Extreme Networks EPICenter Software Installation Manual page 34

EPICenter and Policy Manager Overview
range. The EPICenter Policy Manager currently supports TCP and UDP as L4 protocols. In some cases
you can also specify client-side L4 ports. The ICMP protocol is not currently supported.
The Policy Manager determines the traffic flows of interest based on the combination of endpoints and
direction you have specified, and creates a set of IP QoS rules that can be implemented in the
appropriate network devices.
Figure 3 shows the effects of a bi-directional IP policy specified between server Iceberg and clients A, B,
and C. The policy scope includes all three switches. The effect of this policy is that IP QoS rules are
implemented for six traffic flows on each switch: from the server to each of the three clients, and from
each client to the server.
Although not shown in this diagram, you can specify multiple servers as well as multiple clients.
Figure 3: IP QoS policy
Server
Iceberg
Application:
Baan
(TCP, L4 port 512)
Unlike the VLAN and source port policy types, Security and IP policies specifies a traffic flow between
two endpoints, and that traffic may travel through multiple network devices between those two
endpoints. Thus, to protect the specified traffic along the entire route, the policy should be implemented
on all the devices between the two endpoints. This is done by including these devices in the policy
scope. On each device along the route, the traffic is identified based on the endpoint definitions (the IP
address, protocols, and L4 ports), and is assigned to the specified QoS profile on that device.
The diagrams shown in Figure 4 illustrate how the traffic flows are generated for the example shown in
Figure 3.
The EPICenter Policy Manager lets you specify the policy traffic flow in terms of named components.
Therefore, you can specify server "Iceberg" as the server endpoint, and clients "A," "B," and "C" as
client endpoints. In addition, you can indicate that the traffic from the server should be filtered only to
include traffic generated by the Baan application, which translates to TCP traffic originating from L4
port 512. Ports are not specified for the clients.
Because they were defined through the EPICenter Grouping Manager, the Policy Manager can translate
these high-level server and client names to IP addresses. Based on this information as well as the
specified traffic direction, the Policy Manager generates the set of traffic flows shown in the table at the
bottom of Figure 4. The diagram shows the steps involved in translating from the high-level objects
(host name and service) to IP addresses and L4 ports and protocols, to a set of traffic flows used in
policy rules.
34
Policy scope
Client A
Client B
Client C
XM_016
EPICenter Software Installation and User Guide