Nortel BayStack 460 Switch Programming manual

Enterprise Policy Manager - Device Management Guide
Policy management on the Nortel Ethernet Switch
460, Ethernet Switch 470, and BPS
This guide contains information relating to the configuration of the Nortel
Ethernet Switch 460 (formerly BayStack 460), Ethernet Switch 470 (formerly
BayStack 470), and Business Policy Switch (BPS), to receive policy configuration
from Nortel Enterprise Policy Manager (EPM). It also includes information on the
devices’ compatibility with various policy management objects.
This guide covers the following subjects:

2Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS
318396-4.1
•“Nortel product rebranding” on page 2
•“Nortel product rebranding” on page 2
•“Configuring the device for policy management” on page 3
•“Testing an Ethernet Switch or BPS device’s policy configuration” on page 5
•“Known device limitations for EPM 4.1” on page 6
•“Policy object - device compatibility” on page 7
•“EPM access requirements” on page 8
•“Hardware changes on a policy-enabled device” on page 9
•“Accessing device documentation” on page 9
•“BPS action limitations” on page 10
Nortel product rebranding
Nortel transitioned to new names for many of its products over the course of 2004.
The transition simplifies product naming in order to make it easier for customers
to understand the Nortel product and services portfolio. Table 1 lists the names of
rebranded Nortel products mentioned in this publication.
Full details of the Nortel product rebranding process can be obtained from
http://www.nortel.com/products/announcements/rebranding/index.html#faqs.
Supported software
The EPM 4.1 release has been tested to support the BoSS 3.0, 3.1 software, as
well as the BPS version 2.5 software. BoSS 3.1.1 software is required to support
UBP functionality. EPM 4.1 has been tested to support BoSS 3.6 for the Ethernet
Switch 460 and Ethernet Switch 470.
Table 1 Nortel product rebranding
Products formerly knowm as.... New Nortel Name
Optivity Policy Services (OPS) Nortel Enterprise Policy Manager (EPM)
BayStack Nortel Ethernet Switch

Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS 3
If you are working with a maintenance release in the EPM 4-series (i.e. post-4.1),
it may have been tested against a newer version of the device software. To verify
the absolute latest supported device software versions, refer to the Release Notes
for Enterprise Policy Manager manual.
Configuring the device for policy management
In order for an Ethernet Switch 460, Ethernet Switch 470, or Business Policy
Switch unit to receive policy configuration from EPM, the devices themselves
must be configured to communicate with the EPM Policy Server. Detailed
instructions for accomplishing this task are included below. Once this is
completed, the devices will report to the EPM Policy Server and they will appear
as icons in the management console. The roles they report are also displayed.
Policy management can be initiated by associating a policy with the device’s
reported role(s).
You must open the Web interface for the device and specify the address and port
number of the EPM Policy Server. You can specify more than one Policy Server.
You must also enable QoS configuration on the device and define its role
combinations.
You must know the IP address and COPS-PR Client Port values for your Policy
Server. You can obtain these values by right-clicking the Policy Server object in
the EPM management console and choosing Properties from the menu.
To configure an Ethernet Switch or BPS unit to accept policy configuration,
follow these steps:
1Launch the Web interface for the device you want to configure. Open a Web
browser and go to the IP address of the device.
2In the Access list, navigate to the following location:
Application > COPS > Configuration
3In the COPS Client Creation area, do the following:
aType the IP address of your EPM Policy Server in the IP Address field.
bType the Policy Server COPS-PR Client Port number (specified in EPM)
in the TCP Port field. The default value for this field is 3288.

4Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS
318396-4.1
cType a priority value in the Priority field.
If you are specifying more than one Policy Server, the priority value sets
the sequential order in which the client connects to the Policy Servers.
dClick the Submit button below the COPS Client Creation area.
An entry for the Policy Server is added to the COPS Configuration Table.
eRepeat steps a through d to specify additional Policy Servers (if required).
4In the Access list navigate to the following location:
Application > QoS > QoS Advanced > Agent
5In the QoS Configuration area, choose the Enabled option from the QoS
Policy Server Control drop-down list.
6Click the Submit button.
7In the Access list navigate to the following location:
Application > QoS > QoS Advanced > Devices > Interface Config
8In the Interface Group Creation area, do the following:
aType a name for a role combination in the Role Combination field. Do not
use spaces in role combination names.
The role combination is a common identifier that is used to enforce a
specific set of policies on specific network entities (for example, the print
server, the Web server, employee workstations, etc.). EPM includes a set
of preconfigured roles with policy objects linked to them. You can use
these roles for test purposes. To find the names of these roles, open the
Policy Setup view of the EPM management console.
bChoose an interface class from the Interface Class drop-down list.
Your choice of Trusted, Untrusted, or Unrestricted will depend on the
type of policy actions that will be enforced on the network traffic
controlled under the role combination.
cClick the Submit button below the Group Creation area.
The new interface group is added to the Interface Group table.
dClick the Edit button next to the new entry in the Interface Group table.
The QoS - Interface Group Port Assignment dialog box appears.

Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS 5
eEnable the check box for each port on the device that you want to include
under the new role combination, and then click the Submit button.
fRepeat steps a through e to define additional role combinations.
9Exit the device’s Web interface.
Testing an Ethernet Switch or BPS device’s policy
configuration
In order to check the policy filters installed on your COPS-PR devices, you must
meet the following requirements:
• You must have SNMP reporting enabled on your network devices.
• You must enter the SNMP string for each device on the device’s
corresponding object in the EPM management console.
• You must have the EMANATE SNMP master agent (available as a default
EPM installation option) installed with your Policy Server.
1In the Policy Setup view, drag a policy from the Available Policy Components
tree to the role that is being reported by the device. Enable the policy from the
Options menu.
For example, you can choose the Mark WWW Traffic Best Effort During
Lunch policy to match all Web traffic between 11:30 am and 1:30 pm. You
can remove the schedule from the policy to make it active all of the time.
2Click the Deploy Changes button on the toolbar to notify the Policy Server of
your changes.
3In the Device Setup view, right-click on the device and choose Show Device
Report from the menu.
4In the Device Report dialog box, click the Lookup button next to the Interface
field and choose the interface for which you want to view installed policy
filters.
If the policy was correctly installed on the device, a list of traffic filters
generated by the policy appears in the Filter Set list. If any traffic matching
the filters has passed through the device, the number of affected packets
appears under the Packets column for each filter.

6Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS
318396-4.1
Known device limitations for EPM 4.1
Users should consider the following guidelines when creating policy
configuration for the BPS or Ethernet Switch devices.
• If you are running a stack of cascaded Ethernet Switch devices, you can
configure user-based policies on the stack ONLY if the stack consists entirely
of COPS-PR compatible devices (Business Policy Switch, Ethernet Switch
460, and Ethernet Switch 470). If you are running a mixed stack that includes
Ethernet Switch 450 devices, you will not be able to configure user-based
policies on the stack.
• Maximum 24 roles per device.
• Maximum 200 IP traffic conditions per device.
• Maximum 14 802 traffic conditions per device.
• Devices with limited memory may not be able to achieve the limitations
stated above.
• The BPS 2.x series has a special limit of 24 traffic conditions that specify the
same source IP address.
To avoid device limitations
• Avoid assigning multiple traffic conditions with overlapping traffic criteria to
a single policy. This will result in excessive numbers of policy filters being
sent to the device. For example, do not assign two traffic conditions, each
specifying the same port number, to the same policy.
• When creating a traffic condition, you should limit the number of different
types of traffic flow criteria you specify. A traffic condition that specifies too
many traffic criteria will, in turn, cause the policies to which it is applied to
send an excessive number of policy filters to network devices. The network
devices may return error messages as a result.

Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS 7
Policy object - device compatibility
EPM provides a selection of policy-related objects (traffic conditions and actions)
to support traffic matching and traffic conditioning on a number of policy-enabled
network devices. This does not mean that all of the devices supported by EPM
will support all of the policy objects provided by EPM. This section lists the
traffic criteria matching and policy action types supported by BayRS devices.
Note: The information displayed here reflects the most up-to-date
information available at the time of the EPM 4.1 release. Policy filter
support capabilities may change for individual device types as their
software is upgraded. Check your device documentation for current
policy support capabilities.
Filtering capability Ether Type
VLAN ID
Inbound User Priority
Protocol
Inbound DSCP
Port Ranges
Src/Dest Address and Mask
Src/Dest Port
Policy priority support
(filter prioritization) (Yes)
DiffServ action capability Mark DSCP
Forward
Drop
Meter (2 Level)
Mark User Priority (L2)
Mark Drop Precedence (L2)
Shaping support (Yes)
COPS-PR capability Configure Roles on Device
Configure Backup PDP on Device

8Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS
318396-4.1
EPM access requirements
In order for EPM to be able to send policy configuration to your networking
devices, COPS-PR, SNMP and Telnet connections must be permitted on your
devices. The following protocols and port numbers are required for
communication between the various components of the EPM product family and
your networking devices:
• The management console uses LDAP (port 389 default) to communicate with
the directory server. It uses SNMP to communicate with Policy Servers and
networking devices. Remote access to the directory requires HTTP (port 80
default).
• The Policy Server uses LDAP (port 389 default) to communicate with the
directory server. It uses COPS-PR (port 3288 default) and SNMP (ports 161
and 162) to communicate with networking devices and the Interface Manager.
• The Interface Manager uses LDAP (port 389 default) to communicate with
the directory server. It uses COPS-PR (port 3288 default) to communicate
with the Policy Server, and uses Telnet (port 23) to communicate with
networking devices.
The LDAP, HTTP, and COPS-PR port numbers can be changed.
Reporting capability Device Reporting - View Filters (via SNMP)
Device Reporting - Filter Statistics (via SNMP)
Queue mapping capability 802 COS to DSCP
DSCP to 802 COS
DSCP to queue
802 COS to queue

Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS 9
Hardware changes on a policy-enabled device
Making hardware changes to a device that is enabled for policy management (for
example, switching off and changing blades) will cause the Policy Server to
generate errors when the device is disconnected. To avoid these errors, disable the
device for policy management through EPM before making the hardware
changes. After you have completed the hardware changes and reconfigured the
device, you can re-enable the device for policy management.
➨To disable a device for policy management, right-click its object in the EPM
management console and then choose Disable For Policy Management from
the menu.
➨To enable a device for policy management, right-click its object in the EPM
management console and then choose Enable For Policy Management from
the menu.
Fixed device reset issue
(Q01038174) BoSS version 3.1.3 had a problem that caused the device to reset
repeatedly when running QoS with OPS (EPM). Fixed in BoSS 3.1.4.2.
Accessing device documentation
A complete set of documentation for the Ethernet Switch and BPS devices,
including configuration manuals, user manuals, release notes, and known
anomalies, are available on the Nortel Networks web site at:
http://www.nortelnetworks.com
Follow the link for Technical Documentation and then choose a device as the
product family.

10 Policy management on the Nortel Ethernet Switch 460, Ethernet Switch 470, and BPS
318396-4.1
BPS action limitations
The Business Policy Switch (BPS) accepts different types of policy actions,
depending on the software version installed on the device. In some cases, the EPM
Policy Server does not send all of the action types accepted by the BPS. Use this
appendix as a reference when assigning actions to policies intended for BPS units.
Your choice of action depends on the port class, as defined on the BPS:
•Trusted ports assume that all traffic coming into the port is originating from
a trusted source. Therefore, the DSCP field of any traffic that enters the BPS
from a trusted port is never re-marked. Any policies instructing the BPS to set
the value of the DSCP field on a trusted port will generate errors. Only
policies with Drop or Forward actions are permitted on trusted ports.
•Untrusted ports assume that all traffic coming into the port is suspect.
Therefore, the DSCP field of any traffic that enters the BPS from an untrusted
port is always re-marked. Any policies instructing the BPS to not set the value
of the DSCP field on an untrusted port will generate errors. Only policies with
Meter, Mark, and Drop actions are permitted on untrusted ports.
•Unrestricted ports do not assume anything about the origin of the incoming
traffic. You may assign a policy action to re-mark the DSCP or not to re-mark
the DSCP. This allows you to manipulate the DSCP value based upon the
filter criteria, and not upon the point of origin. All policy actions are permitted
on unrestricted ports.
The following traffic classifications are handled by the BPS:
•Layer 3 - refers to IP filters, or layer 2 filters with IP classification defined in
the ether type value.
•Layer 2 - refers to filters that have no concept of IP.
•Layer 2 (Tagged) - refers to filters that are layer 2 and have the VLAN tag
specified as Tagged Only.
•Layer 2 (UnTagged) - refers to filters that are layer 2 and have the VLAN tag
specified as UnTagged Only.
This section covers the BPS interface class behavior for the following action
types: