# Filters in the NSNA solution

A corresponding NSNA filter set is provisioned for the NSNA Red, Yellow, and Green enforcement zones. Avaya recommends that you use the default filter sets. You can, however, create customized filter sets and attach these to the NSNA VLANs. You can also modify the default filters after you have enabled them and assigned them to the NSNA VLANs.

For more information about modifying the filter sets, see Avaya Ethernet Routing Switch 5000 Series Configuration — Quality of Service (NN47200-504). For more information about the current default NSNA filter set rules, see Default NSNA filters.

Important

When the NSNA filters are applied to a port, an existing Quality of Service (QoS) filters on that port are disabled, and the NSNA filters are applied (pre-existing policies are re-enabled when NSNA is disabled). See Rolling back NSNA mode to default mode and NSNA solution in an active network deployment for more information.

You can configure the NSNA filters manually if, for example, you have specific parameters or proprietary applications.

In certain configurations, workstation startup processes depend on specific network communications. System startup can be negatively impacted if certain network communications are blocked by the initial Red filters. Ensure you are aware of which communications are required for system startup and user authentication prior to the NSNA log on.

If you must configure filters manually to best address your circumstances, Avaya recommends that you use the default filters as your template. Manually configured custom filters must be included in the NSNA filter set.

Important

Avaya does not support NSNA filter sets and non-NSNA filter sets coexisting on NSNA ports.

Red, Yellow, and Green VLANs must be configured on the NSNA uplink ports of the NSNA network access device when the NSNA filter sets for each enforcement zone are assigned to specific VLANs. When only the filter sets are used, a Red VLAN must be configured on the NSNA uplink ports. To configure the uplink ports, use `nsna port <portlist> uplink vlans <vidlist>` (see Enabling NSNA on ports)

Only NSNA ports (uplink or dynamic) can be in the Red, Yellow, Green, and VoIP VLANs.

NSNA ports become members of NSNA VLANs when NSNA is enabled. Manually attaching dynamic NSNA ports to a non-NSNA VLAN is not allowed.

Uplink ports can be members of non-NSNA VLANs.

The NSNA software puts all user ports (dynamic NSNA ports) in the Red, Yellow, or Green state dynamically. When the switch initially comes up, all NSNA ports are moved to the Red state with Red filters attached.

The uplinks can be tagged or untagged. A typical uplink on the edge switch is one or more MLTs connected to two core Ethernet Routing Switches 8800/8600 (to provide redundancy). The core routing switches implement SMLT, but that is transparent to the edge switch. In Layer 2, the NSNA uplink is always tagged. In Layer 3, the uplink can be tagged or untagged (but you do not have to set that port as NSNA uplink—it is just an uplink to the router).

Important

Avaya recommends that you set the NSNA uplink port STP to either Fast Learning or disabled.

The Red, Yellow, and Green VLANs can be Layer 2 or Layer 3. For more information, see Topologies.

You must have one, and only one, Red VLAN on each switch. You can, however, have multiple Yellow, Green, and VoIP VLANs on each switch.

With Ethernet Routing Switch 5000 Series, each switch can support five Yellow VLANs, five Green VLANs, and five VoIP VLANs.

The VoIP filters are part of the Red and Yellow filters by default, but you can define a separate set of VoIP filters (with different VoIP policing values), if necessary. In the Green VLAN, all traffic is allowed by the default filter, therefore VoIP filters are not specifically added.

You can create multiple Yellow and Green VLANs, as well as multiple VoIP filter sets. When you create the Red, Yellow, and Green VLANs, you attach the Red, Yellow, and Green filters (and a set of VoIP filters to the new Red and Yellow VLANs). For example, when the NSNA software adds a port to the Yellow VLAN, it installs the Yellow filters and the VoIP filters that you attached to the Yellow VLAN.

Important

Manual configuration of filters is optional. If filters are not manually configured prior to configuring the NSNA VLANs, the switch automatically generates default filters after you configure the Red, Yellow, Green, and VoIP VLANs.

The devices that connect to an NSNA port can be DHCP PCs and dumb devices, as well as static PCs and dumb devices. In order to have Green access the MAC of the dumb devices must be added to the SNAS MAC address database.

The following table shows filter consumption when using the default NSNA filters.

Table 1. Default NSNA filter consumption
Filter set | Filters consumed | Precedence levels consumed
--- | --- | ---
Red | 5, plus 2 filters for each VoIP VLAN configured | 3, *plus 1 precedence level for VoIP VLANs
Yellow | 6, plus 2 filters for each VoIP VLAN configured | 4, *plus 1 precedence level for VoIP VLANs
*Although each additional VoIP VLAN consumes two more filters, no additional precedence levels are consumed (that is, the first VoIP VLAN consumes one precedence level, but additional VoIP VLANs do not consume any more precedence levels).