HP 3500yl Series User Manual

6-59
RADIUS Authentication, Authorization, and Accounting
Accounting Services
yet configured the switch to use a RADIUS server, your server data has
changed, or you need to specify a non-default UDP destination port for
accounting requests. Note that switch operation expects a RADIUS server to
accommodate both authentication and accounting.
For example, suppose you want the switch to use the RADIUS server
described below for both authentication and accounting purposes.
■ IP address: 10.33.18.151
■ A non-default UDP port number of 1750 for accounting.
■ An encryption key of “source0151” for accounting sessions.
Syntax: [no] radius-server host < ip-address >
Adds a server to the RADIUS configuration or (with no)
deletes a server from the configuration.
[acct-port < port-number >]
Optional. Changes the UDP destination port for
accounting requests to the specified RADIUS server. If
you do not use this option, the switch automatically
assigns the default accounting port number. (Default:
1813)
[key < key-string >]
Optional. Specifies an encryption key for use during
accounting or authentication sessions with the speci-
fied server. This key must match the encryption key
used on the RADIUS server. Use this command only if
the specified server requires a different encryption key
than configured for the global encryption key.
Note: If you save the config file using Xmodem or TFTP,
the key information is not saved in the file. This
causes RADIUS authentication to fail when the
config file is loaded back onto the switch.
[encrypted-key <key-string >]
Encryption key to use with the RADIUS server, speci-
fied using a base64-encoded aes-256 encrypted string.

HP 3500yl Series Specifications

General

Input Voltage	100-240 VAC
Ports	24/48 x 10/100/1000 ports (depending on model)
Uplink Ports	4 x SFP ports
Layer	Layer 3
Management	CLI, Web, SNMP
Routing Protocol	RIP, OSPF, BGP
Operating Temperature	0°C to 45°C
Stacking	Yes
Memory	512 MB
VLAN Support	Yes
Layer 3 Routing	Yes
Security Features	ACLs, 802.1X
Power Supply	Internal
Power over Ethernet (PoE)	Optional

Summary

1 Security Overview

Access Security Features

Overview of switch's access security features, authentication protocols, and methods, with configuration guidelines.

Network Security Features

Outlines features and defense mechanisms for protecting access through the switch to the network.

Getting Started with Access Security

Recommends enforcing a security policy to ensure ease of getting started is not exploited by unauthorized persons.

2 Configuring Username and Password Security

Overview

Explains console access levels (Manager and Operator) and password configuration.

Configuring Local Password Security

Details setting passwords for Manager and Operator levels via menu, CLI, or WebAgent.

Saving Security Credentials in a Config File

Describes storing and viewing security settings (passwords, keys) in the running-config file.

Front-Panel Security

Explains front-panel security features for clearing passwords or restoring factory defaults.

3 Virus Throttling (Connection-Rate Filtering)

Overview of Connection-Rate Filtering

Explains how connection-rate filtering helps protect the network from worm-like malicious code.

Configuring Connection-Rate Filtering

Provides guidance on enabling connection-rate filtering and configuring responses to high connection-rate traffic.

4 Web and MAC Authentication

Overview

Describes port-based security measures for protecting private networks and the switch from unauthorized access.

Configuring Web Authentication

Outlines steps to configure Web Authentication using a RADIUS server.

Configuring MAC Authentication on the Switch

Details the process of configuring MAC Authentication on the switch.

Customizable HTML Templates

Explains how to create customized login web pages to improve the look and feel of Web Authentication.

5 TACACS+ Authentication

Overview

Explains how TACACS+ authentication enables the use of a central server to allow or deny access.

Terminology Used in TACACS Applications

Defines key terms related to TACACS+ operations, such as NAS, TACACS+ Server, and Authentication.

Configuring TACACS+ on the Switch

Provides steps for configuring the switch to support TACACS+ operation.

6 RADIUS Authentication, Authorization, and Accounting

Overview

Explains how RADIUS enables the use of servers to maintain separate authentication and accounting.

Configuring the Switch for RADIUS Authentication

Describes how to configure the switch to interact with a RADIUS server for authentication.

Configuring RADIUS Server Support for Switch Services

Provides guidelines for configuring RADIUS servers to dynamically apply CoS and rate-limiting features.

Configuring and Using Dynamic (RADIUS-Assigned) Access Control Lists

Describes how to apply RADIUS-assigned ACLs on the switch and assumes a general understanding of ACL structure.

8 Configuring Secure Shell (SSH)

Overview

Explains how SSHv2 provides secure remote access via encrypted paths.

Steps for Configuring and Using SSH for Switch and Client Authentication

Outlines general steps for configuring SSH for two-way authentication between the switch and an SSH client.

Configuring the Switch for SSH Operation

Describes commands used to configure the switch for SSH operation.

9 Configuring Secure Socket Layer (SSL)

Overview

Explains how SSLv3 and TLSv1 provide remote web access via encrypted paths.

Steps for Configuring and Using SSL for Switch and Client Authentication

Details the general steps for configuring SSL for switch and client authentication.

Configuring the Switch for SSL Operation

Describes CLI commands for generating certificates and enabling SSL.

10 IPv4 Access Control Lists (ACLs)

Introduction

Defines ACLs and ACEs, and describes how to configure, apply, and edit static IPv4 ACLs.

Overview of Options for Applying IPv4 ACLs on the Switch

Explains static ACL applications (RACL, VACL, Static Port ACL) and dynamic RADIUS-assigned ACLs.

Command Summary for Standard IPv4 ACLs

Provides a summary of commands for creating, editing, and deleting standard IPv4 ACLs.

Command Summary for IPv4 Extended ACLs

Provides a summary of commands for creating, editing, and deleting extended IPv4 ACLs.

11 Configuring Advanced Threat Protection

Introduction

Describes software features providing advanced threat protection against attacks.

DHCP Snooping

Explains how DHCP snooping protects the network from common DHCP attacks.

Dynamic ARP Protection

Details how dynamic ARP protection protects the network from ARP cache poisoning attacks.

Dynamic IP Lockdown

Explains how dynamic IP lockdown prevents IP source address spoofing on a per-port and per-VLAN basis.

13 Configuring Port-Based and User-Based Access Control (802.1X)

Overview

Explains why port-based or user-based access control is used and its general features.

User Authentication Methods

Details the two methods for using 802.1X access control: Port-Based and User-Based.

Configuring Switch Ports as 802.1X Authenticators

Outlines steps to configure switch ports to operate as 802.1X authenticators.

14 Configuring and Monitoring Port Security

Overview

Outlines features and defense mechanisms for protecting access through the switch to the network.

Port Security

Details how to configure each switch port with a unique list of MAC addresses of authorized devices.

MAC Lockdown

Explains static addressing used to prevent station movement and MAC address hijacking.

MAC Lockout

Details how to block a specific MAC address to drop all traffic to or from it.

15 Using Authorized IP Managers

Overview

Explains how the Authorized IP Managers feature uses IP addresses and masks to determine station access.

Defining Authorized Management Stations

Details how to authorize single stations or groups of stations for IP access.

Product Documentation

About Your Switch Manual Set

Provides latest documentation information and lists electronic publications.

Electronic Publications

Lists available publications in PDF format on the HP Networking web site.