Content

| 9.4 |  | Basic Security |
| 9.4.1 |  | Access control policy |

To begin to implement any access control, a standard access policy must be created. An access policy defines access rights and privileges for the network users. The access policy should provide guidelines for connecting external networks, connecting devices to a network, and adding new software to systems.

Most access policies will outline the following information:

- Network device management issues such as physical security and access control
- User access to the network
- Traffic-flow policies
- Route Filtering

Each layer of a hierarchical network will probably have a different access policy because each layer is responsible for different tasks. Figure illustrates a campus network where an access policy should be defined.

The access layer is the point at which local end users are allowed into the network. Port security can be used to control traffic at the access layer. Passwords can be used to protect network devices. The access layer may also use VLANs, access lists or filters to further optimize traffic control for a particular set of users.

The distribution layer of the network is the demarcation point between the access and core layers. This layer helps to define and differentiate the core. Providing boundary definition, the distribution layer is the place at which packet manipulation should take place. The distribution layer should be responsible for ensuring that only necessary traffic makes it to the core or another switch block. The distribution layer can be summarized as the layer that provides policy-based connectivity.

The core layer is a high-speed switching backbone, and it should be designed to switch packets as fast as possible. This layer of the network should not perform any packet manipulation, such as access lists and filtering, which would slow down the switching of packets.