The phoneES role is configured on the Services Edge Switch with:
Because VLANs can be applied to Services Edge Switch ports using the appropriate traffic classification, the explicit deny all PVID 0 will be applied at policy creation. Separate rate limits can be applied to the phone setup and payload ports on the Services Edge Switch using policy rules. A default CoS of 4 will be applied at policy role creation.
ServicesES->configure policy profile 5 name phoneES pvid-status enable pvid 0 cos-status enable cos 4
Forward traffic on UDP source port for IP address request (68) and and forward traffic on UDP destination ports for protocols DHCP (67) and DNS (53) on the phone VLAN, to facilitate phone auto configuration and IP address assignment. Drop traffic for protocols SNMP (161), SSH (22), Telnet (23) and FTP (20 and 21) on the phone VLAN.
ServicesES->configure policy rule 5 udpsourceport 68 mask 16 forward ServicesES->configure policy rule 5 udpdestportIP 67 mask 16 forward ServicesES->configure policy rule 5 udpdestportIP 53 mask 16 forward ServicesES->configure policy rule 5 udpdestportIP 161 mask 16 drop ServicesES->configure policy rule 5 tcpdestportIP 22 mask 16 drop ServicesES->configure policy rule 5 tcpdestportIP 23 mask 16 drop ServicesES->configure policy rule 5 tcpdestportIP 20 mask 16 drop ServicesES->configure policy rule 5 tcpdestportIP 21 mask 16 drop
Apply a CoS 9 to phone setup data on VLAN 11, rate limiting the data to 5 pps with a high priority of 7 on port 2427.
Apply a CoS 10 to phone payload data on VLAN 11, rate limiting the data to 100k bps with a high priority of 7 for both source and destination on port 5004.
ServicesES->configure policy rule 5 udpdestIP 2427 mask 16 vlan 11 cos 9 ServicesES->configure policy rule 5 udpsourceIP 5004 mask 16 vlan 11 cos 10 ServicesES->configure policy rule 5 udpdestIP 5004 mask 16 vlan 11 cos 10
The nature of services related devices that might connect to a switch port is not as static as with the student or faculty roles. Services related network needs can run the gamut from temporary multimedia events to standard office users. There may be multiple VLAN and policy role associations that take care of services related needs, depending upon the connected user. This may include the requirement for multiple services related roles.
For services, the network administrator desires greater resource usage flexibility in assigning the policy to VLAN association. Authentication in this case will return only the tunnel attributes in the response message based upon the requirements of the authenticating user. Setting the VLAN-to-policy association will be handled by the maptable configuration, allowing for ease in changing the policy associated with a VLAN on the fly using Policy Manager. Specify that the tunnel attributes returned in the RADIUS response message will be used by the authenticating user. Associate VLAN 11 with policy role 5 using the configure policy maptable command.
ServicesES->configure policy maptable response tunnel ServicesES->configure policy maptable 11 5