topic RE: Control Plane protection for S-Series in ExtremeSwitching (EOS)

Control Plane protection for S-Series

Susan_Shepard — Sat, 20 May 2017 01:31:00 GMT

How can I verify control plane protection for compliance with STIG NET0966?

RE: Control Plane protection for S-Series

Daniel_Coughlin — Sat, 20 May 2017 07:43:00 GMT

The best way would be to run a compliance tool against it. If there are concerns based on the results give us a call.

RE: Control Plane protection for S-Series

Susan_Shepard — Mon, 22 May 2017 17:39:00 GMT

We have a C4 team here doing STIG checks. They are used to Cisco and having trouble with the Extreme/Enterasys devices. They are concerned about STIG NET0966: Control plane protection is not enabled. There's no way to confirm this?

RE: Control Plane protection for S-Series

Daniel_Coughlin — Thu, 15 Jun 2017 18:42:00 GMT

Without know what the test is I cannot answer. We harden the systems they best we can and when issues arise we get them address ASAP.

RE: Control Plane protection for S-Series

Erik_Auerswald — Thu, 15 Jun 2017 22:01:00 GMT

Hi Susan,

control plane protection on Cisco differs from similar functionality on the S-Series, especially regarding configuration (it differs between Cisco devices as well, e.g. CoPP vs. CPPr). Thus it does not help to compare an S-Series configuration file to a Cisco template.

You might want to (have the C4 team) look into the Host DoS and Host ACL features of the S-Series as a starting point.

Thanks,
Erik