Active Directory Users).
or, when two RADIUS servers are configured in the device:
•
Mismatched Shared Secret in a primary RADIUS server or both RADIUS servers.
•
Unsupported protocol (e.g. CHAP) configured on the device.
•
Unknown policy − No policy (Role) defined in the device.
Ports Tab (Device) 448
NetSight Policy Manager Help
•
Unknown authentication server response − When one RADIUS server is configured in the device:
•
Wrong Authentication UDP port number defined.
•
Mismatched Shared Secret.
•
RADIUS server is not contactable, or RADIUS server is down.
•
Unsupported protocol (e.g. CHAP) configured on the device.
•
Unknown authentication client error − User enters no username and password.
•
Auth client disabled or unavailable − RADIUS server is disabled in the device.
•
Port authentication pending − Port is in the process of authenticating.
•
Port held for too many failed attempts − User reached the maximum number of failed
• attempts to log in.
Port held: Max attempts exceeded − User exceeded the maximum number of failed
• attempts to log in once the port has been held.
Authentication server timeout − When two RADIUS servers are configured in the device:
•
Wrong Authentication UDP port number defined in a primary RADIUS server or
• both RADIUS servers.
RADIUS servers are not contactable
•
Unsupported protocol (e.g. CHAP) configured on the device.
Drop VLAN Tagged Frames
Indicates whether or not the Drop VLAN Tagged Frames feature is enabled on the port.
TCI Overwrite
Indicates whether or not TCI Overwrite is enabled on the port. TCI Overwrite is required for Tagged
Packet VLAN to Role Mapping. Ports on devices that do not support TCI Overwrite will display N/A
(Not Applicable) for this column.
MAC Locking
Indicates whether or not MAC locking is enabled on the port.
Buttons
Retrieve
Retrieves the most recent information about the ports on the device.
Port Properties
view and edit port information.
Ports Tab (Device) 449
Ports Tab
(Port Group)
The port group Ports tab provides a table of information about the ports in the selected port group. It also includes buttons that enable you to retrieve the latest information about the ports and to add and remove ports
group in the left−panel Port Groups tab, then select the Ports tab in the right panel.
See Pre−Defined Port Groups for more information on the port groups provided by Policy Manager.
Click the graphic for more information.
Name
Name of the port, constructed of the name or IP address of the device and either the port index number or the port interface name.
Index
The index value assigned to the port interface.
Default Role
See Default Role in the Concepts topic for information on default roles. For additional information,
Current Role
Current role assigned to the port, through successful authentication or assignment of the default role.
This is determined by the device, based on the configuration settings that have been applied to the
port (Port Properties Authentication Configuration tab).
Interface Name
The port interface name.
Port Type
Type of port. Possible values include: Access, CDP, CDP FTM 1 Backplane, FTM 1 Backplane, and
Logical.
Port Speed
Speed of the port. Possible values include: 10/100, speed in megabits per second (for example, 800.0
Mbps), Unknown (displayed for logical ports).
Ports Tab (Port Group) 450
NetSight Policy Manager Help
User Name
User ID provided by the end user at login (authentication).
Port Mode
unable to determine the port mode (e.g., for logical ports), Unknown is displayed.
Authentication State
Current state of the port with regard to authentication. If "None," authentication is not enabled on the device. Matrix N−Series devices that support multiple authenticated users per port will display N/A
(Not Applicable) for this column.
For web−based authentication:
•
Disconnected − There is no end user currently logged in on the port.
•
Authenticating − An end user is in the process of logging in and being authenticated.
•
Authenticated − An end user is currently logged in and authenticated.
•
Held − The port is locked and authentication attempts are not allowed. Occurs when, for example, an end user tries to log in several times with an incorrect password.
For 802.1X authentication:
•
Initialize − The port is initializing. One reason for this is that the device has been reset.
•
Disconnected − There is no end user currently logged in on the port.
•
Connecting − The port is establishing communication with an end user.
•
Authenticating − An end user is in the process of logging in and being authenticated.
•
Authenticated − An end user is currently logged in and authenticated.
•
Aborting − The authentication procedure is being prematurely terminated due to, for
• example, a re−authentication request or an authentication timeout.
Held − The port is locked and authentication attempts are not allowed. Occurs when, for
• example, an end user tries to log in several times with an incorrect password.
Default Role − An end user has connected and is using the port's default role. Occurs when
•
the port mode is set to Inactive/Default (see Port Mode for more information).
No Authentication − No end user can be authenticated because the port mode is set to
Inactive/Discard (see Port Mode for more information).
NOTE:
RoamAbout R2 devices always show "Authenticating" as their Authentication State.
Because R2 devices can have multiple users authenticated to the same port,
"Authenticating" simply denotes that the port is currently open for users to authenticate.
Last Login Result
(Web−based authentication only) Indicates the result (success/failure) of the last attempt to log in to this port. Possible results are as follows:
•
Not logged in since last reset − No login in since reset.
•
Authentication accepted − User logged in successfully.
•
Authentication rejected
•
Username or password mismatch
•
User misconfiguration (e.g. Deny Remote Permission in Active Directory Users).
or, when two RADIUS servers are configured in the device:
•
Mismatched Shared Secret in a primary RADIUS server or both RADIUS servers.
•
Unsupported protocol (e.g. CHAP) configured on the device.
•
Unknown policy − No policy (Role) defined in the device.
Ports Tab (Port Group) 451
NetSight Policy Manager Help
•
Unknown authentication server response − When one RADIUS server is configured in the device:
•
Wrong Authentication UDP port number defined.
•
Mismatched Shared Secret.
•
RADIUS server is not contactable, or RADIUS server is down.
•
Unsupported protocol (e.g. CHAP) configured on the device.
•
Unknown authentication client error − User enters no username and password.
•
Auth client disabled or unavailable − RADIUS server is disabled in the device.
•
Port authentication pending − Port is in the process of authenticating.
•
Port held for too many failed attempts − User reached the maximum number of failed
• attempts to log in.
Port held: Max attempts exceeded − User exceeded the maximum number of failed
• attempts to log in once the port has been held.
Authentication server timeout − When two RADIUS servers are configured in the device:
•
Wrong Authentication UDP port number defined in a primary RADIUS server or
• both RADIUS servers.
RADIUS servers are not contactable
•
Unsupported protocol (e.g. CHAP) configured on the device.
Drop VLAN Tagged Frames
Indicates whether or not the Drop VLAN Tagged Frames feature is enabled on the port.
TCI Overwrite
Indicates whether or not TCI Overwrite is enabled on the port. TCI Overwrite is required for Tagged
Packet VLAN to Role Mapping. Ports on devices that do not support TCI Overwrite will display N/A
(Not Applicable) for this column.
MAC Locking
Indicates whether or not MAC locking is enabled on the port.
Buttons
Retrieve
Retrieves the most recent information about the ports in the port group.
Add/Remove Ports
Selecting a port in the table and clicking this button opens the Add/Remove Ports window, which
enables you to add and remove ports to and from the port group. This option is available for
user−defined port groups created with the Individual ports option only.
Port Properties
view and edit port information.
Ports Tab (Port Group) 452
Ports Tab
(Rate Limit Port Group)
The rate limit port group Ports tab lets you view all the ports in the selected port group, as well as add and remove ports to and from the group. It provides information about each port, and lets you view and edit port information (via the port's General tab). Click the Retrieve button to retrieve the latest port information for the group.
To access this tab, select a rate limit port group in the left−panel Classes of Service tab, then select the Ports tab in the right panel.
Click the graphic for more information.
Name
Name of the port, constructed of the name or IP address of the device and either the port index number or the port interface name.
Index
The index value assigned to the port interface.
Default Role
See Default Role in the Concepts topic for information on default roles. For additional information,
Current Role
Current role assigned to the port, through successful authentication or assignment of the default role.
This is determined by the device, based on the configuration settings that have been applied to the
port (Port Properties Authentication Configuration tab).
Interface Name
A description of the port.
Port Type
Ports Tab (Rate Limit Port Group) 453
NetSight Policy Manager Help
Type of port. Possible values include: Access, CDP, CDP FTM 1 Backplane, FTM 1 Backplane, and
Logical.
Port Speed
Speed of the port. Possible values include: 10/100, speed in megabits per second (for example, 800.0
Mbps), Unknown (displayed for logical ports).
User Name
User ID of the user currently or most recently authenticated on the port.
Port Mode
unable to determine the port mode (e.g., for logical ports), Unknown is displayed.
Authentication State
Current state of the port with regard to authentication. If "None," authentication is not enabled on the device. Matrix N−Series devices that support multiple authenticated users per port will display N/A
(Not Applicable) for this column.
For web−based authentication:
•
Disconnected − There is no end user currently logged in on the port.
•
Authenticating − An end user is in the process of logging in and being authenticated.
•
Authenticated − An end user is currently logged in and authenticated.
•
Held − The port is locked and authentication attempts are not allowed. Occurs when, for example, an end user tries to log in several times with an incorrect password.
For 802.1X authentication:
•
Initialize − The port is initializing. One reason for this is that the device has been reset.
•
Disconnected − There is no end user currently logged in on the port.
•
Connecting − The port is establishing communication with an end user.
•
Authenticating − An end user is in the process of logging in and being authenticated.
•
Authenticated − An end user is currently logged in and authenticated.
•
Aborting − The authentication procedure is being prematurely terminated due to, for
• example, a re−authentication request or an authentication timeout.
Held − The port is locked and authentication attempts are not allowed. Occurs when, for
• example, an end user tries to log in several times with an incorrect password.
Default Role − An end user has connected and is using the port's default role. Occurs when
•
the port mode is set to Inactive/Default (see Port Mode for more information).
No Authentication − No end user can be authenticated because the port mode is set to
Inactive/Discard (see Port Mode for more information).
Last Login Result
(Web−based authentication only) Indicates the result (success/failure) of the last attempt to log in to this port. Possible results are as follows:
•
Not logged in since last reset − No login in since reset.
•
Authentication accepted − User logged in successfully.
•
Authentication rejected
•
Username or password mismatch
•
User misconfiguration (e.g. Deny Remote Permission in Active Directory Users).
or, when two RADIUS servers are configured in the device:
•
Mismatched Shared Secret in a primary RADIUS server or both RADIUS servers.
Ports Tab (Rate Limit Port Group) 454
NetSight Policy Manager Help
•
Unsupported protocol (e.g. CHAP) configured on the device.
•
Unknown policy − No policy (Role) defined in the device.
•
Unknown authentication server response − When one RADIUS server is configured in the device:
•
Wrong Authentication UDP port number defined.
•
Mismatched Shared Secret.
•
RADIUS server is not contactable, or RADIUS server is down.
•
Unsupported protocol (e.g. CHAP) configured on the device.
•
Unknown authentication client error − User enters no username and password.
•
Auth client disabled or unavailable − RADIUS server is disabled in the device.
•
Port authentication pending − Port is in the process of authenticating.
•
Port held for too many failed attempts − User reached the maximum number of failed
• attempts to log in.
Port held: Max attempts exceeded − User exceeded the maximum number of failed
• attempts to log in once the port has been held.
Authentication server timeout − When two RADIUS servers are configured in the device:
•
Wrong Authentication UDP port number defined in a primary RADIUS server or
• both RADIUS servers.
RADIUS servers are not contactable
•
Unsupported protocol (e.g. CHAP) configured on the device.
Drop VLAN Tagged Frames
Indicates whether or not the Drop VLAN Tagged Frames feature is enabled on the port.
TCI Overwrite
Indicates whether or not TCI Overwrite is enabled on the port. TCI Overwrite is required for Tagged
Packet VLAN to Role Mapping. Ports on devices that do not support TCI Overwrite will display N/A
(Not Applicable) for this column.
MAC Locking
Indicates whether or not MAC locking is enabled on the port.
Buttons
Retrieve
Retrieves the most recent information about the ports in the rate limit port group.
Add/Remove Ports
Opens the Add/Remove Ports window, where you can add and remove ports to and from the port
group. When you create new port groups, you add ports from the Default group into your newly defined port groups.
Port Properties
view and edit port information.
Ports Tab (Rate Limit Port Group) 455
Ports Tab
(Role)
port information (via the Roles tab for the port). To access this tab, select a role in the left panel's Roles tab, then select the Ports tab in the right panel.
Click the graphic for more information.
Name
Name of the port, constructed of the name or IP address of the device and either the port index number or the port interface name.
Index
The index value assigned to the port interface.
Default Role
See Default Role in the Concepts topic for information on default roles. For additional information,
Current Role
Current role assigned to the port, through successful authentication or assignment of the default role.
This is determined by the device, based on the configuration settings that have been applied to the
port (Authentication Settings). See Port Mode for more information.
Interface Name
A description of the port.
Port Type
Type of port. Possible values include: Access, CDP, CDP FTM 1 Backplane, FTM 1 Backplane, and
Logical.
Port Speed
Speed of the port. Possible values include: 10/100, speed in megabits per second (for example, 800.0
Mbps), Unknown (displayed for logical ports).
Ports Tab (Role) 456
NetSight Policy Manager Help
User Name
User ID provided by the authenticated end user.
Port Mode
unable to determine the port mode (e.g., for logical ports), Unknown is displayed.
Authentication State
Current state of the port with regard to authentication. If "None", authentication is not enabled on the device. Matrix N−Series devices that support multiple authenticated users per port will display N/A
(Not Applicable) for this column.
For web−based authentication:
•
Disconnected − There is no end user currently logged in on the port.
•
Authenticating − An end user is in the process of logging in and being authenticated.
•
Authenticated − An end user is currently logged in and authenticated.
•
Held − The port is locked and authentication attempts are not allowed. Occurs when, for example, an end user tries to log in several times with an incorrect password.
For 802.1X authentication:
•
Initialize − The port is initializing. One reason for this is that the device has been reset.
•
Disconnected − There is no end user currently logged in on the port.
•
Connecting − The port is establishing communication with an end user.
•
Authenticating − An end user is in the process of logging in and being authenticated.
•
Authenticated − An end user is currently logged in and authenticated.
•
Aborting − The authentication procedure is being prematurely terminated due to, for
• example, a re−authentication request or an authentication timeout.
Held − The port is locked and authentication attempts are not allowed. Occurs when, for
• example, an end user tries to log in several times with an incorrect password.
Default Role − An end user has connected and is using the port's default role. Occurs when
•
the port mode is set to Inactive/Default (see Port Mode for more information).
No Authentication − No end user can be authenticated because the port mode is set to
Inactive/Discard (see Port Mode for more information).
NOTE:
RoamAbout R2 devices always show "Authenticating" as their Authentication State.
Because R2 devices can have multiple users authenticated to the same port,
"Authenticating" simply denotes that the port is currently open for users to authenticate.
Last Login Result
(Web−based authentication only) Indicates the result (success/failure) of the last attempt to log in to this port. Possible results are as follows:
•
Not logged in since last reset − No login in since reset.
•
Authentication accepted − User logged in successfully.
•
Authentication rejected
•
Username or password mismatch
•
User misconfiguration (e.g. Deny Remote Permission in Active Directory Users).
or, when two RADIUS servers are configured in the device:
•
Mismatched Shared Secret in a primary RADIUS server or both RADIUS servers.
•
Unsupported protocol (e.g. CHAP) configured on the device.
•
Unknown policy − No policy (Role) defined in the device.
Ports Tab (Role) 457
NetSight Policy Manager Help
•
Unknown authentication server response − When one RADIUS server is configured in the device:
•
Wrong Authentication UDP port number defined.
•
Mismatched Shared Secret.
•
RADIUS server is not contactable, or RADIUS server is down.
•
Unsupported protocol (e.g. CHAP) configured on the device.
•
Unknown authentication client error − User enters no username and password.
•
Auth client disabled or unavailable − RADIUS server is disabled in the device.
•
Port authentication pending − Port is in the process of authenticating.
•
Port held for too many failed attempts − User reached the maximum number of failed
• attempts to log in.
Port held: Max attempts exceeded − User exceeded the maximum number of failed
• attempts to log in once the port has been held.
Authentication server timeout − When two RADIUS servers are configured in the device:
•
Wrong Authentication UDP port number defined in a primary RADIUS server or
• both RADIUS servers.
RADIUS servers are not contactable
•
Unsupported protocol (e.g. CHAP) configured on the device.
Drop VLAN Tagged Frames
Indicates whether or not the Drop VLAN Tagged Frames feature is enabled on the port.
TCI Overwrite
Indicates whether or not TCI Overwrite is enabled on the port. TCI Overwrite is required for Tagged
Packet VLAN to Role Mapping. Ports on devices that do not support TCI Overwrite will display N/A
(Not Applicable) for this column.
MAC Locking
Indicates whether or not MAC locking is enabled on the port.
Buttons
Retrieve
Retrieves/updates the list of ports associated with this role.
Port Properties
view and edit port information.
Ports Tab (Role) 458
Ports Tab
(Transmit Queue Port Group)
The transmit queue port group Ports tab lets you view all the ports in the selected port group, as well as add and remove ports to and from the group. It provides information about each port, and lets you view and edit port information (via the port's General tab). Click the Retrieve button to retrieve the latest port information for the group.
To access this tab, select a transmit queue port group in the left panel's Classes of Service tab, then select the
Ports tab in the right panel.
Click the graphic for more information.
Name
Name of the port, constructed of the name or IP address of the device and either the port index number or the port interface name.
Index
The index value assigned to the port interface.
Default Role
See Default Role in the Concepts topic for information on default roles. For additional information,
Current Role
Current role assigned to the port, through successful authentication or assignment of the default role.
This is determined by the device, based on the configuration settings that have been applied to the
port (Port Properties Authentication Configuration tab).
Interface Name
A description of the port.
Port Type
Type of port. Possible values include: Access, CDP, CDP FTM 1 Backplane, FTM 1 Backplane, and
Ports Tab (Transmit Queue Port Group) 459
NetSight Policy Manager Help
Logical.
Port Speed
Speed of the port. Possible values include: 10/100, speed in megabits per second (for example, 800.0
Mbps), Unknown (displayed for logical ports).
User Name
User ID of the user currently or most recently authenticated on the port.
Port Mode
unable to determine the port mode (e.g., for logical ports), Unknown is displayed.
Authentication State
Current state of the port with regard to authentication. If "None," authentication is not enabled on the device. Matrix N−Series devices that support multiple authenticated users per port will display N/A
(Not Applicable) for this column.
For web−based authentication:
•
Disconnected − There is no end user currently logged in on the port.
•
Authenticating − An end user is in the process of logging in and being authenticated.
•
Authenticated − An end user is currently logged in and authenticated.
•
Held − The port is locked and authentication attempts are not allowed. Occurs when, for example, an end user tries to log in several times with an incorrect password.
For 802.1X authentication:
•
Initialize − The port is initializing. One reason for this is that the device has been reset.
•
Disconnected − There is no end user currently logged in on the port.
•
Connecting − The port is establishing communication with an end user.
•
Authenticating − An end user is in the process of logging in and being authenticated.
•
Authenticated − An end user is currently logged in and authenticated.
•
Aborting − The authentication procedure is being prematurely terminated due to, for
• example, a re−authentication request or an authentication timeout.
Held − The port is locked and authentication attempts are not allowed. Occurs when, for
• example, an end user tries to log in several times with an incorrect password.
Default Role − An end user has connected and is using the port's default role. Occurs when
•
the port mode is set to Inactive/Default (see Port Mode for more information).
No Authentication − No end user can be authenticated because the port mode is set to
Inactive/Discard (see Port Mode for more information).
Last Login Result
(Web−based authentication only) Indicates the result (success/failure) of the last attempt to log in to this port. Possible results are as follows:
•
Not logged in since last reset − No login in since reset.
•
Authentication accepted − User logged in successfully.
•
Authentication rejected
•
Username or password mismatch
•
User misconfiguration (e.g. Deny Remote Permission in Active Directory Users).
or, when two RADIUS servers are configured in the device:
•
Mismatched Shared Secret in a primary RADIUS server or both RADIUS servers.
•
Unsupported protocol (e.g. CHAP) configured on the device.
Ports Tab (Transmit Queue Port Group) 460
NetSight Policy Manager Help
•
Unknown policy − No policy (Role) defined in the device.
•
Unknown authentication server response − When one RADIUS server is configured in the device:
•
Wrong Authentication UDP port number defined.
•
Mismatched Shared Secret.
•
RADIUS server is not contactable, or RADIUS server is down.
•
Unsupported protocol (e.g. CHAP) configured on the device.
•
Unknown authentication client error − User enters no username and password.
•
Auth client disabled or unavailable − RADIUS server is disabled in the device.
•
Port authentication pending − Port is in the process of authenticating.
•
Port held for too many failed attempts − User reached the maximum number of failed
• attempts to log in.
Port held: Max attempts exceeded − User exceeded the maximum number of failed
• attempts to log in once the port has been held.
Authentication server timeout − When two RADIUS servers are configured in the device:
•
Wrong Authentication UDP port number defined in a primary RADIUS server or
• both RADIUS servers.
RADIUS servers are not contactable
•
Unsupported protocol (e.g. CHAP) configured on the device.
Drop VLAN Tagged Frames
Indicates whether or not the Drop VLAN Tagged Frames feature is enabled on the port.
TCI Overwrite
Indicates whether or not TCI Overwrite is enabled on the port. TCI Overwrite is required for Tagged
Packet VLAN to Role Mapping. Ports on devices that do not support TCI Overwrite will display N/A
(Not Applicable) for this column.
MAC Locking
Indicates whether or not MAC locking is enabled on the port.
Buttons
Retrieve
Retrieves the most recent information about the ports in the transmit queue port group.
Add/Remove Ports
Opens the Add/Remove Ports window, where you can add and remove ports to and from the port
group. This button is always grayed out for the Default port group. When you create new port groups, you add ports from the Default group into your newly defined port groups.
Port Properties
view and edit port information.
Ports Tab (Transmit Queue Port Group) 461
Port Usage Tab
(Device)
rate limit violations, and CEP (Convergence End Point) connections on a device. To display this tab, select a device in the left−panel Network Elements tab, then click the Port Usage tab in the right panel. You must click Retrieve to display the port information in the tables.
The Port Usage tab provides three sub−tabs to allow you to view the desired information:
•
•
Role−Based Rate Limit Violations Tab
•
End User Sessions Tab
This tab displays information about each login session for the ports on the device, including the current values being collected for a session still in progress, or the final values for the last valid session when there is no session currently active. You must click Retrieve to display the port information in the table.
By default the Show Only Active Sessions checkbox is checked, and only your active sessions are displayed.
Deselect the checkbox to display all entries. Active sessions that are being applied to traffic are listed in blue text. Active sessions that are not being applied are listed in green text. Some devices support multiple authentication sessions simultaneously per interface. This allows a single user to authenticate via 802.1X,
Web−Based, and MAC all at the same time. However, only one authentication type per interface can be
applied at a single time. The multi−user authentication type precedence (configured on the device
Authentication tab) determines which type will be applied. The applied session is the one that provides the role and traffic classification information. The remaining non−applied sessions will only be used if the currently applied session is terminated. For example, if a user authenticates on a port that has multi−user authentication enabled (802.1X, Web−Based, and MAC,) the active/applied session will be displayed in blue text and the other two sessions will be in green text. Another example would be if the user authenticates using the MAC authentication type but MAC authentication is disabled on the port, the session would be listed in green text. For devices that do not support multi−authentication, by definition the active session is also applied.
NOTE:
Matrix N−Series devices configured for multi−user authentication always list only active sessions even if the Show Only Active Session checkbox is deselected.
Session entries are collected up to the maximum allowed. When the maximum is reached, the oldest session entries are replaced with newer ones. The exception to this is the RoamAbout R2, where older session data is not kept.
For devices that support one authenticated user per port, only one user/current role per port will show up in the table. For devices that support multiple authenticated users per port (such as the RoamAbout R2 and the
Matrix N−Series Platinum devices), all users authenticated on its ports will be listed in the table, along with the roles under which they are authenticated.
Port Usage Tab (Device) 462
NetSight Policy Manager Help
Click the graphic for more information.
Device
The IP address or name of the device.
Interface Name
A description of the port.
Index
The index value assigned to the port interface.
Current Role
The role under which the user authenticated on the port. If a session displays "Invalid Role" in this
column, check the Invalid Role Action setting on the device Role/Rule tab to see the action that was
configured in the event a user is assigned an unknown or invalid role. If the user authenticated via
RFC 3580 VLAN Authorization, this column will display the role the VLAN is mapped to
(configured through Authentication−based VLAN to Role Mapping). If VLAN to Role mapping has not been configured, the port's Default role will be displayed (if there is one); otherwise, the column will display "N/A."
Policy PVID Override Status
Indicates whether default access control (a default VLAN) has been enabled for the current role.
Default access control allows you to permit traffic to be forwarded, deny traffic altogether, or contain
traffic to a VLAN. (See the Role General Tab for more information on default access control.) The
default VLAN overrides the 802.1Q PVID for the port.
Policy PVID Override
If default access control (a default VLAN) has been enabled for the current role and configured to contain traffic to a VLAN, this column displays the associated VLAN ID. The VLAN will be applied to all untagged frames arriving on the port that do not match any VLAN traffic classification rules, and overrides the 802.1Q PVID for the port. A value of 0 indicates that the default access control is configured to drop all frames that do not match a classification rule (Deny Traffic). A value of 4095 indicates that the default access control is configured to forward any frames that do not match a classification rule (Permit) using the 802.1Q PVID.
RFC3580 VLAN ID
If the user authenticated via RFC 3580 VLAN Authorization, this is the VLAN ID that was returned from the RADIUS server. A VLAN ID value of 0 indicates that no VLAN was assigned. If VLAN
Port Usage Tab (Device) 463
NetSight Policy Manager Help authentication is not supported on the device, this column will display "N/A."
RFC3580 VLAN Oper Egress
The modification that will be made to the VLAN egress list for the VLAN ID returned by the
RADIUS server, if the user authenticated via RFC 3580 VLAN Authorization.
•
None − No modification to the VLAN egress list will be made.
•
Tagged − The port will be added to the list with the egress state set to Tagged (frames will be
• forwarded as tagged).
Untagged − The port will be added to the list with the egress state set to Untagged (frames
• will be forwarded as untagged).
Dynamic − The port will use information returned in the RADIUS response to modify the
VLAN egress list.
If VLAN authentication is not supported on the device, this column will display "N/A." Use the Port
Properties Authentication Configuration tab to change these settings, if desired.
Type
The authentication type of this login session: Web−Based, 802.1X, MAC, or Role Override (Matrix
N−Series Platinum devices only). If Role Override is displayed, it signifies that a rule has been applied to the port, overriding the user's current role with a different role. An example of this would be if the Automated Security Manager has detected a threat on the port, and used a MAC address rule to apply the Quarantine role to the end user.
•
Role Override (MAC) signifies that a MAC address rule has been applied to the port,
• overriding the Default role or any authenticated role assigned to the end user.
Role Override (IP) signifies that an IP address rule has been applied to the port, overriding the Default role or any authenticated role assigned to an end user authenticated with Single
User 802.1X. An IP Address rule will not override the authenticated role for any authentication type other than Single User 802.1X.
IP Address
The IP address of the remote user of this login session.
MAC Address
The MAC address of the remote user of this login session.
Authentication Status
On Matrix N−Series Platinum devices, the authentication status of the login session. All other devices will display "N/A." Possible values are:
•
Authentication Successful
•
Authentication Failed
•
Authentication in Progress
•
Authentication Server Timeout
•
Authentication Terminated
Terminate Cause
The reason the login session terminated. For web−based authentication, the possible values are:
•
Administratively Terminated
•
Authorization Revoked
•
Link Down
•
Not Applicable
•
Port Disabled
•
Unknown Termination Cause
Port Usage Tab (Device) 464
NetSight Policy Manager Help
•
User Logged Out
For 802.1X authentication, the possible values are:
•
Authorization Revoked
•
Client Restarted
•
Link Down (or Lost Carrier)
•
Not Applicable
•
Port Disabled
•
Port Reinitialized
•
Reauthentication Failed
•
Unknown Termination Cause
•
User Logged Out
Session ID
A unique identifier for the session. For devices that support multiple authenticated users per port, each
User Name
The user name provided by the end user at login (authentication).
Received Bytes
The number of bytes received in user data frames on this port during this session. Matrix N−Series devices must be created using SNMPv3 in order to see this value. N−Series devices using SNMPv1 will display "N/A."
Transmitted Bytes
The number of bytes transmitted in user data frames on this port during this session. Matrix N−Series devices must be created using SNMPv3 in order to see this value. N−Series devices using SNMPv1 will display "N/A."
Received Frames
The number of user data frames received on this port during this session.
Transmitted Frames
The number of user data frames transmitted on this port during this session.
Start Time
The time and date when the login session started.
Duration
The duration of the user's login session, in the format
D + HH:MM:SS
.
Retrieve Button
Gets the device's port information and displays it in the table.
Terminate Button
Select an active session and click Terminate to end the session. If multiple sessions are selected, only active sessions will be terminated. You cannot terminate sessions on frozen ports and you cannot terminate Role Override (IP) or Role Override (MAC) sessions that were created through the CLI
(command line interface). See Terminating a Session for more information.
Port Usage Tab (Device) 465
NetSight Policy Manager Help
Lock MAC Address Button
Enables MAC Locking on the selected port(s) (static MAC locking). MAC locking must be enabled
on the device in order for it to be enabled on a port.
Show Only Active Sessions Checkbox
Select this checkbox to display only active sessions (listed in blue text) in the table.
Role−Based Rate Limit Violations Tab
This tab displays information about the role−based rate limit violations for the ports on the device, including the current data being collected for sessions in progress and data from previous sessions. You must click
Retrieve to display the port information in the tables.
Role−based rate limit functionality is available only on certain devices such as the Matrix N−Series Gold and
Platinum devices (refer to the Firmware Feature Support tables in the release notes for specific
device/firmware rate limit support.) For more information, see Defining Role Based Rate Limits.
Click the graphic for more information.
Name
The port interface name.
Index
The port index number.
Rate Limit
The rate limit that has been violated (exceeded).
Generated System Log
Indicates whether a syslog message was generated when the rate limit was first exceeded. You can
specify this action on a per−rate limit basis in the rate limit General tab.
Generated Trap
Indicates whether an audit trap was generated when the rate limit was first exceeded. You can specify
this action on a per−rate limit basis in the rate limit General tab.
Port Disabled
Role−Based Rate Limit Violations Tab 466
NetSight Policy Manager Help
Indicates whether the port was disabled when the rate limit was first exceeded. You can specify this
action on a per−rate limit basis in the rate limit General tab.
Retrieve Button
Retrieves the most recent rate limit violations information for the ports on the device.
Clear Button
Clears the violations table. If port traffic continues to exceed the rate limit, the violations will reappear in the table.
CEP Usage Tab
This tab displays information about each CEP connection for the ports on the device, including the date and time the connection was made. For devices that support one CEP connection per port, a connection entry remains in the table until a new connection is made on that port or the system is rebooted.
devices that support it.
Click the graphic for more information.
Device
The IP address or name of the device.
Interface Name
A description of the port.
Index
The index value assigned to the port interface.
CEP Type
The CEP product type that has made the connection.
Current Role
The assigned role for the CEP connection. Each CEP product type has a role mapped to it. When a
CEP connects to the network, the device identifies the CEP type and applies the assigned role. You
can map a role for a CEP using the device Authentication tab (CEP sub−tab).
IP Address
The IP address of the CEP connecting to the port.
CEP Usage Tab 467
NetSight Policy Manager Help
MAC Address
The MAC address of the CEP connecting to the port.
Start Time
The date and time the connection was made.
Retrieve Button
Gets the device's CEP connection information and displays it in the table.
CEP Usage Tab 468
Port Usage Tab
(Device Group)
role−based rate limit violations, and CEP (Convergence End Point) connections for the devices in the group.
To display this tab, select a device group in the left−panel Network Elements tab, then click the Port Usage tab in the right panel. You must click Retrieve to display the port information in the tables.
The Port Usage tab provides three sub−tabs to allow you to view the desired information:
•
•
Role−Based Rate Limit Violations Tab
•
End User Sessions Tab
This tab displays information about each login session for the ports on the devices in the device group, including the current values being collected for a session still in progress, or the final values for the last valid session when there is no session currently active. You must click Retrieve to display the port information in the table.
By default the Show Only Active Sessions checkbox is checked, and only your active sessions are displayed.
Deselect the checkbox to display all entries. Active sessions that are being applied to traffic are listed in blue text. Active sessions that are not being applied are listed in green text. Some devices support multiple authentication sessions simultaneously per interface. This allows a single user to authenticate via 802.1X,
Web−Based, and MAC all at the same time. However, only one authentication type per interface can be
applied at a single time. The multi−user authentication type precedence (configured on the device
Authentication tab) determines which type will be applied. The applied session is the one that provides the role and traffic classification information. The remaining non−applied sessions will only be used if the currently applied session is terminated. For example, if a user authenticates on a port that has multi−user authentication enabled (802.1X, Web−Based, and MAC,) the active/applied session will be displayed in blue text and the other two sessions will be in green text. Another example would be if the user authenticates using the MAC authentication type but MAC authentication is disabled on the port, the session would be listed in green text. For devices that do not support multi−authentication, by definition the active session is also applied.
NOTE:
Matrix N−Series devices configured for multi−user authentication always list only active sessions even if the Show Only Active Session checkbox is deselected.
Session entries are collected up to the maximum allowed. When the maximum is reached, the oldest session entries are replaced with newer ones. The exception to this is the RoamAbout R2, where older session data is not kept.
For devices that support one authenticated user per port, only one user/current role per port will show up in the table. For devices that support multiple authenticated users per port (such as the RoamAbout R2 and the
Matrix N−Series Platinum devices), all users authenticated on its ports will be listed in the table, along with the roles under which they are authenticated.
Port Usage Tab (Device Group) 469
NetSight Policy Manager Help
Click the graphic for more information.
Device
The IP address or name of the device in the selected device group.
Interface Name
A description of the port.
Index
The index value assigned to the port interface.
Current Role
The role under which the user authenticated on the port. If a session displays "Invalid Role" in this
column, check the Invalid Role Action setting on the device Role/Rule tab to see the action that was
configured in the event a user is assigned an unknown or invalid role. If the user authenticated via
RFC 3580 VLAN Authorization, this column will display the role the VLAN is mapped to
(configured through Authentication−based VLAN to Role Mapping). If VLAN to Role mapping has not been configured, the port's Default role will be displayed (if there is one); otherwise, the column will display "N/A."
Policy PVID Override Status
Indicates whether default access control (a default VLAN) has been enabled for the current role.
Default access control allows you to permit traffic to be forwarded, deny traffic altogether, or contain
traffic to a VLAN. (See the Role General Tab for more information on default access control.) The
default VLAN overrides the 802.1Q PVID for the port.
Policy PVID Override
If default access control (a default VLAN) has been enabled for the current role and configured to contain traffic to a VLAN, this column displays the associated VLAN ID. The VLAN will be applied to all untagged frames arriving on the port that do not match any VLAN traffic classification rules, and overrides the 802.1Q PVID for the port. A value of 0 indicates that the default access control is configured to drop all frames that do not match a classification rule (Deny Traffic). A value of 4095 indicates that the default access control is configured to forward any frames that do not match a classification rule (Permit) using the 802.1Q PVID.
RFC3580 VLAN ID
If the user authenticated via RFC 3580 VLAN Authorization, this is the VLAN ID that was returned from the RADIUS server. A VLAN ID value of 0 indicates that no VLAN was assigned. If VLAN authentication is not supported on the device, this column will display "N/A."
Port Usage Tab (Device Group) 470
NetSight Policy Manager Help
RFC3580 VLAN Oper Egress
The modification that will be made to the VLAN egress list for the VLAN ID returned by the
RADIUS server, if the user authenticated via RFC 3580 VLAN Authorization.
•
None − No modification to the VLAN egress list will be made.
•
Tagged − The port will be added to the list with the egress state set to Tagged (frames will be
• forwarded as tagged).
Untagged − The port will be added to the list with the egress state set to Untagged (frames
• will be forwarded as untagged).
Dynamic − The port will use information returned in the RADIUS response to modify the
VLAN egress list.
If VLAN authentication is not supported on the device, this column will display "N/A." Use the Port
Properties Authentication Configuration tab to change these settings, if desired.
Type
The authentication type of this login session: Web−Based, 802.1X, MAC, or Role Override (Matrix
N−Series Platinum devices only). If Role Override is displayed, it signifies that a rule has been applied to the port, overriding the user's current role with a different role. An example of this would be if the Automated Security Manager has detected a threat on the port, and used a MAC address rule to apply the Quarantine role to the end user.
•
Role Override (MAC) signifies that a MAC address rule has been applied to the port,
• overriding the Default role or any authenticated role assigned to the end user.
Role Override (IP) signifies that an IP address rule has been applied to the port, overriding the Default role or any authenticated role assigned to an end user authenticated with Single
User 802.1X. An IP Address rule will not override the authenticated role for any authentication type other than Single User 802.1X.
IP Address
The IP address of the remote user of this login session.
MAC Address
The MAC address of the remote user of this login session.
Authentication Status
On Matrix N−Series Platinum devices, the authentication status of the login session. All other devices will display "N/A." Possible values are:
•
Authentication Successful
•
Authentication Failed
•
Authentication in Progress
•
Authentication Server Timeout
•
Authentication Terminated
Terminate Cause
The reason the login session terminated. For web−based authentication, the possible values are:
•
Administratively Terminated
•
Authorization Revoked
•
Link Down
•
Not Applicable
•
Port Disabled
•
Unknown Termination Cause
•
User Logged Out
For 802.1X authentication, the possible values are:
Port Usage Tab (Device Group) 471
NetSight Policy Manager Help
•
Authorization Revoked
•
Client Restarted
•
Link Down (or Lost Carrier)
•
Not Applicable
•
Port Disabled
•
Port Reinitialized
•
Reauthentication Failed
•
Unknown Termination Cause
•
User Logged Out
Session ID
A unique identifier for the session. For devices that support multiple authenticated users per port, each
User Name
The user name provided by the end user at login (authentication).
Received Bytes
The number of bytes received in user data frames on this port during this session.
Transmitted Bytes
The number of bytes transmitted in user data frames on this port during this session.
Received Frames
The number of user data frames received on this port during this session.
Transmitted Frames
The number of user data frames transmitted on this port during this session.
Start Time
The time and date when the login session started.
Duration
The duration of the user's login session, in the format
D + HH:MM:SS
.
Retrieve Button
Gets the port information for the devices in the device group, and displays it in the table.
Terminate Button
Select an active session and click Terminate to end the session. If multiple sessions are selected, only active sessions will be terminated. You cannot terminate sessions on frozen ports and you cannot terminate Role Override (IP) or Role Override (MAC) sessions that were created through the CLI
(command line interface). See Terminating a Session for more information.
Lock MAC Address Button
Enables MAC Locking on the selected port(s) (static MAC locking). MAC locking must be enabled
on the device in order for it to be enabled on a port.
Show Only Active Sessions Checkbox
Select this checkbox to display only active sessions (listed in blue text) in the table.
Port Usage Tab (Device Group) 472
NetSight Policy Manager Help
Role−Based Rate Limit Violations Tab
This tab displays information about the role−based rate limit violations for the ports on the devices in the device group, including the current data being collected for sessions in progress and data from previous sessions. You must click Retrieve to display the port information in the tables.
Role−based rate limit functionality is available only on certain devices such as the Matrix N−Series Gold and
Platinum devices (refer to the Firmware Feature Support tables in the release notes for specific
device/firmware rate limit support.) For more information, see Defining Role Based Rate Limits.
Click the graphic for more information.
Name
The port interface name.
Index
The port index number.
Rate Limit
The rate limit that has been violated (exceeded).
Generated System Log
Indicates whether a syslog message was generated when the rate limit was first exceeded. You can
specify this action on a per−rate limit basis in the rate limit General tab.
Generated Trap
Indicates whether an audit trap was generated when the rate limit was first exceeded. You can specify
this action on a per−rate limit basis in the rate limit General tab.
Port Disabled
Indicates whether the port was disabled when the rate limit was first exceeded. You can specify this
action on a per−rate limit basis in the rate limit General tab.
Retrieve Button
Retrieves the most recent rate limit violations information for the ports on the device in the device group.
Clear Button
Role−Based Rate Limit Violations Tab 473
NetSight Policy Manager Help
Clears the violations table. If port traffic continues to exceed the rate limit, the violations will reappear in the table.
CEP Usage Tab
This tab displays information about each CEP connection for the ports on the devices, including the date and time the connection was made. For devices that support one CEP connection per port, a connection entry remains in the table until a new connection is made on that port or the system is rebooted.
devices that support it.
Click the graphic for more information.
Device
The IP address or name of the device.
Interface Name
A description of the port.
Index
The index value assigned to the port interface.
CEP Type
The CEP product type that has made the connection.
Current Role
The assigned role for the CEP connection. Each CEP product type has a role mapped to it. When a
CEP connects to the network, the device identifies the CEP type and applies the assigned role. You
can map a role for a CEP using the device Authentication tab (CEP sub−tab).
IP Address
The IP address of the CEP connecting to the port.
MAC Address
The MAC address of the CEP connecting to the port.
Start Time
The date and time the connection was made.
CEP Usage Tab 474
NetSight Policy Manager Help
Retrieve Button
Gets the device group CEP connection information and displays it in the table.
CEP Usage Tab 475
Port Usage Tab
(My Network/All Devices Folder)
limit violations, and CEP (Convergence End Point) connections for all devices in the current domain. To access this tab, select either the My Network or the All Devices folder in the left−panel Network Elements tab, then click the Port Usage tab in the right panel. You must click Retrieve to display the port information in the tables.
The Port Usage tab provides three sub−tabs to allow you to view the desired information:
•
•
Role−Based Rate Limit Violations Tab
•
End User Sessions Tab
This tab displays information about each login session for the ports on the listed devices, including the current values being collected for a session still in progress, or the final values for the last valid session when there is no session currently active. You must click Retrieve to display the port information in the table.
By default the Show Only Active Sessions checkbox is checked, and only your active sessions are displayed.
Deselect the checkbox to display all entries. Active sessions that are being applied to traffic are listed in blue text. Active sessions that are not being applied are listed in green text. Some devices support multiple authentication sessions simultaneously per interface. This allows a single user to authenticate via 802.1X,
Web−Based, and MAC all at the same time. However, only one authentication type per interface can be
applied at a single time. The multi−user authentication type precedence (configured on the device
Authentication tab) determines which type will be applied. The applied session is the one that provides the role and traffic classification information. The remaining non−applied sessions will only be used if the currently applied session is terminated. For example, if a user authenticates on a port that has multi−user authentication enabled (802.1X, Web−Based, and MAC,) the active/applied session will be displayed in blue text and the other two sessions will be in green text. Another example would be if the user authenticates using the MAC authentication type but MAC authentication is disabled on the port, the session would be listed in green text. For devices that do not support multi−authentication, by definition the active session is also applied.
NOTE:
Matrix N−Series devices configured for multi−user authentication always list only active sessions even if the Show Only Active Session checkbox is deselected.
Session entries are collected up to the maximum allowed. When the maximum is reached, the oldest session entries are replaced with newer ones. The exception to this is the RoamAbout R2, where older session data is not kept.
For devices that support one authenticated user per port, only one user/current role per port will show up in the table. For devices that support multiple authenticated users per port (such as the RoamAbout R2 and the
Matrix N−Series Platinum devices), all users authenticated on its ports will be listed in the table, along with the roles under which they are authenticated.
Port Usage Tab (My Network/All Devices Folder) 476
NetSight Policy Manager Help
Click the graphic for more information.
Device
The IP address or name of the device.
Interface Name
A description of the port.
Index
The index value assigned to the port interface.
Current Role
The role under which the user authenticated on the port. If a session displays "Invalid Role" in this
column, check the Invalid Role Action setting on the device Role/Rule tab to see the action that was
configured in the event a user is assigned an unknown or invalid role. If the user authenticated via
RFC 3580 VLAN Authorization, this column will display the role the VLAN is mapped to
(configured through Authentication−based VLAN to Role Mapping). If VLAN to Role mapping has not been configured, the port's Default role will be displayed (if there is one); otherwise, the column will display "N/A."
Policy PVID Override Status
Indicates whether default access control (a default VLAN) has been enabled for the current role.
Default access control allows you to permit traffic to be forwarded, deny traffic altogether, or contain
traffic to a VLAN. (See the Role General Tab for more information on default access control.) The
default VLAN overrides the 802.1Q PVID for the port.
Policy PVID Override
If default access control (a default VLAN) has been enabled for the current role and configured to contain traffic to a VLAN, this column displays the associated VLAN ID. The VLAN will be applied to all untagged frames arriving on the port that do not match any VLAN traffic classification rules, and overrides the 802.1Q PVID for the port. A value of 0 indicates that the default access control is configured to drop all frames that do not match a classification rule (Deny Traffic). A value of 4095 indicates that the default access control is configured to forward any frames that do not match a classification rule (Permit) using the 802.1Q PVID.
RFC3580 VLAN ID
If the user authenticated via RFC 3580 VLAN Authorization, this is the VLAN ID that was returned from the RADIUS server. A VLAN ID value of 0 indicates that no VLAN was assigned. If VLAN authentication is not supported on the device, this column will display "N/A."
Port Usage Tab (My Network/All Devices Folder) 477
NetSight Policy Manager Help
RFC3580 VLAN Oper Egress
The modification that will be made to the VLAN egress list for the VLAN ID returned by the
RADIUS server, if the user authenticated via RFC 3580 VLAN Authorization.
•
None − No modification to the VLAN egress list will be made.
•
Tagged − The port will be added to the list with the egress state set to Tagged (frames will be
• forwarded as tagged).
Untagged − The port will be added to the list with the egress state set to Untagged (frames
• will be forwarded as untagged).
Dynamic − The port will use information returned in the RADIUS response to modify the
VLAN egress list.
If VLAN authentication is not supported on the device, this column will display "N/A." Use the Port
Properties Authentication Configuration tab to change these settings, if desired.
Type
The authentication type of this login session: Web−Based, 802.1X, MAC, or Role Override (Matrix
N−Series Platinum devices only). If Role Override is displayed, it signifies that a rule has been applied to the port, overriding the user's current role with a different role. An example of this would be if the Automated Security Manager has detected a threat on the port, and used a MAC address rule to apply the Quarantine role to the end user.
•
Role Override (MAC) signifies that a MAC address rule has been applied to the port,
• overriding the Default role or any authenticated role assigned to the end user.
Role Override (IP) signifies that an IP address rule has been applied to the port, overriding the Default role or any authenticated role assigned to an end user authenticated with Single
User 802.1X. An IP Address rule will not override the authenticated role for any authentication type other than Single User 802.1X.
IP Address
The IP address of the remote user of this login session.
MAC Address
The MAC address of the remote user of this login session.
Authentication Status
On Matrix N−Series Platinum devices, the authentication status of the login session. All other devices will display "N/A." Possible values are:
•
Authentication Successful
•
Authentication Failed
•
Authentication in Progress
•
Authentication Server Timeout
•
Authentication Terminated
Terminate Cause
The reason the login session terminated. For web−based authentication, the possible values are:
•
Administratively Terminated
•
Authorization Revoked
•
Link Down
•
Not Applicable
•
Port Disabled
•
Unknown Termination Cause
•
User Logged Out
For 802.1X authentication, the possible values are:
Port Usage Tab (My Network/All Devices Folder) 478
NetSight Policy Manager Help
•
Authorization Revoked
•
Client Restarted
•
Link Down (or Lost Carrier)
•
Not Applicable
•
Port Disabled
•
Port Reinitialized
•
Reauthentication Failed
•
Unknown Termination Cause
•
User Logged Out
Session ID
A unique identifier for the session. For devices that support multiple authenticated users per port, each
User Name
The user name provided by the end user at login (authentication).
Received Bytes
The number of bytes received in user data frames on this port during this session.
Transmitted Bytes
The number of bytes transmitted in user data frames on this port during this session.
Received Frames
The number of user data frames received on this port during this session.
Transmitted Frames
The number of user data frames transmitted on this port during this session.
Start Time
The time and date when the login session started.
Duration
The duration of the user's login session, in the format
D + HH:MM:SS
.
Retrieve Button
Gets the port information for the devices, and displays it in the table.
Terminate Button
Select an active session and click Terminate to end the session. If multiple sessions are selected, only active sessions will be terminated. You cannot terminate sessions on frozen ports and you cannot terminate Role Override (IP) or Role Override (MAC) sessions that were created through the CLI
(command line interface). See Terminating a Session for more information.
Lock MAC Address Button
Enables MAC Locking on the selected port(s) (static MAC locking). MAC locking must be enabled
on the device in order for it to be enabled on a port.
Show Only Active Sessions Checkbox
Select this checkbox to display only active sessions (listed in blue text) in the table.
Port Usage Tab (My Network/All Devices Folder) 479
NetSight Policy Manager Help
Role−Based Rate Limit Violations Tab
This tab display information about the role−based rate limit violations for the ports on all devices, including the current data being collected for sessions in progress and data from previous sessions. You must click
Retrieve to display the port information in the tables.
Role−based rate limit functionality is available only on certain devices such as the Matrix N−Series Gold and
Platinum devices (refer to the Firmware Feature Support tables in the release notes for specific
device/firmware rate limit support.) For more information, see Defining Role Based Rate Limits.
Click the graphic for more information.
Name
The port interface name.
Index
The port index number.
Rate Limit
The rate limit that has been violated (exceeded).
Generated System Log
Indicates whether a syslog message was generated when the rate limit was first exceeded. You can
specify this action on a per−rate limit basis in the rate limit General tab.
Generated Trap
Indicates whether an audit trap was generated when the rate limit was first exceeded. You can specify
this action on a per−rate limit basis in the rate limit General tab.
Port Disabled
Indicates whether the port was disabled when the rate limit was first exceeded. You can specify this
action on a per−rate limit basis in the rate limit General tab.
Retrieve Button
Retrieves the most recent rate limit violations information for the ports on all devices.
Clear Button
Role−Based Rate Limit Violations Tab 480
NetSight Policy Manager Help
Clears the violations table. If port traffic continues to exceed the rate limit, the violations will reappear in the table.
CEP Usage Tab
This tab displays information about each CEP connection for the ports on the devices, including the date and time the connection was made. For devices that support one CEP connection per port, a connection entry remains in the table until a new connection is made on that port or the system is rebooted.
devices that support it.
Click the graphic for more information.
Device
The IP address or name of the device.
Interface Name
A description of the port.
Index
The index value assigned to the port interface.
CEP Type
The CEP product type that has made the connection.
Current Role
The assigned role for the CEP connection. Each CEP product type has a role mapped to it. When a
CEP connects to the network, the device identifies the CEP type and applies the assigned role. You
can map a role for a CEP using the device Authentication tab (CEP sub−tab).
IP Address
The IP address of the CEP connecting to the port.
MAC Address
The MAC address of the CEP connecting to the port.
Start Time
The date and time the connection was made.
CEP Usage Tab 481
NetSight Policy Manager Help
Retrieve Button
Gets the device group CEP connection information and displays it in the table.
CEP Usage Tab 482
Port Properties
Port Usage Tab
role−based rate limit violations, and CEP (Convergence End Point) connections on a port.
There are two ways to access the Port Usage tab:
•
Select a device in the left−panel Network Elements tab and expand a slot or ports grouping in the right−panel Details view. Right−click on a port and select Properties from the menu. In the Port
•
Properties window, select the Port Usage tab (in the top row of tabs).
Select a port in the left−panel Port Groups tab, then select the Port Usage tab in the right panel.
The Port Usage tab provides four sub−tabs:
•
•
•
Role−Based Rate Limit Violations Tab
•
End User Sessions Tab
This table displays information about login sessions for the port, including the current values being collected for a session still in progress, or the final values for the last valid session when there is no session currently active. You must click Retrieve to display the port information in the table.
By default the Show Only Active Sessions checkbox is checked, and only your active sessions are displayed.
Deselect the checkbox to display all entries. Active sessions that are being applied to traffic are listed in blue text. Active sessions that are not being applied are listed in green text. Some devices support multiple authentication sessions simultaneously per interface. This allows a single user to authenticate via 802.1X,
Web−Based, and MAC all at the same time. However, only one authentication type per interface can be
applied at a single time. The multi−user authentication type precedence (configured on the device
Authentication tab) determines which type will be applied. The applied session is the one that provides the role and traffic classification information. The remaining non−applied sessions will only be used if the currently applied session is terminated. For example, if a user authenticates on a port that has multi−user authentication enabled (802.1X, Web−Based, and MAC,) the active/applied session will be displayed in blue text and the other two sessions will be in green text. Another example would be if the user authenticates using the MAC authentication type but MAC authentication is disabled on the port, the session would be listed in green text. For devices that do not support multi−authentication, by definition the active session is also applied.
NOTE:
Matrix N−Series devices configured for multi−user authentication always list only active sessions even if the Show Only Active Session checkbox is deselected.
Session entries are collected up to the maximum allowed. When the maximum is reached, the oldest session entries are replaced with newer ones. The exception to this is the RoamAbout R2, where older session data is not kept.
Port PropertiesPort Usage Tab 483
NetSight Policy Manager Help
For devices that support one authenticated user per port, only one user/current role per port will show up in the table. For devices that support multiple authenticated users per port (such as the RoamAbout R2 and the
Matrix N−Series devices), all users authenticated on the port will be listed in the table, along with the roles under which they are authenticated.
Click the graphic for more information.
End User Sessions
Device
The IP address or name of the device where the port is located.
Interface Name
A description of the port.
Index
The index value assigned to the port interface.
Current Role
The role under which the user authenticated on the port. If a session displays "Invalid Role" in this
column, check the Invalid Role Action setting on the device Role/Rule tab to see the action that was
configured in the event a user is assigned an unknown or invalid role. If the user authenticated via
RFC 3580 VLAN Authorization, this column will display the role the VLAN is mapped to
(configured through Authentication−based VLAN to Role Mapping). If VLAN to Role mapping has not been configured, the port's Default role will be displayed (if there is one); otherwise, the column will display "N/A."
Policy PVID Override Status
Indicates whether default access control (a default VLAN) has been enabled for the current role.
Default access control allows you to permit traffic to be forwarded, deny traffic altogether, or contain
traffic to a VLAN. (See the Role General Tab for more information on default access control.) The
default VLAN overrides the 802.1Q PVID for the port.
End User Sessions 484
NetSight Policy Manager Help
Policy PVID Override
If default access control (a default VLAN) has been enabled for the current role and configured to contain traffic to a VLAN, this column displays the associated VLAN ID. The VLAN will be applied to all untagged frames arriving on the port that do not match any VLAN traffic classification rules, and overrides the 802.1Q PVID for the port. A value of 0 indicates that the default access control is configured to drop all frames that do not match a classification rule (Deny Traffic). A value of 4095 indicates that the default access control is configured to forward any frames that do not match a classification rule (Permit) using the 802.1Q PVID.
RFC3580 VLAN ID
If the user authenticated via RFC 3580 VLAN Authorization, this is the VLAN ID that was returned
from the RADIUS server. A VLAN ID value of 0 indicates that no VLAN was assigned. If VLAN authentication is not supported on the device, this column will display "N/A."
RFC3580 VLAN Oper Egress
The modification that will be made to the VLAN egress list for the VLAN ID returned by the
RADIUS server, if the user authenticated via RFC 3580 VLAN Authorization.
•
None − No modification to the VLAN egress list will be made.
•
Tagged − The port will be added to the list with the egress state set to Tagged (frames will be
• forwarded as tagged).
Untagged − The port will be added to the list with the egress state set to Untagged (frames
• will be forwarded as untagged).
Dynamic − The port will use information returned in the RADIUS response to modify the
VLAN egress list.
If VLAN authentication is not supported on the device, this column will display "N/A." Use the Port
Properties Authentication Configuration tab to change these settings, if desired.
Type
The authentication type of this login session: Web−Based, 802.1X, MAC, or Role Override (Matrix
N−Series Platinum devices only). If Role Override is displayed, it signifies that a rule has been applied to the port, overriding the user's current role with a different role. An example of this would be if the Automated Security Manager has detected a threat on the port, and used a MAC address rule to apply the Quarantine role to the end user.
•
Role Override (MAC) signifies that a MAC address rule has been applied to the port,
• overriding the Default role or any authenticated role assigned to the end user.
Role Override (IP) signifies that an IP address rule has been applied to the port, overriding the Default role or any authenticated role assigned to an end user authenticated with Single
User 802.1X. An IP Address rule will not override the authenticated role for any authentication type other than Single User 802.1X.
IP Address
The IP address of the remote user of this login session.
MAC Address
The MAC address of the remote user of this login session.
Authentication Status
On Matrix N−Series Platinum devices, the authentication status of the login session. All other devices will display "N/A." Possible values are:
•
Authentication Successful
•
Authentication Failed
End User Sessions 485
NetSight Policy Manager Help
•
Authentication in Progress
•
Authentication Server Timeout
•
Authentication Terminated
Terminate Cause
The reason the login session terminated. For web−based authentication, the possible values are:
•
Administratively Terminated
•
Authorization Revoked
•
Link Down
•
Not Applicable
•
Port Disabled
•
Unknown Termination Cause
•
User Logged Out
For 802.1X authentication, the possible values are:
•
Authorization Revoked
•
Client Restarted
•
Link Down (or Lost Carrier)
•
Not Applicable
•
Port Disabled
•
Port Reinitialized
•
Reauthentication Failed
•
Unknown Termination Cause
•
User Logged Out
Session ID
A unique identifier for the session. For devices that support multiple authenticated users per port, each
User Name
The user name provided by the end user at login (authentication).
Received Bytes
The number of bytes received in user data frames on this port during this session. Matrix N−Series devices must be created using SNMPv3 in order to see this value. N−Series devices using SNMPv1 will display "N/A."
Transmitted Bytes
The number of bytes transmitted in user data frames on this port during this session. Matrix N−Series devices must be created using SNMPv3 in order to see this value. N−Series devices using SNMPv1 will display "N/A."
Received Frames
The number of user data frames received on this port during this session.
Transmitted Frames
The number of user data frames transmitted on this port during this session.
Start Time
The time and date when the login session started.
End User Sessions 486
NetSight Policy Manager Help
Duration
The duration of the user's login session, in the format
D + HH:MM:SS
.
Retrieve Button
Displays the latest information for the port.
Terminate Button
Select an active session and click Terminate to end the session. If multiple sessions are selected, only
active sessions will be terminated. You cannot terminate a session on a frozen port and you cannot
terminate Role Override (IP) or Role Override (MAC) sessions that were created through the CLI
(command line interface).
Lock MAC Address Button
Enables MAC Locking on the selected port(s) (static MAC locking). MAC locking must be enabled
on the device in order for it to be enabled on a port.
Show Only Active Sessions Checkbox
Select this checkbox to display only active sessions (listed in blue text) in the table.
End User Session Settings Tab
This tab displays the current authentication state and login statistics for the port. Because this section displays information for a single end user login session, these fields are grayed out for Matrix N−Series devices that support multiple authenticated users per port.
Click the graphic for more information.
End User Session Settings
Authentication State
End User Session Settings Tab 487
NetSight Policy Manager Help
Current state of the port with regard to authentication. If "None," authentication is not enabled on the device.
For web−based authentication:
•
Disconnected − There is no end user currently logged in on the port.
•
Authenticating − An end user is in the process of logging in and being authenticated.
•
Authenticated − An end user is currently logged in and authenticated.
•
Held − The port is locked and authentication attempts are not allowed. Occurs when, for example, an end user tries to log in several times with an incorrect password.
For 802.1X authentication:
•
Initialize − The port is initializing. One reason for this is that the device has been reset.
•
Disconnected − There is no end user currently logged in on the port.
•
Connecting − The port is establishing communication with an end user.
•
Authenticating − An end user is in the process of logging in and being authenticated.
•
Authenticated − An end user is currently logged in and authenticated.
•
Aborting − The authentication procedure is being prematurely terminated due to, for
• example, a re−authentication request or an authentication timeout.
Held − The port is locked and authentication attempts are not allowed. Occurs when, for
• example, an end user tries to log in several times with an incorrect password.
Default Role − An end user has connected and is using the port's default role. Occurs when
•
the port mode is set to Inactive/Default (see Port Mode for more information).
No Authentication − No end user can be authenticated because the port mode is set to
Inactive/Discard (see Port Mode for more information).
NOTE:
RoamAbout R2 devices always show "Authenticating" as their Authentication State.
Because R2 devices can have multiple users authenticated to the same port,
"Authenticating" simply denotes that the port is currently open for users to authenticate.
Authentication Server State (802.1X)
For ports using 802.1X authentication, the current status of the authentication server, or the activity in which it is currently engaged.
•
Request − A request for authentication has been received by the authentication server.
•
Response − The authentication server is in the process of responding to an authentication
• request.
Success − Authentication of the end user has succeeded.
•
Fail − Authentication of the end user has failed.
•
Timeout − The authentication attempt has timed out.
•
Idle − The authentication server is ready to accept authentication requests, but no requests are
• currently being processed.
Initialize − The authentication server is initializing. One reason for this is because the machine on which the server is located has been reset.
Port Protocol Version (802.1X)
For ports using 802.1X authentication, the protocol version number of the EAPOL (Extensible
Authentication Protocol Over LANs) implementation supported by the port.
Failed Login Attempts (total) (Web−Based)
For ports using web−based authentication, the total number of failed login attempts on this port.
End User Session Settings Tab 488
NetSight Policy Manager Help
Failed Login Attempts (since last success) (Web−Based)
For ports using web−based authentication, the total number of failed login attempts since the last successful login on this port.
Last Login Attempt Result (Web−Based)
For ports using web−based authentication, indicates the result (success/failure) of the last attempt to log in to this port. Possible results are as follows:
•
Not logged in since last reset − No login in since reset.
•
Authentication accepted − User logged in successfully.
•
Authentication rejected
•
Username or password mismatch
•
User misconfiguration (e.g. Deny Remote Permission in Active Directory Users).
or, when two RADIUS servers are configured in the device:
•
Mismatched Shared Secret in a primary RADIUS server or both RADIUS servers.
•
Unsupported protocol (e.g. CHAP) configured on the device.
•
Unknown policy − No policy (Role) defined in the device.
•
Unknown authentication server response − When one RADIUS server is configured in the device:
•
Wrong Authentication UDP port number defined.
•
Mismatched Shared Secret.
•
RADIUS server is not contactable, or RADIUS server is down.
•
Unsupported protocol (e.g. CHAP) configured on the device.
•
Unknown authentication client error − User enters no username and password.
•
Auth client disabled or unavailable − RADIUS server is disabled in the device.
•
Port authentication pending − Port is in the process of authenticating.
•
Port held for too many failed attempts − User reached the maximum number of failed
• attempts to log in.
Port held: Max attempts exceeded − User exceeded the maximum number of failed
• attempts to log in once the port has been held.
Authentication server timeout − When two RADIUS servers are configured in the device:
•
Wrong Authentication UDP port number defined in a primary RADIUS server or
• both RADIUS servers.
RADIUS servers are not contactable
•
Unsupported protocol (e.g. CHAP) configured on the device.
Last Failure Cause (MAC)
For ports using MAC authentication, the reason for the last authentication failure on the port.
Role−Based Rate Limit Violations Tab
This tab displays information about the role−based rate limit violations for the port, including the current data being collected for a session in progress and data from previous sessions. You must click Retrieve to display the port information in the tables.
Role−based rate limit functionality is available only on certain devices such as the Matrix N−Series Gold and
Platinum devices (refer to the Firmware Feature Support tables in the release notes for specific
device/firmware rate limit support.) For more information, see Defining Role Based Rate Limits.
Click the graphic for more information.
Role−Based Rate Limit Violations Tab 489
NetSight Policy Manager Help
Violations
Name
The port interface name.
Index
The port index number.
Rate Limit
The rate limit that has been violated (exceeded).
Generated System Log
Indicates whether a syslog message was generated when the rate limit was first exceeded. You can
specify this action on a per−rate limit basis in the rate limit General tab.
Generated Trap
Indicates whether an audit trap was generated when the rate limit was first exceeded. You can specify
this action on a per−rate limit basis in the rate limit General tab.
Port Disabled
Indicates whether the port was disabled when the rate limit was first exceeded. You can specify this
action on a per−rate limit basis in the rate limit General tab.
Retrieve Button
Retrieves the most recent rate limit violations information for the port.
Clear Button
Clears the violations table. If port traffic continues to exceed the rate limit, the violations will reappear in the table.
Violations 490
NetSight Policy Manager Help
CEP Usage Tab
This tab displays information about each CEP connection for the ports on the device, including the date and time the connection was made. For devices that support one CEP connection per port, a connection entry remains in the table until a new connection is made on that port or the system is rebooted. You must click
Retrieve to display the connection information in the table.
devices that support it.
Click the graphic for more information.
Device
The IP address or name of the device where the port is located.
Interface Name
A description of the port.
Index
The index value assigned to the port interface.
CEP Type
The CEP product type that has made the connection.
Current Role
The assigned role for the CEP connection. Each CEP product type has a role mapped to it. When a
CEP connects to the network, the device identifies the CEP type and applies the assigned role. You
can map a role for a CEP using the device Authentication tab (CEP sub−tab).
IP Address
The IP address of the CEP connecting to the port.
CEP Usage Tab 491
NetSight Policy Manager Help
MAC Address
The MAC address of the CEP connecting to the port.
Start Time
The date and time the connection was made.
Retrieve Button
Gets the port's CEP connection information and displays it in the table.
CEP Usage Tab 492
Port Usage Tab
(Port Group)
limit violations, and CEP (Convergence End Point) connections for the ports in the selected port group. To display this tab, select a port group in the left−panel Port Groups tab and the Port Usage tab in the right panel.
You must click Retrieve to display the port information in the tables.
The Port Usage tab provides three sub−tabs to allow you to view the desired information:
•
•
Role−Based Rate Limit Violations Tab
•
End User Sessions Tab
This tab displays login session information for each port in the selected port group, including the current values being collected for a session still in progress, or the final values for the last valid session when there is no session currently active. You must click Retrieve to display the port information in the table.
By default the Show Only Active Sessions checkbox is checked, and only your active sessions are displayed.
Deselect the checkbox to display all entries. Active sessions that are being applied to traffic are listed in blue text. Active sessions that are not being applied are listed in green text. Some devices support multiple authentication sessions simultaneously per interface. This allows a single user to authenticate via 802.1X,
Web−Based, and MAC all at the same time. However, only one authentication type per interface can be
applied at a single time. The multi−user authentication type precedence (configured on the device
Authentication tab) determines which type will be applied. The applied session is the one that provides the role and traffic classification information. The remaining non−applied sessions will only be used if the currently applied session is terminated. For example, if a user authenticates on a port that has multi−user authentication enabled (802.1X, Web−Based, and MAC,) the active/applied session will be displayed in blue text and the other two sessions will be in green text. Another example would be if the user authenticates using the MAC authentication type but MAC authentication is disabled on the port, the session would be listed in green text. For devices that do not support multi−authentication, by definition the active session is also applied.
NOTE:
Matrix N−Series devices configured for multi−user authentication always list only active sessions even if the Show Only Active Session checkbox is deselected.
Session entries are collected up to the maximum allowed. When the maximum is reached, the oldest session entries are replaced with newer ones. The exception to this is the RoamAbout R2, where older session data is not kept.
For devices that support one authenticated user per port, only one user/current role per port will show up in the table. For devices that support multiple authenticated users per port (such as the RoamAbout R2 and the
Matrix N−Series Platinum devices), all users authenticated on its ports will be listed in the table, along with the roles under which they are authenticated.
Port Usage Tab (Port Group) 493
NetSight Policy Manager Help
Click the graphic for more information.
Device
The IP address or name of the device where the port is located.
Interface Name
A description of the port.
Index
The index value assigned to the port interface.
Current Role
The role under which the user authenticated on the port. If a session displays "Invalid Role" in this
column, check the Invalid Role Action setting on the device Role/Rule tab to see the action that was
configured in the event a user is assigned an unknown or invalid role. If the user authenticated via
RFC 3580 VLAN Authorization, this column will display the role the VLAN is mapped to
(configured through Authentication−based VLAN to Role Mapping). If VLAN to Role mapping has not been configured, the port's Default role will be displayed (if there is one); otherwise, the column will display "N/A."
Policy PVID Override Status
Indicates whether default access control (a default VLAN) has been enabled for the current role.
Default access control allows you to permit traffic to be forwarded, deny traffic altogether, or contain
traffic to a VLAN. (See the Role General Tab for more information on default access control.) The
default VLAN overrides the 802.1Q PVID for the port.
Policy PVID Override
If default access control (a default VLAN) has been enabled for the current role and configured to contain traffic to a VLAN, this column displays the associated VLAN ID. The VLAN will be applied to all untagged frames arriving on the port that do not match any VLAN traffic classification rules, and overrides the 802.1Q PVID for the port. A value of 0 indicates that the default access control is configured to drop all frames that do not match a classification rule (Deny Traffic). A value of 4095 indicates that the default access control is configured to forward any frames that do not match a classification rule (Permit) using the 802.1Q PVID.
RFC3580 VLAN ID
If the user authenticated via RFC 3580 VLAN Authorization, this is the VLAN ID that was returned from the RADIUS server. A VLAN ID value of 0 indicates that no VLAN was assigned. If VLAN
Port Usage Tab (Port Group) 494
NetSight Policy Manager Help authentication is not supported on the device, this column will display "N/A."
RFC3580 VLAN Oper Egress
The modification that will be made to the VLAN egress list for the VLAN ID returned by the
RADIUS server, if the user authenticated via RFC 3580 VLAN Authorization.
•
None − No modification to the VLAN egress list will be made.
•
Tagged − The port will be added to the list with the egress state set to Tagged (frames will be
• forwarded as tagged).
Untagged − The port will be added to the list with the egress state set to Untagged (frames
• will be forwarded as untagged).
Dynamic − The port will use information returned in the RADIUS response to modify the
VLAN egress list.
If VLAN authentication is not supported on the device, this column will display "N/A." Use the Port
Properties Authentication Configuration tab to change these settings, if desired.
Type
The authentication type of this login session: Web−Based, 802.1X, MAC, or Role Override (Matrix
N−Series Platinum devices only). If Role Override is displayed, it signifies that a rule has been applied to the port, overriding the user's current role with a different role. An example of this would be if the Automated Security Manager has detected a threat on the port, and used a MAC address rule to apply the Quarantine role to the end user.
•
Role Override (MAC) signifies that a MAC address rule has been applied to the port,
• overriding the Default role or any authenticated role assigned to the end user.
Role Override (IP) signifies that an IP address rule has been applied to the port, overriding the Default role or any authenticated role assigned to an end user authenticated with Single
User 802.1X. An IP Address rule will not override the authenticated role for any authentication type other than Single User 802.1X.
IP Address
The IP address of the remote user of this login session.
MAC Address
The MAC address of the remote user of this login session.
Authentication Status
On Matrix N−Series Platinum devices, the authentication status of the login session. All other devices will display "N/A." Possible values are:
•
Authentication Successful
•
Authentication Failed
•
Authentication in Progress
•
Authentication Server Timeout
•
Authentication Terminated
Terminate Cause
The reason the login session terminated. For web−based authentication, the possible values are:
•
Administratively Terminated
•
Authorization Revoked
•
Link Down
•
Not Applicable
•
Port Disabled
•
Unknown Termination Cause
Port Usage Tab (Port Group) 495
NetSight Policy Manager Help
•
User Logged Out
For 802.1X authentication, the possible values are:
•
Authorization Revoked
•
Client Restarted
•
Link Down (or Lost Carrier)
•
Not Applicable
•
Port Disabled
•
Port Reinitialized
•
Reauthentication Failed
•
Unknown Termination Cause
•
User Logged Out
Session ID
A unique identifier for the session. For devices that support multiple authenticated users per port, each
User Name
The user name provided by the end user at login (authentication).
Received Bytes
The number of bytes received in user data frames on this port during this session.
Transmitted Bytes
The number of bytes transmitted in user data frames on this port during this session.
Received Frames
The number of user data frames received on this port during this session.
Transmitted Frames
The number of user data frames transmitted on this port during this session.
Start Time
The time and date when the login session started.
Duration
The duration of the user's login session, in the format
D + HH:MM:SS
.
Retrieve Button
Reads the latest information about the port group and displays it in the table.
Terminate Button
Select an active session and click Terminate to end the session. If multiple sessions are selected, only active sessions will be terminated. You cannot terminate sessions on frozen ports and you cannot terminate Role Override (IP) or Role Override (MAC) sessions that were created through the CLI
(command line interface). See Terminating a Session for more information.
Lock MAC Address Button
Enables MAC Locking on the selected port(s) (static MAC locking). MAC locking must be enabled
on the device in order for it to be enabled on a port.
Port Usage Tab (Port Group) 496
NetSight Policy Manager Help
Show Only Active Sessions Checkbox
Select this checkbox to display only active sessions (listed in blue text) in the table.
Role−Based Rate Limit Violations Tab
These tables displays information about the role−based rate limit violations for the ports in the selected port group, including the current data being collected for sessions in progress and data from previous sessions. You must click Retrieve to display the port information in the tables.
Role−based rate limit functionality is available only on certain devices such as the Matrix N−Series Gold and
Platinum devices (refer to the Firmware Feature Support tables in the release notes for specific
device/firmware rate limit support.) For more information, see Defining Role Based Rate Limits.
Click the graphic for more information.
Name
The port interface name.
Index
The port index number.
Rate Limit
The rate limit that has been violated (exceeded).
Generated System Log
Indicates whether a syslog message was generated when the rate limit was first exceeded. You can
specify this action on a per−rate limit basis in the rate limit General tab.
Generated Trap
Indicates whether an audit trap was generated when the rate limit was first exceeded. You can specify
this action on a per−rate limit basis in the rate limit General tab.
Port Disabled
Indicates whether the port was disabled when the rate limit was first exceeded. You can specify this
action on a per−rate limit basis in the rate limit General tab.
Retrieve Button
Role−Based Rate Limit Violations Tab 497
NetSight Policy Manager Help
Retrieves the most recent rate limit violations information for the ports in the selected port group.
Clear Button
Clears the violations table. If port traffic continues to exceed the rate limit, the violations will reappear in the table.
CEP Usage Tab
The table displays information about any CEP connection for the ports in the group, including the date and time the connection was made. For devices that support one CEP connection per port, a connection entry remains in the table until a new connection is made on that port or the system is rebooted.
devices that support it.
Click the graphic for more information.
Device
The IP address or name of the device where the port is located.
Interface Name
A description of the port.
Index
The index value assigned to the port interface.
CEP Type
The CEP product type.
Current Role
The assigned role for the CEP connection. Each CEP product type has a role mapped to it. When a
CEP connects to the network, the device identifies the CEP type and applies the assigned role. You
can map a role for a CEP using the device Authentication tab (CEP sub−tab).
IP Address
The IP address of the CEP connecting to the port.
MAC Address
CEP Usage Tab 498
NetSight Policy Manager Help
The MAC address of the CEP connecting to the port.
Start Time
The date and time the connection was made.
Retrieve Button
Gets the ports' CEP connection information and displays it in the table.
CEP Usage Tab 499
Precedence Tab
(Rate Limits Folder)
This tab enables you to set the order in which priority−based rate limits will be written to devices that support them. Policy Manager allows you to define as many rate limits as you wish; however, the number written to a device is restricted by the number of rate limits supported by the device. Rate limits will be written to a device in the order displayed on this tab, up until the maximum number of rate limits has been reached on each device. Rate limits are listed in the order of precedence under the rate limit folder in the left−panel tree.
NOTE:
Although all rate limits have a precedence and show up in this list, only rate limits that include a priority−based configuration will actually be written to a device.
To access this tab, select the Rate Limits folder in the left panel Classes of Service tab, then select the
Precedence tab in the right panel. This tab also appears when you select the Precedence Edit button on the
To use the Precedence tab, select the rate limit you want to position, and use the Up or Down button to move it to the desired place in the list.
Click the graphic for more information.
Precedence List
Lists all the currently defined rate limits and their current precedence. To position a rate limit in the list, select it and use the Up or Down button, as appropriate.
Buttons
Up
Moves the selected rate limit up in the list.
Down
Moves the selected rate limit down in the list.
Precedence Tab(Rate Limits Folder) 500
RADIUS Tab
(Device)
The device RADIUS tab allows you to configure and enable communication between the selected device (the
accounting (for your SNMPv3 devices that support it).
RADIUS accounting collects various data and statistics, such as the length of time a user has been logged on, and makes that data available to an administrator. It is used by a device to save accounting data on a RADIUS server. Accounting requests are sent from the device to the server. The server acknowledges these requests, and data is passed to the server via accounting updates. For more information on accounting functionality, refer to your RADIUS server documentation.
To display the device RADIUS tab, select a device in the left−panel Network Elements tab, then click the
RADIUS tab in the right panel.
Click the graphic for more information.
RADIUS Tab (Device) 501
NetSight Policy Manager Help
RADIUS Server(s) − Authentication Tab
This tab lists the RADIUS authentication server(s) with which the device (the RADIUS client) can communicate. Use the buttons to add or remove servers, and edit server parameters. You can also edit a server's parameters by double−clicking the server entry in the list.
RADIUS Server IP
IP address of the RADIUS authentication server.
Client UDP Port
UDP port number (1−65535) on the RADIUS authentication server that the device will send authentication requests to; 1812 is the default port number.
Access Type
The type of authentication access allowed for this RADIUS server:
•
Any access − the server can authenticate users originating from any access type.
•
Management access − the server can only authenticate users that have requested
RADIUS Tab (Device) 502
NetSight Policy Manager Help
• management access via the console, Telnet, SSH, or HTTP, etc.
Network access − the server can only authenticate users that are accessing the network via
802.1X, MAC, or Web−Based authentication.
Devices that do not support this feature will display N/A in this column.
Priority
Order in which the RADIUS authentication server is checked, as compared to the other RADIUS authentication servers listed here. The lower the number, the higher the priority.
Add Button
Opens the Add RADIUS Authentication Server window, where you can enter the parameters for a
server you want to add to the list. When you click OK on this window, the new server is added.
Remove Button
Removes the selected RADIUS authentication server from the list.
Edit Button
Opens the Edit RADIUS Authentication Server window, where you can change the parameters for
the selected RADIUS authentication server. You can also edit the server parameters by double−clicking the server entry in the list.
Apply Button
Applies any changes you made in the RADIUS Authentication Server(s) tab.
RADIUS Server(s) − Accounting Tab
This tab lists the RADIUS accounting server(s) with which the device (the RADIUS client) can communicate.
Use the buttons to add or remove servers, and edit server parameters. You can also edit a server's parameters by double−clicking the server entry in the list.
Click the graphic for more information.
RADIUS Server IP
IP address of the RADIUS accounting server.
Client UDP Port
UDP port number (1−65535) on the RADIUS accounting server that the device will send accounting
RADIUS Tab (Device) 503
NetSight Policy Manager Help requests to; 1813 is the default port number. Devices that do not support RADIUS accounting will display N/A in this column (with the exception of an SNMPv1 R2 device, which will display accounting values but will not allow you to set them.)
Timeout Duration
The amount of time in seconds the device will wait for the RADIUS accounting server to respond to an accounting request. Valid values are 2−10 seconds. Devices that do not support RADIUS accounting will display N/A in this column (with the exception of an SNMPv1 R2 device, which will display accounting values but will not allow you to set them.)
Number of Timeouts
The number of times the device will resend an accounting request if the RADIUS accounting server does not respond. Valid values are 0−20. Devices that do not support RADIUS accounting will display N/A in this column (with the exception of an SNMPv1 R2 device, which will display accounting values but will not allow you to set them.)
Priority
Order in which the RADIUS accounting server is checked, as compared to the other RADIUS accounting servers listed here. The lower the number, the higher the priority.
Add Button
Opens the Add RADIUS Accounting Server window, where you can enter the parameters for a server
you want to add to the list. When you click OK on this window, the new server is added.
Remove Button
Removes the selected RADIUS accounting server from the list.
Edit Button
Opens the Edit RADIUS Accounting Server window, where you can change the parameters for the
selected RADIUS accounting server. You can also edit the server parameters by double−clicking the server entry in the list.
Apply Button
Applies any changes you made in the RADIUS Accounting Server(s) tab.
RADIUS Authentication Client Settings
This section lets you enable or disable communication between the selected device (the RADIUS client) and the RADIUS authentication server(s), and specify connection attempt information.
RADIUS Client Status
Allows you to enable and disable communication between this device and the RADIUS authentication server(s). If enabled, the device becomes a RADIUS client and will communicate with a RADIUS authentication server whenever a user logs on to a port on the device, as long as the port itself is enabled for authentication and the device is set up as a client on the RADIUS authentication server
(see the Authentication Configuration Guide). The default is Disabled.
Number of Retry Attempts
The number of attempts the device will make in contacting each RADIUS authentication server before giving up and trying the next RADIUS authentication server on the list. Valid values are
1−65535.
RADIUS Tab (Device) 504
NetSight Policy Manager Help
Retry Timeout Duration (seconds)
The total number of seconds the device will wait for the RADIUS authentication server to respond, before trying again. Valid values are 1−65535.
Client Accounting Status
Allows you to enable or disable RADIUS accounting on SNMPv3 devices that support it. The default is Disabled. RADIUS accounting is used by a device to save accounting data on a RADIUS accounting server. If accounting is enabled, an accounting session starts after the user is successfully authenticated by a RADIUS authentication server. Devices that do not support RADIUS accounting will have this field grayed out (with the exception of an SNMPv1 R2 device, which will display accounting values but will not allow you to set them.)
Accounting Update Interval (minutes)
Collected accounting data is sent from the device to the RADIUS accounting server via accounting updates. The Accounting Update Interval is the amount of time in minutes between accounting updates. Valid values are 1−65535. It is recommended that the value be greater than 10 minutes, and careful consideration should be given to its impact on network traffic. Devices that do not support
RADIUS accounting will have this field grayed out (with the exception of an SNMPv1 R2 device, which will display accounting values but will not allow you to set them.)
Apply Button
Applies the changes you made in the RADIUS Authentication Client Settings section.
Application Shared Secret
The device (the RADIUS client) and Policy Manager share a common "secret," that provides for a secure means of RADIUS client configuration on devices using SNMPv1. This "Application Shared Secret" is a string of characters used to encrypt and decrypt communication between Policy Manager and the device. A
Default shared secret is provided that allows you to initially configure the RADIUS settings on this tab, but it is recommended that you change this secret to increase security.
NOTE:
This Application Shared Secret is not to be confused with the Server Shared Secret that encrypts communication between the RADIUS server and the RADIUS client, entered
in the Add RADIUS Authentication Server window or Add RADIUS Accounting
Server window available from the Add buttons on this tab, or in the Add RADIUS
Server window in the Device Configuration Wizard.
WARNING:
It is important to remember the Application Shared Secret, since the shared secret specified in Policy Manager must match the shared secret on the device. If you delete and recreate the device in Policy Manager, you will have to supply the correct Application Shared Secret in the device's RADIUS tab in order to retrieve or input the RADIUS settings on this tab. If you're using an Auto−Generated or User−Defined Application Shared Secret and you clear
NVRAM on the device, you will need to go to the RADIUS tab for the device and change the Application Shared Secret back to "Default" in order to regain access to the RADIUS information in that tab. Once Policy Manager and the device are using the same (Default)
Application Shared Secret, then the secret can be changed to be either Auto−Generated or
User−Defined.
Auto−Generated
Generates a new 32−character Application Shared Secret automatically whenever you click the radio button.
RADIUS Tab (Device) 505
NetSight Policy Manager Help
User−Defined
Use this field to change the default or existing Application Shared Secret. The format is a
32−character string with optional dashes or spaces, typically xxxx−xxxx−xxxx−xxxx−xxxx−xxxx−xxxx−xxxx.
Default
Select this radio button to use the default Application Shared Secret. The default shared secret is provided to allow you to initially configure the RADIUS settings on this tab, but it is recommended that you change to an auto−generated or user−defined secret to increase security.
Change Button
Click this button to make the Application Shared Secret fields available for editing. This button is grayed out for devices that use SNMPv3 for RADIUS configuration.
Cancel Button
Cancels any changes you made in the Application Shared Secret area.
Apply Button
Applies the changes you made in the Application Shared Secret area.
RADIUS Response Conflict Resolution
Select which response to use if both a Filter ID (which specifies a role) and a VLAN Tunnel Attribute (RFC
3580) are returned by the RADIUS server during authentication.
•
Filter ID − The Filter ID (role) is used.
•
VLAN Tunnel Attribute − The VLAN Tunnel Attribute is used and the Authentication−Based
•
VLAN to Role Mappings are applied, if present.
Filter ID With VLAN Tunnel Attribute − Both attributes are applied in the following manner: the role is applied to the user, except that the VLAN Tunnel Attribute replaces the role's Default Access
Control VLAN (if present). In this case, the Authentication−Based VLAN to Role mappings are ignored (as the role was explicitly assigned). VLAN classification rules are still applied, as defined by the assigned role.
RADIUS Tab (Device) 506
RADIUS Tab
(Device Group)
The device group RADIUS tab displays authentication and accounting RADIUS server information for all the
RADIUS Tab or the Device Configuration Wizard.
To access this tab, select a device group in the left−panel Network Elements tab, then select the RADIUS tab in the right panel.
Click the graphic for more information.
Device
Name or IP address of the device.
Auth. Client Status
Informs you whether or not the device is enabled as a RADIUS client. If Enabled, the device is a
RADIUS client and will communicate with a RADIUS authentication server whenever a user logs on to a port on the device, as long as the port itself is enabled for authentication. If Disabled, the device is currently not enabled as a RADIUS client.
Retry Attempts
Number of attempts the device (RADIUS client) will make to connect to the RADIUS authentication server before giving up and trying the next RADIUS server on the list. Valid values are 1−65535.
Timeout Duration (sec)
Total number of seconds the device (RADIUS client) will wait for the RADIUS authentication server to respond, before trying again. Valid values are 1−65535.
Acct. Client Status
Informs you whether or not RADIUS accounting is enabled on the device (the RADIUS client).
RADIUS accounting is supported on certain SNMPv3 devices, and is used by the device to save accounting data on a RADIUS server. If accounting is enabled, an accounting session starts after the user is successfully authenticated by a RADIUS server. Devices that do not support RADIUS accounting will display N/A in this column (with the exception of an SNMPv1 R2 device, which will display a status.)
RADIUS Tab (Device Group) 507
NetSight Policy Manager Help
Acct. Update Interval (minutes)
Collected accounting data is sent from the device (RADIUS client) to the RADIUS server via accounting updates. The Accounting Update Interval is the amount of time in minutes between accounting updates. Devices that do not support RADIUS accounting will display N/A in this column
(with the exception of an SNMPv1 R2 device, which will display a value.)
RADIUS Server List
Lists the IP addresses of the RADIUS servers the client device will attempt to contact, followed by the UDP port number used to send authentication requests and the UDP port number used to send accounting requests. The addresses are listed in the order of priority in which the RADIUS server will be contacted. Devices that do not support RADIUS accounting will display N/A for an accounting port (with the exception of an SNMPv1 R2 device, which will display a value.)
Response Conflict Resolution
Indicates which response the device will use if both a Filter ID (which specifies a role) and a VLAN
Tunnel Attribute (RFC 3580) are returned by the RADIUS server during authentication. You can
configure the Response Conflict Resolution in the RADIUS tab for the device.
Button
Retrieve
Retrieves the latest RADIUS server information from the devices and displays it in the table.
RADIUS Tab (Device Group) 508
RADIUS Tab
(My Network/All Devices Folder)
This RADIUS tab displays authentication and accounting RADIUS server information for all the devices in
RADIUS Tab or the Device Configuration Wizard.
To access this tab, select either the My Network or the All Devices folder in the left−panel Network Elements tab, then click the RADIUS tab in the right panel. You must click Retrieve to display the RADIUS information in the table.
Click the graphic for more information.
Device
Name or IP address of the device.
Auth. Client Status
Informs you whether or not the device is enabled as a RADIUS client. If Enabled, the device is a
RADIUS client and will communicate with a RADIUS authentication server whenever a user logs on to a port on the device, as long as the port itself is enabled for authentication. If Disabled, the device is currently not enabled as a RADIUS client.
Retry Attempts
Number of attempts the device (RADIUS client) will make to connect to the RADIUS authentication server before giving up and trying the next RADIUS server on the list. Valid values are 1−65535.
Timeout Duration (sec)
Total number of seconds the device (RADIUS client) will wait for the RADIUS authentication server to respond, before trying again. Valid values are 1−65535.
Acct. Client Status
Informs you whether or not RADIUS accounting is enabled on the device (the RADIUS client).
RADIUS accounting is supported on certain SNMPv3 devices, and is used by the device to save accounting data on a RADIUS server. If accounting is enabled, an accounting session starts after the user is successfully authenticated by a RADIUS server. Devices that do not support RADIUS accounting will display N/A in this column (with the exception of an SNMPv1 R2 device, which will display a status.)
RADIUS Tab (My Network/All Devices Folder) 509
NetSight Policy Manager Help
Acct. Update Interval (minutes)
Collected accounting data is sent from the device (RADIUS client) to the RADIUS server via accounting updates. The Accounting Update Interval is the amount of time in minutes between accounting updates. Devices that do not support RADIUS accounting will display N/A in this column
(with the exception of an SNMPv1 R2 device, which will display a value.)
RADIUS Server List
Lists the IP addresses of the RADIUS servers the client device will attempt to contact, followed by the UDP port number used to send authentication requests and the UDP port number used to send accounting requests. The addresses are listed in the order of priority in which the RADIUS server will be contacted. Devices that do not support RADIUS accounting will display N/A for an accounting port (with the exception of an SNMPv1 R2 device, which will display a value.)
Response Conflict Resolution
Indicates which response the device will use if both a Filter ID (which specifies a role) and a VLAN
Tunnel Attribute (RFC 3580) are returned by the RADIUS server during authentication. You can
configure the Response Conflict Resolution in the RADIUS tab for the device.
Button
Retrieve
Retrieves the latest RADIUS server information from the devices and displays it in the table.
RADIUS Tab (My Network/All Devices Folder) 510
Role/Rule Tab
(Device)
The device Role/Rule tab lets you configure invalid role action and a device−level role (Matrix C1 devices only) for the selected device. It also lets you enable Rule Accounting on devices that support it and view any ports on the device that have been disabled due to rule usage. To access this tab, select a device on the left panel's Network Elements tab and click the Role/Rule tab in the right panel.
Click the graphic for more information.
Invalid Role Action
For devices that support this feature, this area of the tab lets you specify what happens to a user that gets an unknown or invalid role.
Invalid Role Action
Role/Rule Tab (Device) 511
NetSight Policy Manager Help
Select the action you would like taken if an authenticated user is assigned an unknown or invalid role:
•
Apply Default − Apply the port's default role to the user.
•
Deny Traffic − Drop the packets for this user.
•
Permit Traffic − Forward traffic with the port's assigned VID.
Invalid Roles Detected
Displays the number of invalid roles that were found.
Device Level Role (Matrix C1 Devices Only)
On Matrix C1 devices, you can set a device−level role that configures the services and rules for all ports on the device. Due to a limitation of the C1 devices, services and rules from the role returned from authentication cannot be applied to the port. The services and rules from this device−level role will be used instead.
Device Level Role
Displays the device−level role currently set on the device.
Select
Opens the Selection View (Roles) window where you can select a role to be the device−level role on
the device.
Rule Accounting
For devices that support this feature, you can specify whether to enable or disable rule accounting. When rule accounting is enabled on a device, each rule keeps a list of the ports on which it has been used. You can view
operations that determine when to clear specified ports from a rule's Rule Usage tab.
Rule Accounting Status
Select whether to enable or disable Rule Accounting on the device.
Clear Rule Usage on Port Link−Status Change
change. Ports must be listed in the Rule Usage Auto Clear Ports list (below) to be subject to this clear operation.
Clear Rule Usage Port Role Change
When enabled, this option clears a port from any rule's Rule Usage tab when the port's role changes.
Ports must be listed in the Rule Usage Auto Clear Ports list (below) to be subject to this clear operation.
Clear Rule Usage on Interval
When enabled, clears all the ports listed in the Rule Usage Auto Clear Ports list (below) from any
rule's Rule Usage tab at the set interval. Enter the desired interval (in minutes) and click Apply.
Rule Usage Auto Clear Ports
Lists the ports on the device that the Clear Rule Usage operations will be performed on. Click Add to
open the Add Ports window where you can select ports to add to the list. Select a port and click
Remove to remove a port from the list. Click Apply to set any changes you have made.
Disabled Ports (Rule Hit)
When rule accounting is enabled on a device, each rule keeps a list of the ports on which it has been used, and
Role/Rule Tab (Device) 512
NetSight Policy Manager Help also allows you to specify that any port reporting a "rule hit" will be disabled. This table lists the ports that
have been disabled due to rule usage. For more information, refer to the Rule Usage tab.
Port
Name of the port, constructed of the name or IP address of the device and either the port index number or the port interface name.
Index
The index value assigned to the port interface.
Retrieve
Retrieves a list of ports on the device that have been disabled due to a rule hit.
Clear
Clears any selected disabled ports, and re−enables them. Keep in mind that if the port continues to receive traffic that matches the rule, and the rule is still configured to disable the port, then the port will almost immediately reappear in the table.
Role/Rule Tab (Device) 513
Roles Tab
(802.1p Priority)
The 802.1p priority Roles tab displays a list of roles associated with the selected 802.1p priority. If you select a role in the table, you can view and/or edit the role using the View/Edit Role button. To access this tab, select an 802.1p priority in the left−panel Classes of Service tab and click the Roles tab in the right panel.
Click the graphic for more information.
Name
Name of the role utilizing the selected 802.1p priority.
802.1p Priority Usage
How the 802.1p priority is being utilized: Role Default, Rule Action or both (Role Default/Rule
Action).
Buttons
View/Edit Role
Select a role in the table and click this button to open the left−panel Roles tab and select the role in which the 802.1p priority is being used. This lets you view and/or edit information about the role in the right−panel tabs. If you make a role change, you need to enforce it using the Enforce toolbar button.
Roles Tab (802.1p Priority) 514
Roles Tab
(Rate Limit)
The rate limit Roles tab displays the list of roles utilizing the selected rate limit. If you select a role in the table, you can view and/or edit the role using the View/Edit Role button. To access this tab, select a rate limit in the left−panel Classes of Service tab, then select the Roles tab in the right panel.
Click the graphic for more information.
Name
Name of the role utilizing the selected rate limit.
Rate Limit Usage
How the rate limit is being utilized: Role Default, Rule Action or both (Role Default/Rule Action).
Buttons
View/Edit Role
Select a role in the table and click this button to open the left−panel Roles tab with the role selected.
You can then view and/or edit information about the role in the right−panel tabs. If you make a change to the role, you will need to enforce it using the Enforce toolbar button.
Roles Tab (Rate Limit) 515
Roles Tab
(Class of Service)
The class of service Roles tab displays the list of roles utilizing the selected class of service. If you select a role in the table, you can view and/or edit the role using the View/Edit Role button. To access this tab, select a class of service from the Classes of Service folder in the left−panel Classes of Service tab, then select the
Roles tab in the right panel.
Click the graphic for more information.
Name
Name of the role utilizing the selected class of service.
CoS Usage
How the class of service is being utilized: Role Default, Rule Action or both (Role Default/Rule
Action).
Buttons
View/Edit Role
Select a role in the table and click this button to open the left−panel Roles tab and select the role in which the class of service is being used. This lets you view and/or edit information about the role in the right−panel tabs. If you make a role change, you need to enforce it using the Enforce toolbar button.
Roles Tab (Class of Service) 516
Roles Tab
(IP Type of Service Value)
This tab displays a list of the roles associated with the selected IP type of service value. If you select a role in the table, you can view and/or edit that role using the View/Edit Role button. To access this tab, select an IP type of service value in the left−panel Classes of Service tab and click the Roles tab in the right panel.
Click the graphic for more information.
Name
Name of the role utilizing the selected IP type of service value.
ToS Usage
How the IP type of service value is being utilized: Rule Action.
Buttons
View/Edit Role
Select a role in the table and click this button to open the left−panel Roles tab with the role selected.
You can then view and/or edit information about the role in the right−panel tabs. If you make a change to the role, you will need to enforce it using the Enforce toolbar button.
Roles Tab (IP Type of Service Value) 517
Roles Tab
(Service)
The service Roles tab displays the list of roles utilizing the selected service. If you select a role in the table, you can view and/or edit the role using the View/Edit Role button. To access this tab, select a service in the left panel's Services tab and click the Roles tab in the right panel.
Click the graphic for more information.
Name
Name of the role utilizing the selected service.
View/Edit Role Button
Selecting a role in the table and clicking this button opens the left panel Roles tab and selects the appropriate role, allowing you to access its right−panel tabs.
Roles Tab (Service) 518
Roles Tab
(Transmit Queue)
The transmit queue Roles tab displays the list of roles utilizing the selected transmit queue. If you select a role in the table, you can view and/or edit the role using the View/Edit Role button. To access this tab, select a transmit queue in the left−panel Classes of Service tab, then select the Roles tab in the right panel.
Click the graphic for more information.
Name
Name of the role utilizing the selected transmit queue.
Transmit Queue Usage
How the transmit queue is being utilized: Role Default, Rule Action or both (Role Default/Rule
Action).
Buttons
View/Edit Role
Select a role in the table and click this button to open the left−panel Roles tab with the role selected.
Then you can view and/or edit information about the role in the right−panel tabs. If you make a change to the role, you will need to enforce it using the Enforce toolbar button.
Roles Tab (Transmit Queue) 519
Roles Tab
(VLAN)
The VLAN Roles tab displays a list of the roles associated with the selected VLAN. If you select a role, you can view and/or edit it using the View/Edit Role button. To access this tab, select the VLAN in the left−panel
VLANs tab, then select the Roles tab in the right panel. If you make a role change from this tab, be sure to
Click the graphic for more information.
Name
Name of the role utilizing the selected VLAN.
VLAN Usage
The way in which the role is utilizing the selected VLAN. It can be one or more of the following:
•
Rule Action
•
Role Definition (Egress List)
•
Role Definition (Default Access Control)
•
Role Definition (Authentication Based VLAN to Role Mapping)
•
Role Definition (Tagged Packet VLAN to Role Mapping)
Buttons
View/Edit Role
Selecting a role in the table and clicking this button lets you jump to the role the left−panel Roles tab and access its right−panel tabs.
Roles Tab (VLAN) 520
Rule Usage Tab
When rule accounting is enabled on a device, each rule keeps a list of the ports on which it has been used.
This tab displays port information for all the rules that have been used for a selected role, service (manual or automated), device, device group, or for all the devices in the current domain.
To access this tab, select a role, service, device, device group, or the My Network or All Devices folder in the left−panel Network Elements tab, then select the Rule Usage tab in the right panel. Click the Retrieve button
to display the rule usage information. Rule accounting must be enabled on the device; see the device
Role/Rule tab for information.
TIP:
You can see rule accounting information for an individual rule using the Rule Usage Tab
Click the graphic for more information.
Port
Name of the port the rule has been used on.
Index
The index value assigned to the port interface.
Rule
The name of the rule used on the port.
From Role
The role that the rule is associated with.
Buttons
Retrieve
Retrieves/updates the rule usage information.
Clear
Clears the selected port(s) from the associated rule's usage list.
Rule Usage Tab 521
NetSight Policy Manager Help
Rule Usage Tab 522
Port Properties
Rule Usage Tab
When rule accounting is enabled on a device, each rule keeps a list of the ports on which it has been used. The
Port Properties Rule Usage tab displays all the rules that have been used on the selected port, and the role they are associated with.
There are two ways to access the Rule Usage tab:
•
Select a device in the left−panel Network Elements tab and expand a slot or ports grouping in the right−panel Details view. Right−click on a port and select Properties from the menu. In the Port
•
Properties window, select the Rule Usage tab (in the top row of tabs).
Select a port in the left−panel Port Groups tab, then select the Rule Usage tab in the right panel.
Click the Retrieve button to display the rule usage information. Rule accounting must be enabled on the
device; see the device Role/Rule tab for information.
TIP:
You can see rule accounting information for an individual rule using the Rule Usage Tab
Click the graphic for more information.
Rule
The name of the rule used on the port.
From Role
The role that the rule is associated with.
Buttons
Retrieve
Retrieves/updates the rule usage information.
Port PropertiesRule Usage Tab 523
NetSight Policy Manager Help
Clear
Clears the port from the selected rule's usage list.
Port PropertiesRule Usage Tab 524
Rule Usage Tab
(Rule)
When rule accounting is enabled on a device, each rule keeps a list of the ports on which it has been used.
This tab lists the ports on which a selected rule has been used. To access this tab, select a rule in the left−panel tree, then select the Rule Usage tab in the right panel. Click the Retrieve button to display the rule usage
the rule type does not include any devices that support rule accounting, this tab will be grayed out.
TIP:
You can see rule accounting information for all rules associated with a role,
service, device, or device group using the Rule Usage Tab
(Role/Service/Device/Device Group).
Click the graphic for more information.
Rule Usage
Lists all the ports the selected rule has been used on. You can specify options to automatically clear ports from
this list in the device Role/Rule tab.
Port
Name of the port the rule has been used on.
Index
The index value assigned to the port interface.
Rule
The name of the rule used on the port.
From Role
The role that the rule is associated with.
Buttons
Retrieve
Retrieves/updates the rule usage information.
Rule Usage Tab (Rule) 525
NetSight Policy Manager Help
Clear
Clears the selected port(s) from the associated rule's usage list. You can set up auto−clear
functionality on a per−port basis in the device Role/Rule tab.
Rule Usage Tab (Rule) 526
Services Tab
(802.1p Priority)
The 802.1p priority Services tab displays the list of services utilizing the selected 802.1p priority. If you select a service in the table, you can view and/or edit the service using the View/Edit Service button. To access this tab, select an 802.1p priority in the left−panel Classes of Service tab and click the Services tab in the right panel.
Click the graphic for more information.
Name
Name of the service utilizing the selected 802.1p priority.
Defined Rules
Total number of rules utilizing the 802.1p priority. This includes rules that are enabled and are part of at least one role (applied rules), as well as rules not yet assigned to any roles.
Applied Rules
Number of rules utilizing this 802.1p priority that are enabled and are part of at least one role.
Buttons
View/Edit Service
Select a service in the table and click this button to open the left−panel Services tab and select the service in which the 802.1p priority is being used. This lets you view and/or edit information about the service in the right−panel tabs. If you make a service change, you need to enforce it using the
Enforce toolbar button.
Services Tab (802.1p Priority) 527
Services Tab
(Class of Service)
The class of service Services tab displays the list of services utilizing the selected class of service. If you select a service in the table, you can view and/or edit the service using the View/Edit Service button. To access this tab, select a class of service from the Classes of Service folder in the left−panel Classes of Service tab, then select the Services tab in the right panel.
Click the graphic for more information.
Name
Name of the service utilizing the selected class of service.
Defined Rules
Total number of rules utilizing the class of service. This includes rules that are enabled and are part of at least one role (applied rules), as well as rules not yet assigned to any roles.
Applied Rules
Number of rules utilizing this class of service that are enabled and are part of at least one role.
Buttons
View/Edit Service
Select a service in the table and click this button to open the left−panel Services tab and select the service in which the class of service is being used. This lets you view and/or edit information about the service in the right−panel tabs. If you make a service change, you need to enforce it using the
Enforce toolbar button.
Services Tab (Class of Service) 528
Services Tab
(IP Type of Service Value)
This tab displays the list of services utilizing the selected IP type of service value. If you select a service in the table, you can view and/or edit the service using the View/Edit Service button. To access this tab, select an IP type of service in the left−panel Classes of Service tab and click the Services tab in the right panel.
Click the graphic for more information.
Name
Name of the service utilizing the selected IP type of service value.
Defined Rules
Total number of rules utilizing the IP type of service. This includes rules that are enabled and are part of at least one role (applied rules), as well as rules not yet assigned to any roles.
Applied Rules
Number of rules utilizing this IP type of service value that are enabled and are part of at least one role.
Buttons
View/Edit Service
Select a service in the table and click this button to open the left−panel Services tab with the service selected. You can then view and/or edit information about the service in the right−panel tabs. If you make a change to the service, you will need to enforce it using the Enforce toolbar button.
Services Tab (IP Type of Service Value) 529
Services Tab
(Network Resource Group)
The network resource group Services tab displays a list of Automated services associated with the network resource group selected in the left panel. It also includes a button that lets you view and edit any service selected in the list. To access this tab, select a network resource group in the left−panel Services tab and the
Services tab in the right panel.
Click the graphic for more information.
Name
Name of the Automated service associated with the selected network resource group.
View/Edit Service Button
can define settings for the service.
Services Tab (Network Resource Group) 530
Services Tab
(Rate Limit)
The rate limit Services tab displays a list of services utilizing the selected rate limit. If you select a service in the table, you can view and/or edit the service using the View/Edit Service button. To access this tab, select a rate limit in the left−panel Classes of Service tab, then select the Services tab in the right panel.
Click the graphic for more information.
Name
Name of the service utilizing the selected rate limit.
Defined Rules
Total number of rules utilizing the rate limit. This includes rules that are enabled and are part of at least one role (applied rules), as well as rules not yet assigned to any roles.
Applied Rules
Number of rules for this rate limit that are enabled and are part of at least one role.
Buttons
View/Edit Service
Select a service in the table and click this button to open the left−panel Services tab with the service selected. Then you can view and/or edit information about the service in the right−panel tabs. If you make a change to the service, you will need to enforce it using the Enforce toolbar button.
Services Tab (Rate Limit) 531
Services Tab (Role)
The role Services tab displays the list of services associated with a selected role, and provides buttons for adding and removing services, creating a new service, and viewing and editing any service selected in the table. To access this tab, select a role in the left panel's Roles tab and click the Services tab in the right panel.
Any changes made using the buttons on this tab need to be enforced with the Enforce button on the toolbar.
Click the graphic for more information.
Name
Name of the service associated with the selected role.
Buttons
Add/Remove Services
Opens the role Add/Remove Services window, where you can add and remove services to and from
any of the existing roles.
Create Service
Opens the Service Wizard, where you can create a new service.
View/Edit Service
Selecting a service in the table and clicking this button opens the left−panel Services tab and selects the appropriate service, allowing you to access its right−panel tabs.
Services Tab (Role) 532
Services Tab
(Transmit Queue)
The transmit queue Services tab displays the list of services utilizing the selected transmit queue. If you select a service in the table, you can view and/or edit the service using the View/Edit Service button. To access this tab, select a transmit queue in the left−panel Classes of Service tab, then select the Services tab in the right panel.
Click the graphic for more information.
Name
Name of the service utilizing the selected transmit queue.
Defined Rules
Total number of rules utilizing the transmit queue. This includes rules that are enabled and are part of at least one role (applied rules), as well as rules not yet assigned to any roles.
Applied Rules
Number of rules utilizing the transmit queue that are enabled and are part of at least one role.
Buttons
View/Edit Service
Select a service in the table and click this button to open the left−panel Services tab with the service selected. Then you can view and/or edit information about the service in the right−panel tabs. If you make a change to the service, you will need to enforce it using the Enforce toolbar button.
Services Tab (Transmit Queue) 533
Services Tab (VLAN)
The VLAN Services tab displays a list of the services associated with the VLAN selected in the left panel, and enables you to view and edit them. To access this tab, select the VLAN in the left panel VLANs tab, then
Click the graphic for more information.
Name
Name of the service associated with the VLAN.
Defined Rules
Total number of rules associated with the service, including Applied Rules, as well as those not yet
assigned to any roles.
Applied Rules
Number of rules associated with this service that are enabled and are part of at least one role.
Buttons
View/Edit Service
Selecting a service in the table and clicking this button opens the left−panel Services tab and selects the appropriate service, allowing you to access its right−panel tabs.
Services Tab (VLAN) 534
Summary Tab
(Rate Limit
Port Groups Folder)
This tab appears when you select a role−based rate limit port groups folder on the left−panel Classes of
Service tab. It displays a list of all the rate limit port groups contained in the folder, along with their rate limit mapping information. Rate limit mapping maps a logical rate limit index to an actual physical rate limit you
Click the graphic for more information.
Port Type
The type of role−based rate limit port group. Rate limit port groups are based on the number of rate limits the ports support (for example, 8−rate limit port groups and 32−rate limit port groups) and the direction to which the rate limit applies (inbound or outbound traffic). Policy Manager currently supports only inbound role−based rate limits.
Port Group
The name of the port group.
Rate Limit Index
The logical rate limit index number. Keep in mind that for some port groups, the number of logical rate limit indexes may be greater or less than the actual number of rate limits the ports support.
Rate Limit
The actual rate limit that the rate limit index is mapped to.
Summary Tab(Rate LimitPort Groups Folder) 535
NetSight Policy Manager Help
Summary Tab(Rate LimitPort Groups Folder) 536
Summary Tab
(Transmit Queue
Port Groups Folder)
This tab appears when you select a transmit queue port groups folder in the left−panel Classes of Service tab.
It displays a list of all the transmit queue port groups contained in the folder, along with their transmit queue mapping information. Transmit queue mapping maps a logical transmit queue index to an actual physical transmit queue you have configured in Policy Manager. You can configure transmit queue port group
Click the graphic for more information.
Port Type
The type of transmit queue port group. Transmit queue port groups are based on the number of transmit queues the ports support, for example 4−queue port groups (queues 0−3) and 16−queue port groups (queues 0−15).
Port Group
The name of the port group.
Transmit Queue Index
The logical transmit queue index number. Keep in mind that for some port groups, the number of logical transmit queue indexes will be greater than the actual number of transmit queues the ports support.
Summary Tab(Transmit QueuePort Groups Folder) 537
NetSight Policy Manager Help
Transmit Queue
The physical transmit queue that the transmit queue index is mapped to.
Summary Tab(Transmit QueuePort Groups Folder) 538
Traffic Description
Tab
The Traffic Description tab allows you to view and change the traffic description associated with a rule. Rules allow you to assign access control (VLAN membership) and/or class of service to network traffic depending on the traffic's classification type. The Traffic Description identifies the traffic classification type for the rule.
The Traffic Description tab displays a table with information about the traffic description and allows you to add, remove, or edit the traffic description. To apply the traffic description, you must click Enforce on the
Policy Manager main tool bar.
To display the Traffic Description tab, select a rule in the left−panel's Services tab and the Traffic Description tab in the right panel.
Click the graphic for more information.
Type
Displays the Classification Type selected for the rule. Each Classification Type requires certain
parameters and/or values. See Classification Types and their Parameters for information.
Value
Mask
The mask for the classification value, if applicable.
Buttons
Add
Opens the Traffic Description Wizard, where you can add a traffic description to a rule. If there is
already a traffic description for the rule, you must first remove it before you can click Add.
Remove
Removes the traffic description from the rule. You must first select the traffic description in the table.
Traffic Description Tab 539
NetSight Policy Manager Help
Edit
type.
Traffic Description Tab 540
VLAN Egress Tab (Role)
The role VLAN Egress tab displays the list of VLANs on the selected role's egress list, and allows you to add and remove VLANs and set their Egress Forwarding State. Ports that the selected role is active on will forward traffic belonging to the listed VLANs according to the specified forwarding state. Both the role's egress list and the VLAN egress list are checked for egress information. If the lists have duplications, the
Forbid Forwarding state takes precedence.
To access this tab, select a role in the left panel's Roles tab and click the VLAN Egress tab in the right panel.
Any changes made on this tab need to be enforced with the Enforce button on the toolbar.
Click the graphic for more information.
VLAN Egress
VLAN
The VLAN ID and name.
Egress Forwarding State
Ports the selected role is active on will forward traffic belonging to this VLAN according to the egress forwarding state: Tagged (frames will be forwarded as tagged), Untagged (frames will be forwarded as untagged), or Forbid Forwarding (frames will not be forwarded; they will be discarded). To edit a
VLAN's egress forwarding state, you must remove the VLAN from the list and then add it again with the new state.
Add
Opens the Egress VLANs Selection View, where you can choose a VLAN for the role's egress list
and specify the egress forwarding state.
Remove
Select a VLAN and click Remove to remove the VLAN from the list.
VLAN Egress Tab (Role) 541
VLANs Tab
(VLAN Island)
the devices in the island. To display this tab, select the VLAN island in the left−panel VLANs tab, and the
VLANs tab in the right panel. You can access information about a specific Local VLAN by selecting the
VLAN in the table and clicking the View/Edit Local VLAN button. You can also edit local VLAN IDs with the Edit Local VLAN ID button.
Click the graphic for more information.
Local VLAN
Name of the local VLAN that is being used to create VLANs in the VLAN island.
Island VLAN Name
VLAN name created on the device in the VLAN island, using the naming convention specified during the creation of the VLAN island.
Island VLAN ID
VLAN ID created on the device in the VLAN island. This VID is within the range calculated from the base VID and offset specified during the creation of the VLAN island.
Status
Indicates whether this VLAN is being used to deny traffic (Discard), or contain traffic (Contain). The icon for a Discard VLAN displays a red X .
Buttons
View/Edit Local VLAN
Selecting a VLAN in the table and clicking this button opens the selected VLAN's General tab.
Edit Local VLAN ID
Selecting a VLAN in the table and clicking this button opens the Edit Local VLAN ID window, where you can change the VID for the local VLAN.
NOTE:
If the VLAN IDs are recalculated (for example, if you change the base or offset for the VLAN island), any changes you made to local VLAN IDs will be lost.
VLANs Tab (VLAN Island) 542
NetSight Policy Manager Help
VLANs Tab (VLAN Island) 543
Policy Manager Windows
The Windows help folder contains help topics describing Policy Manager windows and their field definitions.
Double−click the Windows help folder in the left panel to open the folder and navigate to topics describing a particular window.
Policy Manager Windows 544
Add/Edit CEP Detection Rule Window
Use this window to add or edit CEP detection rules that are used to determine if a connecting end−system is a
CEP device, and what type of CEP device it is. This allows Policy Manager to assign the appropriate role to the port based on the type of CEP device detected. Access the window from the CEP Detection sub−tab in the
right−panel Device Authentication tab.
NOTE:
CEP detection rules apply only to Siemens, H.323, and SIP (Session Initiation Protocol) phone detection. Cisco detection uses CiscoDP as its detection method.
CEP detection rules are based on two detection methods:
•
TCP/UDP Port Number detection − Many CEP vendors use specific TCP/UDP port numbers for call setup on their IP phones. You can create detection rules that identify CEP devices based on specific
TCP/UDP port numbers. By default, Siemens Hi−Path phones will be detected on TCP/UDP port
•
4060.
IP Address detection − H.323 phones use a reserved IP multicast address and UDP port number for call setup. You can create detection rules that will detect an IP phone based on its IP address in combination with an IP address mask. By default, H.323 phones will be detected using the multicast address 224.0.1.41 and the TCP/UDP ports 1718, 1719, and 1720. SIP phones will be detected using the multicast address 224.0.1.75 and the TCP/UDP port 5060. H.323 and SIP phones will also be detected using only their respective multicast addresses without the TCP/UDP ports.
Click the graphic for more information.
CEP Detection Settings
Priority
Enter the rule priority with one (1) being the highest priority. The rule with the highest priority will be used first, so it is recommended that the highest priority be given to the predominate protocol in the network to provide for greater efficiency.
Address
If the rule is based on IP address detection, enter the IP address that incoming packets will be matched against. By default, H.323 will use 224.0.1.41 as its IP address, SIP will use 224.0.1.75 as its IP address, and Siemens will have no IP address configured.
Address Mask
Add/Edit CEP Detection Rule Window 545
NetSight Policy Manager Help
If the rule is based on IP address detection, enter the IP address mask that incoming packets will be matched against.
End Point Type
Select the endpoint type (H.323, Siemens, or SIP) that will be assigned if incoming packets match this rule.
Protocol
If the rule is based on TCP/UDP port detection, select the UDP and/or TCP checkbox and define a port range with Port Low and Port High values:
•
UDP and TCP − Match the port number for both UDP and TCP frames.
•
TCP − Match the port number only for TCP frames.
•
UDP − Match the port number only for UDP frames.
Port Low
Define the low end of the port range for detection on UDP and/or TCP ports.
Port High
Define the high end of the port range for detection on UDP and/or TCP ports.
Add/Edit CEP Detection Rule Window 546
Add Device Window
automatically listed in the left−panel device tree. You can access this window by right−clicking a group in the left−panel Network Elements tab and choosing Add Device from the right−click menu.
Click areas in the window for more information.
IP Address
Enter the IP address of the device you want to add.
Profile
Use the drop−down list to select one of the SNMP profiles that have been defined for device access.
The Edit button lets you create a profile if one does not already exist.
SNMP Context
Select the checkbox and enter an SNMP context that has been configured on the device. An SNMP context is a collection of MIB objects, often associated with an entity. By specifying the SNMP context here, you can access the subset of MIB objects related to that context on the device.
The use of context differs depending on the protocol version being used with a user's credentials:
•
When used with SNMPv3 credentials, the context provides access to a specific collection of
MIB objects associated with a particular context configured on the device. If the credentials used are accepted, but the context specified doesn't match one configured on the device,
• access is denied.
Some Enterasys devices, such as Matrix N series, also provide limited support of contexts for
SNMPv1/v2. For these devices, an SNMPv1 or SNMPv2 community name can be mapped through Local Management, to a particular SNMP context on the device. Then, when
SNMPv1/v2 credentials are used, access is granted to the subset of MIB objects associated with that credential (community name).
Policy Manager treats each context for a given device (IP address) as a distinct device. The devices are displayed in the tree with the same IP address followed by the different SNMP contexts. All
Add Device Window 547
NetSight Policy Manager Help
SNMP contexts known to the device can be displayed using the show snmp context
command.
Refer to a Matrix Series Configuration Guide for more information about setting and showing
SNMP contexts.
Nickname
You can use the default nickname or click Specify to assign a unique nickname to this device. The default nickname for SNMP devices is the sysName MIB object, or if no sysName has been assigned, the device's IP address. The default nickname for pingable devices is the IP address.
Buttons
Edit
Opens the Profiles/Credentials tab in the Authorization/Device Access window where you can add or modify an existing profile to be associated with this device.
OK
Adds the device and closes the window.
Apply
Adds the device and leaves the window open so that you can add another device.
Cancel
Closes the window, but does not remove any devices that have already been added.
Add Device Window 548
Add RADIUS Accounting Server Window
This window lets you add a RADIUS server to Policy Manager for the purpose of RADIUS accounting.
device.
Click the graphic for more information.
RADIUS Accounting Server IP
IP address of the RADIUS accounting server.
Accounting Client UDP Port
UDP port number (1−65535) the device (RADIUS client) uses to send accounting requests to the
RADIUS server; 1813 is the default port number. Devices that do not support RADIUS accounting will have this field grayed out (with the exception of an SNMPv1 R2 device, which will display accounting values but will not allow you to set them.)
Timeout Duration (2 −10 sec)
The amount of time in seconds the device will wait for the RADIUS server to respond to an accounting request. Valid values are 2−10 seconds. Devices that do not support RADIUS accounting will have this field grayed out (with the exception of an SNMPv1 R2 device, which will display accounting values but will not allow you to set them.)
Number of Retries (0−20)
The number of times the device will resend an accounting request if the RADIUS server does not respond. Valid values are 0−20. Devices that do not support RADIUS accounting will have this field grayed out (with the exception of an SNMPv1 R2 device, which will display accounting values but will not allow you to set them.)
Server Shared Secret
A string of characters used to encrypt and decrypt communications between the device (RADIUS client) and the RADIUS accounting server. This string must match the shared secret entered when you
unable to communicate. The shared secret must be at least 6 characters long; 16 characters is recommended. Dashes are allowed in the string, but spaces are not.
Add RADIUS Accounting Server Window 549
NetSight Policy Manager Help
NOTE:
If you are configuring multiple RADIUS servers, the same server shared secret must be used for each RADIUS server. This is because most Policy Manager devices (RADIUS clients) only support one shared secret. Matrix N−Series devices with firmware version
5.0 or above are an exception to this, as these devices do support a unique shared secret for each server.
NOTE:
This Server Shared Secret is not to be confused with the Application Shared
Secret that encrypts communication between the RADIUS client and Policy
Manager, entered in the Application Shared Secret area of the RADIUS tab for
a device.
Verify Shared Secret
Re−enter the Server Shared Secret you entered above.
RADIUS Accounting Server Priority
Order in which the RADIUS accounting server will be checked, as compared to the other RADIUS accounting servers on the device. The lower the number, the higher the priority.
Add RADIUS Accounting Server Window 550
Add RADIUS Authentication Server Window
This window lets you add a RADIUS server to Policy Manager for the purpose of authentication. Access this
Click the graphic for more information.
RADIUS Authentication Server IP
IP address of the RADIUS authentication server.
Authentication Client UDP Port
UDP port number (1−65535) the device (RADIUS client) uses to send authentication requests to the
RADIUS authentication server; 1812 is the default port number.
Server Shared Secret
A string of characters used to encrypt and decrypt communications between the device (RADIUS client) and the RADIUS authentication server. This string must match the shared secret entered when
you added the client device on the RADIUS server. Without the shared secret, the server and client
will be unable to communicate, and authentication attempts will fail. The shared secret must be at least 6 characters long; 16 characters is recommended. Dashes are allowed in the string, but spaces are not.
NOTE:
If you are configuring multiple RADIUS servers, the same server shared secret must be used for each RADIUS server. This is because most Policy Manager devices (RADIUS clients) only support one shared secret. Matrix N−Series devices with firmware version
5.0 or above are an exception to this, as these devices do support a unique shared secret for each server.
NOTE:
This Server Shared Secret is not to be confused with the Application Shared
Secret that encrypts communication between the RADIUS client and Policy
Manager, entered in the Application Shared Secret area of the RADIUS tab for
a device.
Verify Shared Secret
Re−enter the Server Shared Secret you entered above.
Authentication Access Type
Add RADIUS Authentication Server Window 551
NetSight Policy Manager Help
Use the drop−down list to select the type of authentication access allowed for this RADIUS server:
•
Any access − the server can authenticate users originating from any access type.
•
Management access − the server can only authenticate users that have requested
• management access via the console, Telnet, SSH, or HTTP, etc.
Network access − the server can only authenticate users that are accessing the network via
802.1X, MAC, or Web−Based authentication.
This feature allows you to have one set of servers for authenticating management access requests and a different set for authenticating network access requests. Devices that do not support this feature will have this field grayed out.
RADIUS Authentication Server Priority
Order in which the RADIUS authentication server will be checked, as compared to the other RADIUS authentication servers on the device. The lower the number, the higher the priority.
Add RADIUS Authentication Server Window 552
Add/Remove Devices Window
(VLAN Islands)
This window enables you to add and remove devices from VLAN islands. To access the window, right−click a VLAN island in the left−panel VLANs tab and select Add/Remove Devices from the menu.
Devices contained in an island will be assigned a VID for each Local VLAN that is unique to the island, allowing roles and rules which use the Local VLANs to isolate users to that island. A device must always belong to an island, and will share a common VID assignment for the Local VLANs with all other devices contained in that island.
To add a device to an island, select the device in the left panel and either drag it to the island, or select the island and click Add. You can also select and add multiple devices. Device groups are included as a convenience. If you add a device that belongs to a device group to an island, that group will be removed from the list, as the group has become fragmented−−some devices belonging to an island, others not.
Click the graphic for more information.
Devices
When you expand the folders in this panel, the devices available to be added to VLAN islands are displayed. All the available devices are listed in the Default Island folder. If you have device groups, the device groups and their devices are in listed in the Grouped By folder.
Islands
This panel displays all the user−defined VLAN islands.
Add/Remove Devices Window (VLAN Islands) 553
NetSight Policy Manager Help
Buttons
Add
Adds the device(s) selected in the Devices panel to the island selected in the Islands panel. You can also add a device using drag and drop.
Remove
Removes the device(s) selected in the Islands panel from the VLAN island.
Remove All
Removes all the devices from the VLAN island selected in the Islands panel.
Add/Remove Devices Window (VLAN Islands) 554
Add/Remove Mappings Window
(Port−Level Mappings)
In the Add/Remove Mappings window, you can add or remove port−level Tagged Packet VLAN to Role mappings for a selected VLAN. To access this window, first select a VLAN in the left−panel VLANs tab.
section.
NOTE:
You cannot add or remove a port−level mapping to or from a frozen port . You must clear the frozen state on a port in order to add or remove a mapping.
Click the graphic for more information.
Role
Use the drop−down list to select the role being mapped.
Devices
This field displays all the device groups, devices, and port groups in the current domain. If you are adding a mapping to a port, select the desired port or ports. You can select an individual port, one or more devices, or groups of ports.
Selected Ports
This field displays all the ports currently defined for the mapping. You can remove one or more ports from the list by selecting the port and clicking Remove or you can remove all the ports by clicking
Add/Remove Mappings Window(Port−Level Mappings) 555
NetSight Policy Manager Help
Remove All.
Buttons
Add
Adds the ports selected in the Devices field to the Selected Ports field. You can also add ports by double clicking or using drag and drop.
Remove
Removes the ports selected in the Selected Ports field. You can also double click a port to remove it.
Remove All
Removes all the ports in the Selected Ports field.
Add/Remove Mappings Window(Port−Level Mappings) 556
Add/Remove
Network Elements Window
You can exclude specified network elements from the effects of a rate limit using the Add/Remove Network
Elements window.
To access this window, select the rate limit in the left−panel Classes of Service tab and make sure the General tab is displayed in the right panel. In the Exclusion section of the General tab, click Edit.
Click the graphic for more information.
Devices
not want to be affected by the rate limit.
Exclusion List
This list displays the network elements currently excluded from the rate limit. Select any network
elements you want to remove from this list. Removing a network element from the Exclusion List means it can then be affected by the rate limit.
Buttons
Add
Adds the network elements selected in the Devices list to the Exclusion List. You can also add a network element to the Exclusion List by using drag and drop.
Add/Remove Network Elements Window 557
NetSight Policy Manager Help
Remove
Removes the network elements selected in the Exclusion List. You can also double click a network element to remove it.
Remove All
Removes all the network elements from the Exclusion List.
Add/Remove Network Elements Window 558
Add/Remove Ports Window
(Rate Limit and
Transmit Queue Port Groups)
In this window, you can add and remove ports to and from role−based rate limit port groups and transmit queue port groups. Initially, all ports (on devices that support role−based rate limits and transmit queue configuration) are grouped into a Default port group under the appropriate port type. When you create new port groups, you add ports from the Default group into your newly defined port groups using this window.
To access this window, select the left−panel Classes of Service tab. Expand the Role−Based Rate Limits Port
Groups or Transmit Queue Port Groups folders and select the desired port group. Then, you can either:
•
Right−click the port group and select Add/Remove Ports from the menu, or
•
Click the Add/Remove Ports button in the right−panel Ports tab.
Click the graphic for more information.
Ports
This field displays the Default port group. Initially, all ports (on devices that support role−based rate limits and transmit queue configuration) are grouped into the Default port group under the appropriate port type.
Add/Remove Ports Window (Rate Limit andTransmit Queue Port Groups) 559
NetSight Policy Manager Help
Port Groups
This field displays any rate limit or transmit queue port groups you have created and their currently defined ports.
Buttons
Add
Adds the ports selected under the Default port group to the port group selected on the right. You can also add ports to a group using drag and drop.
Remove
Select the ports you want to remove from a port group and click Remove to return the ports to the
Default port group.
Remove All
Select a port group and click Remove All to remove all ports from the port group and return them to the Default port group.
Add/Remove Ports Window (Rate Limit andTransmit Queue Port Groups) 560
Add/Remove Ports Window
(Rule Usage Auto Clear)
Use this window to add or remove ports to and from the Rule Usage Auto Clear Ports list in the device
Click the graphic for more information.
Ports
Lists all the ports on the device. Select the ports you want to add to the list and click Add.
Selected Ports
click Remove.
Buttons
Add
Click Add to add the ports selected in the Ports list. You can also add ports by double clicking or using drag and drop.
Remove
Click Remove to remove the ports selected in the Selected Ports list. You can also double click a port to remove it.
Add/Remove Ports Window (Rule Usage Auto Clear) 561
NetSight Policy Manager Help
Remove All
Click Remove All to remove all the ports in the Selected Ports list.
Add/Remove Ports Window (Rule Usage Auto Clear) 562
Add/Remove Ports Window
(User−Defined Port Groups)
In the Add/Remove Ports window, you can add and remove ports from user−defined port groups created with
User−Defined Port Groups folder and select a port group. Then, you can either:
•
Right−click the port group and select Add/Remove Ports from the menu, or
•
Click the Add/Remove Ports button in the right−panel Ports tab.
Click the graphic for more information.
Port Group
Use the drop−down list to select the port group where you want to add or remove ports.
Devices
ports you want to add to the port group. You can select individual ports, devices, or groups of ports.
Selected Ports
This field displays all the ports currently defined for the port group. Select the port you want to
remove from the port group.
Buttons
Add/Remove Ports Window(User−Defined Port Groups) 563
NetSight Policy Manager Help
Add
Click Add to add the ports selected in the Devices field to the Selected Ports field. You can also add ports by double clicking or using drag and drop.
Remove
Click Remove to remove the ports selected in the Selected Ports field from the port group. You can also double click a port to remove it.
Remove All
Click Remove All to remove all the ports in the Selected Ports field.
Add/Remove Ports Window(User−Defined Port Groups) 564
Add/Remove Services
Window (Roles)
You can add and remove services and service groups from roles using the Add/Remove Services window.
To access the Add/Remove Services window, you must have a role selected in the left−panel Roles tab and the Services tab selected in the right panel. Click the Add/Remove Services button.
If you add a service to a role and any or all of the following conditions exist, you are in effect adding an
"empty" service, and a warning message will be displayed when you click OK or Apply:
•
No traffic description exists for one or more of the classification rules.
•
No access control or class of service has been defined for one or more of the classification rules.
•
All of the classification rules are disabled.
When you add a service to a role which already has services associated with it, Policy Manager checks for
rule conflicts. See Conflict Checking for more information.
Click the graphic for more information.
Add/Remove Services Window (Roles) 565
NetSight Policy Manager Help
Role
Use the drop−down list to select the role where you want to add or remove service groups and services.
Groups and Services
or services you want to add to the role.
Selected Services
to remove from the role.
Buttons
Add
Remove
Click Add to add the services or service groups selected in the Groups and Services field to the
Selected Services field. You can also add a service by double clicking the service or using drag and drop.
Add/Remove Services Window (Roles) 566
NetSight Policy Manager Help
Click Remove to remove the services selected in the Selected Services field. You can also double click a service to remove it.
Remove All
Click Remove All to remove all the services in the Selected Services field.
Add/Remove Services Window (Roles) 567
Add/Remove Services
Window (Service Groups)
You can add and remove services from service groups using the Add/Remove Services window.
To access the Add/Remove Services window, you must have a Service Group selected in the left−panel
Services tab, then select Edit > Add/Remove Services. You can also right−click on a service group and select
Add/Remove Services from the menu.
Click the graphic for more information.
Service Group
Use the drop−down list to select the service group where you want to add or remove services.
Services
service group.
Selected Services
you want to remove from the service group.
Buttons
Add
Click Add to add the services selected in the Services field to the Selected Services field. You can
Add/Remove Services Window (Service Groups) 568
NetSight Policy Manager Help also add a service by double clicking the service or using drag and drop.
Remove
Click Remove to remove the services selected in the Selected Services field. You can also double click a service to remove it.
Remove All
Click Remove All to remove all the services in the Selected Services field.
Add/Remove Services Window (Service Groups) 569
Add Static MAC Window
The Add Static MAC window displays current MAC addresses detected on the selected device(s), and lets you create a list of MAC addresses to lock (referred to as Static MAC Locking). MAC Locking ensures that only certain MAC addresses can access a port, and that traffic from any other MAC addresses will be discarded. MAC Locking is only available on devices that support it, and is not allowed on backplane and logical ports.
In order for MAC Locking to take effect on a port, it must be enabled on the port and at the device level. You
ports using the Port Configuration wizard. You can enable MAC Locking for a device using the MAC
Locking Tab (Device) or the Device Configuration wizard.
To access this window, select a device, device group, or the Devices folder, or a port or port group, in the left−panel Network Elements tab. Select the MAC Locking tab in the right panel, and click Retrieve to display the current list of locked MAC addresses for the selected item. Click the Add button to open the Add
Static MAC window. (If the device does not support the MAC locking feature, the Retrieve and Add buttons are grayed out.)
If you have selected the Devices folder, a device group, or a port group, the Add Static MAC window looks like the window below. If you selected a single device or port, the tables in the window will not include the
Device column and there will be no Device drop−down list.
Click the graphic for more information.
Detected MACs
This table displays the MAC addresses detected on the selected device(s) or port group and their corresponding index number and device IP address. (Only MAC addresses for devices that support
MAC Locking are displayed.) If you have selected a single device in the left−panel tree, the Device column will not be included. Select the desired MAC address and click Add to list the address in the
Add Static MAC Window 570
NetSight Policy Manager Help
Statically Add MACs list. You can also add a MAC address by double−clicking it.
Statically Add MACs
Lists the MAC addresses that you want to lock to a specific port or ports. To remove a MAC address from the list, select the address and click Remove. If you have selected a single device or port in the left−panel tree, the Device column will not be included.
MAC/Device/Index
Enter a MAC address and index number, and select a device from the dropdown list (if applicable).
Click Add to add the address to the Statically Add MACs list. If you have selected a single device or port in the left−panel tree, the device drop−down list is not displayed.
Buttons
Add
Adds the MAC addresses selected in the Detected MACs table or specified in the fields to the
Statically Add MACs table.
Remove
Removes the MAC address selected in the Statically Add MACs table. You can also double click a
MAC address to remove it.
OK
Adds the Statically Add MACs list to the Static MAC Locking lists on the devices.
Add Static MAC Window 571
Advanced Statistics Window
This window provides advanced server statistics that are useful as a troubleshooting tool. You can access this
window by clicking the Advanced button in the Server Statistics window.
Statistics are provided on the following server functionality. In each tab, you must use the Refresh button to display current statistical information.
•
Server Status
•
Topology Manager
•
Device Status Poller
•
Messaging
•
Database Status
•
NetSightMBean Status
•
EventsAndAlarmsMBean Status
TIP:
You may find it useful to copy information from these tabs and paste it elsewhere. For example, you may want to include the information in an e−mail. However, the text in some of these tabs is in .html
format. On Windows platforms you should copy and paste the text into a word processing program that preserves .html format, such as Microsoft Word. (Microsoft Notepad and WordPad do not preserve the .html format.) On Linux and Solaris platforms you can do a Ctrl−c to copy the text and insert it into vi, however the formatting is not preserved.
The Server Status Tab in the Advanced Statistics Window
Advanced Statistics Window 572
NetSight Policy Manager Help
Advanced Statistics Window 573
Assign Devices to Domain Window
This window lets you assign devices that are in the NetSight database to a Policy Domain or move devices from one domain to another. A Policy Domain contains any number of roles and a set of devices that are uniquely assigned to that particular domain. A device can exist in only one Policy Domain. For more
information on domains, see How to Create and Use Domains.
Initially, you must use Console to add your devices to the NetSight database. Once your devices are in the database, you can use this window to assign the devices to a Policy Domain. As soon as the devices are assigned to a domain, they are automatically displayed in the Policy Manager Network Elements tree. Only devices that support policy are displayed in the Policy Manager tree.
Devices to Domain.
Click the graphic for more information.
Devices
Assign Devices to Domain Window 574
NetSight Policy Manager Help
The Devices panel displays all the unassigned devices that are in the database (including devices that do not support policy) but are not assigned to a domain. The panel also displays any other domains and the devices assigned to that domain. Use the drop−down list to select a single domain or All
Other Domains. If you select All Other Domains, use the bottom panel to view which domain each device is assigned to.
Current Domain
The right panel displays the current domain and the devices assigned to that domain. To add a device to the current domain, select the device in the left panel and click Add. You can also select and add multiple devices. To remove a device from the current domain, select the device and click Remove.
This removes the device from the current domain and places it back in the device tree as either unassigned or as a member of the domain it came from.
Device Domain Membership
This panel lists the domain assignment for whatever device or device group you have selected in the
Devices panel. This is particularly useful when you have selected All Other Domains from the drop−down list in the Devices panel, as it allows you to quickly see the domain assignment for each device.
Buttons
Add
Adds the devices selected in the Devices panel to the current domain.
Remove
Removes the devices selected in the Current Domain panel from the current domain and places it back in the device tree as either unassigned or as a member of the domain it came from.
NOTE:
Removing a device from a domain does not delete the device from the NetSight database. To
delete a device from the database, right−click on the device in the left−panel Network Elements
tab, and select Delete from the menu. When a device is deleted from the database, it is automatically removed from the Console and Policy Manager device tree.
Remove All
Removes all the devices from the current domain.
OK/Apply
Assigns the selected devices to the current domain and displays the devices in the Policy Manager
Network Elements tree. Only devices that support policy are assigned to the domain and displayed in the Policy Manager tree.
Assign Devices to Domain Window 575
Authorization/Device Access
Users/Groups Tab
Use this tab to specify users who are authorized to access the NetSight database, and assign those users to authorization groups that define their access privileges to application features. Access privileges (called
Capabilities) are associated with authorization groups. Based on their membership in a particular authorization group, users are granted specific capabilities in the application. For example, you may have an authorization group called "IT Staff" that grants access to a wide range of capabilities, while another authorization group called "Guest" grants a very limited range of capabilities.
NOTE:
The NetSight Administrator authorization group is automatically created during installation and is granted Full capabilities. The NetSight Administrator group cannot be deleted and its capabilities cannot be changed.
Begin by creating your authorization groups and specifying the capabilities for that group. Then, create a list
Click areas in the window for more information.
Authorization/Device Access Users/Groups Tab 576
NetSight Policy Manager Help
Automatic User Membership
The Automatic User Membership feature lets you specify an authorization group for users that log in without having been previously assigned to a group. This lets you control the capabilities for these users. Users that are automatically added to a group by this feature are indicated by a Yes in the
Automatic Member column of the Authorized Users table.
Enable
When checked, users who are not in the Authorized Users table are automatically added to the selected group the first time that they log in.
Authorization Group
Use the drop−down list to select the desired authorization group.
Authorized Users Table
This table lists all of the users who are authorized to access the NetSight database. From here you can add, edit, and delete users and define a user's membership in an authorization group. Each entry shows the user name, domain, and group membership for the user. Users can be members of only one group.
User Name
This column lists users that have been created as authorized users.
Domain/Host Name
The user's domain/hostname that will be used to authenticate to the NetSight database.
Authorization/Device Access Users/Groups Tab 577
NetSight Policy Manager Help
Authorization Group
The authorization group where the user is a member.
Automatic Member
Yes indicates that the associated user was not a previously authorized user and, as a result was automatically added to the Automatic User Membership − Authorization Group. No indicates that the associated user is an authorized user that was created by the NetSight
Administrator.
Authorization Groups Table
This table lists all of the groups that have been created.
Group Name
This is the name assigned to the group. The NetSight Administrator group is created during installation and is granted Full capabilities and access. The NetSight Administrator group cannot be deleted and its capabilities can be viewed, but cannot be changed.
Number of Group Members
This is the number of current members in the associated group.
Capabilities
This column summarizes the capabilities granted to the associated group: Full (all capabilities) or Customized (a subset of capabilities).
Buttons
Add User
Opens the Add User window where you can define the username, domain, and authorization group
that will be used by a new user.
Edit (User)
Opens the Edit User window where you can modify the domain or group membership for a selected
user.
Delete (User)
Removes a selected User from the Authorized Users table.
Add Group
Opens the Add Group window where you can define the capabilities and settings for a new group.
Edit (Group)
Opens the Edit Group window where you can modify the capabilities and settings for a selected
group.
Delete (Group)
Removes the selected Group from the Groups table.
Add/Edit User Window
This window lets you define an authorized user's user name, domain, and membership in an authorization group.
Click areas in the window for more information.
Add/Edit User Window 578
NetSight Policy Manager Help
User name
The name used for this authorized user.
Domain/Host name
The user's domain/hostname that will be used to authenticate to the NetSight database.
Authorization Group
Use the drop−down list to select the authorization group where this user will be a member.
Add/Edit Group Window
This window lets you define a new group or edit an existing group.
Click areas in the windows for more information.
Add/Edit Group Window 579
NetSight Policy Manager Help
Group Name
This is the name given to the group. When adding a group, you can enter any text string that is descriptive of the members of this group.
Capabilities Tab
Expand the Capabilities tree in this tab and select the specific capabilities to be granted to users that are members of this group. The capabilities are divided into suite−wide and application−specific capabilities. Access to a particular capability is granted when it is checked in the tree.
Add/Edit Group Window 580
NetSight Policy Manager Help
Settings Tab
The Settings tab configures how SNMP requests will be handled for users that are members of this group.
Allow Users to Configure SNMP Redirect in Options
Lets users that are members of this group edit the Suite−wide Option setting for Client/Server
SNMP Redirect.
Always Redirect SNMP to NetSight Server
Redirects all SNMP requests to the NetSight Server for users that are members of this group, regardless of the Suite−wide Option setting for Client/Server SNMP Redirect.
Never Redirect SNMP to NetSight Server
Never redirects SNMP requests to the NetSight Server for users that are members of this group, regardless of the Suite−wide Option setting for Client/Server SNMP Redirect.
Add/Edit Group Window 581
Authorization/Device Access
Profiles/Credentials Tab
NetSight applications access devices to control certain device functions (SNMP sets) and retrieve information for device properties views, FlexViews and periodic polling (SNMP gets). This tab lets you manage
credentials that define the access privileges required for SNMPv1, SNMPv2, and SNMPv3, and profiles that use the credentials for various access levels. Two elements are involved with access management:
•
Credentials − define the SNMPv1/SNMPv2 community names and SNMPv3 values that will be used to access your network devices. Credentials are created:
•
Manually using the Add Credential button
•
Imported from a file in NetSight Generated Format (.ngf) using the Import from Device
List.
•
Profiles − are assigned to device models in the NetSight database. They identify the credentials that are used for the various access levels when communicating with the device. Profiles are created using the Add Profile button.
Click areas in the window for more information.
Authorization/Device Access Profiles/Credentials Tab 582
NetSight Policy Manager Help
Default Profile:
This drop−down list lets you specify a profile that will be used by default to access a device.
Profiles Table
This table lists all of the profiles that have been created.
The public_v1_Profile is automatically created during Console installation and cannot be deleted.
Name
This is the name assigned when the profile was created.
Version
This is the SNMP protocol version for the profile. Profiles can be configured for SNMPv1,
SNMPv2c, or as SNMPv3.
Read, Write, Max Access Credential
When the Version is SNMPv1 or SNMPv2c, the Read, Write, and Max Access columns in the table contain the Community Name for each access level. When the Version is SNMPv3, the Read, Write, and Max Access columns in the table contain the credential specified for each access level.
Credentials Table
Authorization/Device Access Profiles/Credentials Tab 583
NetSight Policy Manager Help
This table lists all of the credentials that have been created in the NetSight database. The public_v1 credential is automatically created during Console installation and cannot be deleted.
Name
This column lists names assigned to credentials that have been created in the NetSight database.
Version
This is the SNMP protocol version for the credential. Credentials can be configured for
SNMPv1, SNMPv2c, or as SNMPv3.
Community
For SNMPv1 or SNMPv2c credentials, this is the Community Name used for device access.
User Name
For SNMPv3 credentials, this is the User Name used for device access.
Auth Type, Priv Type
For SNMPv3 credentials, these columns show the authentication protocol (None, MD5, or
SHA) and privacy protocol (None or DES) used by the credential.
Show passwords in clear text
When this option is checked, passwords and community names appear as text. The default setting for this option is unchecked, and passwords and community names appear as a string of asterisks.
Buttons
Add Profile
Opens the Add Profile window where you can select the SNMP version and define the profile name
and passwords/community names used by the profile.
Edit (Profile)
Opens the Edit Profile window where you can modify the SNMP version and passwords/community
names used by a selected profile.
Delete (Profile)
Removes the selected Profile from the Groups table. You cannot delete the profile that is currently selected to be the Default Profile.
Add Credential
Opens the Add Credential window where you can define new credentials.
Edit (Credential)
Opens the Edit Credential window where you can modify a credential selected from the Credentials
table.
Delete (Credential)
Removes a selected credential from the Credentials table.
Add/Edit Profile Window
This window lets you define the SNMP Credentials for SNMPv1/SNMPv2 Community Names and for
SNMPv3 users that will be granted access to your network devices. The Add Profile window lets you create a new profile and the Edit Profile window lets you modify an existing profile.
Add/Edit Profile Window 584
NetSight Policy Manager Help
Click areas in the windows for more information.
Profile Name
A unique name (up to 32 characters) that you assign to this profile.
When editing an existing profile, you can select a profile from the table to modify its settings.
However, you cannot change the name of an existing profile.
SNMP Version
This is the SNMP protocol version for the profile. Profiles can be configured for SNMPv1,
SNMPv2c, or as SNMPv3. When either SNMPv1 or SNMPv2c is selected, the editor provides fields where you can configure access levels using Community Names. With SNMPv3 selected, you can configure access levels using Credentials and Security Levels.
Read, Write, Max Access
SNMPv1, SNMPv2c
The Read, Write, Max Access define the community names used for these levels of access.
•
Read − This Community Name is used for get operations.
•
Write − This Community Name is used for set operations.
•
Max Access − This Community Name is used for set operations that require administrative access, such as changing community names.
SNMPv3
The Read, Write, Max Access levels are defined by Credentials and Security Level:
Credentials
Credential Names are assigned to each of the three SNMPv3 access levels that are used for the Read, Write and Max Access operations.
•
Read − used for read operations (gets).
•
Write − used for write operations (sets).
Add/Edit Profile Window 585
NetSight Policy Manager Help
Security Level
•
Max Access − used for write operations (set ) that require administrative access.
Each access level can be assigned a security level:
•
AuthPriv − Highest security level requiring authentication and privacy
•
(encrypted information).
AuthNoPriv − Requires authentication, but unencrypted information.
•
NoAuthNoPriv − Neither authentication nor privacy required.
Add/Edit Credential Window
This window lets you define or edit the names and community names/passwords for credentials.
Click areas in the window for more information.
Add/Edit Credential Window 586
NetSight Policy Manager Help
Credential Name
A unique name (up to 32 characters) that you assign to this access credential. You can define a new credential or select a name from the table to modify settings for an existing credential.
You cannot edit the name of an existing credential.
SNMP Version
This is the SNMP protocol version for the credential. Credentials can be configured for
SNMPv1, SNMPv2, or as SNMPv3. When either SNMPv1 or SNMPv2 is selected, the window provides fields where you can configure access levels using Community Names.
With SNMPv3 selected, you can configure access levels using Authentication and Privacy
Types.
Community Name
For SNMPv1 or SNMPv2c credentials, this is the Community Name used for device access.
User Name
For SNMPv3 credentials, this is the User Name used for device access.
Authentication Type
For SNMPv3 credentials, select MD5, SHA1, or None, from this drop−down list .
Specify/Confirm Password
This is the password (between 1 and 64 characters in length) that will be used to determine Authentication. These fields are disabled for Authentication Type, None. If an existing password is changed and the credential is currently used with a profile that is applied to one or more devices, a confirmation dialog is opened to determine how the changes will be handled. You will be asked if you want to change the password on the device(s). You can then select the devices where the password will be changed and, if this user is a valid user on the device(s), then the new password will be set on the device.
NOTE:
SNMPv1 profiles can be set on device(s) using Console's Set Profile on Device feature of the Properties (Access) tab.
Privacy Type
For SNMPv3 credentials, select DES or None from this drop−down list. These settings are disabled if Authentication Type None is selected.
Specify/Confirm Password
This is the password (between 1 and 64 characters in length) that will be used to determine Privacy. These fields are disabled for Privacy Type, None. If an existing password is changed and the credential is currently used with a profile that is applied to one or more devices, a confirmation dialog is opened to determine how the changes will be handled. You will be asked if you want to change the password on the device(s). You can then select the devices where the password will be changed and, if this user is a valid user on the device(s), then the new password will be set on the device.
NOTE:
SNMPv1 profiles can be set on device(s) using the Set Profile on Device feature of Console's Set Profile on Device feature of the Properties (Access) tab.
Show passwords in clear text
When this option is checked, passwords and community names appear as text. The default setting for this option is unchecked and passwords and community names appear as a string of asterisks.
Add/Edit Credential Window 587
NetSight Policy Manager Help
Add/Edit Credential Window 588
Authorization/Device Access
Profile/Device Mapping Tab
This tab lets you define the specific Profiles to be used by users in each Authorization Group when communicating with network devices. The view consists of a device tree in the left panel where you select devices, and a table in the right panel that lists the current device profile assignments. The Table Editor button
activates the editing row where profile selections are made.
Click areas in the window for more information.
Device Tree
The left panel contains a device tree, where you select the devices you want to view or configure.
Profile/Device Mapping Table
This table lists all of the selected devices and shows a column for the NetSight Administrator
Group and each Authorization Group you have defined. The NetSight Administrator column shows
Authorization/Device Access Profile/Device Mapping Tab 589
NetSight Policy Manager Help the profile used by the NetSight Administrator group. The Profile listed/selected for each
Authorization Group column will be used by that group when communicating with the associated device and, as a result, defines the level of access granted to users that are members of that
Authorization Group.
Table Editor Row
This row is visible when the Show/Hide Table Editor button is toggled to make the Table
Editor visible. The drop down list for each Authorization Group column contains all of the
Profiles that have been created in the NetSight database, including Ping Only, No Access, and the profile selected on the Profiles/Credentials tab as the Default profile. Selecting a profile in the Table Editor row alters the value for that entry in the row(s) selected in the table. Once you select a profile to be changed for your selected column(s), a green exclamation mark ( ) marks the cells that have been changed (but not Applied) and the Apply button becomes active. Clicking the (Show/Hide Table Editor button) at this point cancels your changes, restores the original profiles, and hides the Table Editor.
Clicking Apply sets the profiles that you've changed for the selected devices, removes the
, and hides the Table Editor row.
Buttons
Show/Hide Table Editor
This button toggles the Table Editor, a row at the bottom of the table that allows you to define a profile for each Authorization Group. Use the drop down list to select a profile for each group, and then click Apply.
Apply
This button is active when the Table Editor is enabled. Apply sets your profile selections for the
Authorization Groups, clears the from the table, and hides the table editor row.
Authorization/Device Access Profile/Device Mapping Tab 590
Authorization/Device Access
Manage SNMP Passwords Tab
This tab lets you collectively manage the credentials that have been set on your network's devices. When a particular credential is selected from the drop−down list above the table, the table lists the devices where that credential/password is set. When an SNMPv1 or SNMPv2 credential is selected, you can define a New
Community Name for access to the devices in the table. When an SNMPv3 credential is selected, you can define both the Authentication password and the Privacy password for access to the devices in the table. You can assess the impact of applying new passwords on your devices before actually applying them by clicking
Test and checking the information in the Test Results column.
Click areas in the window for more information.
Select Credential
This drop−down list contains all of the Credentials that have been created in the NetSight database.
New Community Name
The new (SNMPv1/2) community name that will be used for access to the associated device(s).
Authorization/Device Access Manage SNMP Passwords Tab 591
NetSight Policy Manager Help
Authentication/Privacy
The new SNMPv3 passwords that will be used for access to the associated device(s).
Show Passwords in Clear Text
When checked, the passwords are shown in text. When unchecked, the passwords are shown as a string of asterisks.
Credentials Table
This table lists all of the devices where the selected credential can be used.
Device
The list of devices where the currently selected credential can be used to access the device.
Auth Group
This is the Authorization Group(s) that are granted access to the associated device.
Profile
This is the profile used by the associated Authorization Group for access to the device.
Read, Write, Max Access
These columns show the credential used for each access level.
Use for Set
Shows the credential that is used with the SNMP Set to change the credential on the device.
Test Results
After clicking Test, this column shows the results that can be expected if the credential changes are actually applied to devices.
Results
After clicking Apply, this column shows the results of the credential changes that were applied to devices.
Buttons
Refresh
Updates the table when information has changed.
Test
This button lets you view the results that can be expected if your credential changes are actually applied to the devices.
Apply
Sets your credential changes on the devices in the table.
Authorization/Device Access Manage SNMP Passwords Tab 592
Backup Database Window
Use the Backup Database window to save the currently active database to a file on the NetSight Server workstation. If the NetSight Server is local, you can specify a directory path where you would like the backup file stored. If the server is remote, the database will be saved to the default database backup location. You can
Click the graphic for more information.
Database Path
The default database backup location. If the NetSight Server is local, you can specify an alternate backup directory by entering a path to the directory, or using the Browse button to navigate to the directory. If the server is remote, the database will be saved to the default database backup location.
Database Name
Enter a name for the database backup file.
Buttons
Backup
Starts the backup operation.
Backup Database Window 593
Classes of Service Usage Window
This window provides an easy way to view class of service information for a specific port. In the window, you select a port and a role. A table then displays the actual rate limit and transmit queue configuration that would be implemented on the selected port if a user's traffic were to match any of the rules defined for the role.
To access this window, select View > CoS Usage from the menu bar. You can also access the window by right−clicking a port in the left−panel Network Elements tab and selecting CoS Usage from the menu. The port will be automatically selected in the window.
Click the graphic for more information.
Devices
Expand the tree and select the port whose class of service usage you want to view.
Default Role
Use the drop−down list to select the desired role.
Rule
The name of the rule the class of service is part of.
Class of Service
Classes of Service Usage Window 594
NetSight Policy Manager Help
The name of the class of service associated with the rule.
ToS
The ToS value associated with the class of service, if any.
Transmit Queue
The transmit queue associated with the class of service for this port.
Inbound Rate Limit
The inbound rate limit associated with the class of service for this port.
Buttons
View/Edit CoS
Select a rule in the table and click this button to access the class of service (CoS) General tab where you can view and edit the class of service values.
Classes of Service Usage Window 595
Configure Server Window
The Configure Server window allows you to configure various NetSight Server parameters. The window has a right−panel view that changes depending on what you have selected in the left−panel tree. You can access this
window by clicking the Configure button in the Server Information window. You must be assigned the
appropriate user capabilities to access and use this window.
Information on the following Configure Server view:
•
Client Connections
Selecting Client Connections in the left panel of the Configure Server window provides the following view where you can see the number of current client connections for each installed plugin application, and change the maximum number of connections allowed for each plugin and the NetSight Server.
Click the graphic for more information.
Installed Application Plugins
The name of the installed plugin application with clients connecting to the NetSight Server.
Current Connections
The number of current client connections for this plugin application.
Configure Server Window 596
NetSight Policy Manager Help
Total Allowed
The maximum number of client connections allowed for this plugin application. Select this field and use the arrows to change the number, if desired.
Clients Currently Connected
The total number of clients currently connected to the NetSight Server.
Number of Clients Allowed
The maximum number of concurrent client connections allowed by the NetSight Server. Use the arrows to change the number, if desired. This number should be set to the total number of clients you want to allow to connect to your server.
Buttons
Refresh
Refreshes the current connection information.
Configure Server Window 597
Create
Class of Service
Window
This window lets you create a class of service (CoS) that includes one or more of the following components: an 802.1p priority, an IP type of service (ToS) value, rate limits, and transmit queue configuration. Once you've created the class of service, you can apply it as a classification rule action, as part of the definition of
To access this window, right−click the Classes of Service folder in the Classes of Service left−panel tab, and select the Create Class of Service option. You can also open this window using the Tools > Create Class of
Service menu bar option when the Classes of Service folder is selected.
Click the graphic for more information.
Name
Enter the name of the class of service.
802.1p Priority
If the class of service includes an 802.1p priority, select this checkbox and use the drop−down list to choose the priority (0−7 with 7 being the highest priority). Changing the 802.1p priority will also
change the Transmit Queue Index to the default index for the selected priority.
ToS
Some IP rules allow a ToS/DSCP value to be written to the ToS/DSCP field in the IP header of incoming packets. Select this option to associate an IP ToS (Type of Service) or DSCP (Diffserv Codepoint) rewrite value with this class of service. The IP/ToS value appears in the left−panel IP Type of Service Values folder.
See ToS/DSCP Rewrite for more information.
NOTE:
If you apply a class of service with a ToS/DSCP value as a role default, the ToS/DSCP value will be ignored. This is because ToS/DSCP rewrite works only for certain IP ToS classification rules,
Create Class of Service Window 598
NetSight Policy Manager Help not as a role default.
Value
The IP type of service value is an 8−bit hexadecimal number between 0 and FF (see IP Type of
Service for more information). You can either enter this value in the Value 0x text box, or click
Select to open the ToS/DSCP Configuration window, where you can automatically configure a ToS
(Type of Service) or DSCP (Diffserv Codepoint) value.
Mask
The ToS mask controls which bits in the ToS/DSCP field of incoming packets will be overwritten.
Masking a ToS value is only supported on Matrix N−Series devices. Devices that do not support the mask will ignore this field.
Role−Based Rate Limit Configuration
This section lets you select the transmit queue index and inbound rate limit index to associate with the class of service. These index numbers are used by devices that support Role−Based Rate Limit and Transmit Queue
Transmit Queue Index
Transmit Queue Index numbers map logical transmit queue indexes on the ports to the actual physical
transmit queues you have configured in Policy Manager. If you have selected an 802.1p priority for
this class of service, a default transmit queue index is automatically specified based on the selected priority. You can use the default index or change it according to your own transmit queue configuration. Click Select to open the Transmit Queues selection view window, which lists all the possible transmit queues, organized by index number for each existing port type and group. Selecting an index automatically includes all the transmit queues configured for that index number.
Inbound Rate Limit Index
Inbound Rate Limit Index numbers map logical rate limit indexes to the actual physical rate limits you have created in Policy Manager. Click Select to open the Inbound Rate Limits selection view window, which lists all the possible rate limits, organized by index number for each existing port type and group. Selecting an index includes all the rate limits configured for that index number.
Create Class of Service Window 599
Create
Classification Rule
Window
This window appears when you select a service in the left−panel Services tab and select the Create
Classification Rule right−click menu option. It provides a way to add a rule to a service without using the
Classification Rule Wizard. If you use this window, traffic descriptions and actions can be added to the rule
Click the graphic for more information.
Name
Enter a name for the rule.
Status
Disable the rule, if desired. If a rule is disabled, it is unavailable for use by the current service, but can
The rule icon in the left panel displays a red X if the rule is disabled.
Type
Create Classification Rule Window 600
NetSight Policy Manager Help
Select the types of devices to which you wish this rule to apply when enforced. See Rule Type for
more information on the consequences of your choice.
Create Classification Rule Window 601
Create Mixed−Stack
SecureStack C2/C3 Domain Tool
This tool provides a way to manage mixed stacks of SecureStack C2/C3 and SecureStack B2/B3 devices by creating a new domain specifically for those mixed stack devices, using the data in the currently active domain. This is necessary because SecureStack C3 and B3 devices do not support Class of Service rate limiting and certain rule types (Layer 2 rules and ICMP Layer 3 rules) that are supported by the C2 and B2 devices. When you have a mixed stack, all devices in the stack have the rule type and Class of Service limitations of the C3 or B3 device, despite the fact that the stack may report itself as a C2 or B2 device. (The device type that the stack reports is based on what switch is set as the master. It is strongly recommended that the C3 or B3 device be configured as the master in the mixed stack) Because of the C3 and B3 limitations, managing a mixed stack in a domain with C2 or B2 rules in use, will cause enforce to fail. For more
the Policy Manager release notes.
Using this tool, you can import all current domain role/rule data relevant to your mixed stack devices into a new domain created specifically to manage those mixed stacks. Unsupported rules (Layer 2 rules and ICMP
Layer 3 rules) are not imported, and all imported rules are changed to the "All Devices" type. In addition, the imported devices will have their Class of Service mode set to "Rate Limits Disabled" because rate limiting is not supported in mixed stacks. These changes allow the rules to be enforced to all devices in the new domain, regardless of what type of SecureStack device they are reporting as.
NOTE:
After you have created your new mixed−stack domain, be careful not to add unsupported rules to the new domain or enforce will once again fail.
You can access the tool from the Tools > Create Mixed−Stack SecureStack C2/C3 Domain menu option.
The tool has two windows. The first window lets you view the configuration data that will be imported into the new domain. When you click Create Domain in that window, the second window opens where you select the specific devices that you want to include in the new mixed−stack domain. When you click OK in that window, a new mixed−stack domain is created and opened.
Click the graphic for more information.
Create Mixed−StackSecureStack C2/C3 Domain Tool 602
NetSight Policy Manager Help
"Show" Radio Buttons
These radio buttons determine the amount of data displayed in the right panel of the window.
All
Select this radio button to display what will and what will not be imported into the new domain.
Errors and Warnings Only
Select this radio button to show only what will not be imported into the new domain.
Left Panel
The left panel of the window displays a New Domain Data folder that contains the C2/C3 and B2/B3 devices in your network. The icon alerts you that there are certain things that will not be imported into the new domain.
Create Mixed−StackSecureStack C2/C3 Domain Tool 603
NetSight Policy Manager Help
Right Panel
The upper portion of the right panel provides information about whether certain policy management features are supported and/or enabled for the devices listed in the left panel.
•
Additional Warnings − This section notifies you if there are problems detected with the policy
• configuration. View the Enforce Warnings in the Event Log for details.
GVRP − Shows whether GVRP is Enabled, Disabled, or Not Supported. You can enable or disable
•
GVRP via the Edit menu.
Dynamic Egress − Shows whether Dynamic Egress is Supported or Not Supported.
There are three tabs that provide specific information about the roles, classification rules, and classes of service that will be imported into the new domain. The information displayed depends on whether you have
in the Roles tab to filter the information for just that role.
Roles Tab
Incomplete − Lists any roles with unsupported classification rules that will not be imported. These roles will be imported to the new domain, but without the unsupported rules.
Complete − Lists any roles which do not include unsupported classification rules. These roles will be imported as defined.
Classification Rules Tab
Excluded − Lists any unsupported classification rules (Layer 2 rules and ICMP Layer 3 rules) that have been applied to a role. These rules will not be included when the associated roles are imported to the new domain.
Included − Lists any supported classification rules that have been applied to a role. These rules will be included when the associated roles are imported to the new domain.
Classes of Service Tab
Class of Service Mode − Lists the Class of Service mode currently in effect on the devices. The Class of Service mode will always be set to "Rate Limits Disabled" for the devices in the new mixed−stack domain.
Included Classes of Service − Lists the classes of service that will be imported to the new domain:
•
Class of Service − the name of the class of service.
•
802.1p Priority − the priority associated with the class of service.
•
ToS Value − the IP type of service value associated with this class of service, if any. See IP
•
Type of Service for more information.
Transmit Queue Reference − the transmit queue index associated with the class of service.
•
IRL Reference − the role−based rate limit index associated with the class of service.
For more information, see Getting Started with Class of Service and How to Create a Class of
Create Domain Button
Opens the second window of the tool where you can select the mixed−stack devices you want included in the new domain. In most cases, you should create one new domain for the mixed−stack devices in each of your domains.
Click the graphic for more information.
Create Mixed−StackSecureStack C2/C3 Domain Tool 604
NetSight Policy Manager Help
Domain Name
Use this field to enter a name for the new domain or use the default name that's displayed.
SecureStack Devices from Current Domain
This panel lists the C2/C3 and B2/B3 devices in the current domain. Select the devices that will be included in the mixed−stacks and click Add. (In most cases, you should create one new domain for the mixed−stack devices in each of your domains.)
Selected Mixed−Stack Devices
This panel lists the devices you've selected for the mixed−stack domain. To remove a device, select the device and click Remove, or click Remove All to remove all devices from the list.
OK Button
Creates and opens a new domain for your mixed−stack devices.
Create Mixed−StackSecureStack C2/C3 Domain Tool 605
Create Network Resource Window
Use the Create Network Resource window to create a group of network resources which you can use with
Policy Manager Automated services. For example, you can create groups of network resources such as routers, VoIP (Voice over IP) gateways, and servers. You create a network resource group by defining a list of
IP addresses for devices that you want included in the group, or by choosing an IP subnet which comprises the
rule with a specified action (class of service and/or access control), for each IP address in the network resource group.
To access this window, right−click on the Network Resources folder in the left−panel Services tab, and select
Create Network Resources from the menu. You can also access this window from the Network Resources
Selection View or the Service Wizard's Network Resources window.
Click the graphic for more information.
Name
Enter a name for the network resource group. (The group name is case−sensitive; therefore, Policy
Manager sees "SAP Servers" and "sap servers" as two different group names.)
Network Resources IP Address List
Select this option to specify the IP addresses of the devices you want to be a part of the network resource group. To add an IP address to the group, enter an IP address in the box below the list field and click Add. To remove an IP address from the group, select the IP Address in the list and click Remove.
Remove
Removes the selected IP address from the list. To select more than one address, hold down Ctrl (for non−sequential addresses) or Shift (for sequential addresses) while selecting.
Add
Adds the IP address in the box to the left of the button to the IP Address list.
Subnet
This option lets you create a network resource group that consists of an entire IP subnet.
Create Network Resource Window 606
NetSight Policy Manager Help
Subnet
Enter the IP address of the subnet you want to be in the network resource group.
Mask
Select the desired subnet mask from the drop−down list.
Buttons
Apply
Creates the network resource group and leaves the window open.
Create Network Resource Window 607
Create Rate Limit
Window
Role−Based rate limits. When you create a rate limit you can configure it with both priority−based and role−based parameters. The rate limit configuration used will depend on the device and the type of rate limit
NOTE:
Rate limits are disabled by default on devices. You can specify the type of rate limits you want to
use on a device in the Class of Service Mode section on the device General tab or using the
Device Configuration wizard. Only certain devices such as the Matrix N−Series Gold and
Platinum devices support both types of rate limits, but you cannot have both types enabled at the same time.
To access this window, right click the Rate Limits folder in the left−panel Classes of Service tab, and select the Create Rate Limit option. You can also open this window using the Tools > Create Rate Limit menu bar option when the Rate Limits folder is selected. To create the rate limit, fill out the window and click OK (to
for the new rate limit appears, where you can configure additional rate limit parameters.
Click the graphic for more information.
Rate Limit
Specify the highest transmission rate at which traffic can enter or exit a port before packets will be
Create Rate Limit Window 608
NetSight Policy Manager Help rate limited:
•
% − A percentage of the total bandwidth available (not available for priority−based rate
• limits)
PPS − Packets per second (not available for priority−based rate limits)
•
Kb/s − Kilobits per second
•
Mb/s − Megabits per second
•
Gb/s − Gigabits per second
NOTE:
The lower and upper limits vary according to the types of devices you have and
how they are connected; refer to the Firmware Feature Support tables in the
release notes for minimum and maximum limits per device type.
Priority−Based Configuration
Use this area to configure priority−based rate limit parameters. The rate limit will be associated with one or more of the eight 802.1p priorities (0−7). When the associated priority is selected for a class of service, the rate limit becomes part of that class of service. When applied to a port, the combined rate of all traffic on the port that matches the priorities associated with the rate limit cannot exceed the configured limit. If the rate exceeds the configured limit, frames are dropped until the rate falls below the limit. Once a rate limit is associated with a priority, that priority will include rate limiting wherever and however it is used, until the rate limit is deleted from Policy Manager. Also, once a priority−based rate limit is applied to a port, it will remain on the port even if the role that originally used the rate limit is no longer associated with the port.
You must have priority−based rate limiting enabled if you want priority−based rate limits to be written to your devices when you perform an enforce. Priority−based rate limits add to the amount of time it takes to enforce and verify roles. Once you've created your rate limits and enforced them, you may want to disable rate limits so that it takes less time to enforce. You can enable or disable rate limits in the Class of Service Mode section
NOTE:
There are important differences in priority−based rate limit behavior on Matrix
N−Series Platinum devices. For more information, see Priority−Based Rate Limiting on
Matrix N−Series Platinum Devices.
NOTE:
The Direction field will have Inbound selected by default. If you do not want to configure priority−based parameters, just leave the default selection without specifying any associated priorities. The rate limit will not be written to your devices when you enforce.
Direction
Select Inbound or Outbound, depending on whether the rate limit is for inbound or outbound traffic.
In order to control traffic inbound and outbound on the same port, two rate limits must be configured
(one inbound and one outbound). Inbound rate limiting takes place after a frame has been classified into one of the eight priorities. Outbound rate limiting takes place just before a frame is queued for transmission.
802.1p Priorities
Select the 802.1p priority or priorities with which the rate limit will be associated. Each 802.1p
priority can have only one inbound and one outbound rate limit; therefore, if a priority is already being utilized for the selected direction, it is grayed out.
SecureStack C2/B2 10/100 Priority
Create Rate Limit Window 609
NetSight Policy Manager Help
SecureStack C2/B2 10/100 ports support two rate limits (inbound only). If you are creating a rate limit to be used on SecureStack C2/B2 10/100 ports, select either Low to associate the rate limit with priorities 0−3 or High to associate the rate limit with priorities 4−7. You can select both Low and
High if you want to associate the rate limit with priorities 0−7. If the Low or High priority is already being utilized for another rate limit, it will be grayed out. Because SecureStack C2/B2 10/100 ports only support inbound rate limits, this section will be grayed out if you have selected Outbound for
Role−Based Configuration
Use this area to configure notification parameters for a role−based rate limit. Role−based rate limits are defined within a class of service and associated with a specific role via a rule action or as a role default. When role−based rate limits are implemented, all traffic on the port that matches the rule with the associated rate limit cannot exceed the configured limit. If the rate exceeds the configured limit, frames are dropped until the rate falls below the limit. The rate limit will remain on the port only as long as the role using the rate limit is active on the port either as the authenticated role or as the port's default role.
You must have role−based rate limiting enabled if you want role−based rate limits to be included in roles written to your devices when you perform an enforce. You can enable or disable rate limits in the Class of
Service Mode section of the device General tab.
Notification
Select the notification type(s) you would like this rate limit to use:
•
Generate System Log on Rate Violation − a syslog message is generated when the rate limit is
• first exceeded.
Generate Audit Trap on Rate Violation − an audit trap is generated when the rate limit is first
• exceeded.
Disable Port on Rate Violation − the port is disabled when the rate limit is first exceeded.
NOTE:
Matrix N−Series Gold devices do not support rate limit notification.
Create Rate Limit Window 610
Create VLAN
Window
This window appears when you select the Create VLAN menu option, or if you select New in the VLAN
Selection View or the Role VLAN window in the Role Wizard. If you access this window from the VLAN
Selection View or Role Wizard, the title bar states Create Deny VLAN or Create Contain VLAN, and the appropriate items are selected or grayed out, depending on whether you have selected "Contain to VLAN" or a "Deny Traffic" (discard VLAN) as your access control.
See How to Create a VLAN, How to Create a Policy VLAN Island, and Roles for additional information.
Click the graphic for more information.
VLAN Name
Unique name for the VLAN you want to create. VLAN names can be up to 32 characters in length, including spaces. VLAN names are case sensitive. For example, "Sales" and "sales" would be considered two different VLAN names. You cannot have two VLANs with the same name in Policy
Manager.
VLAN Scope
Scope of the VLAN (Local or Global).
This choice is available only if the Policy VLAN Islands feature is enabled. If Policy VLAN Islands
are disabled, this selection is grayed out, and the VLAN will be global by default. If you open this window from the Policy VLAN Islands Configuration Wizard, the selection is grayed out, and the
VLAN will be local by default.
•
Local − Creates a local VLAN, which can be segmented into different VIDs for use with
•
Policy VLAN Islands.
Global − Creates a global VLAN, which will be written to all selected devices with the same
VID.
Create VLAN Window 611
NetSight Policy Manager Help
You can change a global VLAN to a local VLAN and vice versa, but if you switch from local to global, you will need to supply a VID for the global VLAN.
VLAN ID
Unique numerical identifier for the VLAN, also known as VID. Can be a value between 1 and 4094, with VID1 being reserved for the DEFAULT VLAN (a name for a particular VLAN, not to be confused with a default VLAN you assign to a role). To select the next VID in sequence, click Next
Available VID.
This VLAN is intended as a Discard VLAN only
If this VLAN is to be used to deny traffic, select this box. If it is to be used to contain traffic, leave the box unchecked.
Dynamic Egress Enabled
Dynamic Egress is enabled by default in Policy Manager. If you want to disable Dynamic Egress,
uncheck the box. If you select "This VLAN is intended as a Discard VLAN only" option, the
Dynamic Egress is automatically deselected. If for some reason you wish to have it enabled for a discard VLAN, you can reselect it.
Note: GVRP (GARP VLAN Registration Protocol) is automatically enabled the first time you enforce a Dynamic Egress VLAN in Policy Manager. If you do not want GVRP enabled on your network, you can disable it by selecting the Policy Manager Edit > GVRP Disabled menu option. If necessary, you can then manually configure the interswitch ports to do what GVRP does automatically, using
NetSight Element Manager or local management to set up set up your interswitch links as Q trunks.
The trunk ports will be automatically added to the egress lists of all the VLANs at the time of trunk configuration.
Note: If GVRP is already enabled on your network and you enforce, the GVRP status of ports on which you have disabled GVRP will not change.
Always write VLAN to device(s)
If the box is checked, the VLAN will be written to the device whether the VLAN is being used in a rule or role, or not. If it is not checked, the VLAN will not be written to the device unless it is being used in a rule or role. Enabling this option is a way of ensuring that the device is aware of a VLAN that is being used for something other than policy configuration, and it allows you to configure that
VLAN for Dynamic Egress.
Buttons
Next Available VID
Enters the next unassigned VID in the VLAN ID field.
Apply
Creates the VLAN and leaves the window open.
Create VLAN Window 612
Device Configuration Wizard
Add RADIUS Accounting Server Window
This window lets you add a RADIUS server to Policy Manager for the purpose of RADIUS accounting.
Access this window by clicking Add in the RADIUS Accounting Server(s) window in the Device
Configuration Wizard.
Click the graphic for more information.
IP Address
IP address of the RADIUS accounting server.
Client UDP Port
UDP port number (1−65535) the device (RADIUS client) uses to send accounting requests to the
RADIUS server; 1813 is the default port number.
Timeout Duration (2 −10 sec)
The amount of time in seconds the device will wait for the RADIUS server to respond to an accounting request. Valid values are 2−10 seconds.
Device Configuration Wizard Add RADIUS Accounting Server Window 613
NetSight Policy Manager Help
Number of Retries (0−20)
The number of times the device will resend an accounting request if the RADIUS server does not respond. Valid values are 0−20.
Server Shared Secret
A string of characters used to encrypt and decrypt communications between the RADIUS client
unable to communicate. The shared secret must be at least 6 characters long; 16 characters is recommended. Dashes are allowed in the string, but spaces are not.
NOTE:
If you are configuring multiple RADIUS servers, the same server shared secret must be used for each RADIUS server. This is because most Policy Manager devices (RADIUS clients) only support one shared secret. Matrix N−Series devices with firmware version
5.0 or above are an exception to this, as these devices do support a unique shared secret for each server.
NOTE:
This Server Shared Secret is not to be confused with the Application Shared
Secret that encrypts communication between the RADIUS client and Policy
Manager.
Verify Shared Secret
Re−enter the Server Shared Secret you entered above.
Buttons
OK
Saves the settings and returns you to the RADIUS Accounting Server(s) window in the Device
Configuration Wizard. The new RADIUS server is displayed in the table of servers.
Cancel (upper)
Returns you to the RADIUS Accounting Server(s) window in the Device Configuration Wizard without saving any settings.
Cancel (lower)
Exits you from the Device Configuration Wizard without saving any of the settings you've entered so far.
Device Configuration Wizard Add RADIUS Accounting Server Window 614
Device Configuration Wizard
Add RADIUS Authentication Server Window
This window lets you add a RADIUS server to Policy Manager for the purpose of authentication. Access this window by clicking Add in the RADIUS Authentication Server(s) window in the Device Configuration
Wizard.
Click the graphic for more information.
IP Address
IP address of the RADIUS authentication server.
Client UDP Port
UDP port number (1−65535) the device (RADIUS client) uses to send authentication requests to the
RADIUS authentication server; 1812 is the default port number.
Server Shared Secret
A string of characters used to encrypt and decrypt communications between the RADIUS client
Device Configuration Wizard Add RADIUS Authentication Server Window 615
NetSight Policy Manager Help unable to communicate, and authentication attempts will fail. The shared secret must be at least 6 characters long; 16 characters is recommended. Dashes are allowed in the string, but spaces are not.
NOTE:
If you are configuring multiple RADIUS servers, the same server shared secret must be used for each RADIUS server. This is because most Policy Manager devices (RADIUS clients) only support one shared secret. Matrix N−Series devices with firmware version
5.0 or above are an exception to this, as these devices do support a unique shared secret for each server.
NOTE:
This Server Shared Secret is not to be confused with the Application Shared
Secret that encrypts communication between the RADIUS client and Policy
Manager.
Verify Shared Secret
Re−enter the Server Shared Secret you entered above.
Access Type
Use the drop−down list to select the type of authentication access allowed for this RADIUS server:
•
Any access − the server can authenticate users originating from any access type.
•
Management access − the server can only authenticate users that have requested
• management access via the console, Telnet, SSH, or HTTP, etc.
Network access − the server can only authenticate users that are accessing the network via
802.1X, MAC, or Web−Based authentication.
This feature allows you to have one set of servers for authenticating management access requests and a different set for authenticating network access requests.
Buttons
OK
Saves the settings and returns you to the RADIUS Authentication Server(s) window in the Device
Configuration Wizard. The new RADIUS server is displayed in the table of servers.
Cancel (upper)
Returns you to the RADIUS Authentication Server(s) window in the Device Configuration Wizard without saving any settings.
Cancel (lower)
Exits you from the Device Configuration Wizard without saving any of the settings you've entered so far.
Device Configuration Wizard Add RADIUS Authentication Server Window 616
Add/Edit CEP Detection Rule Window
Use this window to add or edit CEP detection rules that are used to determine if a connecting end−system is a
CEP device, and what type of CEP device it is. This allows Policy Manager to assign the appropriate role to the port based on the type of CEP device detected. Access the window from the CEP Detection sub−tab in the
right−panel Device Authentication tab.
NOTE:
CEP detection rules apply only to Siemens, H.323, and SIP (Session Initiation Protocol) phone detection. Cisco detection uses CiscoDP as its detection method.
CEP detection rules are based on two detection methods:
•
TCP/UDP Port Number detection − Many CEP vendors use specific TCP/UDP port numbers for call setup on their IP phones. You can create detection rules that identify CEP devices based on specific
TCP/UDP port numbers. By default, Siemens Hi−Path phones will be detected on TCP/UDP port
•
4060.
IP Address detection − H.323 phones use a reserved IP multicast address and UDP port number for call setup. You can create detection rules that will detect an IP phone based on its IP address in combination with an IP address mask. By default, H.323 phones will be detected using the multicast address 224.0.1.41 and the TCP/UDP ports 1718, 1719, and 1720. SIP phones will be detected using the multicast address 224.0.1.75 and the TCP/UDP port 5060. H.323 and SIP phones will also be detected using only their respective multicast addresses without the TCP/UDP ports.
Click the graphic for more information.
CEP Detection Settings
Priority
Enter the rule priority with one (1) being the highest priority. The rule with the highest priority will be used first, so it is recommended that the highest priority be given to the predominate protocol in the network to provide for greater efficiency.
Address
If the rule is based on IP address detection, enter the IP address that incoming packets will be matched against. By default, H.323 will use 224.0.1.41 as its IP address, SIP will use 224.0.1.75 as its IP address, and Siemens will have no IP address configured.
Address Mask
Add/Edit CEP Detection Rule Window 617
NetSight Policy Manager Help
If the rule is based on IP address detection, enter the IP address mask that incoming packets will be matched against.
End Point Type
Select the endpoint type (H.323, Siemens, or SIP) that will be assigned if incoming packets match this rule.
Protocol
If the rule is based on TCP/UDP port detection, select the UDP and/or TCP checkbox and define a port range with Port Low and Port High values:
•
UDP and TCP − Match the port number for both UDP and TCP frames.
•
TCP − Match the port number only for TCP frames.
•
UDP − Match the port number only for UDP frames.
Port Low
Define the low end of the port range for detection on UDP and/or TCP ports.
Port High
Define the high end of the port range for detection on UDP and/or TCP ports.
Add/Edit CEP Detection Rule Window 618
Edit RADIUS Accounting Server Window
Use this window to change the parameters used for communication between a device and a RADIUS accounting server. To access this window, select a server in the RADIUS Server(s) Accounting sub−tab (in
the RADIUS tab for a device), and then click the Edit button.
Click the graphic for more information.
RADIUS Accounting Server IP
IP address of the RADIUS accounting server.
Accounting Client UDP Port
UDP port number (1−65535) the device (RADIUS client) uses to send accounting requests to the
RADIUS server; 1813 is the default port number. Devices that do not support RADIUS accounting will have this field grayed out (with the exception of an SNMPv1 R2 device, which will display accounting values but will not allow you to set them.)
Timeout Duration (2 −10 sec)
The amount of time in seconds the device will wait for the RADIUS server to respond to an accounting request. Valid values are 2−10 seconds. Devices that do not support RADIUS accounting will have this field grayed out (with the exception of an SNMPv1 R2 device, which will display accounting values but will not allow you to set them.)
Number of Retries (0−20)
The number of times the device will resend an accounting request if the RADIUS server does not respond. Valid values are 0−20. Devices that do not support RADIUS accounting will have this field grayed out (with the exception of an SNMPv1 R2 device, which will display accounting values but will not allow you to set them.)
Change Server Shared Secret
Check this box to change the string of characters used to encrypt and decrypt communications between the device (RADIUS client) and the RADIUS server. This shared secret is not to be confused
Edit RADIUS Accounting Server Window 619
NetSight Policy Manager Help with the RADIUS client/Policy Manager shared secret entered in the Application Shared Secret area
Server Shared Secret
communicate. The shared secret must be at least 6 characters long; 16 characters is recommended.
Dashes are allowed in the string, but spaces are not.
Verify Shared Secret
Re−enter the Server Shared Secret you entered above, to verify the change.
RADIUS Accounting Server Priority
Order in which the RADIUS accounting server will be checked, as compared to the other RADIUS accounting servers on the device. The lower the number, the higher the priority.
Edit RADIUS Accounting Server Window 620
Edit RADIUS Authentication Server Window
Use this window to change the parameters used for communication between a device and a RADIUS authentication server. To access this window, select a server in the RADIUS Server(s) Authentication sub−tab
(in the RADIUS tab for a device), and then click the Edit button.
Click the graphic for more information.
RADIUS Authentication Server IP
IP address of the RADIUS authentication server.
Authentication Client UDP Port
UDP port number (1−65535) the device (RADIUS client) uses to send authentication requests to the
RADIUS server; 1812 is the default port number.
Authentication Access Type
Use the drop−down list to select the type of authentication access allowed for this RADIUS server:
•
Any access − the server can authenticate users originating from any access type.
•
Management access − the server can only authenticate users that have requested
• management access via the console, Telnet, SSH, or HTTP, etc.
Network access − the server can only authenticate users that are accessing the network via
802.1X, MAC, or Web−Based authentication.
This feature allows you to have one set of servers for authenticating management access requests and a different set for authenticating network access requests. Devices that do not support this feature will have this field grayed out.
Change Server Shared Secret
Check this box to change the string of characters used to encrypt and decrypt communications between the device (RADIUS client) and the RADIUS server. This shared secret is not to be confused with the RADIUS client/Policy Manager shared secret entered in the Application Shared Secret area
Server Shared Secret
Edit RADIUS Authentication Server Window 621
NetSight Policy Manager Help
communicate, and authentication attempts will fail. The shared secret must be at least 6 characters long; 16 characters is recommended. Dashes are allowed in the string, but spaces are not..
Verify Shared Secret
Re−enter the Server Shared Secret you entered above, to verify the change.
RADIUS Authentication Server Priority
Order in which the RADIUS authentication server will be checked, as compared to the other RADIUS authentication servers on the device. The lower the number, the higher the priority.
Edit RADIUS Authentication Server Window 622
Edit Rate Limit Mappings Window
This window lets you configure the rate limit mappings for a role−based rate limit port group. Rate limit mappings map a logical rate limit index to an actual physical rate limit you have created in Policy Manager. In this window you can specify a rate limit for each of the selected port group's logical indexes.
Policy Manager supports a maximum of 32 logical rate limit indexes and each type of rate limit port group lets you map all 32 indexes. For 8−rate limit port groups, this means that the number of logical indexes is greater than the actual number of rate limits the ports support. These port groups will have 32 logical rate limit indexes (0−31), but they can only be mapped to a maximum of eight different physical rate limits. The
100−rate limit port groups will have only 32 logical rate limit indexes that can be mapped to 32 different physical rate limits, even though the ports support a maximum of 100 different physical rate limits.
To access this window, select a rate limit port group in the left−panel Classes of Service tab. Then, select the
Mappings tab in the right panel and click the Edit button.
Click the graphic for more information.
Specify Rate Limit
Use the drop−down list to select a rate limit to map to an index. Rate limits are listed by precedence
followed by the rate limit name. For information on how to create a rate limit, see Defining
Clear Rate Limit
Use this checkbox to clear a rate limit from a selected index. Select the checkbox, then select an Index and click Apply or OK.
Specify Rate Limit Indexes
Use the checkboxes to select the logical index(es) that you want to map to the selected rate limit. If the Clear Rate Limit checkbox is selected, rate limits mapped to the selected indexes will be cleared.
TIP:
Use the Apply button to map all your indexes without having to re−open the window.
Edit Rate Limit Mappings Window 623
NetSight Policy Manager Help
Edit Rate Limit Mappings Window 624
Edit Rule Window
The Edit Rule window allows you to change the traffic description associated with a rule. The Traffic
Description, which includes the traffic classification layer, traffic classification type, and traffic value, was
entered when the rule was created (see How to Create or Modify a Rule).
To display the Edit Rule window, select the rule in the left panel's Services tab and the Traffic Description tab in the right panel, then double−click the traffic description in the table. You can also single−click the traffic description and click Edit to bring up the Edit Rule window.
If you modify an enabled rule's traffic descriptions, Policy Manager checks for conflicts with other rules in the
services and roles with which the newly modified rule is associated. See Conflict Checking for more
information.
The contents of the Edit Rule window varies according to the selected rule and traffic description.
Click the graphic for more information.
Edit Rule Window 625
NetSight Policy Manager Help
Layer Area
Traffic Classification Layer
The OSI model classification layer (2, 3, or 4) currently associated with the rule. Each layer has multiple classification types from which you can select. If you change the layer, the Type and Value sections in the window change, and you must make new selections in those sections. See
Classification Types and their Parameters for information.
Type Area
Traffic Classification Type
The traffic classification type currently associated with the rule. Each classification type consists of certain parameters and/or values. If you change the type, the Value section of the window changes,
Edit Rule Window 626
NetSight Policy Manager Help
and you must make new selections in that section. See Classification Types and their Parameters for
information.
Value Area
This area displays the values currently selected for the traffic classification type, and allows you to change
Types and their Parameters for parameter information.
Buttons
OK
Saves any changes you made and closes the window.
Apply
Saves any changes you made and leaves the window open.
Edit Rule Window 627
Edit Slice Percentages Window
This window lets you configure the slice percentages for each transmit queue. These percentages are used when configuring the weighted fair queuing arbiter mode for a transmit queue port group. They determine the way that traffic in each queue will be serviced. (For more information on the arbiter mode, see the transmit
an Edit Slice Percentages window for a 4−queue port group.
To access this window, select a transmit queue port group in the left−panel Classes of Service tab, then select
click the Edit button in the Slice Configuration section.
Click the graphic for more information.
Port Group
The port group whose slice percentages are being configured. This is the transmit queue port group selected in the left−panel Classes of Service tab.
Slice Configuration
Select the slice percentage to assign to each transmit queue. Percentages must add up to 100%. Configuring
100% for the highest priority (highest numbered) queue sets the arbiter mode to Strict mode.
Edit Slice Percentages Window 628
Enforce Preview
Window
Use the Enforce Preview window to view the information that will be written to your devices, before you
policy management. For example, some devices support only the policy features of policy management; some devices support the policy features and classification rules, but do not support VLAN forwarding for certain classification rules; and some devices fully support all policy management features, including policy, classification rules, and VLAN forwarding for all classification rules.
The Enforce Preview window appears whenever you click the Enforce button, or select the File > Enforce
Role Set menu option, or double−click the enforce icon on the status bar, so that you always get a chance to review the effects of enforcing prior to actually performing the enforce. You can control whether or not this
view automatically appears with the Show this view on Enforce checkbox, or in Optional Views in the
Options window.
You can also access this window from the File > Enforce Preview menu option, and from the Enforce
Preview button on the confirmation message that appears when a verify has taken place.
What you see in the window depends on whether you would be enforcing to all devices or to a subset of devices. The title bar indicates the devices to which the enforce will apply. After viewing the information in this window, you can either click Cancel to back out and make fixes, or Enforce to go ahead with the enforce. (The Enforce button does not appear in this window when you use the File > Enforce Preview menu option to launch the window.)
Release Notes for complete information on device support for Policy Manager features, and VLAN and
Priority classification rules.
Click the graphic for more information.
Enforce Preview Window 629
NetSight Policy Manager Help
"Show" Radio Buttons
What you see in the right panel of the Enforce Preview window depends on which radio button you have selected at the top of the window.
All
Select this radio button to display what will and what will not be written to the devices when you enforce.
Errors and Warnings Only
Select this radio button to show only what will not be written to the devices when you enforce.
Left Panel
The left panel of the Enforce Preview window displays folders for different device types. Expand the folders to see your network devices and device groups organized according to device type. The icon alerts you that there are certain things that will not be written to this device type that you might want to investigate prior to enforcing (e.g. rules that are not supported on a device).
Select a specific device type to display the information that will be written to those devices when you enforce.
Show this view on Enforce
When this checkbox is checked, the Enforce Preview window will appear any time you enforce,
Enforce Preview Window 630
NetSight Policy Manager Help
before the actual enforcement takes place. You can also turn this option on and off via Optional
Right Panel
The upper portion of the right panel provides information about whether certain policy management features are supported and/or enabled for the device type selected in the left panel.
•
Additional Warnings − If there are additional problems detected with the enforce, you will be directed
• to see the Event Log for details.
GVRP − Shows whether GVRP is Enabled, Disabled, or Not Supported. You can enable or disable
•
GVRP via the Edit menu.
Dynamic Egress − Shows whether Dynamic Egress is Supported or Not Supported.
There are six tabs that provide specific information about the Roles, Classification Rules, VLANs, Classes of
Service, and Mappings that will be enforced. The information displayed depends on the device type you've
button selected. In addition, select a role in the Roles tab to filter the information for just that role.
Roles Tab
Incomplete − Lists any roles with unsupported classification rules. These roles will be written to the devices, but without the unsupported rules.
Complete − Lists any roles which do not include unsupported classification rules. These roles will be written to the devices as defined.
NOTE:
Select a Role to display only those classification rules and VLANs associated with the selected role.
Classification Rules Tab
Excluded − Lists any unsupported classification rules that have been applied to a role. These rules will not be included when the associated roles are written to the devices.
Included − Lists any supported classification rules that have been applied to a role. These rules will be included when the associated roles are written to the devices.
NOTE:
On Matrix N−Series Platinum devices, range classification rules are achieved through applying subnet masks to values. As such, in order to achieve a user−specified range, the device may need multiple rules with subnets applied to encompass that range. So, although the user created only one rule with a range, this list may show multiple instances of that rule with the name of the rule followed by the portion of the over−all range it applies to.
VLAN Tab
Excluded − Lists any VLANs associated with unsupported classification rules, or VLANs that are not supported by the device. These VLANs will not be written to the devices.
Included − Lists any VLANs associated with supported classification rules and VLANs associated with roles. These will be written to the devices.
Classes of Service Tab
Class of Service Mode − Lists the Class of Service mode that will be written to the devices.
Included Classes of Service − Lists the classes of service that will be written to the devices:
•
Class of Service − the name of the class of service.
Enforce Preview Window 631
NetSight Policy Manager Help
•
802.1p Priority − the priority associated with the class of service.
•
ToS Value − the IP type of service value associated with this class of service, if any. See IP
•
Type of Service for more information.
Transmit Queue Reference − the transmit queue index associated with the class of service.
•
IRL Reference − the role−based rate limit index associated with the class of service.
For more information, see Getting Started with Class of Service and How to Create a Class of
Mappings Tab
WARNING:
Enforcing port−level MAC to Role mappings could potentially remove rules created by NetSight Automated Security Manager (ASM) as an intrusion detection response.
MAC to Role Mapping − Lists the device−level and port−level mappings that will be written to the devices:
•
Device/Port Level − indicates whether the mapping is a device−level mapping (all devices) or a port−level mapping (IP address and port description). Port−level mappings on frozen ports
• will be enforced.
MAC Address − the MAC address mapped to the role. Masking a MAC address is only
• supported on Matrix N−Series Platinum devices.
Mask − the mask associated with the MAC address.
•
Role − the role mapped to the MAC address.
IP to Role Mapping − Lists the device−level mappings that will be written to the devices:
•
IP Address − the IP address mapped to the role.
•
Mask − the mask associated with each IP address. Masking an IP address is only supported on
•
Matrix N−Series Gold and Platinum devices.
Role − the role mapped to the IP address.
Tagged Packet VLAN to Role Mapping − Lists the device−level and port−level mappings that will be written to the devices:
•
Device/Port Level − indicates whether the mapping is a device−level mapping (all devices) or a port−level mapping (IP address and port description). Port−level mappings on frozen ports
• will be enforced.
VLAN − the VLAN mapped to the role.
•
Role − the role mapped to the VLAN.
Statistics Tab
Provides information about each role:
•
Number of Rules − The number of traffic classification rules the role includes.
•
Number of Unique Masks − The number of masks defined for the rules included in the role.
Buttons
Enforce
level of support available on the devices as indicated in the Enforce Preview window. This button does not appear in this window when you use the File > Enforce Preview menu option to launch the window.
Enforce Preview Window 632
Event Details Window
The Event Details window shows additional information about an event or trap selected in the Event View. It combines information about the event as defined in the trapd.conf
file and specific information about the source of the event. It is accessed by choosing Event Details from the right−click menu in the Event View.
Click areas in the window for more information.
Timestamp
Shows the date and time when an event, or trap occurred.
Acknowledged
Shows whether or not the selected event has been acknowledged.
Type
Identifies the type of information for this row (Event, or Trap).
Source
Shows the IP address of the host that was the source of the event or trap.
Event Name
Shows the type of event or trap. For traps, this field shows the name of the event as defined in the trapd.conf
file.
Event Details Window 633
NetSight Policy Manager Help
Client
Only applicable to Console events and shows the hostname of the source of the event.
Severity
Indicates the potential impact of the event or trap. For traps, this field shows the Severity as defined in the trapd.conf
file.
Category
For traps, this field shows the category defined in the trapd.conf
file. For other tabs, it indicates the source of the of the information, either a Console Poller, local log, syslog, trap log, Error (java exceptions), etc.
User
Associates an event with the user that performed the action that triggered the event.
Information
Shows a summary explanation of the event or trap.
Enterprise
Only applicable to traps and shows the Enterprise for this event (Cabletron, Enterasys, snmpTraps, rmonEventsV2, dot1dBridge)as defined in the trapd.conf
file.
Trap Number
Only applicable to traps and shows the Event OID for this event as defined in the trapd.conf
file.
Description
Only applicable to traps and shows the description for this event as defined in the trapd.conf
file.
Buttons
Acknowledge/Unacknowledge
Places a check or removes a check in the Acknowledge column for the selected row.
Event Details Window 634
Event Log
Access the Event Log by clicking the Events button in the Policy Manager toolbar. The Event Log displays error and informational messages about Policy Manager system operations.
Click the graphic for more information.
Acknowledge
This checkbox lets you acknowledge an event.
Severity
The event's severity.
Category
The category of event.
Timestamp
The date and time when the event occurred.
Source
The IP address of the host that was the source of the event.
Client
The name of the client host machine that triggered the event.
User
The name of the user that triggered the event.
Type
The type of information: Event.
Event
The type of event.
Information
Information about the event.
Event Log 635
NetSight Policy Manager Help
Right−click Menu Options
The event log right−click menu lets you Acknowledge and Unacknowledge events. It also provides options and a standard set of table tools to help you find, filter, sort, print, and export information in a table and customize table settings. You can access the menu options through a right−mouse click on a column heading or anywhere in the table body, or by clicking the Table Tools button in the upper left corner of the table (if you have the row count column displayed). For more information, see Table Tools.
Event Log 636
Filter Window
The Filter window lets you specify which entries to display in the right panel. When the information in the right panel is presented in a column format, you can perform a filter, and only those entries matching your filter criteria will be displayed. You can filter the entries in a single column or in all columns, and you can apply consecutive filters.
You can access the Filter window by selecting View > Filter. You can also right−click on a column header and select Filter.
NOTE:
Some Policy Manager tables use a set of Table Tools to find, filter, sort, print, and export information in a table. You can access these Table Tools by clicking the Table Tools
button in the upper left corner of the table. For more information, see Table Tools.
Click the graphic for more information.
Filter
Enter the numeric value or text you want to filter.
Case Sensitive
Select the Case Sensitive check box to filter based on the exact case of the text entered in the Filter field.
Match Whole Word
Select the Match Whole Word check box to filter based on the entire text or numeric value entered in the Filter field.
Column
Use the Column drop−down list to select the column you want to filter. Select All Columns to filter all entries.
Whole Table
Select the Whole Table option to filter all entries by the value in the Filter field. If you have already performed a filter, this will enable you to perform a new filter on all entries instead of just the filtered entries.
Filter Window 637
NetSight Policy Manager Help
Current Table
Select the Current Table option to perform a new filter on the results of the previous filter.
Buttons
Filter
Click Filter to perform the filter operation.
Show All
Click Show All to remove any filters and display all entries.
Clear
Click Clear to clear the information entered in the Filter field.
Close
Click Close to exit the Filter window.
Help
Click Help to display detailed information about the current window.
Filter Window 638
Find Window
The Find window lets you search the right panel for a specific text or value. When the information in the right panel is presented in a column format, you can perform a find, and the entry that matches the search criteria is highlighted in the right panel. You can search in a single column or in all columns. You can also search forward or backward from your current position, and restrict your search to match the exact case and/or whole word of the entry.
You can access the Find window by selecting Edit > Find. You can also right−click on a column header and select Find.
NOTE:
Some Policy Manager tables use a set of Table Tools to find, filter, sort, print, and export information in a table. You can access these Table Tools by clicking the Table Tools
button in the upper left corner of the table. For more information, see Table Tools.
Click the graphic for more information.
Find
Enter the value you are searching for.
Case Sensitive
Select the Case Sensitive check box to search based on the exact case of the text entered in the Find field.
Match Whole Word
Select the Match Whole Word check box to search based on the entire text or numeric value entered in the Find field.
Forward
Select Forward to search from your current position to the end of the table.
Backward
Select Backward to search from your current position to the beginning of the table.
Column
Use the Column drop−down list to select the column you want to search. Select All Columns to search all entries.
Find Window 639
NetSight Policy Manager Help
Buttons
Find
Click Find to search based on the value in the Find field and the parameters selected.
Clear
Click Clear to clear the information entered in the Find field.
Close
Click Close to exit the Find window.
Help
Click Help to view detailed information about the current window.
Find Window 640
Import from Domain Window
This window lets you import policy configuration data from one Policy Domain into another domain. To
access the Import from Domain window, select File > Import > Import From Domain. (This menu option is not available if only one domain exists, as there are no other domains from which to import data.)
Click the graphic for more information.
Domain
Use the drop−down list to select the domain whose data you want to import.
Data Elements to Import
In this section, you can choose the specific data elements you want to import. Click Select All to select all the data import options at once.
Roles
Select this option to import roles, including the role's name, description, default VLAN (access control), and default class of service. If a role's services already exist in the current domain, or if you are importing them at the same time as the role, the services will be associated with the role.
Otherwise, the services will not be imported.
VLANs
Select this option to import VLANs.
Policy VLAN Islands
If applicable, Policy VLAN Islands and Local VLANs are imported via the Devices and VLANs options.
•
If the Devices option is selected and the Policy VLAN Islands feature is enabled in the current domain as well as the imported domain, the Policy VLAN Islands will be imported.
Import from Domain Window 641
NetSight Policy Manager Help
The Policy VLAN Island Base ID and Offset settings from the imported data will be used and
• those in the current domain will be lost.
If the VLANs option is selected and the Policy VLAN Islands feature is enabled in the current domain as well as the imported domain, the Local VLANs are imported and are added to any existing Policy VLAN Islands.
Whenever Policy VLAN Islands are imported, all the island VLANs are recalculated and the island ranges may change. It is possible to import more islands and VLANs than can be configured. If this is the case, an error appears in the Event Log, asking that the Base ID and Offset settings be changed.
User−Defined Port Groups
Select this option to import user−defined port groups. If you are importing a port group's ports at the same time as the port group, the ports will be associated with the port group. Otherwise, the ports will not be imported.
Network Resources
Select this option to import network resource groups. After a Network Resource is imported, the associated services are updated. If a network resource group no longer exists after an import, the
Port−Level Role Mapping Status
Select this option to import the Port−Level Role Mappings Enabled status indicated in the Edit menu.
Service Groups
Select this option to import service group names. If a service group's services already exist in the current domain, or if you are importing them at the same time as the service group, the services will be associated with the group. Otherwise, the services will not be imported.
Device Groups
Select this option to import device group names. If you are importing a device group's devices at the same time as the device group, the devices will be associated with the device group. Otherwise, the devices will not be imported.
Services and Classification Rules
Select this option to import services and their associated classification rules. When you import rules
from another domain, Policy Manager checks for rule conflicts (see Conflict Checking for more
information).
Bandwidth Rate Limits
Select this option to import rate limits. For the purposes of importing, a rate limit is defined as [rate +
direction] when determining uniqueness. When you append or update rate limits and a duplicate rate
limit exists in the current domain, any unique priority and exclusion properties of the imported rate limit replace (if appending) or are added to (if updating) those of the first duplicate rate limit in the
include conflicting priority values, if a priority is already being utilized by an existing rate limit, it
actions affect the import of rate limits.
Note: Only those network elements that are recognized by the existing domain can be imported as exclusions. Others will be ignored.
Import from Domain Window 642
NetSight Policy Manager Help
Service Names
Select this option to import service names but not any associated classification rules.
Devices
Select this option to import devices. Because a device can exist in only one Policy Domain, imported devices are reassigned to the current domain and removed from the domain they were imported from.
If applicable, Policy VLAN Islands and Local VLANs are imported via the Devices and VLANs
options. For the behavior of Policy VLAN Islands during importing, see VLANs, above.
Class of Service
Select this option to import classes of service, role−based rate limit port groups, and transmit queue port groups. For the purposes of importing, a class of service is defined as the class of service name, i.e., priority is not a factor in determining uniqueness. After a class of service is imported, its associated roles, services, and rules are updated. When you import class of service data, the relationship between a class of service and its priority is retained; however, rate limiting
are imported first, then the classes of service are imported. You can then redefine the class of service priorities with some or all of the imported rate limits, if desired. Although ToS characteristics are not used to determine the uniqueness of a class of service for importing, if ToS is a part of a class of
information on how those specific actions affect the import of classes of service.
GVRP Status
Select this option to import the GVRP Disabled status indicated in the Edit menu.
Application of Imported Data Elements
In this section, you can choose how you want the data elements selected above to update your current domain.
Append domain data to existing elements
Select this option to import only new data elements into your current domain. If any of the selected data elements already exist in your current domain, they will not be changed.
Rate Limits: A rate limit will not be appended if: 1) The Rate, Direction, and 802.1P Priority are already defined. 2) The Priority list is empty.
CoS: A class of service will not be appended if: 1) The name is the same as an existing class of service. 2) The class of service names are different but the rate limits for the imported class of service do not match the existing rate limit settings.
Update existing data with elements from domain
Select this option to 1) replace the selected data elements that exist in your current domain with the imported data elements, and 2) import the selected data elements that don't exist in your current domain.
Rate Limits: A rate limit will not be updated if the rate limit and direction do not match.
CoS: A class of service will not be updated if: 1) The name does not match an existing class of service. 2) The class of service name matches but the rate limits for the imported class of service do not match the existing rate limit settings.
Import from Domain Window 643
NetSight Policy Manager Help
Overwrite existing elements
Select this option to replace the selected data elements that exist in your current domain with the imported data elements.
CoS: A class of service will not be overwritten if the rate limits for the imported class of service do not match the existing rate limit settings.
NOTE:
If you decide that you want to return to the previous configuration (that the import updated), you can perform a File > Read Policy Domain operation to restore the configuration, as long as you have not saved the data you imported.
Buttons
Select All
Selects all of the data elements.
OK
Imports the selected data and closes the window.
Apply
Imports the selected data and leaves the window open.
Import from Domain Window 644
Import from File Window
This window lets you import policy data from a .pmd file into a Policy Domain. To access the window, select
File > Import > Import From File.
Click the graphic for more information.
Data file
Enter the name and path for the data file (.pmd) you want to import, or navigate to the file.
Data Elements to Import
In this section, you can choose the specific data elements you want to import. Click Select All to select all the data import options at once.
Roles
Select this option to import roles, including the role's name, description, default VLAN (access control), and default class of service. If a role's services already exist in the current domain, or if you are importing them at the same time as the role, the services will be associated with the role.
Otherwise, the services will not be imported.
VLANs
Select this option to import VLANs.
Policy VLAN Islands
If applicable, Policy VLAN Islands and Local VLANs are imported via the Devices and VLANs options.
•
If the Devices option is selected and the Policy VLAN Islands feature is enabled in the current domain as well as the imported domain, the Policy VLAN Islands will be imported.
Import from File Window 645
NetSight Policy Manager Help
The Policy VLAN Island Base ID and Offset settings from the imported data will be used and
• those in the current domain will be lost.
If the VLANs option is selected and the Policy VLAN Islands feature is enabled in the current domain as well as the imported domain, the Local VLANs are imported and are added to any existing Policy VLAN Islands.
Whenever Policy VLAN Islands are imported, all the island VLANs are recalculated and the island ranges may change. It is possible to import more islands and VLANs than can be configured. If this is the case, an error appears in the Event Log, asking that the Base ID and Offset settings be changed.
User−Defined Port Groups
Select this option to import user−defined port groups. If you are importing a port group's ports at the same time as the port group, the ports will be associated with the port group. Otherwise, the ports will not be imported.
Network Resources
Select this option to import network resource groups. After a Network Resource is imported, the associated services are updated. If a network resource group no longer exists after an import, the
Port−Level Role Mapping Status
Select this option to import the Port−Level Role Mappings Enabled status indicated in the Edit menu.
Service Groups
Select this option to import service group names. If a service group's services already exist in the current domain, or if you are importing them at the same time as the service group, the services will be associated with the group. Otherwise, the services will not be imported.
Device Groups
Select this option to import device group names. If you are importing a device group's devices at the same time as the device group, the devices will be associated with the device group. Otherwise, the devices will not be imported.
Services and Classification Rules
Select this option to import services and their associated classification rules. When you import rules
from another domain, Policy Manager checks for rule conflicts (see Conflict Checking for more
information).
Bandwidth Rate Limits
Select this option to import rate limits. For the purposes of importing, a rate limit is defined as [rate +
direction] when determining uniqueness. When you append or update rate limits and a duplicate rate
limit exists in the current domain, any unique priority and exclusion properties of the imported rate limit replace (if appending) or are added to (if updating) those of the first duplicate rate limit in the
include conflicting priority values, if a priority is already being utilized by an existing rate limit, it
actions affect the import of rate limits.
Note: Only those network elements that are recognized by the existing domain can be imported as exclusions. Others will be ignored.
Import from File Window 646
NetSight Policy Manager Help
Service Names
Select this option to import service names but not any associated classification rules.
Devices
Select this option to import devices. Any devices in the .pmd file must already exist in the NetSight
database or they won't be imported. (See How to Add and Delete Devices for more information on
using Console to add devices to the NetSight database.) Devices that are imported are automatically assigned to the current domain and are displayed in the Policy Manager Network Elements tree. If the devices being imported were already assigned to another domain, then those devices are reassigned to the current domain. Any devices that are not imported are listed in an Event Log message along with their device type and firmware version.
Class of Service
Select this option to import classes of service, role−based rate limit port groups, and transmit queue port groups. For the purposes of importing, a class of service is defined as the class of service name, i.e., priority is not a factor in determining uniqueness. After a class of service is imported, its associated roles, services, and rules are updated. When you import class of service data, the relationship between a class of service and its priority is retained; however, rate limiting
are imported first, then the classes of service are imported. You can then redefine the class of service priorities with some or all of the imported rate limits, if desired. Although ToS characteristics are not used to determine the uniqueness of a class of service for importing, if ToS is a part of a class of
information on how those specific actions affect the import of classes of service.
GVRP Status
Select this option to import the GVRP Disabled status indicated in the Edit menu.
Application of Imported Data Elements
In this section, you can choose how you want the data elements selected above to update your current domain.
Append domain data to existing elements
Select this option to import only new data elements into your current domain. If any of the selected data elements already exist in your current domain, they will not be changed.
Rate Limits: A rate limit will not be appended if: 1) The Rate, Direction, and 802.1P Priority are already defined. 2) The Priority list is empty.
CoS: A class of service will not be appended if: 1) The name is the same as an existing class of service. 2) The class of service names are different but the rate limits for the imported class of service do not match the existing rate limit settings.
Update existing data with elements from domain
Select this option to 1) replace the selected data elements that exist in your current domain with the imported data elements, and 2) import the selected data elements that don't exist in your current domain.
Rate Limits: A rate limit will not be updated if the rate limit and direction do not match.
CoS: A class of service will not be updated if: 1) The name does not match an existing class of
Import from File Window 647
NetSight Policy Manager Help service. 2) The class of service name matches but the rate limits for the imported class of service do not match the existing rate limit settings.
Overwrite existing elements
Select this option to replace the selected data elements that exist in your current domain with the imported data elements.
CoS: A class of service will not be overwritten if the rate limits for the imported class of service do not match the existing rate limit settings.
NOTE:
If you decide that you want to return to the previous configuration (that the import updated), you can perform a File > Read Policy Domain operation to restore the configuration, as long as you have not saved the data you imported.
Buttons
Select All
Selects all of the data elements.
OK
Imports the selected data and closes the window.
Apply
Imports the selected data and leaves the window open.
Import from File Window 648
Main Window
The Policy Manager main window is the central point for all Policy Manager tasks. It is divided into a left panel and a right panel. The tabs in the left panel display hierarchical representations of the roles, services, network elements, port groups, VLANs, and classes of service involved in managing policies for your network. The tabbed pages in the right panel display detailed information about the item selected in the left panel.
The menu bar and the toolbar at the top of the window provide access to Policy Manager functions and let you perform policy−related tasks. The status bar at the bottom of the window displays error and status information.
Information on the Main window features:
•
•
•
•
•
•
•
Click the graphic for more information.
Main Window 649
NetSight Policy Manager Help
Dialog Boxes (Messages)
In the course of using Policy Manager, you will see message dialog boxes confirming that certain tasks have been completed, or warning you of the consequences of a certain action. Many of these dialog boxes give you the option of turning off subsequent displays of the message, and once you have become accustomed to using
Policy Manager you may want to take advantage of this option. You can also turn off the display of all
information message dialog boxes in the Dialog Boxes view accessible from the Tools > Options menu
option. In that view, you can also turn on the message dialog boxes that you have turned off on the individual dialog box(es).
Icons
The icons used in Policy Manager and their meanings are as follows:
Icon Definition
Pre−Defined Groups
Device/Wireless Device
Port
Role
Rule
Device−specific Rule
Automated Service
Network Resource Group
Contain VLAN
VLAN Island
CoS (Class of Service)
IP Type of Service Value
Rate Limit
Status Bar Icons
Icon Definition
User−Defined Groups
Port Group
Frozen Port
Quarantine Role
Disabled Rule
Service Group
Manual Service
Slot/Logical Ports/Ports
Deny VLAN
Warning
802.1p Priority
CoS Port Group
Transmit Queue
The following icons appear in the status bar:
Lock
Reminds you that the current Policy Domain is locked for editing purposes. You can lock and unlock the domain from the Lock tool bar button.
Save
Dialog Boxes (Messages) 650
NetSight Policy Manager Help
Reminds you that you've made changes, and that you need to save the Policy Manager data to the
Policy Domain. Double−clicking this icon initiates the save operation. Only users with the capability to Enforce will be able to save the domain.
Enforce
Reminds you that you've made changes to roles that you need to enforce. Double−clicking this icon initiates the enforce operation.
Event Log
This icon is displayed when a new Warning or Error message has been logged to the Event Log.
Double−click the icon to open the Event Log window.
Dialog Boxes (Messages) 651
Left Panel
The left panel of the Policy Manager main window contains tabs for Roles, Services, Network Elements, Port
Groups, VLANs, and Classes of Service. These tabs display hierarchical representations of the roles, services, service groups, devices, device groups, port groups, network resources, Policy VLAN Islands, VLANs, and classes of service in your network. What you select in the left panel determines what is displayed in the right panel.
startups. There is also an option to display the same tab you were using when you last closed Policy Manager.
Features of the left panel include:
•
Expanding and collapsing items in the hierarchy: Double−click the item or its icon, or single−click
• the turner to the left of the icon.
Right−click menus: Right−click a folder or other item in the left panel, and a menu of the options you
• can perform on your selection appears.
Drag and drop: Populate port groups, services, and service groups by using drag and drop in the left panel. You can also drag and drop multiple selections from right−panel Details View tab lists in the
Services tab.
Information on the left−panel tabs:
•
•
•
•
•
•
Roles Tab
The Roles tab is displayed in the left panel when you open Policy Manager, and lists the roles defined for the
policy−enabled network.
Click the tree items for more information.
Roles Folder
Left Panel 652
NetSight Policy Manager Help
This folder contains the roles defined for the current domain. See How to Create a Role for more
information.
Role
Individual roles are listed by name. Select a role in the left panel, and view information about that role
in the right−panel tabs. Only Quarantine roles are displayed with a red icon
.
Services Tab
rules that define how network traffic for a particular network service or application should be handled by a
network access device. The tab also displays your network resource groups.
Click the tree items for more information.
Service Groups Folder
Policy Manager lets you create categories into which you can group services. This folder contains the
service groups defined for the current domain. For more information, see How to Create a Service
Services Tab 653
NetSight Policy Manager Help
Service Group
Individual service groups are listed by name. Expand the service group to see the services in that group.
Services Folder
This folder contains the services defined for the current domain. For more information, see How to
Automated Services Folder
This folder contains your currently defined Automated services. For more information, see How to
Automated Service
Individual Automated services are listed under the Automated Services Folder or within a service group in the Service Groups folder.
Manual Services Folder
Manual Service
Individual Manual services are listed under the Manual Services Folder or within a service group in the Service Groups folder. Expand the service to see the rules associated with it.
Rule
Individual rules are listed by name. If the rule is disabled, the rule icon displays a red X . If the rule is device−specific, the rule icon displays a small switch .
Network Resources Folder
This folder contains any network resource groups you have created for the current domain. For more
information, see How to Create a Network Resource Group.
Network Resource Group
Individual network resource groups are listed by name. Select a group in the left panel, and view information about that group in the right−panel tabs.
Network Elements Tab
This tab displays the devices that are assigned to the current domain, organized into groups.
Click the tree items for more information.
Network Elements Tab 654
NetSight Policy Manager Help
My Network
My Network displays the system−created device groups and any user−created device groups (that you created through NetSight Console). Each device group name is followed by the total number of devices in that group and any subgroups, in parentheses.
All Devices Folder
This folder contains all the devices that are assigned to the current domain. For information on adding
devices to the domain, see How to Add and Delete Devices.
Grouped By Folder
The top−level Grouped By folder contains five system−created groups: Chassis, Contact, Device
Type, IP, and Location. When a device is assigned to a domain, it automatically becomes a member of the appropriate group. System−created groups are displayed with blue folders.
Chassis Folder
Contains subgroups for specific chassis in the domain.
Contact Folder
Contains subgroups of the devices in a domain based on the system contact. Sub−groups in this folder are automatically created based on the Contact value in the Console Properties (Device) tab. For example, a contact defined as NOC/Andover/Jones will automatically create a hierarchy of three sub−groups under the Grouped By > Contact folder. The Contact sub−groups are removed when the last device with a particular contact is deleted.
Device Type Folder
Contains subgroups for the specific product families and device types in the domain.
IP Folder
Contains subgroups based on the IP subnets in the domain.
Location Folder
Network Elements Tab 655
NetSight Policy Manager Help
Contains subgroups of the devices in a domain based on the system location. Sub−groups in this folder are automatically created based on the Location value in the Console Properties (Device) tab.
For example, a location defined as Andover/Building 3/Floor 1 will automatically create a hierarchy of three sub−groups under the Grouped By > Location folder. The Location sub−groups are removed when the last device for a particular location is deleted.
User−created Device Groups
You can add your own device groups and subgroups (displayed with yellow folders) using NetSight
Console.
Device
This icon represents an individual device that has been assigned to the current domain. It appears below the Devices folder and also below any device group of which it is a member.
Port Groups Tab
This tab displays the pre−defined and user−defined port groups for the current domain.
Click the tree items for more information.
Port Groups Folder
This folder contains the Pre−Defined and User−Defined Port Groups for the current domain. Policy
Manager allows ports to be combined into groups, similar to the way devices are combined into device groups. Port groups enable you to configure multiple ports on the same device or on different
devices simultaneously, or to retrieve port information from them. For more information, see How to
Pre−Defined Port Groups Folder
Policy Manager provides you with several commonly used port groups for your convenience. Expand
this folder to see the pre−defined port groups. For more information, see Pre−Defined Port Groups.
User−Defined Port Groups Folder
Port Groups Tab 656
NetSight Policy Manager Help
Policy Manager lets you create your own port groups. When you create a user−defined port group, you can either select individual ports to add to the group, or specify a range or ranges of ports from all
devices to be included in the group. See General Tab (User−Defined Port Group) for more
information.
Port Group
Select a port group in the left panel and view information about that group in the right−panel tabs.
VLANs Tab
This tab displays the Global VLANs for the current domain. If you have enabled Policy VLAN Islands, it also
displays your Local VLANs and Policy VLAN Islands.
Click the tree items for more information.
Global VLANs Folder
This folder contains your currently defined global VLANs for this domain.
VLAN
The VLAN icon indicates the access control for the VLAN−− if it is a Discard VLAN, the icon displays a red X . Otherwise, it is a Contain VLAN.
Local VLANs Folder
This folder appears only when the Policy VLAN Islands feature is enabled, and contains your
currently defined local VLANs for this domain.
Policy VLAN Islands Folder
This folder appears only when the Policy VLAN Islands feature is enabled, and contains your
currently defined VLAN islands. When you enable Policy VLAN Islands, this folder is pre−populated with a Default Island containing all the devices in the domain.
VLAN Island
Click on a VLAN island to see the devices associated with it listed in the right−panel Details View
tab. The Default Island is created by Policy Manager when you enable Policy VLAN Islands, and it cannot be deleted.
VLANs Tab 657
NetSight Policy Manager Help
Classes of Service Tab
This tab displays your Classes of Service defined for the current domain. Classes of Service prioritize traffic with an 802.1p priority, and optionally an IP type of service (ToS/DSCP) value, rate limits, and transmit queue configuration. You can then assign the class of service as a classification rule action, as part of the
Click the tree items for more information.
Classes of Service Folder
When you first install Policy Manager, the left−panel Classes of Service folder is pre−populated with eight classes of service, each associated with one of the 802.1p priorities (0−7). You can use these classes of service as is, or configure them to include ToS/DSCP, rate limit, and/or transmit queue values. You can also create your own classes of service. After you have created and defined your classes of service, they are then available when you make a class of service selection for a rule action
(Actions tab), a role default (General tab), or an automated service (General tab).
Class of Service
Classes of Service Tab 658
NetSight Policy Manager Help
Select a Class of Service in the left panel, and view information about that service in the right−panel
tabs. For more information, see How to Create a Class of Service.
CoS Components Folder
This folder contains subfolders of the possible components of a class of service (802.1p Priorities, IP
Type of Service Values, Rate Limits, Role−Based Rate Limit Port Groups, and Transmit Queue Port
Groups).
802.1p Priorities Folder
This folder contains the eight 802.1p priorities. Select a priority in the left panel, and view information about that priority in the right−panel tabs.
IP Type of Service Values Folder
This folder contains the currently defined IP type of service values. An IP type of service value appears in this folder when it has been selected for use by a class of service in the class of service
Rate Limits Folder
This folder contains the currently defined rate limits, listed in the order of precedence. For more
information, see How to Define Rate Limits.
Role−Based Rate Limit Port Groups
This folder contains subfolders that include the currently defined role−based inbound rate limit port groups. Select a port group in the left panel and view information about that group in the right−panel
tabs. For more information, see How to Create Role−Based Rate Limit Port Groups.
Transmit Queue Port Groups Folder
This folder contains subfolders that include the currently defined transmit queue port groups and the
transmit queues defined for each group. For more information, see How to Configure Transmit
Classes of Service Tab 659
Menus
The menu bar on the Main Window provides access to Policy Manager functions. Some sub−items on the menu are standard, and some depend on what left−panel item and right−panel tab you have selected. When you have something specific selected in the left or right panel (e.g., a device, service, VLAN), it may be more convenient to use the right−click menu for the selection, instead of the menu bar.
Click the graphic for more information.
File Menu
The File Menu provides file management options for Policy Manager.
File > Lock Policy Domain
Lets you lock the current Policy Domain for editing purposes. Policy Manager automatically locks the domain when you begin to edit the domain configuration. Other Policy Manager clients are notified that the domain is locked and they will not be able to save their own domain changes until the lock is
released. For more information, see Controlling Client Interactions with Locks. This menu option
serves the same function as the Lock button on the toolbar.
File > Save Policy Domain
Lets you save any changes you have made to the current Policy Domain. Only users with the capability to Enforce will be able to save the domain. This menu option serves the same function as the Save button on the toolbar.
File > Read Policy Domain
Lets you update the current Policy Domain with the latest saved domain data. This menu option serves the same function as the Read button on the toolbar.
File > Export to File
Lets you save policy data from the current Policy Domain to a .pmd file with the file name and location of your choosing. This file stores all information about roles, services, and rules configured in the current Policy Domain. This allows you to save a Domain configuration prior to making changes so that you can restore the original Domain configuration if required (via File > Import>
Import From File).
File > Import > Import From Domain
Opens the Import from Domain window where you can import policy configuration data from one
Policy Domain into another domain. (This menu option is not available if only one domain exists, as there are no other domains from which to import data.)
File > Import > Import From File
Enables you to import policy data from a .pmd file into the current Policy Domain. Be aware that the import overwrites any existing data in the Policy Domain. Any devices in the .pmd file must already exist in the Console database or they won't be imported.
Menus 660
NetSight Policy Manager Help
File > Import > Policy Configuration From Device
Enables you to import policy configurations (roles and rules) from a selected device or devices into your Policy Domain.
File > Enforce Role Set
Writes the role and/or any changes you have made to it (rules, services) to all the devices in your
on the toolbar. See Enforcing for more information.
File > Enforce Preview
Opens the Enforce Preview window, where you can view the effects of enforcing prior to the actual
enforcement.
File > Verify Role Set
Compares the roles in your current domain to the roles currently enforced on all the devices in the current domain. This is useful for ensuring that the roles in your domain have been enforced, or, if you use more than one domain, ensuring that the roles in the domain you are currently using matches what is on the devices. This menu option serves the same function as the Verify (Global) button on
the toolbar. See Verifying for more information.
File > Delete
Deletes the current selection in the left panel. This menu option serves the same function as the Delete button on the toolbar.
File > Print
Opens a platform−dependent print setup window for printing the contents of the currently displayed selection in the right panel in text format. This menu option serves the same function as the Print button on the toolbar.
File > Exit
Exits the Policy Manager application. If there is unsaved or unenforced data, you will be asked if you wish to update the database and/or enforce before exiting. This menu option serves the same function as the Exit button on the toolbar.
Edit Menu
The Edit Menu options change depending on what is currently displayed in the left and right panels.
Edit > Copy
Copies an item selected in the left panel or right panel. This menu option serves the same function as the Copy button on the toolbar.
Edit > Paste
Pastes what has been copied into the specified location. This menu option serves the same function as the Paste button on the toolbar.
Edit > Add
Adds or applies what has been copied to the currently selected item. This menu option serves the same function as the Add button on the toolbar.
Menus 661
NetSight Policy Manager Help
Edit > Find
Lets you search the currently displayed right panel tab for specified criteria.
Edit > Clear Disabled Ports (Rule Hits)
Clears any ports that have been disabled due to a "rule hit" and re−enables them. For more
information, see the Rule Usage tab.
Edit > Rename
Lets you edit the name of the currently selected item. Some of the elements that come pre−packaged with Policy Manager cannot be renamed (e.g., Pre−Defined Port Groups).
Edit > Add/Remove Ports
Lets you add and remove ports from the selected user−defined port group.
Edit > Add/Remove Services
Lets you add and remove services from the selected service group.
Edit > Pre−Defined Well−Known IDs
Opens the Pre−Defined Well−Known IDs window, where you can add to the pre−defined list of
well−known identifiers (IDs) used when creating Policy Manager rules.
Edit > GVRP Disabled
GVRP (GARP VLAN Registration Protocol) is automatically enabled the first time you enforce a
Dynamic Egress VLAN in Policy Manager. If you do not want GVRP enabled on your network,
select (check) this menu option and enforce. To allow GVRP to be enabled, deselect this option and
enforce.
Edit > Policy VLAN Islands Enabled
Check this box to enable Policy VLAN Islands for the current domain.
Edit > Port Level Role Mappings Enabled
Check this box to enable any port−level Tagged Packet VLAN to role mappings or port−level MAC to role mappings that have been configured and enforced for the current domain. If the box is not checked, all port−level mappings are ignored.
View Menu
Lets you make changes to the appearance of the Policy Manager main window and the information contained in the right panel. The View Menu options depend on what is currently selected in the left panel.
View > Tool Bar
Lets you hide or display the Tool Bar by selecting or deselecting the check box.
View > Status Bar
Lets you hide or display the Status Bar by selecting or deselecting the check box.
View > Sort
Opens the Sort window, which lets you sort the information in the right panel in ascending or
descending order by column. For instructions, see Sorting.
Menus 662
NetSight Policy Manager Help
View > Filter
Opens the Filter window, which allows you to select specific information to display in the right panel.
For instructions, see Filtering.
View > Refresh
Updates the contents of the right panel. This can be useful for rereading device information after downloading new firmware or for refreshing port authentication information. This menu option serves the same function as the Refresh button on the toolbar.
View > Policy Classification Rules
Opens the Policy Classification Rules window, where you can view all of the Policy Manager rules
that exist in the currently active domain, along with information about each rule.
View > Statistics
Opens the Statistics window, where you can view the number of roles, services, devices and VLANs
currently configured.
View > CoS Usage
Opens the Classes of Service Usage window, where you can view information about current class of
service usage on a port.
View > Event Log
Opens the Event Log window, where you can view error and informational messages about Policy
Manager system operation. This menu option serves the same function as the Event Log button on the toolbar.
Tools Menu
Lets you perform administrative tasks on roles, services, devices, and VLANs. The Tools Menu options vary depending on what is currently selected in the left panel or right panel.
Tools > Assign Devices to Domain
Opens the Assign Devices to Domain window where you can assign devices that are in the NetSight
database to the current Policy Domain.
Tools > Add/Remove Ports
Opens the Add/Remove Ports window, where you can add and remove ports to and from role−based
rate limit port groups and transmit queue port groups.
Tools > Create Role
Creates a "New Role" item in the left panel's Role tab, which you can then change to the desired role name. Use this function when you want to create a role without using the Role Wizard. For
instructions, see Using the Role Tabs.
Tools > Role Wizard
Starts the Role Wizard, a series of windows that leads you through all the steps required to create a
role. For instructions, see Creating a Role Using the Role Wizard.
Tools > Create Network Resources
Opens the Create Network Resource window where you can create a group of network resources to
Menus 663
NetSight Policy Manager Help
use with an Automated service. See How to Create a Network Resource Group for more information.
Tools > Network Resources Wizard
Starts the Network Resources Wizard, a series of windows that leads you through all the steps
required to create a Network Resource Group and associate it with an Automated service. See How to
Create a Network Resource Group for more information.
Tools > Properties
Opens the Port Properties window where you can view general information about the selected port,
and also view and change various port configuration settings.
Tools > Device Configuration Wizard
Starts the Device Configuration Wizard, a series of windows that lets you define an authentication configuration and a RADIUS configuration, then apply it to the devices of your choosing. For
instructions, see Using the Device Configuration Wizard.
Tools > Remove Device(s) from Group
Removes the device currently selected in the left−panel Network Elements tab from the user−defined device group.
Tools > Create Policy VLAN Island
Expands the Policy VLAN Islands folder in the left−panel VLANs tab, and creates a "New Island"
item, which you can then change to the desired VLAN island name. At the same time, the right panel displays the Details View for the new VLAN island. While you can use this option to create an
VLAN island, it is recommended you use the Policy VLAN Islands Configuration Wizard to lead you
through the creation and configuration of VLAN islands.
Tools > Policy VLAN Islands Configuration Wizard
Starts the Policy VLAN Islands Configuration Wizard, a series of windows that helps you create and
configure Policy VLAN Islands, as well as select the devices that will comprise each island.
Tools > Create Service
Creates a "New Service" item in the left panel's Services tab, which you can then change to the desired service name. Use this option if you want to create a service without using the Service
Wizard. For instructions, see Using the Service Tabs.
Tools > Save Service(s) As
Enables you to save the selected service(s) to a Policy Manager data (
.pmd
) file. Special characters such as / \ : ? " < > | are not allowed in the file name. The service name is not case−sensitive; therefore, Policy Manager sees X.pmd and x.pmd as the same service name.
Tools > Remove Service(s) from Group
Removes the services currently selected in the left−panel Services tab from the service group.
Tools > Service Wizard
Starts the Service Wizard, a series of windows that leads you through all the steps required to create a
service. For instructions, see Using the Service Wizard.
Tools > Enable Rule(s)
This menu option enables a single−selected rule, multi−selected rules in the right panel, or all the rules for a selected service (Manual services only).
Menus 664
NetSight Policy Manager Help
Tools > Disable Rule(s)
This menu option disables a single−selected rule, multi−selected rules in the right panel, or all the rules for a selected service (Manual services only).
Tools > Create Classification Rule
Creates a "New Rule" item in the left panel's Services tab, which you can then change to the desired rule name. Use this option if you want to create a traffic classification rule without using the Rule
Wizard. For instructions, see Using the Rule Tabs.
Tools > Classification Rule Wizard
Starts the Rule Wizard, a series of windows that leads you through all the steps required to create a
new traffic classification rule. For instructions, see Using the Rule Wizard.
Tools > Create Service Group
Expands the Service Groups folder in the left panel's Services tab, and creates a "New Service Group"
item, which you can then change to the desired service group name. For instructions, see Creating a
Tools > Port Configuration Wizard
Starts the Port Configuration Wizard, a series of windows that leads you through all the steps required to configure a port, including setting the authentication status, login settings, and default role. For
instructions, see Using the Port Configuration Wizard.
Tools > Create Port Group
Expands the User−Defined Port Groups folder in the left panel's Port Groups tab, and creates a "New
Port Group" item, which you can then change to the desired port group name. For instructions, see
Tools > Create VLAN
Opens the Create VLAN window. For instructions, see How to Create a VLAN.
Tools > Reload VLAN
Rereads the VLAN settings on your devices and refreshes the list of VLANs in the left−panel VLANs tab.
Tools > Create Class of Service
Opens the Create Class of Service window, where you can define a new class of service. See How to
Create a Class of Service for more information.
Tools > Set Default Role
Opens the Roles Selection View, where you can assign a default role to a selected device or device
Tools > Remove Port(s) from Group
Removes the port currently selected in the left−panel Port Groups tab from the user−defined port group.
Tools > Set Frozen
Tools > Clear Frozen
Menus 665
NetSight Policy Manager Help
Unfreezes all the ports on the selected device. See How to Freeze/Unfreeze a Port for more
information.
Tools > Set/Clear Frozen
Depending on the current state of the port(s), freezes or unfreezes the selected port(s). See How to
Freeze/Unfreeze a Port for more information.
Tools > Terminate Session(s)
Terminates the user's session on the selected port(s). If multiple ports are selected, only authenticated sessions whose Terminate Cause is "Not Applicable" are affected. You cannot terminate sessions on
frozen ports. See Terminating a Session for more information.
Tools > Quarantine Role Wizard
Starts the Quarantine Role Wizard that leads you through all the steps required to create a Quarantine
role. For instructions, see Using the Quarantine Role Wizard.
Tools > Options
Opens the Options window where you can set suite−wide options and Policy Manager options.
Tools > Authorization/Device Access
Opens the Authorization/Device Access window where you can define users and groups and
configure their access to features available in NetSight applications.
Tools > Server Information
Opens the Server Information window where you can view and configure certain NetSight Server
functions, including management of client connections, locks, and licenses.
Domain Menu
Lets you create, rename, and delete Policy Domains, and assign devices to the current domain. The bottom part of the menu displays all of your domains and lets you switch between multiple domains.
Domain > Assign Devices to Domain
Opens the Assign Devices to Domain window where you can assign devices that are in the NetSight
database to the current Policy Domain.
Domain > Create Domain
Lets you create and name a new (blank) Policy Domain.
Domain > Rename Domain
Lets you rename the current Policy Domain.
Domain > Delete Domain(s)
Opens a window where you can select one or more Policy Domains to delete.
Domain > Show All Rules for All Domains
Opens the Policy Classification Rules window, where you can view all of the Policy Manager rules
that exist in all your domains, along with information about each rule.
Menus 666
NetSight Policy Manager Help
Applications Menu
Lets you launch other installed Enterasys NetSight and Enterasys Sentinel plugin applications from Policy
Manager. You can also customize the Applications menu to launch your own applications. For more
information, see How to Add Applications to the Applications Menu.
Help Menu
Lets you access the components of the Policy Manager online information system.
Help > Topics
Opens the Policy Manager Help system.
Help > Release Notes
Displays the NetSight Policy Manager Release Notes for the current release.
Help > About This Window
Displays detailed information about the currently selected right−panel tab or window. This menu option serves the same function as the Help button on the toolbar.
Help > Support Center
Opens the Enterasys Networks Support website. (A browser is required to view the website and
Solaris users must add the browser's path to their PATH environment variable.)
Help > Check for Updates
Allows you to update Policy Manager with the latest version of release notes, new data templates to
update the demo.pmd file, and additions to the pre−defined list of well−known identifiers (IDs). For
more information, see Setting Web Update Options.
Help > Getting Started
Displays the Getting Started help topic that provides an overview of Policy Manager features and functionality. It also includes a summary of the basic steps you must perform to create and configure policies with Policy Manager.
Help > About NetSight Policy Manager
Displays the NetSight Policy Manager version and copyright information.
Applications Menu 667
Right Panel
The right panel of the Policy Manager main window displays tabs containing information about the item selected in the left panel.
For some of the items you select in the Policy Manager left panel, the default display in the right panel is a
section of the Policy Manager Help Contents panel.
The illustration below shows an example of the Details View tab when you have a service selected in the left panel Services tab.
Right Panel 668
Status Bar
The status bar at the bottom of the window displays useful information regarding the status of Policy Manager operations. On the left side, the status bar displays the name of the domain that you are currently working in.
On the right side, a progress bar shows the percentage of completion for certain lengthy operations. In addition, status bar icons serve as reminders of tasks that need to be performed.
Click the graphic for more information.
Lock Icon
Reminds you that the current Policy Domain is locked for editing purposes. You can lock and unlock the domain from the Lock tool bar button.
Save Icon
Reminds you that you've made changes, and that you need to save the Policy Manager data to the
Policy Domain. Double−clicking this icon initiates the save operation. Only users with the capability to Enforce will be able to save the domain.
Enforce Icon
An Enforce icon is displayed when you have made changes that require you to write the information to your devices. Double−click the icon to perform the enforce operation. For more information, see
Event Log Icon
An Event Log icon is displayed when a new Warning or Error message has been logged to the Event
Log. Double−click the icon to open the Event Log window.
Status Bar 669
Toolbar
The toolbar on the main window provides easy access to some of the more commonly used Policy Manager functions. Some toolbar buttons may not be available, depending on your current location within the Policy
Manager application.
You can detach the toolbar from the main window by clicking it and dragging it off the window. To re−attach the toolbar, close the detached toolbar.
Click the graphic for more information.
Exit
Closes the Policy Manager application. If there is unsaved or unenforced data, you will be asked if you wish to save domain data and/or enforce before closing. This button serves the same function as the File > Exit menu option.
Lock/Unlock
Lock or unlock the current Policy Domain for editing purposes. Policy Manager automatically locks the domain when you begin to edit the domain configuration. Other Policy Manager clients are notified that the domain is locked and they will not be able to save their own domain changes until the
lock is released. For more information, see Controlling Client Interactions with Locks. This button
serves the same function as the File > Lock/Unlock Policy Domain menu option.
Save
Saves any changes you have made to the current Policy Domain. Only users with the capability to
Enforce will be able to save the domain. This button serves the same function as the File > Save
Policy Domain menu option.
Read
Updates the current Policy Domain with the latest saved domain data. This button serves the same function as the File > Read Policy Domain menu option.
Enforce (Global)
Writes the role and/or any changes you have made to it (rules, services) to all the devices in your
current domain. You have a chance to review the effects of enforcing in the Enforce Preview window,
if it is enabled. This button serves the same function as the File > Enforce Role Set menu option. See
Enforcing for more information.
Verify (Global)
Compares the roles in your current domain to the roles currently enforced on all the devices in the current domain. This is useful for ensuring that the roles in the domain have been enforced, or that the roles in the domain match what is on the devices. This button serves the same function as the File >
Verify Role Set menu option. See Verifying for more information.
Delete
Deletes the current selection in the left panel. This button serves the same function as the File >
Toolbar 670
NetSight Policy Manager Help
Delete menu option.
Prints the contents of the currently displayed right panel. This button serves the same function as the
File > Print menu option.
Copy
Copies an item selected in the left panel or right panel. The button may or may not be available, depending on where you are in the application This button serves the same function as the
Edit > Copy menu option.
Paste
Pastes what has been copied into the specified location. The button may or may not be available, depending on where you are in the application. This button serves the same function as the
Edit > Paste menu option.
Add
Adds or applies what has been copied to the currently selected node. The button may or may not be available, depending on where you are in the application. This button serves the same function as the
Edit > Add menu option.
Refresh
Updates the contents of the right panel. This can be useful for rereading device information or for refreshing port authentication information. This button serves the same function as the
View > Refresh menu option.
Event Log
Opens the Event Log window, where you can view and filter Policy Manager events. This button serves the same function as the View > Event Log menu option.
Authorization/Device Access
Opens the Authorization/Device Access window where you can define users and groups and
configure their access to features available in NetSight applications. This button serves the same function as the Tools > Authorization/Device Access menu option.
Server Information
Opens the Server Information window where you can view and configure certain NetSight Server
functions, including management of client connections, locks, and licenses. This button serves the same function as the Tools > Server Information menu option.
Help
Displays detailed information about the currently selected right−panel tab or window. This button serves the same function as the Help > About This Window menu option.
Toolbar 671
Options Window
The Options window allows you to set options for NetSight functions on a suite−wide and per−application basis. The Options window has a right−panel view that changes depending on what you have selected in the left−panel tree. Each view allows you to set different options. You can access the Options window using
Tools > Options in the menu bar.
Information on the following options:
•
Suite Options
•
Client/Server SNMP Redirection
•
Data Display
•
Date/Time Format
•
Device Display Name
•
Event Logs
•
Services for NetSight Server
•
SMTP Email Server
•
Status Polling
•
Web Update
•
•
•
•
•
•
•
Options Window 672
Options Window
Policy Manager Options
These options apply only to the Policy Manager application. In the Options window (Tools > Options), the right−panel view changes depending on what you have selected in the left−panel tree. Expand the Policy
Manager folder to view all the different options you can set.
Information on the following Options views:
•
•
•
•
•
•
Ports
Selecting Ports in the left panel of the Options window (Tools > Options) provides the following view where you can set or clear the Hide Logical Ports feature. The feature is set by default when you first launch Policy
Manager. This setting applies only to the logged−in user on this client.
The Hide Logical Ports feature lets you hide the display of logical ports in Policy Manager. Logical ports include SmartTrunk ports and LEC (LAN emulation client) ports, which can be seen in Policy Manager even if they are not yet configured or connected. If there are too many of these logical ports, they can cause unwanted clutter in your Policy Manager port list displays.
Click the graphic for more information.
Options WindowPolicy Manager Options 673
NetSight Policy Manager Help
Hide Logical Ports
Select this checkbox to exclude (hide) the display of logical ports in Policy Manager.
Optional Views
Selecting Optional Views in the left panel of the Options window (Tools > Options) provides the following view where you can choose whether or not you want certain views to be displayed. These settings apply only to the logged−in user on this client.
Click the graphic for more information.
Optional Views 674
NetSight Policy Manager Help
Getting Started
Select this checkbox if you want the Getting Started Help topic to open whenever you start Policy
Manager.
Enforce Preview
When this checkbox is checked, the Enforce Preview window will appear any time you enforce,
before the actual enforcement takes place. You can also turn this option on and off on the Enforce
Preview window itself.
Dialog Boxes
Selecting Dialog Boxes in the left panel of the Options window (Tools > Options) provides the following view where you can turn off non−critical informational message dialog boxes that display in the course of using Policy Manager. It also enables you to turn on the message dialog boxes that you have turned off on individual dialog box(es). These settings apply only to the logged−in user on this client.
Click the graphic for more information.
Dialog Boxes 675
NetSight Policy Manager Help
Informational Dialog Boxes
Select the option to show or hide all non−critical message dialog boxes displayed in the course of using Policy Manager. Warning messages that are considered crucial to the successful operation of
Policy Manager are not affected by this action and will continue to be shown.
Ignored Dialog Boxes
Click the Re−Show All button to turn on the display of messages that have been turned off in individual message dialog box(es).
Startup
Selecting Startup in the left panel of the Options window (Tools > Options) provides the following view where you can configure the features that run on startup. When you launch Policy Manager, it automatically performs certain actions, including reading the VLANs from all reachable devices and verifying that the roles on the devices match those in the current Policy Manager domain. However, when you have many VLANs and roles, these procedures can take some time. If it is not required that Policy Manager and the devices be synchronized each time you launch Policy Manager, you can turn off these actions in the Startup view. This lets Policy Manager launch more quickly. These settings apply only to the logged−in user on this client.
Click the graphic for more information.
Startup 676
NetSight Policy Manager Help
Verify On Startup/Database Read/Import
Deselect this option to stop Policy Manager from performing the verify operation at the time it is launched, or when you perform a database read or import.
Get VLANs On Startup
Deselect this option to stop Policy Manager from the reading the VLANs from the devices at the time it is launched.
Launch in Tab
Selecting Launch in Tab in the left panel of the Options window (Tools > Options) provides the following view where you can specify which left−panel tab is displayed when you launch Policy Manager. By default, the Roles tab is displayed the first time you start Policy Manager; this option lets you select which tab will be displayed in subsequent startups. These settings apply only to the logged−in user on this client.
Click the graphic for more information.
Launch in Tab 677
NetSight Policy Manager Help
Select Tab
Select the left−panel tab you would like displayed when you launch Policy Manager: Roles Tab,
Services Tab, Network Elements Tab, Port Groups Tab, VLANs Tab, or Classes of Service Tab.
Remember Tab During Close
Select this checkbox if you would like to display the same tab you were using when you last closed
Policy Manager.
SNMP Options
Selecting SNMP Options in the left panel of the Options window (Tools > Options) provides the following view where you can specify SNMP polling parameters for the Policy Manager server and client. These settings apply to all users on all clients.
Click the graphic for more information.
SNMP Options 678
NetSight Policy Manager Help
Server SNMP
Specify SNMP polling parameters for the Policy Manager server. These settings apply to all users on all clients.
•
SNMP Retries − The number of times the server will attempt to contact a device after the first attempt fails. The default setting is 3 retries, which means that the server retries a timed−out
• request three times, making a total of four attempts to contact a device.
SNMP Timeout − The amount of time (in seconds) that the server waits before re−trying to contact a device.
Client SNMP
Specify SNMP polling parameters for the Policy Manager client. These settings apply to the logged−in user on this client.
•
SNMP Retries − The number of times the client will attempt to contact a device after the first attempt fails. The default setting is 3 retries, which means that the client retries a timed−out
• request three times, making a total of four attempts to contact a device.
SNMP Timeout − The amount of time (in seconds) that the client waits before re−trying to contact a device.
Buttons
Apply
Sets any changes made in the current options view and leaves the window open.
Restore Defaults
Restores the default option values to the fields in the currently selected Options view.
OK
SNMP Options 679
NetSight Policy Manager Help
Sets any changes made in the current options view and closes the window.
Cancel
Cancels any changes you have made in the current options view and closes the window.
SNMP Options 680
Policy Classification Rules Window
The Policy Classification Rules window provides a way to view all of the Policy Manager rules that exist in either the currently active domain or all domains, and displays information about each rule. Access this window by selecting one of the following options from the menu bar.
•
View > Policy Classification Rules − to view all the rules that exist in the currently active domain
•
Domain > Show All Rules for All Domains − to view all the rules that exist in all your domains
Information on the following Policy Classification Rules views:
•
•
Rules for the Current Domain
This window lets you view all the Policy Manager rules that exist in the currently active domain. To access the window, select View > Policy Classification Rules from the menu bar. Clicking on a column heading sorts the column. Use the buttons at the bottom of the window to export or print the table.
Click the graphic for more information.
Name of Rule
The name assigned to the rule. If a rule has been applied to a specific device type (see Rule Type),
that device type will precede the rule name, in brackets.
Rule Status
The status of the rule: Enabled or Disabled. If a rule is disabled, it is unavailable for use by the service
Policy Classification Rules Window 681
NetSight Policy Manager Help with which it is associated, but can still be copied to other services and enabled. Disabling a rule is an alternative to deleting and recreating it. The rule icon in the left panel displays a red X if the rule
is disabled. For more information, see Disabling/Enabling a Rule.
Rule Type
The rule type selected when the rule was created. Rule type specifies the type of device to which the rule is applied when enforced, or all devices. If the rule is device−specific, the rule icon displays a small switch
. See Rule Type for more information.
Traf Desc Type
The traffic description (classification type) defined for the rule. The traffic description identifies the
type of traffic to which the rule will pertain. See Classification Types and their Parameters for a
description of classification layers and types.
Traf Desc Value
Each traffic description (classification type) requires certain parameters and/or values. See
Classification Types and their Parameters for parameter information.
Traf Desc Mask
The mask for the rule's classification type, if applicable.
Access Control
The access control (VLAN assignment) defined for the rule. The rule's access control specifies whether to:
•
Permit Traffic − traffic will be forwarded with the port's assigned VID
•
Deny Traffic − traffic will be denied altogether
•
Contain to VLAN − traffic is contained to a specified VLAN
For more information, see Access Control.
CoS
The class of service associated with the rule. A class of service includes an 802.1p priority, and optionally an IP type of service (ToS/DSCP) value, rate limits, and transmit queue configuration. See
Getting Started with Class of Service and How to Create a Class of Service for more information.
Sys Log
Indicates whether a syslog message is generated when the rule is used, as set in the Actions tab for
the rule.
Trap
rule.
Disable Port
rule.
Service Name
Lists any services the rule belongs to.
Policy Classification Rules Window 682
NetSight Policy Manager Help
Service Group
Lists any service groups the rule belongs to.
In Role
Lists any roles the rule belongs to.
Rules for All Domains
This window lets you view all the rules that exist in all your domains. To access the window, select Domain >
Show All Rules for All Domains from the menu bar. Clicking on a column heading sorts the column. Use the buttons at the bottom of the window to export or print the table.
Click the graphic for more information.
Domain
The name of the domain the rule exists in.
In Role
Lists any roles the rule belongs to.
Name of Rule
The name assigned to the rule. If a rule has been applied to a specific device type (see Rule Type),
that device type will precede the rule name, in brackets.
Rule Status
The status of the rule: Enabled or Disabled. If a rule is disabled, it is unavailable for use by the service with which it is associated, but can still be copied to other services and enabled. Disabling a rule is an
Rules for All Domains 683
NetSight Policy Manager Help alternative to deleting and recreating it. The rule icon displays a red X if the rule is disabled. For
more information, see Disabling/Enabling a Rule.
Rule Type
The rule type selected when the rule was created. Rule type specifies the type of device to which the rule is applied when enforced, or all devices. If the rule is device−specific, the rule icon displays a small switch
. See Rule Type for more information.
Traf Desc Type
The traffic description (classification type) defined for the rule. The traffic description identifies the
type of traffic to which the rule will pertain. See Classification Types and their Parameters for a
description of classification layers and types.
Traf Desc Value
Each traffic description (classification type) requires certain parameters and/or values. See
Classification Types and their Parameters for parameter information.
Traf Desc Mask
The mask for the rule's classification type, if applicable.
Access Control
The access control (VLAN assignment) defined for the rule. The rule's access control specifies whether to:
•
Permit Traffic − traffic will be forwarded with the port's assigned VID
•
Deny Traffic − traffic will be denied altogether
•
Contain to VLAN − traffic is contained to a specified VLAN
For more information, see Access Control.
CoS
The class of service associated with the rule. A class of service includes an 802.1p priority, and optionally an IP type of service (ToS/DSCP) value, rate limits, and transmit queue configuration. See
Getting Started with Class of Service and How to Create a Class of Service for more information.
Sys Log
Indicates whether a syslog message is generated when the rule is used, as set in the Actions tab for
the rule.
Audit Trap
rule.
Disable Port
rule.
Service Name
Lists any services the rule belongs to.
Service Group
Rules for All Domains 684
NetSight Policy Manager Help
Lists any service groups the rule belongs to.
Buttons
Event Log
Export Table
Exports the information in this window to an HTML file. Clicking Export Table opens a Save as Web
Page window where you can name your exported file, and navigate to a folder/directory where you want to place the file.
Update View
Updates the information in the window.
Prints the information in the window.
Rules for All Domains 685
Port Properties
General Tab
The Port Properties General tab provides general information about the selected port, and also lets you view and change various port configuration settings.
There are two ways to access the General tab:
•
Select a device in the left−panel Network Elements tab and expand a slot or ports grouping in the right−panel Details view. Right−click on a port and select Properties from the menu. In the Port
•
Properties window, select the General tab (in the top row of tabs).
Select a port in the left−panel Port Groups tab, then select the General tab in the right panel.
The General tab has four sub−tabs:
•
•
•
•
•
Disabled Traffic Classification Types Tab
General Tab
This tab displays general information about the port and indicates whether it is a frozen port or if TCI
Overwrite is enabled on the port.
Click the graphic for more information.
Port Properties General Tab 686
NetSight Policy Manager Help
General
Name
Name of the port, constructed of the name or IP address of the device and either the port index number or the port interface name.
Index
The index value assigned to the port interface.
Interface Name
A description of the port.
Port Type
Type of port. Possible values include: Access, CDP, CDP FTM 1 Backplane, FTM 1 Backplane, and
Logical.
Port Speed
Speed of the port. Possible values include: 10/100, speed in megabits per second (for example, 800.0
Mbps), Unknown (displayed for logical ports).
Frozen (Prevents Port Modifications)
Enables you to freeze (check) the port or clear (uncheck) the frozen status on the port. Freezing a port
"locks" it so that no one can accidentally reconfigure sensitive attributes such as port authentication or
default role settings, or terminate sessions that are authenticated on the port. See How to
Freeze/Unfreeze a Port for more information.
TCI Overwrite
Enable or disable TCI Overwrite functionality for the port. (This option will be grayed out if the device on which the port is located does not support TCI Overwrite.) Enabling TCI Overwrite causes the VLAN or class of service tag in a received packet to be overwritten by the VLAN (access control) and class of service characteristics defined in the port's current or default role. If there is no role assigned to the port, the port uses any static classification rules which exist. If there are no static rules, the port uses the PVID and default class of service for the port. TCI Overwrite is required for Tagged
Packet VLAN to Role Mapping, and can be enabled either here on a per−port basis, or for an
individual role in the role's General tab.
Role Status Tab
This tab displays the default and current role on the port, and lets you select a new default role. The default role is the role assigned to the port if no other role has been authenticated on it. The current role is the role currently active on the port (either the default role or the currently logged−in and authenticated user's role). If the port was not assigned a role when the end user logged in (authenticated), or if authentication is disabled on a port, then the port's default role will take effect. If you set a default role for the port, it is recommended that
you enable the Drop VLAN Tagged Frames feature.
Click the graphic for more information.
General 687
NetSight Policy Manager Help
Role Status
Default Role
See Default Role in the Concepts topic for information on default roles. Click the Select button to
change the default role. For additional information, see Port Mode.
Current Role
Displays the role currently active on the port. This current role is either the role assigned to the port when an end user logs in (authenticates), or it is the default role on the port. For ports on devices that
each end user login (authentication) session on the port.
Select Button
Click Select to select a new default role for the port. This opens the Selection View (Roles) where
you can select an existing role or click New to launch the Role Wizard and create a new role. Select
the Clear the current default role option to set the default role back to <None>.
Mappings Tab
This tab allows you to create port−level MAC to Role mappings and Tagged Packet VLAN to Role mappings.
A mapping does not have to exist at the device level to be created at the port level, and port−level mappings
order to take effect.
NOTES:
−− You must have the Port Level Role Mappings feature enabled in Policy Manager for the mappings to take effect. (From the menu bar, select the Edit > Port Level Role
Mappings checkbox.) If the feature is not enabled, the mappings will be ignored and any mappings listed here will be grayed out.
−− Port−level mappings cannot be added or removed to or from frozen ports . You
Role Status 688
NetSight Policy Manager Help must clear the frozen state on a port in order to add or remove a mapping. Once you have created a mapping, you can freeze the port. The port−level mappings of the frozen port will still be enforced and verified.
WARNING:
Enforcing port−level MAC to Role mappings could potentially remove rules created by
NetSight Automated Security Manager (ASM) as an intrusion detection response.
Click the graphic for more information.
MAC to Role Mapping
MAC to Role mapping provides a way to assign a role to an end station based on its source MAC address. In this section, you can create a list of MAC addresses and map each of them to a specific role. If the listed mappings are grayed out, it means that the Port Level Role Mappings feature is not enabled (Edit > Port Level
Role Mappings).
MAC Address
The MAC addresses that are mapped to a role. Click Add to add a mapping to the list.
Mask
The mask associated with each MAC address. Masking a MAC address is only supported on Matrix
N−Series Platinum devices. Using a mask provides an easy way to select end stations based on a portion of their MAC address. For example, you could select one MAC address, then use a mask based on the manufacturers ID portion of the MAC address to specify all your Siemens IP Phones.
MAC to Role Mapping 689
NetSight Policy Manager Help
Role
The role that is mapped to a MAC address. Click Add to add a mapping to the list.
Add Button
Opens the Add MAC Address window, where you can select a MAC address and mask, and map it to a role.
Remove Button
Select a MAC address and click Remove to remove the MAC address from the mapping list.
Tagged Packet VLAN to Role Mapping
Tagged Packet VLAN to Role Mapping provides a way to assign a role to network traffic, based on a VLAN
ID. In this section, you can create a list of VLANs and map each of them to a specific role. If the listed mappings are grayed out, it means that the Port Level Role Mappings feature is not enabled (Edit > Port Level
Role Mappings). For more information, see VLAN to Role Mapping in the Concepts Help topic.
NOTE:
When configuring Tagged Packet VLAN to role mapping, you must also enable the TCI
Overwrite attribute. TCI Overwrite allows the VLAN or class of service tag in a
received packet to be overwritten by the VLAN (access control) and class of service characteristics defined in the mapped role. You can enable TCI Overwrite on a per−port
basis in the Port Properties General tab, or for an individual role in the role's General
VLAN
The VLANs (VLAN ID and name) that are mapped to a role. Click Add to add a mapping to the list.
Role
The role that is mapped to a VLAN. Click Add to add a mapping to the list.
Add Button
Opens the VLAN to Role Mapping Selection View, where you can select a VLAN and map it to a role.
Remove Button
Select a VLAN and click Remove to remove the VLAN from the mapping list.
Drop VLAN Tagged Frames Tab
This tab lets you enable or disable the Drop VLAN Tagged Frames feature on this port. When the Drop
VLAN Tagged Frames feature is enabled, any packet already tagged with a VLAN coming into the port will be dropped. This provides extra security in that it prevents users from, for example, coming in with a card capable of VLAN tagging and attempting to access the network. In most cases, you would enable this feature on user ports because you don't want users to be tagging their own traffic, and you would disable it on interswitch link ports, where you want tagged packets to be accepted.
It is recommended that you enable the Drop VLAN Tagged Frames feature when you set a default role on a port or when you enable authentication on a port, because these things indicate that the port is a user port that should not be transmitting tagged packets. You can enable Drop VLAN Tagged Frames for a single port here,
Tagged Packet VLAN to Role Mapping 690
NetSight Policy Manager Help
VLAN Tagged Frames, this tab is grayed out.
WARNING:
Enabling this feature on a CDP or Backplane port is likely to result in loss of contact with devices connected through the port.
Disabled Traffic Classification Types Tab
Use this tab to specify rule types that will be disabled on the port. You can disable specific classification rule types on an individual port as a way to disable policy−assignment rules used in VLAN to Role Mapping, IP to
Role Mapping, MAC to Role Mapping, and Role Override. For example, you can disable the VLAN ID traffic classification type to disable Tagged Packet VLAN to Role Mapping on the port. You can also disable all traffic classification types, which effectively turns off policy on the port.
Click the graphic for more information.
Disabled Traffic Classification Types Tab 691
NetSight Policy Manager Help
Disabled Traffic Classification Types
Use the Add or Add All button to create a list of rule types that will be disabled on the port.
Add Button
want to disable on the port and add it to the list.
Add All Button
Adds all traffic classification types to the list. This would disable all traffic classification on the port, and the role's default class of service and/or default access control would take effect.
Remove Button
Removes the selected traffic classification type from the list.
Apply Button
Applies the list of disabled traffic classification types to the port.
Disabled Traffic Classification Types 692
Port Properties
Authentication Configuration Tab
settings for a port. Authentication must be configured and enabled on the device in order for individual port authentication settings to take effect. Only those areas of the tab that relate to the authentication type configured on the device are available for editing.
There are two ways to access the Authentication Configuration tab:
•
Select a device in the left−panel Network Elements tab and expand a slot or ports grouping in the right−panel Details view. Right−click on a port and select Properties from the menu. In the Port
•
Properties window, select the Authentication Configuration tab (in the top row of tabs).
Select a port in the left−panel Port Groups tab, then select the Authentication Configuration tab in the right panel.
The Authentication Configuration tab has six sub−tabs:
•
•
RFC3580 VLAN Authorization Tab
•
•
Automatic Re−Authentication Tab
•
•
General Tab
This tab displays general authentication and port mode information about the port.
Click the graphic for more information.
Port PropertiesAuthentication Configuration Tab 693
NetSight Policy Manager Help
Device Authentication Type(s)
Authentication type(s) configured on the device (802.1X, Web−Based, MAC, or None). Some devices
support multiple authentication types and multiple users (Multi−User authentication) per port, while others are restricted to only one or two authentication types and single users per port (Single User authentication). If the value is None, all types of authentication are disabled at the device level, and port authentication settings cannot be configured and will not take effect.
Device Authentication Status
Indicates whether or not the authentication type(s) configured on the device are enabled or not. If multiple authentication types are configured on the device, this status applies to all authentication types. If Authentication Status is disabled at the device level, port authentication settings will not take effect.
Port Mode
This area displays the current port mode for the port, and allows you to change the settings if desired. Port mode defines whether or not a user is required to authenticate on a port, and how unauthenticated traffic will be handled. It is a combination of Authentication Behavior (whether or not authentication is enabled on the port), and Unauthenticated Behavior (whether unauthenticated traffic will be assigned to the port's default role
or discarded). See Port Mode for a complete description of each port mode.
In addition, this section provides checkboxes that allow you to disable a specific authentication type at the port level.
Authentication Behavior
Select an option to specify whether or not authentication is enabled on the port. (See Port Mode for
more information.) If you set the port's Authentication Behavior to Active (i.e., you enable
authentication for the port), it is recommended that you enable the Drop VLAN Tagged Frames
feature.
Port Mode 694
NetSight Policy Manager Help
NOTE:
On Matrix N−Series devices, Authentication Behavior must be set to Active for authentication to be allowed using CEP Protocols.
Unauthenticated Behavior
NOTE:
For Single User 802.1X and 802.1X+MAC authentication types:
−− Active/Default Role mode requires that a default role be set on the port.
−− Active/Discard mode requires that any default role set on the port is cleared.
For Multi−User Web−based authentication:
−− Active/Discard mode is not supported.
Disable 802.1X Authentication for this port
Select this checkbox to disable 802.1X authentication at the port level. If the device is only configured with 802.1X authentication, selecting this checkbox will result in the port Authentication Behavior being set to Inactive.
NOTE:
For Single User 802.1X+MAC authentication with Active/Default Role as the selected port mode: Disabling 802.1X authentication also disables MAC authentication on the port. An end user connecting to the port will not be able to authenticate via 802.1X or
MAC. The port will behave as if Inactive/Default Role is the selected port mode.
Disable Web−Based Authentication for this port
Select this checkbox to disable web−based authentication at the port level. If the device is only configured with web−based authentication, selecting this checkbox will result in the port
Authentication Behavior being set to Inactive.
NOTE:
For Multi−User Web−Based authentication with Active/Discard as the selected port mode: This checkbox is automatically selected because multi−user web−based authentication does not support the Active/Discard port mode.
Disable MAC Authentication for this port
Select this checkbox to disable MAC authentication at the port level. If the device is only configured with MAC authentication, selecting this checkbox will result in the port Authentication Behavior being set to Inactive.
Disable CEP protocols in the CEP Access tab
Use the CEP Access tab to disable CEP protocols at the port level.
Apply Button
Applies any Port Mode changes to the port.
RFC3580 VLAN Authorization Tab
This tab lets you enable or disable RFC 3580 VLAN Authorization on the port and specify an egress state.
RFC 3580 VLAN Authorization must be enabled in networks where the RADIUS server has been configured to return a VLAN ID when a user authenticates. When RFC 3580 VLAN Authorization is enabled:
• ports on devices that do not support policy, will tag packets with the VLAN ID.
•
ports on devices that do support policy and also support Authentication−Based VLAN to Role
Mapping, will classify packets according to the role that the VLAN ID maps to.
RFC3580 VLAN Authorization Tab 695
NetSight Policy Manager Help
If the device does not support RFC 3580, this tab will be grayed out.
Click the graphic for more information.
RFC3580 VLAN Authorization
VLAN Authorization Status
Allows you to enable and disable RFC 3580 VLAN Authorization for the selected port. This option is grayed out if not supported by the device.
VLAN Authorization Admin Egress
Allows you to modify the VLAN egress list for the VLAN ID returned by the RADIUS server when a user authenticates on the port:
•
None − No modification to the VLAN egress list will be made.
•
Tagged − The port will be added to the list with the egress state set to Tagged (frames will be
• forwarded as tagged).
Untagged − The port will be added to the list with the egress state set to Untagged (frames
• will be forwarded as untagged).
Dynamic − The port will use information returned in the RADIUS response to modify the
VLAN egress list. This value is supported only if the device supports a mechanism through which the egress state may be returned in the RADIUS response.
The current egress settings for the port are displayed in the VLAN Oper Egress column in the End
User Sessions table on the Port Usage tabs. These options are grayed out if not supported by the device.
Apply Button
Saves any change you made to the VLAN Authorization settings.
RFC3580 VLAN Authorization 696
NetSight Policy Manager Help
Login Settings Tab
This tab displays the current login settings for the port and allows you to change the settings if desired. The options available depend on what type(s) of authentication are enabled on the device.
Click the graphic for more information.
Login Settings
Number of Attempts Before Timeout
Number of times a user can attempt to log in before authentication fails and login attempts are not allowed. For web−based authentication, valid values are 1−2147483647, zero is not allowed, and the default is 2. For 802.1X and MAC authentication, this value is permanently set to 1.
Hold Time (seconds)
Amount of time (in seconds) authentication will remain timed out after the specified Number of
Attempts Before Timeout has been reached. Valid values are 0−65535. The default is 60. (Hold Time is also known as Quiet Period in web−based and MAC authentication.)
Authentication Request Period
For 802.1X authentication, how often (in seconds) the device queries the port to see if there is a new user on it. If a user is found, the device then attempts to authenticate the user. Valid values are
1−65535. The default is 30.
User Timeout
For 802.1X authentication, the amount of time (in seconds) the device waits for an answer when querying the port for the existence of a user. Valid values are 1−300. The default is 30.
Authentication Server Timeout
Login Settings Tab 697
NetSight Policy Manager Help
For 802.1X authentication, if a user is found on the port, the amount of time (in seconds) the device waits for a response from the authentication server before timing out. Valid values are 1−300. The default is 30.
Port Handshake Requests Before Failure
For 802.1X authentication, the number of times the device tries to finalize the authentication process with the user, before the authentication request is considered invalid and authentication fails. Valid values are 1−10. The default is 2.
Apply Button
Applies the Login Settings changes to the port.
Automatic Re−Authentication Tab
This tab is grayed−out if only web−based authentication is enabled on the device. For 802.1X and MAC authentication, the Automatic Re−Authentication tab lets you set up the periodic automatic re−authentication of logged−in users on this port. Without disrupting the user's session, the device repeats the authentication process using the most recently obtained user login information, to see if the same user is still logged in.
Authenticated logged−in users are not required to log in again for re−authentication, as this occurs "behind the scenes."
Click the graphic for more information.
Automatic Re−Authentication
Re−Authentication Status
If Active is selected, the re−authentication feature is enabled. If Inactive is selected, the re−authentication feature is disabled.
Automatic Re−Authentication Tab 698
NetSight Policy Manager Help
Re−Authentication Frequency
How often (in seconds) the device checks the port to re−authenticate the logged in user. Valid values are 1−2147483647. The default is 3600.
Apply Button
Applies the Automatic Re−Authentication changes to the port.
Authenticated User Counts Tab
This tab provides authenticated user count information for devices with Multi−User as their configured
type.
Click the graphic for more information.
Authenticated User Counts
Current Number of Users
The current number of users that are actively authenticated or have authentications in progress on this interface. If multi−user authentication is disabled, this number will be 0 (zero). Any unauthenticated traffic on the port is not included in this count.
Number of Users Allowed (up to n)
Displays the number of users (up to the maximum number allowed) that can be actively authenticated or have authentications in progress at one time on this interface, and allows you to change the number if desired. If you set this value below the current number of users, end user sessions exceeding that number will be terminated.
NOTE:
SecureStack B2/C2 Devices. If you are configuring a single user and an IP phone per port, set this value to 2.
Authenticated User Counts Tab 699
NetSight Policy Manager Help
Number of MAC Users Allowed (up to n)
Displays the number of users (up to the maximum number allowed) that can be actively authenticated via MAC authentication, or have MAC authentications in progress at one time on this interface, and allows you to change the number if desired. The number of MAC users allowed cannot exceed the number of users allowed. If you set this value below the current number of users, end user sessions exceeding that number will be terminated. If MAC is not selected as a Multi−User authentication type
on the device Authentication tab, this field will be grayed out.
Apply Button
Applies User Counts changes to the port.
CEP Access Tab
This tab lists all the CEP (Convergence End Point) protocols supported by the device that the port resides on, and lets you enable or disable them for that port. For devices that do not support CEP, the tab will be blank.
NOTE:
On Matrix N−Series devices, Port Mode Authentication Behavior must be set to Active
(on the General sub−tab) for authentication to be allowed using these CEP Protocols.
protocols on the port, you must also configure CEP for the device the port resides on. You can configure CEP
Click the graphic for more information.
CEP Access
Lists all the CEP protocols supported by the device that the port resides on. Use the checkboxes to enable or disable CEP protocols on this port. If the device does not support the CEP feature, this area
CEP Access Tab 700
NetSight Policy Manager Help is blank.
Enable All Button
Selects all the checkboxes and enables all the CEP protocols for this port.
Disable All Button
Deselects all the checkboxes and disables all the CEP protocols for this port.
Apply Button
Applies CEP access changes to the port.
CEP Access Tab 701
Port Properties
Port Usage Tab
role−based rate limit violations, and CEP (Convergence End Point) connections on a port.
There are two ways to access the Port Usage tab:
•
Select a device in the left−panel Network Elements tab and expand a slot or ports grouping in the right−panel Details view. Right−click on a port and select Properties from the menu. In the Port
•
Properties window, select the Port Usage tab (in the top row of tabs).
Select a port in the left−panel Port Groups tab, then select the Port Usage tab in the right panel.
The Port Usage tab provides four sub−tabs:
•
•
•
Role−Based Rate Limit Violations Tab
•
End User Sessions Tab
This table displays information about login sessions for the port, including the current values being collected for a session still in progress, or the final values for the last valid session when there is no session currently active. You must click Retrieve to display the port information in the table.
By default the Show Only Active Sessions checkbox is checked, and only your active sessions are displayed.
Deselect the checkbox to display all entries. Active sessions that are being applied to traffic are listed in blue text. Active sessions that are not being applied are listed in green text. Some devices support multiple authentication sessions simultaneously per interface. This allows a single user to authenticate via 802.1X,
Web−Based, and MAC all at the same time. However, only one authentication type per interface can be
applied at a single time. The multi−user authentication type precedence (configured on the device
Authentication tab) determines which type will be applied. The applied session is the one that provides the role and traffic classification information. The remaining non−applied sessions will only be used if the currently applied session is terminated. For example, if a user authenticates on a port that has multi−user authentication enabled (802.1X, Web−Based, and MAC,) the active/applied session will be displayed in blue text and the other two sessions will be in green text. Another example would be if the user authenticates using the MAC authentication type but MAC authentication is disabled on the port, the session would be listed in green text. For devices that do not support multi−authentication, by definition the active session is also applied.
NOTE:
Matrix N−Series devices configured for multi−user authentication always list only active sessions even if the Show Only Active Session checkbox is deselected.
Session entries are collected up to the maximum allowed. When the maximum is reached, the oldest session entries are replaced with newer ones. The exception to this is the RoamAbout R2, where older session data is not kept.
Port PropertiesPort Usage Tab 702
NetSight Policy Manager Help
For devices that support one authenticated user per port, only one user/current role per port will show up in the table. For devices that support multiple authenticated users per port (such as the RoamAbout R2 and the
Matrix N−Series devices), all users authenticated on the port will be listed in the table, along with the roles under which they are authenticated.
Click the graphic for more information.
End User Sessions
Device
The IP address or name of the device where the port is located.
Interface Name
A description of the port.
Index
The index value assigned to the port interface.
Current Role
The role under which the user authenticated on the port. If a session displays "Invalid Role" in this
column, check the Invalid Role Action setting on the device Role/Rule tab to see the action that was
configured in the event a user is assigned an unknown or invalid role. If the user authenticated via
RFC 3580 VLAN Authorization, this column will display the role the VLAN is mapped to
(configured through Authentication−based VLAN to Role Mapping). If VLAN to Role mapping has not been configured, the port's Default role will be displayed (if there is one); otherwise, the column will display "N/A."
Policy PVID Override Status
Indicates whether default access control (a default VLAN) has been enabled for the current role.
Default access control allows you to permit traffic to be forwarded, deny traffic altogether, or contain
traffic to a VLAN. (See the Role General Tab for more information on default access control.) The
default VLAN overrides the 802.1Q PVID for the port.
End User Sessions 703
NetSight Policy Manager Help
Policy PVID Override
If default access control (a default VLAN) has been enabled for the current role and configured to contain traffic to a VLAN, this column displays the associated VLAN ID. The VLAN will be applied to all untagged frames arriving on the port that do not match any VLAN traffic classification rules, and overrides the 802.1Q PVID for the port. A value of 0 indicates that the default access control is configured to drop all frames that do not match a classification rule (Deny Traffic). A value of 4095 indicates that the default access control is configured to forward any frames that do not match a classification rule (Permit) using the 802.1Q PVID.
RFC3580 VLAN ID
If the user authenticated via RFC 3580 VLAN Authorization, this is the VLAN ID that was returned
from the RADIUS server. A VLAN ID value of 0 indicates that no VLAN was assigned. If VLAN authentication is not supported on the device, this column will display "N/A."
RFC3580 VLAN Oper Egress
The modification that will be made to the VLAN egress list for the VLAN ID returned by the
RADIUS server, if the user authenticated via RFC 3580 VLAN Authorization.
•
None − No modification to the VLAN egress list will be made.
•
Tagged − The port will be added to the list with the egress state set to Tagged (frames will be
• forwarded as tagged).
Untagged − The port will be added to the list with the egress state set to Untagged (frames
• will be forwarded as untagged).
Dynamic − The port will use information returned in the RADIUS response to modify the
VLAN egress list.
If VLAN authentication is not supported on the device, this column will display "N/A." Use the Port
Properties Authentication Configuration tab to change these settings, if desired.
Type
The authentication type of this login session: Web−Based, 802.1X, MAC, or Role Override (Matrix
N−Series Platinum devices only). If Role Override is displayed, it signifies that a rule has been applied to the port, overriding the user's current role with a different role. An example of this would be if the Automated Security Manager has detected a threat on the port, and used a MAC address rule to apply the Quarantine role to the end user.
•
Role Override (MAC) signifies that a MAC address rule has been applied to the port,
• overriding the Default role or any authenticated role assigned to the end user.
Role Override (IP) signifies that an IP address rule has been applied to the port, overriding the Default role or any authenticated role assigned to an end user authenticated with Single
User 802.1X. An IP Address rule will not override the authenticated role for any authentication type other than Single User 802.1X.
IP Address
The IP address of the remote user of this login session.
MAC Address
The MAC address of the remote user of this login session.
Authentication Status
On Matrix N−Series Platinum devices, the authentication status of the login session. All other devices will display "N/A." Possible values are:
•
Authentication Successful
•
Authentication Failed
End User Sessions 704
NetSight Policy Manager Help
•
Authentication in Progress
•
Authentication Server Timeout
•
Authentication Terminated
Terminate Cause
The reason the login session terminated. For web−based authentication, the possible values are:
•
Administratively Terminated
•
Authorization Revoked
•
Link Down
•
Not Applicable
•
Port Disabled
•
Unknown Termination Cause
•
User Logged Out
For 802.1X authentication, the possible values are:
•
Authorization Revoked
•
Client Restarted
•
Link Down (or Lost Carrier)
•
Not Applicable
•
Port Disabled
•
Port Reinitialized
•
Reauthentication Failed
•
Unknown Termination Cause
•
User Logged Out
Session ID
A unique identifier for the session. For devices that support multiple authenticated users per port, each
User Name
The user name provided by the end user at login (authentication).
Received Bytes
The number of bytes received in user data frames on this port during this session. Matrix N−Series devices must be created using SNMPv3 in order to see this value. N−Series devices using SNMPv1 will display "N/A."
Transmitted Bytes
The number of bytes transmitted in user data frames on this port during this session. Matrix N−Series devices must be created using SNMPv3 in order to see this value. N−Series devices using SNMPv1 will display "N/A."
Received Frames
The number of user data frames received on this port during this session.
Transmitted Frames
The number of user data frames transmitted on this port during this session.
Start Time
The time and date when the login session started.
End User Sessions 705
NetSight Policy Manager Help
Duration
The duration of the user's login session, in the format
D + HH:MM:SS
.
Retrieve Button
Displays the latest information for the port.
Terminate Button
Select an active session and click Terminate to end the session. If multiple sessions are selected, only
active sessions will be terminated. You cannot terminate a session on a frozen port and you cannot
terminate Role Override (IP) or Role Override (MAC) sessions that were created through the CLI
(command line interface).
Lock MAC Address Button
Enables MAC Locking on the selected port(s) (static MAC locking). MAC locking must be enabled
on the device in order for it to be enabled on a port.
Show Only Active Sessions Checkbox
Select this checkbox to display only active sessions (listed in blue text) in the table.
End User Session Settings Tab
This tab displays the current authentication state and login statistics for the port. Because this section displays information for a single end user login session, these fields are grayed out for Matrix N−Series devices that support multiple authenticated users per port.
Click the graphic for more information.
End User Session Settings
Authentication State
End User Session Settings Tab 706
NetSight Policy Manager Help
Current state of the port with regard to authentication. If "None," authentication is not enabled on the device.
For web−based authentication:
•
Disconnected − There is no end user currently logged in on the port.
•
Authenticating − An end user is in the process of logging in and being authenticated.
•
Authenticated − An end user is currently logged in and authenticated.
•
Held − The port is locked and authentication attempts are not allowed. Occurs when, for example, an end user tries to log in several times with an incorrect password.
For 802.1X authentication:
•
Initialize − The port is initializing. One reason for this is that the device has been reset.
•
Disconnected − There is no end user currently logged in on the port.
•
Connecting − The port is establishing communication with an end user.
•
Authenticating − An end user is in the process of logging in and being authenticated.
•
Authenticated − An end user is currently logged in and authenticated.
•
Aborting − The authentication procedure is being prematurely terminated due to, for
• example, a re−authentication request or an authentication timeout.
Held − The port is locked and authentication attempts are not allowed. Occurs when, for
• example, an end user tries to log in several times with an incorrect password.
Default Role − An end user has connected and is using the port's default role. Occurs when
•
the port mode is set to Inactive/Default (see Port Mode for more information).
No Authentication − No end user can be authenticated because the port mode is set to
Inactive/Discard (see Port Mode for more information).
NOTE:
RoamAbout R2 devices always show "Authenticating" as their Authentication State.
Because R2 devices can have multiple users authenticated to the same port,
"Authenticating" simply denotes that the port is currently open for users to authenticate.
Authentication Server State (802.1X)
For ports using 802.1X authentication, the current status of the authentication server, or the activity in which it is currently engaged.
•
Request − A request for authentication has been received by the authentication server.
•
Response − The authentication server is in the process of responding to an authentication
• request.
Success − Authentication of the end user has succeeded.
•
Fail − Authentication of the end user has failed.
•
Timeout − The authentication attempt has timed out.
•
Idle − The authentication server is ready to accept authentication requests, but no requests are
• currently being processed.
Initialize − The authentication server is initializing. One reason for this is because the machine on which the server is located has been reset.
Port Protocol Version (802.1X)
For ports using 802.1X authentication, the protocol version number of the EAPOL (Extensible
Authentication Protocol Over LANs) implementation supported by the port.
Failed Login Attempts (total) (Web−Based)
For ports using web−based authentication, the total number of failed login attempts on this port.
End User Session Settings Tab 707
NetSight Policy Manager Help
Failed Login Attempts (since last success) (Web−Based)
For ports using web−based authentication, the total number of failed login attempts since the last successful login on this port.
Last Login Attempt Result (Web−Based)
For ports using web−based authentication, indicates the result (success/failure) of the last attempt to log in to this port. Possible results are as follows:
•
Not logged in since last reset − No login in since reset.
•
Authentication accepted − User logged in successfully.
•
Authentication rejected
•
Username or password mismatch
•
User misconfiguration (e.g. Deny Remote Permission in Active Directory Users).
or, when two RADIUS servers are configured in the device:
•
Mismatched Shared Secret in a primary RADIUS server or both RADIUS servers.
•
Unsupported protocol (e.g. CHAP) configured on the device.
•
Unknown policy − No policy (Role) defined in the device.
•
Unknown authentication server response − When one RADIUS server is configured in the device:
•
Wrong Authentication UDP port number defined.
•
Mismatched Shared Secret.
•
RADIUS server is not contactable, or RADIUS server is down.
•
Unsupported protocol (e.g. CHAP) configured on the device.
•
Unknown authentication client error − User enters no username and password.
•
Auth client disabled or unavailable − RADIUS server is disabled in the device.
•
Port authentication pending − Port is in the process of authenticating.
•
Port held for too many failed attempts − User reached the maximum number of failed
• attempts to log in.
Port held: Max attempts exceeded − User exceeded the maximum number of failed
• attempts to log in once the port has been held.
Authentication server timeout − When two RADIUS servers are configured in the device:
•
Wrong Authentication UDP port number defined in a primary RADIUS server or
• both RADIUS servers.
RADIUS servers are not contactable
•
Unsupported protocol (e.g. CHAP) configured on the device.
Last Failure Cause (MAC)
For ports using MAC authentication, the reason for the last authentication failure on the port.
Role−Based Rate Limit Violations Tab
This tab displays information about the role−based rate limit violations for the port, including the current data being collected for a session in progress and data from previous sessions. You must click Retrieve to display the port information in the tables.
Role−based rate limit functionality is available only on certain devices such as the Matrix N−Series Gold and
Platinum devices (refer to the Firmware Feature Support tables in the release notes for specific
device/firmware rate limit support.) For more information, see Defining Role Based Rate Limits.
Click the graphic for more information.
Role−Based Rate Limit Violations Tab 708
NetSight Policy Manager Help
Violations
Name
The port interface name.
Index
The port index number.
Rate Limit
The rate limit that has been violated (exceeded).
Generated System Log
Indicates whether a syslog message was generated when the rate limit was first exceeded. You can
specify this action on a per−rate limit basis in the rate limit General tab.
Generated Trap
Indicates whether an audit trap was generated when the rate limit was first exceeded. You can specify
this action on a per−rate limit basis in the rate limit General tab.
Port Disabled
Indicates whether the port was disabled when the rate limit was first exceeded. You can specify this
action on a per−rate limit basis in the rate limit General tab.
Retrieve Button
Retrieves the most recent rate limit violations information for the port.
Clear Button
Clears the violations table. If port traffic continues to exceed the rate limit, the violations will reappear in the table.
Violations 709
NetSight Policy Manager Help
CEP Usage Tab
This tab displays information about each CEP connection for the ports on the device, including the date and time the connection was made. For devices that support one CEP connection per port, a connection entry remains in the table until a new connection is made on that port or the system is rebooted. You must click
Retrieve to display the connection information in the table.
devices that support it.
Click the graphic for more information.
Device
The IP address or name of the device where the port is located.
Interface Name
A description of the port.
Index
The index value assigned to the port interface.
CEP Type
The CEP product type that has made the connection.
Current Role
The assigned role for the CEP connection. Each CEP product type has a role mapped to it. When a
CEP connects to the network, the device identifies the CEP type and applies the assigned role. You
can map a role for a CEP using the device Authentication tab (CEP sub−tab).
IP Address
The IP address of the CEP connecting to the port.
CEP Usage Tab 710
NetSight Policy Manager Help
MAC Address
The MAC address of the CEP connecting to the port.
Start Time
The date and time the connection was made.
Retrieve Button
Gets the port's CEP connection information and displays it in the table.
CEP Usage Tab 711
Port Properties
MAC Locking Tab
port, if the device supports it. You can also view and change a list of MAC addresses that are currently locked on the port.
There are two ways to access the MAC Locking tab:
•
Select a device in the left−panel Network Elements tab and expand a slot or ports grouping in the right−panel Details view. Right−click on a port and select Properties from the menu. In the Port
•
Properties window, select the MAC Locking tab (in the top row of tabs).
Select a port in the left−panel Port Groups tab, then select the MAC Locking tab in the right panel.
In order for MAC Locking to take effect on a port, it must be enabled at the device level. You can do this
for selected ports in the Port Configuration wizard. The MAC Locking tab provides two sub−tabs:
•
•
General Tab
This tab lets you enable/disable MAC Locking on the port as well as view the MAC locking status on the device. You can also set MAC locking limits and change all dynamic MACs (with a locking cause of "First
Arrival) to statically locked MACs.
Click the graphic for more information.
Port PropertiesMAC Locking Tab 712
NetSight Policy Manager Help
Device MAC Locking Status
Shows whether the MAC Locking feature is enabled or disabled the device. If the device does not
support MAC locking, this option is grayed out. In order for MAC Locking to take effect on a port, it
must be enabled at the device level. You can do this using the device MAC Locking tab.
MAC Locking
Lets you to enable or disable the MAC Locking feature on this port. If the device does not support
MAC locking, this option is grayed out.
MAC Locking Limits
Maximum Number of Dynamic Locked MAC Addresses
Allows you to set the maximum number of MAC addresses that can be locked dynamically on the port. The numbers in parentheses let you know the range of allowed values for the particular device.
When you enable Dynamic MAC Locking on a port, the next MAC address that authenticates or accesses the port (up to the maximum number of dynamic locked MAC addresses) will have exclusive access to that port from that time on. If you are using static locked MAC addresses, the maximum number of dynamic locked MAC addresses is usually set to 0.
Maximum Number of Static Locked MAC Addresses
Allows you to set the maximum number of MAC addresses that can be locked administratively on the port. The numbers in parentheses let you know the range of allowed values for the particular device.
Static MAC Locking lets you create a list of locked MAC addresses for a port so that the port only accepts traffic from those MAC addresses.
Apply Button
Applies the MAC limits you've set.
MAC Locking Limits 713
NetSight Policy Manager Help
Static MACs
Static MACs
Click Apply to change all Dynamic Locked MAC addresses (with the Locking Cause of "First
Arrival") to Static Locked MAC addresses. To ensure that all Dynamic Locked MAC addresses are
changed to Static, make sure that the Maximum Number of Static Locked MAC Addresses is set to a
large enough value.
Locked MAC Addresses Tab
This tab lets you view a list of the MAC addresses currently locked on the selected port. You must click the
Retrieve button to display this information.
Click the graphic for more information.
Locked MAC Addresses
MAC Address
MAC address that is locked.
Locking Cause
Indicates why the MAC address is locked:
•
Authentication − Locked as the result of authentication
•
First Arrival − Locked because it was the first MAC address to access the port
•
Static − MAC address was added to the list administratively
Retrieve Button
Static MACs 714
NetSight Policy Manager Help
Populates the Locked MAC Addresses table with a list of the MAC addresses currently locked on the selected port.
Add Button
Opens the Add Static MAC window, where you can create a list of locked MAC addresses for this
port.
Remove Button
Removes the selected entry from the Locked MAC Addresses table.
Static MACs 715
Port Properties
Rule Usage Tab
When rule accounting is enabled on a device, each rule keeps a list of the ports on which it has been used. The
Port Properties Rule Usage tab displays all the rules that have been used on the selected port, and the role they are associated with.
There are two ways to access the Rule Usage tab:
•
Select a device in the left−panel Network Elements tab and expand a slot or ports grouping in the right−panel Details view. Right−click on a port and select Properties from the menu. In the Port
•
Properties window, select the Rule Usage tab (in the top row of tabs).
Select a port in the left−panel Port Groups tab, then select the Rule Usage tab in the right panel.
Click the Retrieve button to display the rule usage information. Rule accounting must be enabled on the
device; see the device Role/Rule tab for information.
TIP:
You can see rule accounting information for an individual rule using the Rule Usage Tab
Click the graphic for more information.
Rule
The name of the rule used on the port.
From Role
The role that the rule is associated with.
Buttons
Retrieve
Retrieves/updates the rule usage information.
Port PropertiesRule Usage Tab 716
NetSight Policy Manager Help
Clear
Clears the port from the selected rule's usage list.
Port PropertiesRule Usage Tab 717
Pre−Defined Well−Known IDs Window
This window lets you add to the pre−defined list of well−known identifiers (IDs) used when creating Policy
Manager rules. You can define a new ID for a TCP/UDP port number (Layer 4 Application Transport traffic classification type) or for an IP Protocol Type (Layer 3 Network traffic classification type). Once defined, these IDs are available for selection from the list of well−known values when defining the rule's traffic classification type.
To access the window, select Edit > Pre−Defined Well−Known IDs from the menu bar. IDs are defined using either of two tabs:
•
•
Port Tab
The Port tab lets you define an ID for a TCP/UDP port number. Once defined, this ID can be used when creating a Policy Manager rule with a Layer 4 Application Transport traffic classification type.
Click on areas in the window for more information.
Pre−Defined Well−Known IDs Window 718
NetSight Policy Manager Help
Well−Known IDs Table
Lists the currently defined well−known IDs for TCP/UDP port numbers.
Port Number
Enter the port number for the ID you are defining.
Protocol
Enter the protocol for the ID you are defining.
Buttons
Add
Adds the specified ID to the table.
Clear
Clears both the Port Number and Protocol fields, but does not change the content of the table.
Remove
Deletes the selected ID(s) from the list of well−known IDs.
Reset to Default
Restores the Well−known IDs table to its original settings. Any IDs that you have added will be removed.
IP Protocol Tab
The IP Protocol tab lets you define an ID for an IP Protocol Type. Once defined, this ID can be used when creating a Policy Manager rule with a Layer 3 Network Traffic Classification Type.
Click areas in the window for more information.
IP Protocol Tab 719
NetSight Policy Manager Help
Well−Known IDs Table
Lists the currently defined well−known IDs for IP Protocol Types.
IP Protocol Number
Enter the IP Protocol number for the ID you are defining.
Protocol
Enter the protocol for the ID you are defining.
Buttons
Add
Adds the specified ID to the table.
Clear
Clears both the IP Protocol Number and Protocol fields, but does not change the content of the table.
Remove
Deletes the selected ID(s) from the list of well−known IDs.
Reset to Default
Restores the Well−known IDs table to its original settings. Any IDs that you have added will be removed.
IP Protocol Tab 720
NetSight Policy Manager Help
IP Protocol Tab 721
Restore Database Window
Use the Restore Database window to restore the initial database or restore a saved database. Both functions will cause all current client connections and operations in progress to be terminated. You can access this
window by clicking the Restore button in the Database tab of the Server Information window.
Click the graphic for more information.
Restore Initial Database
Restoring an initial database removes all data elements from the database and populates the NetSight
Administrator authorization group with the name of the logged−in user. You must restart both the
NetSight Server and the client following an initialize database operation.
Restore Saved Database
Specify the database you wish to restore or use the Browse button to navigate to the database. If the server is remote, you only have access to databases in the default database backup directory.
Buttons
Restore
Starts the restore operation.
Restore Database Window 722
Selection View
(Classes of Service)
This window lets you select a class of service (CoS) to use as the default CoS for a role, the CoS action for a rule, or the CoS action for an automated service.
NOTE:
If you select a class of service with a ToS/DSCP value to use as the default CoS for a role, the ToS/DSCP value will be ignored. This is because ToS/DSCP rewrite works
only for certain IP ToS classification rules, not as a role default. See ToS/DSCP
Click the graphic for more information.
Classes of Service
This is a list of the available classes of service.
Buttons
New
Opens the Create Class of Service window, where you can create a new class of service. The Create
Class of Service window returns you to the Selection View window after the class of service has been created, and the new class of service is available for selection on the list.
Selection View (Classes of Service) 723
Selection View
(Egress VLANs)
The Egress VLANs Selection View appears when you click the Add button in the VLAN Egress window in
specify the egress forwarding state.
Click the graphic for more information.
VLANs
This is a list of the available non−Discard VLANs. Make a selection from this list, or click New to create a new VLAN and add it to the list.
Forwarding State
Select the desired forwarding state: Tagged (frames will be forwarded as tagged), Untagged (frames will be forwarded as untagged), or Forbidden (frames will not be forwarded; they will be discarded).
Buttons
New
Opens the Create VLAN Window, where you can create a new VLAN. The Create VLAN window
returns you to the Selection View window after the VLAN has been created, and the new VLAN is available for selection in the list.
Selection View (Egress VLANs) 724
NetSight Policy Manager Help
Selection View (Egress VLANs) 725
Selection View
(Network Resources)
appears when you are creating an Automated service (via the Create Service menu option), or it can be
Click the graphic for more information.
Network Resources
This is a list of the available network resource groups. Click New to create a new group to add to the list. Make a selection from this list and click OK.
Buttons
New
Opens the Create Network Resource window, where you can create a new network resource group to
add to the selection list.
Selection View (Network Resources) 726
Selection View
(Roles)
The Roles Selection View appears in various instances:
•
role from a port or device. To access this view, right−click the desired port or device in the left−panel
•
Network Elements tab, then select Set Default Role from the menu. This view is shown below.
When you are selecting a device−level role for a Matrix C1 device. To access this view, select the desired C1 device in the left−panel Network Elements tab, then click the Select button in the device's
•
When you are selecting a role for VLAN to role mapping. It also lets you clear the current VLAN to role mapping. To access this view, click the desired VLAN in the left−panel VLANs tab, then click
the Select button in the Role Mapping section on the VLAN's Mappings tab.
Click the graphic for more information.
Clear
Select this option to clear the current role selection.
Assign/Replace
Select this option to assign a new role. Make a selection from the list of available roles, or click New to create a new role and add it to the list.
Selection View (Roles) 727
NetSight Policy Manager Help
Buttons
New
Opens the Role Wizard, where you can create a new role. The Role Wizard returns you to the
Selection View window after the role has been created, and the new role is available for selection on the list.
Selection View (Roles) 728
Selection View
(VLANs)
Use this window to select a VLAN when you are configuring the default access control for a role or the access control action for a rule. The Selection View lists either Discard VLANs or Contain VLANs, depending on what type of access control you are selecting for the role or rule.
There are other instances when a VLANs Selection View appears:
•
When you import or open a .pmd file from an older version of Policy Manager, where the "Deny
Traffic" and "Contain To VLAN" choices were not available, or when you import or create a device on which that choice was not made. That version of the view enables you to select the VLANs you
• want to act as Discard VLANs, and it has no New button.
When you click the Add button when configuring Authentication−based or Tagged Packet VLAN to
VLANs and allows you to select from the list to add to the role's VLAN mapping table.
Click the graphic for more information.
VLANs
Make a selection from the list of VLANs, or click New to create a new VLAN and add it to the list.
Buttons
New
Opens the Create VLAN Window, where you can create a new VLAN. The Create VLAN window
returns you to the Selection View window after the VLAN has been created, and the new VLAN is available for selection on the list.
Selection View (VLANs) 729
NetSight Policy Manager Help
Selection View (VLANs) 730
Server Information
Window
The Server Information window lets you view and configure certain NetSight Server functions, including management of client connections, database backup and restore, locks, and licenses. It also provides access to the server log and server statistics. To access this window, select Tools > Server Information from the menu bar. You must be assigned the appropriate user capabilities to access and use this window.
Information on the following tabs:
Client Connections Tab
The Client Connections tab provides information that lets you view and manage current client connections to this server, and also view a history of client connections.
Click the graphic for more information.
Server InformationWindow 731
NetSight Policy Manager Help
Current Client Connections
This table lists all of the currently connected clients for this server, with the most recent connection at the top.
The list is automatically updated when clients connect or disconnect.
User:
The name of the user that has connected to the server as a client.
Authorization Group
The authorization group the user belongs to.
Client Type
The type of client, which will be NetSight Console or a NetSight plugin application such as Inventory
Manager.
Client Host
The name of the client host machine.
Connection Started
The date and time the client connection started.
Disconnect Button
Server InformationWindow 732
NetSight Policy Manager Help
Disconnects the selected client. The client being disconnected receives a message saying that their connection will be terminated in 30 seconds. You must be assigned the appropriate user capability to disconnect clients.
Client Connection Log
The client connection log displays a list of all client connect and disconnect activities, and allows you to track the history of a particular client connection. The table displays the last 50,000 log entries, and updates automatically when a client connects or disconnects. The current log file is automatically archived when its size reaches 1 megabyte and opens a new log.
Acknowledge:
This checkbox lets you acknowledge an event and also hide items that have been acknowledged.
Click the checkbox to acknowledge the item and then click the Show Acknowledged Events button
to hide or show the checked items.
Severity
The event's severity.
Category
The category of event: user connection.
Timestamp
The date and time when the event occurred.
Client
The name of the client host machine that triggered the event.
User
The name of the user that triggered the event.
Type
The type of information: event.
Event
The type of event.
Information
Information about the client authentication or disconnect.
Show/Hide Acknowledged Events
This button hides or shows items in the table that have been acknowledged by a check in the
Acknowledge column.
Refresh
Refreshes the log.
Clear Log
Server InformationWindow 733
NetSight Policy Manager Help
Clears the log. If you want to retain a copy of the log that you are clearing, you must manually copy the date−stamped file in the <install area>\Enterasys Networks\NetSight
Console\server\logs\admin.log.
Database Tab
This tab allows you to manage the password and connection URL for the database, and perform database backup and restore operations. You must be assigned the appropriate user capabilities to perform these functions.
IMPORTANT:
When Console is installed, it automatically secures the MySQL database server by removing all the root and anonymous users from the MySQL user database. Console then adds one generic user name (user = netsight) and password (password = enterasys). It is recommended that you change this password, since all customers who install Console will know this generic password.
Click the graphic for more information.
Database Server Properties
Database server properties are used by the NetSight Server when it connects to the database. The database is
Database Tab 734
NetSight Policy Manager Help you modify that password, and also view and modify the connection URL for the database.
Password
Click Change to display a window where you can enter a new password. The password is masked unless you select the checkbox to Show Password. You must restart both the NetSight Server and client after you change the database password.
Connection URL
Displays the URL the NetSight Server uses when connecting to the database. For troubleshooting purposes, (for example, if you can't connect to the database) you may wish to enter a new connection
URL. Enter a new URL in the following format, and click Apply: jdbc:mysql://[hostname]/<database> where [hostname] is optional.
You must restart both the NetSight Server and client after you change the Connection URL.
NetSight Data Set Operations
This area lets you perform database backup and restore operations.
Backup Button
Opens the Backup Database window where you can save the currently active database to a file. If the
NetSight Server is local, you can specify a directory path where you would like the backup file stored.
If the server is remote, the database will be saved to the default database backup location.
Restore Button
Opens the Restore Database window where you can restore the initial database or restore a saved
database. Restoring an initial database removes all data elements from the database and populates the
NetSight Administrator authorization group with the name of the logged−in user. Both functions will cause all current client connections and operations in progress to be terminated. You must restart both the NetSight Server and the client following an initialize database operation. When restoring a database, if the server is remote, you only have access to databases in the default database backup directory.
Locks Tab
The Locks tab lets you view a list of currently held operational locks. Operational locks are used to control the concurrency of certain client/server operations. They are used in two ways:
• to lock a device while a critical operation is being performed, such as a firmware download.
• to lock a certain function so that only one user can access it at a time. For example, only one user can have the Authorization/Device Access window open at a time.
In the Current Locks table you can view information about each lock, such as who owns the lock, the duration of the lock, and a description of the lock. You can cancel a lock by selecting it in the table and clicking the
Revoke button. When a lock is revoked, a message is displayed on the user's machine informing them that their use of the locked functionality has been terminated. When the user acknowledges the message, the function closes. You must be assigned the appropriate user capability to revoke a lock.
Click the graphic for more information.
Locks Tab 735
NetSight Policy Manager Help
User:
The name of the user who initiated the lock.
Authorization Group
The authorization group the user belongs to.
Client Type
The type of client: Console or a NetSight plugin application.
Client Host
The client host machine.
Duration
The amount of time the lock has been held.
Description
A description of the lock.
Refresh Button
Refreshes the table and obtains updated lock information.
Revoke Button
Removes the selected lock. When a lock is revoked, a message is displayed on the user's machine informing them that their use of the locked functionality has been terminated. When the user acknowledges the message, the function closes.
Locks Tab 736
NetSight Policy Manager Help
Server Log Tab
The Server Log displays all the events for the server. Server Log entries are listed by date and time, with newer entries listed at the bottom. A new Server Log is created every day. If the NetSight Server is local, you
can view previous logs using the File tab.
You can perform Find and Filter operations on Server Log entries to target specific entries of interest. The last
Filter and Find settings you enter remain in the Server Log display until you refresh the display.
Information on the following tabs:
•
•
•
Find Tab
The Find tab lets you search the Server Log (filtered or unfiltered) for a specific set of characters, like a word, phrase, or number. Enter your search criteria in the Find field, and when you click the Find button, any search terms found will be highlighted in the Server Log display. You can search forward or backward from your current position, and restrict your search to match the exact upper or lowercase, and/or whole word.
Click the graphic for more information.
Display:
Server Log Tab 737
NetSight Policy Manager Help
Use the drop−down list to select the number of lines you would like displayed in the log.
Find:
Enter the text or numeric value you want to find.
Case Sensitive
Select this checkbox to search based on an exact match of the upper or lowercase of the text entered in the Find field.
Match Whole Word
Select this checkbox to search based on an exact match of the whole word or numeric value entered in the Find field.
Forward
Select Forward to search from your current position to the end of the Server Log.
Backward
Select Backward to search from your current position to the beginning of the Server Log.
Server Log Entries
Lists the events by date and time, with the more recent entries at the bottom. Directly above the entries you can see the status of whether the entries are filtered or not filtered. Any search terms found are highlighted.
Find Button
Performs the Find operation on the information currently displayed in the Server Log.
Clear Filter Button
Removes any filters currently in effect.
Refresh Button
Displays and updates log entries, and removes any filters. The Server Log does not refresh automatically. If the Server Log is open and new entries are written to the log, you must click Refresh to update the log.
Filter Tab
The Filter tab lets you specify which entries to display in the Server Log. Enter the information you want to see, and only matching log entries will be displayed. You can use any combination of filter options, and you can perform consecutive filters on the filtered events.
Click the graphic for more information.
Server Log Tab 738
NetSight Policy Manager Help
Display:
Use the drop−down list to select the number of lines you would like displayed in the log.
Filter:
Enter the text or numeric value you want to use as a filter.
Case Sensitive
Select this checkbox to search based on an exact match of the upper or lowercase of the text entered in the Filter field.
Match Whole Word
Select this checkbox to search based on an exact match of the whole word or numeric value entered in the Filter field.
Entire Text
Select the Entire Text scope option to filter all text by the value in the Filter field. If you have already performed a filter, this will enable you to perform a new filter on all entries instead of just the filtered entries.
Filtered Text
Select the Filtered Text scope option to perform a new filter on the results of the previous filter.
Server Log Entries
After running the filter, this area displays the matching Server Log entries by date and time, with the more recent entries at the bottom. Click Clear Filter to remove the filter currently in effect. Directly
Server Log Tab 739
NetSight Policy Manager Help above the entries you can see the status of whether the entries are filtered or not filtered.
Filter Button
Performs the filter and displays the results.
Clear Filter Button
Removes any filters currently in effect.
Refresh Button
Displays and updates log entries, and removes any filters. The Server Log does not refresh automatically. If the Server Log is open and new entries are written to the log, you must click Refresh to update the log.
File Tab
The File tab lets you specify which day's server log you wish to view. You can select the current day's log file, or a previous day's log file. The NetSight Server must be local in order to view previous logs.
Click the graphic for more information.
Display:
Use the drop−down list to select the number of lines you would like displayed in the log.
Current Log
Server Log Tab 740
NetSight Policy Manager Help
Select this button to view the current day's log. The name of the log and the path to where it is located is displayed in the field to the right.
Previous Log
Select this button to view a previous day's log. Click the Open button to open a file selection window where you can select the log you want to view. The file names are dated, in the format
YYYY_MM_DD_events.log
. The NetSight Server must be local in order to view previous logs.
Server Log Entries
Lists the entries in the currently selected Server Log, by date and time, with the more recent entries at the bottom. If you apply a filter to the log, only the entries that match the filter are displayed on this tab.
Clear Filter Button
Removes any filters currently in effect.
Refresh Button
Displays and updates log entries, and removes any filters. The Server Log does not refresh automatically. If the Server Log is open and new entries are written to the log, you must click Refresh to update the log.
License Tab
The License tab displays a list of all the server plugin applications that have been installed on this particular
NetSight server, and their respective license information. You can also use this tab to change a license. You would change a license in the event that you want to upgrade from an evaluation copy to a purchased copy or upgrade to a license that supports more users/devices. You can also use the Change License functionality to upgrade a Console license from a Standalone to a Client−Server configuration on UNIX or Linux systems
only (see Upgrading a Console License for more information.)
Contact your Enterasys Networks Representative to purchase the software and receive a Licensed Product
Entitlement ID that allows you to generate a product license. Prior to changing a license, you must redeem your Entitlement ID for the new product license. Refer to the instructions included with the Entitlement that was sent to you. (For more information, see http://www.enterasys.com/products/management/
.)
Click the graphic for more information.
License Tab 741
NetSight Policy Manager Help
Server License Limitations
Information on the selected server license:
• whether the server accepts connections from remote clients.
• the maximum number of devices that can be managed by the server.
• the maximum number of unique client hosts allowed to connect to the server.
Installed Server Plugin
The name of the installed server plugin application.
Version
The version of the server plugin application.
License
The license number of the server plugin application. This is the license text that was entered during installation.
Expires
If the plugin is an evaluation copy, this column displays the date the license expires.
Refresh Button
Refreshes the table and obtains updated license information.
Change License Button
Opens the Change License window. Read and accept the terms of the license agreement and click
OK. Enter the license text that you received when you generated the product license. (When you purchased your Enterasys software product, you received a License Entitlement ID that allows you to
License Tab 742
NetSight Policy Manager Help generate a product license. Refer to the instructions included with the License Entitlement ID that was sent to you.) Click Update. The license file will be updated with the new license text.
Buttons
Configure
Opens the Configure Server window where you can configure various NetSight Server parameters
such as the maximum number of concurrent client connections supported by the NetSight Server.
Server Stats
Opens the Server Statistics window where you can view NetSight Server statistics such as CPU usage,
and also launch Advanced statistics used for troubleshooting purposes.
License Tab 743
NetSight Server Statistics Window
Use this window to view NetSight Server statistics. You can access the window by clicking the Server Stats
button in the Server Information window.
Click the graphic for more information.
CPU
The percentage of CPU being used by the NetSight Server.
Object Heap Memory in Use
The amount of object heap memory (in kilobytes) being used by the server. Heap memory refers to the amount of free memory available to the program.
Buttons
Advanced
Opens the Advanced Statistics window, which provides server statistics that can be used for
troubleshooting purposes.
NetSight Server Statistics Window 744
Set Authentication Port Mode to Inactive/Default Role
Window
This window lets you select the ports you want to set to Inactive/ Default Role, prior to enabling authentication on a device. It is displayed when you select the Select Ports to set to Inactive/Default Role option on the Authentication Status window that appears when you elect to enable authentication in the
Device Configuration Wizard or on the device Authentication tab.
Click the graphic for more information.
Devices
To add a port or port group, select it and click Add Include or Add Exclude.
Include Ports
Lists the ports and port groups you want to be changed to Inactive/Default Role. To add a port or port
it and click Remove.
Exclude Ports
Lists the ports and port groups you don't want changed to Inactive/Default Role. It is not necessary to add all the ports and port groups you don't want changed to this list. Simply leaving them off the
Include Ports list means they won't be changed. However, the Exclude Ports list enables you to, for
Set Authentication Port Mode to Inactive/Default Role Window 745
NetSight Policy Manager Help example, add the All Ports port group to the Include Ports list, but add the CDP Ports port group to the
Exclude Ports list so all but the CDP ports will be changed. To add a port or port group to this list,
select it and click Add Exclude. To remove a port or port group from the list, select it and click
Remove.
Buttons
Add Include
Adds the ports or port groups selected in the Devices list to the Include Ports list.
Remove
Removes the selected ports or port groups from the Include or Exclude Ports List.
Add Exclude
Adds the ports or port groups selected in the Devices list to the Exclude Ports list.
Set Authentication Port Mode to Inactive/Default Role Window 746
Sort Window
The Sort window lets you sort column entries in the right panel in ascending or descending order. Text entries are sorted alphabetically, numeric entries are sorted numerically, and mixed entries are sorted alpha−numerically.
You can access the Sort window by selecting View > Sort. You can also sort a column by right−clicking on a column header and selecting Sort Ascending or Sort Descending.
NOTE:
Some Policy Manager tables use a set of Table Tools to find, filter, sort, print, and export information in a table. You can access these Table Tools by clicking the Table Tools
button in the upper left corner of the table. For more information, see Table Tools.
Click the graphic for more information.
Ascending
Sorts the selected column in ascending order.
Descending
Sorts the selected column in descending order.
Column
Enables you to select the column to be sorted from a drop−down list.
Buttons
Sort
Performs the sort operation.
Close
Exits the Sort window.
Help
Displays detailed information about the current window.
Sort Window 747
Statistics Window
The Statistics window provides information on the total number of roles, services, devices and VLANs that exist in your currently active domain. The Statistics window has a right−panel view that changes depending on what you have selected in the left−panel tree. Each view allows you to see a different set of statistics.
Access this window by selecting View > Statistics from the menu bar.
Information on the following Statistics views:
•
•
•
•
Role Statistics
Selecting Role in the left panel of the Statistics window (View > Statistics) displays information on the roles that exist in your current domain. It also provides information on the services and classification rules associated with the roles.
Click the graphic for more information.
Statistics Window 748
NetSight Policy Manager Help
Number of Roles
Total number of roles that currently exist in this domain.
Applied Services
Total number of services associated with roles, listed by device type. A service is listed for each device type that its rules will apply to when enforced.
Applied Classification Rules
Total number of traffic classification rules associated with the Applied Services, listed by the device type to which the rule applies. This is the total number of rules that would be written to the devices when enforced. Only classification rules that are enabled and are part of at least one applied service are counted towards this total; the total does not include disabled rules.
Applied VLAN Classifications
Statistics Window 749
NetSight Policy Manager Help
Total number of VLAN classification rules associated with the Applied Classification Rules, listed by the device type to which the rule applies.
Applied CoS Classifications
Total number of class of service classification rules associated with the Applied Classification Rules, listed by the device type to which the rule applies.
Service Statistics
Selecting Service in the left panel of the Statistics window (View > Statistics) displays information on the services that exist in your current domain.
Click the graphic for more information.
Defined Services
assigned to any roles.
Defined Classification Rules
Total number of traffic classification rules that have been created, including both enabled and disabled rules.
Defined Rules (enabled)
Total number of traffic classification rules currently enabled, including those currently associated with roles (via a service), as well as those not yet associated with any roles.
Defined Rules (disabled)
Total number of traffic classification rules currently disabled, including those associated with roles
Service Statistics 750
NetSight Policy Manager Help
(via a service), as well as those not yet associated with any roles.
Network Elements Statistics
Selecting Network Elements in the left panel of the Statistics window (View > Statistics) displays information on the devices that exist in your current domain.
Click the graphic for more information.
Number of Devices
Total number of devices that currently exist in your domain as well as the number of each device type.
Number of Device Groups
Total number of device groups that currently exist in your domain, including both Pre−defined and
User−defined device groups.
Number of Port Groups
Network Elements Statistics 751
NetSight Policy Manager Help
Total number of port groups that currently exist in your domain, including both Pre−defined and
User−defined port groups.
VLAN Statistics
Selecting VLAN in the left panel of the Statistics window (View > Statistics) displays information on the
VLANs that exist in your current domain.
Click the graphic for more information.
Number of VLANs
Total number of VLANs (global and local) that currently exist in your domain.
Buttons
Refresh
Updates the information in the views with the latest statistics.
VLAN Statistics 752
ToS/DSCP
Configuration
Window
The ToS/DSCP Configuration window allows you to automatically configure a ToS (Type of Service) or
DSCP (Diffserv Codepoint) value defined by a hexadecimal number between 0 and FF. The ToS/DSCP field contained in the IP header of a frame is used by applications to indicate the priority and Quality of Service for
In Policy Manager, you can configure a ToS/DSCP value in two different situations, as follows:
IP Type of Service Classification
An IP Type of Service classification rule causes the one−byte ToS/DSCP field in the IP header of incoming packets to be read. If a value is found in this field and it matches the ToS/DSCP value specified in the classification rule, the packet is classified accordingly. You can access the ToS/DSCP Configuration window
Description Wizard's IP Type of Service window.
ToS/DSCP Rewrite
Some IP rules allow a ToS/DSCP value to be written to the ToS/DSCP field in the IP header of incoming packets. If the packet's ToS/DSCP field is blank, the value specified in the rule is entered, or if the value is already present, it is replaced with the new value. The traffic is then classified accordingly. In Policy
Manager, you specify the ToS/DSCP rewrite value by creating a CoS (class of service) and associating the appropriate ToS/DSCP value with it. You then select this CoS action for the classification rule. You can access the ToS/DSCP Configuration window during the creation of the class of service by clicking the Select
select this CoS action for the classification rule in the Rule Wizard or on the rule's Actions tab.
NOTE:
The ToS/DSCP Rewrite feature works only for the appropriate classification rules. It does not work at the role level. If you select a CoS that is associated with a ToS/DSCP value as the default CoS for a role, the ToS/DSCP value will be ignored.
Click the graphic for more information.
ToS/DSCP Configuration Window 753
NetSight Policy Manager Help
Type of Service (ToS)
Select this option to generate a ToS hexadecimal value. Type of Service is used by applications to indicate priority and Quality of Service for each frame.
Precedence
Use the drop−down list to select the desired precedence. Precedence specifies the importance or priority of the traffic.
0 −− Routine
1 −− Priority
2 −− Immediate
3 −− Flash
4 −− Flash Override
5 −− CRITIC/ECP
6 −− Internetwork Control
7 −− Network Control The Internetwork Control designation is intended for use by gateway originators only. The Network Control precedence designation is intended to be used within a network only. The actual use and control of that designation is up to each network.
Delay Sensitive
Select this check box to generate a Low Delay service parameter that will minimize delay.
High Throughput
Select this check box to generate a High Throughput service parameter that will maximize throughput.
High Reliability
Select this check box to generate a High Reliability service parameter that will maximize reliability.
ToS/DSCP Configuration Window 754
NetSight Policy Manager Help
Explicit Congestion Notification
Select this check box to generate an Explicit Congestion Notification service parameter that will minimize monetary cost.
Diffserv Codepoint (DSCP)
Select this option and use the Value drop−down list to generate a DSCP hexadecimal value.
Value
The drop−down list presents recommended codepoints for three Differentiated Services (DS)
Per−Hop−Behavior (PHB) groups called Assured Forwarding (AF), Class−Selector (CS), and
Expedited Forwarding (EF). For more information on these PHB groups, refer to RFC 2474, RFC
2597 and RFC 2598.
ToS/DSCP Configuration Window 755
Traffic Classification Type Wizard
You can disable specific classification rule types on an individual port as a way to disable policy−assignment rules used in VLAN to Role Mapping, IP to Role Mapping, MAC to Role Mapping, and Role Override. For example, you can disable the VLAN ID traffic classification type to disable Tagged Packet VLAN to Role
Mapping on this port.
The Traffic Classification Type Wizard lets you easily choose a rule type that you want to disable on the selected port. You choose the rule type by first selecting the traffic classification layer and then the
The Traffic Classification Type Wizard is accessed from the Add button in the Disabled Traffic Classification
Type tab in the Port Properties General tab.
Traffic Classification Layer
Use the drop−down list in this window to select the desired traffic classification layer. Classification types are grouped according to Layers 2, 3, and 4 of the OSI model: Data Link, Network, and Transport, respectively.
Traffic Classification Type
Use the drop−down list in this window to select the desired traffic classification type. There are multiple classification types for each layer. The layer you selected in the previous window determines which types will be listed here.
Traffic Classification Type Wizard 756
NetSight Policy Manager Help
Finish Button
Click Finish to display the selected rule type in the Disabled Traffic Classification Type tab of the
Traffic Classification Type Wizard 757
Updates Available Window
NetSight applications provide an easy way to download product updates using a web update operation accessed from Help > Check for Updates in the menu bar. The Updates Available window displays any new updates that are available for download, and lets you initiate the download operation. You must be assigned the appropriate user capability to access this view.
Click the graphic for more information.
Download
Use the checkboxes in this column to select or deselect updates to be downloaded.
Product
The name of the product the update is for.
Available
The package version number for the available update.
Current
The package version number currently installed in the application.
Requires
Lists any dependencies for the update.
Download Progress
A progress bar showing the percent completed of the download operation.
Buttons
Download
Initiates the download operation.
Updates Available Window 758
NetSight Policy Manager Help
Details
Opens the NetSight Updates Details window where you can see details on what each update includes.
Updates Available Window 759
Letöltés
A nyilvános link frissítve
A csevegés nyilvános linkje frissítve lett. You may view and manage your chat links after registration here.
Dokumentum nyilvános linkje
Hirdetés