background image
Definition of an Access Policy
425
Documentation of the type of traffic allowed from the switch blocks
through the distribution layer to the core layer
Route filtering (access lists)
When designing your access policy, remember the big picture: access pol-
icies are meant to secure the corporate network and prevent unwanted and
unneeded traffic from entering it or slowing it down. Network administra-
tors should implement access policies based on a set of defined traffic stan-
dards as well as provide a level of security to campus network devices.
Applying Policies to the Hierarchical Model
Throughout this book, when discussing different aspects of network design,
we have included a discussion of the Cisco three-layer hierarchical model. A
discussion of network policies is no exception. Each layer in the Cisco hier-
archical model can have a different access policy because each layer can be
responsible for a different task. However, only the access layer and the dis-
tribution layer are typically used for implementing policies.
Access Layer
As you already know, the access layer is where users gain access to the net-
work. You need to create security without hindering the company's business
requirements. You can provide security at the access layer with port security
on layer 2 switches and passwords on all devices in the internetwork.
Distribution Layer
The distribution layer is where routing occurs (that is, where layer 3 devices
are present). At this layer, you create routing policies, which will ensure that
only traffic that is necessary makes it to the core layer or is switched to
another access layer. Because the distribution layer is also responsible for
advertising routing information to the core layer, the routing policy can
include route filtering with access lists and routing filters.
Core Layer
The idea of the core layer is to pass data as quickly as possible, so typically,
no access policies would apply here. Any policy implemented at the core will
only slow down data traversing the core. The distribution layer is responsible
for preventing unwanted traffic from entering the core layer.
Copyright ©2000 SYBEX , Inc., Alameda, CA
www.sybex.com