It is useful to break up policy implementation into logical domains for ease of understanding and configuration. For this example, it is useful to consider four domains: basic edge, standard edge on the Fixed Switch, premium edge on the Services Edge Switch, and premium distribution on the Distribution Switch.
Protocols not appropriate to the edge should be blocked. For this example we will block DHCP (Dynamic Host Configuration Protocol), DNS, SNMP (Simple Network Management Protocol), SSH, Telnet and FTP at the edge on the data VLAN (Virtual LAN). We will forward destination port DHCP and DNS and source port for IP address request to facilitate auto configuration and IP address assignment. See Blocking Non-Edge Protocols at the Edge Network Layer for a listing of protocols you should consider blocking at the edge.
Edge Switch platforms will be rate-limited using a configured CoS (Class of Service) that will be applied to the student and faculty, and phoneFS policy roles. Fixed Switch support for hybrid authentication depends upon the platform and firmware release. The Fixed Switch in this example supports the hybrid authentication capability. Hybrid authentication will be enabled.
Print
this page
Email this topic
Feedback
View PDF
Download EPUB