Extreme Networks EPICenter Software Installation Manual page 532

EPICenter Policy System Feature Comparison
• An IP or source port rule created by the EPICenter policy server is identified by its owner string
"EPICenter."
• Any access-list using TCP Permit-Established is displayed in the EPICenter policy server as protocol
"Deny TCP Sync" and QoS profile "blackhole."
• VLAN policy does not support the "blackhole" QoS profile.
• There is no owner string for VLAN QoS. As a result, the EPICenter policy server can modify VLAN
QoS that was created via the ExtremeWare CLI.
• A VLAN must have a QoS profile. As a result, when a VLAN policy is deleted, the VLAN QoS
settings for the VLANs affected by that policy are not deleted. If the user wants these VLANs to
revert back to some default QoS setting when the policy is removed, it is recommended that the user
creates a separate "default VLAN" policy that assigns the desired QoS setting to these VLANs.
• For a Cisco device, the EPICenter policy server enforces policy precedence by using a combination of
"deny" and "permit" traffic specification. No explicit precedence number is used. However, inside
the policy ACL viewer, an equivalent precedence number is displayed for Cisco devices. It is the
relative ordering between the rules that is important, not the precedence number itself.
• If Cisco device is synchronized, its equivalent precedence number is lost until the next policy
configuration. This can happen in the following cases:
— The user removes the Cisco device from the EPICenter inventory, then adds it back to the
EPICenter database.
— The user uses the "Sync" button to explicitly synchronize the device.
• Policy components (resources) inherit different properties when used as traffic endpoints than when
they are used in a scope definition:
— As an endpoint, a user resource inherits any physical port and IP information from all host
resources that the user resource is related to. In the EPICenter policy server, this is treated as
"user using host(s)." However, a host resource does not inherit from any user resources.
— As an endpoint, a group resource inherits any physical port, VLAN, and IP information from all
resources that are contained within the group, and all their descendents.
— As an endpoint, a non-group resource does not inherit any physical port, VLAN, and IP
information from any groups of which it is a descendant (i.e. from any parent groups).
— As a scope, a group resource encompasses all descendent resources of the group. Defining a
policy on a group is equivalent to defining the policy on all descendents of that group.
532 EPICenter Software Installation and User Guide