EXOS 16.1 Releases with New Hardware and Role-based Policy Support!

[Drew_C]

We are pleased to announce that our secure, role-based policy management technology is now available for the newly launched Summit® X450-G2 family of fixed switches and some other select previously released Summit switches. This marks the integration of proven policy and security management technology into the ExtremeXOS® operating system, allowing customers the flexibility to define and manage end-to-end policy in mixed Extreme Networks' wired and wireless environments, including those with IdentiFiTM Access Points, the A, B, C, K and S-Series switches and the Summit line of switches.

New Hardware Supported in ExtremeXOS 16.1:

• BDXB-40G12X-XL I/O, BDXA-G48T, and BDXA-G48X modules for the BlackDiamond X8 series switches
• Summit X450-G2 series switches: 24t-10GE4, 24p-10GE4, 48t-10GE4, 48p-10GE4, 24t-GE4, 24p-GE4, 48t-GE4, 48p-GE4

New and Corrected Features in ExtremeXOS 16.1:

• RADIUS Authentication and Authorization Enhancements
• ONEPolicy
• Access Control List (ACL) Library Enhancements
• Class of Service (CoS) Enhancements
• Command Usability Enhancements
• Access Control List (ACL) Two-Stage Policy
• Various Security Enhancements
• Generalized Precision Time Protocol (gPTP) Enhancement
• Extreme Loop Recovery Protocol (ELRP) Port Shutdown
• Increase of Protocol-Independent Multicast (PIM) Control Packets
• OpenFlow Updated Match Conditions and Actions
• Alternate Stacking Supported on 1G Variant of Summit X460-G2 Series Switches
• Two-Way Active Measurement Protocol (TWAMP) Light
• Flow Redirects (Policy-Based Routes) Limits Increase
• Single Virtual Group for User Access Control Lists (ACLs)
• 40Gbps LR4 Parallel Single-Mode (PSM) Quad Small Form-Factor Pluggable (QSFP) Optical Transceivers

Additional details on these features can be found in the documentation listed below.

• ExtremeXOS 16.1 Datasheet
• ExtremeXOS User Guide 16.1
• ExtremeXOS Command Reference Guide 16.1
• Release Notes can be found on http://support.extremenetworks.com/ - Follow the Downloads for BlackDiamond Series, Summit Series, E4G, and ExtremeXOS link.

In anticipation of a few questions, we've proactively published a few articles to GTAC Knowledge to coincide with this release.

• Can accounts created in EXOS 16 be used to log in when running previous versions of EXOS?
• Cannot log into EXOS switch after downgrading from EXOS 16 to an earlier release
• How to determine if an account password is hashed with MD5 or SHA-256
• How to convert passwords for accounts created prior to EXOS 16 to SHA-256

Official Press Release: http://investor.extremenetworks.com/releasedetail.cfm?ReleaseID=919071

If you've got any questions, feel free to post them here.

[Stephane_Grosj1]

Hi Daniel,

x250 are not supported after 15.3, so no.
x440, yes.
BD8K : that depends on your modules. Some old modules are not supported since previous release, and 16.1 will not change that.

16.1 doesn't bring new hardware end of support.

[Daniel_Valera1]

Thanks Stephane

[Christoph]

It's great, that the policy feature is now available for EXOS!
In the release note of summit X450-g2 it's policy capabilities are listed, but not in the ones for X460-G2 nor the other new switches.

Do you have an overview or a kind of matrix which shows policy capabilities of all supported models?

[Drew_C]

Hi Christoph,
Check your email 😉

Here's the ONEPolicy description from the RN. Hopefully it will answer your questions.

ONEPolicy provides for the configuration of role-based profiles for securing and provisioning network resources based upon the role the user or device plays within the enterprise. By first defining the user or device role, network resources can be tailored to a specific user, system, service, or port-based context by configuring and assigning rules to the policy role. A policy role can be configured for any combination of Class of Service, VLAN assignment, classification rule precedence, logging, accounting, or default behavior based upon L2, L3, and L4 packet fields. Hybrid authentication allows either policy or dynamic VLAN assignment, or both, to be applied through RADIUS authorization.

Limitations

• Stacking of dissimilar models is not supported.
• Only 'macdest', 'macsource', or 'port' policy rules can be applied to QinQ (that is, double-tagged) packets received on an untagged VMAN port.

[Christoph]

Hello Drew

thanks for your answer.
Because I have no serial number of a summit switch I was not able to access the release notes.
I'm also interested in a few more details for the systems you mentioned:

• Which classification rules are supported?
• How many rules?
• How many users per port/chassis/stack?
• Will policies have any impact on other functionalities?

Regards
Christoph