Home
HP
Switch
3600 v2 Series
HP 3600 v2 Series Configuration Guide
4
of 1
of 1 rating
449 pages
Give review
Manual
Specs
To Next Page
To Next Page
To Previous Page
To Previous Page
Loading...
237
<SwitchA> display habp
Global HABP information:
HABP Mode: Server
Sending HABP request packets every 50 seconds
Bypass VLAN: 1
# Display HABP MAC address table entries.
<SwitchA> display habp table
MAC Holdtime Receive Port
001f-3c00-0030 53 Ethernet1/0/2
001f-3c00-0031 53 Ethernet1/0/1
249
251
Table of Contents
Table of Contents
3
Configuring AAA
14
AAA Overview
14
Radius
15
Hwtacacs
20
Domain-Based User Management
22
RADIUS Server Feature of the Switch
23
AAA for MPLS L3Vpns
24
Protocols and Standards
25
RADIUS Attributes
25
FIPS Compliance
28
AAA Configuration Considerations and Task List
28
Configuring AAA Schemes
30
Configuring Local Users
30
Configuring RADIUS Schemes
34
Configuring HWTACACS Schemes
47
Configuring AAA Methods for ISP Domains
54
Configuration Prerequisites
54
Creating an ISP Domain
54
Configuring ISP Domain Attributes
55
Configuring AAA Authentication Methods for an ISP Domain
56
Configuring AAA Authorization Methods for an ISP Domain
58
Configuring AAA Accounting Methods for an ISP Domain
59
Tearing down User Connections
61
Configuring a NAS ID-VLAN Binding
61
Specifying the Device ID Used in Stateful Failover Mode
61
Configuring a Switch as a RADIUS Server
62
RADIUS Server Functions Configuration Task List
62
Configuring a RADIUS User
62
Specifying a RADIUS Client
63
Displaying and Maintaining AAA
63
AAA Configuration Examples
64
AAA for Telnet Users by an HWTACACS Server
64
AAA for Telnet Users by Separate Servers
65
Authentication/Authorization for Ssh/Telnet Users by a RADIUS Server
67
Level Switching Authentication for Telnet Users by an HWTACACS Server
70
RADIUS Authentication and Authorization for Telnet Users by a Switch
74
Troubleshooting AAA
76
Troubleshooting RADIUS
76
Troubleshooting HWTACACS
77
802.1X Overview
78
802.1X Architecture
78
Controlled/Uncontrolled Port and Port Authorization Status
78
802.1X-Related Protocols
79
Packet Formats
80
EAP over RADIUS
81
Initiating 802.1X Authentication
81
802.1X Client as the Initiator
81
Access Device as the Initiator
82
802.1X Authentication Procedures
82
A Comparison of EAP Relay and EAP Termination
83
EAP Relay
83
EAP Termination
86
Configuring 802.1X
87
HP Implementation of 802.1X
87
Access Control Methods
87
Using 802.1X Authentication with Other Features
87
Configuration Prerequisites
93
802.1X Configuration Task List
93
Enabling 802.1X
94
Configuration Guidelines
94
Configuration Procedure
94
Enabling EAP Relay or EAP Termination
94
Setting the Port Authorization State
95
Specifying an Access Control Method
96
Setting the Maximum Number of Concurrent 802.1X Users on a Port
96
Setting the Maximum Number of Authentication Request Attempts
97
Setting the 802.1X Authentication Timeout Timers
97
Configuring the Online User Handshake Function
97
Configuration Guidelines
98
Configuration Procedure
98
Configuring the Authentication Trigger Function
98
Configuration Guidelines
99
Configuration Procedure
99
Specifying a Mandatory Authentication Domain on a Port
99
Configuring the Quiet Timer
100
Enabling the Periodic Online User Re-Authentication Function
100
Configuration Guidelines
100
Configuration Procedure
101
Configuring a Port to Send EAPOL Frames Untagged
101
Setting the Maximum Number of 802.1X Authentication Attempts for MAC Authentication Users
101
Configuring a VLAN Group
102
Configuring an 802.1X Guest VLAN
102
Configuration Guidelines
102
Configuration Prerequisites
103
Configuration Procedure
103
Configuring an 802.1X Auth-Fail VLAN
104
Configuration Guidelines
104
Configuration Prerequisites
104
Configuration Procedure
104
Configuring an 802.1X Critical VLAN
105
Configuration Guidelines
105
Configuration Prerequisites
105
Configuration Procedure
105
Specifying Supported Domain Name Delimiters
106
Configuring an 802.1X Voice VLAN
106
Configuration Guidelines
107
Configuration Prerequisites
107
Configuration Procedure
107
Configuring 802.1X MAC Address Binding
107
Displaying and Maintaining 802.1X
108
802.1X Authentication Configuration Example
109
Network Requirements
109
Configuration Procedure
109
Verifying the Configuration
111
With Guest VLAN and VLAN Assignment Configuration Example
111
Network Requirements
111
Configuration Procedure
112
Verifying the Configuration
113
With ACL Assignment Configuration Example
114
Network Requirements
114
Configuration Procedure
114
Verifying the Configuration
115
Configuring EAD Fast Deployment
116
Overview
116
Free IP
116
URL Redirection
116
Configuration Prerequisites
116
Configuring a Free IP
116
Configuring the Redirect URL
117
Setting the EAD Rule Timer
117
Displaying and Maintaining EAD Fast Deployment
118
EAD Fast Deployment Configuration Example
118
Network Requirements
118
Configuration Procedure
119
Verifying the Configuration
119
Troubleshooting EAD Fast Deployment
120
Web Browser Users Cannot be Correctly Redirected
120
Configuring MAC Authentication
121
Overview
121
User Account Policies
121
Authentication Approaches
121
MAC Authentication Timers
122
Using MAC Authentication with Other Features
122
VLAN Assignment
122
ACL Assignment
122
Guest VLAN
122
Critical VLAN
123
Configuration Task List
123
Basic Configuration for MAC Authentication
123
Configuring MAC Authentication Globally
124
Configuring MAC Authentication on a Port
124
Specifying a MAC Authentication Domain
125
Configuring a MAC Authentication Guest VLAN
125
Configuring a MAC Authentication Critical VLAN
126
Configuring MAC Authentication Delay
127
Enabling MAC Authentication Multi-VLAN Mode
128
Displaying and Maintaining MAC Authentication
128
MAC Authentication Configuration Examples
129
Local MAC Authentication Configuration Example
129
RADIUS-Based MAC Authentication Configuration Example
131
ACL Assignment Configuration Example
133
Configuring Portal Authentication
135
Overview
135
Extended Portal Functions
135
Portal System Components
135
Portal System Using the Local Portal Server
137
Portal Authentication Modes
138
Portal Support for EAP
139
Layer 2 Portal Authentication Process
140
Layer 3 Portal Authentication Process
141
Portal Stateful Failover
144
Portal Authentication Across Vpns
146
Portal Configuration Task List
146
Configuration Prerequisites
147
Specifying the Portal Server
148
Specifying the Local Portal Server for Layer 2 Portal Authentication
148
Specifying a Portal Server for Layer 3 Portal Authentication
149
Configuring the Local Portal Server
149
Customizing Authentication Pages
149
Configuring the Local Portal Server
152
Enabling Portal Authentication
153
Enabling Layer 2 Portal Authentication
153
Enabling Layer 3 Portal Authentication
154
Controlling Access of Portal Users
154
Configuring a Portal-Free Rule
154
Configuring an Authentication Source Subnet
156
Setting the Maximum Number of Online Portal Users
156
Specifying an Authentication Domain for Portal Users
157
Configuring Layer 2 Portal Authentication to Support Web Proxy
157
Enabling Support for Portal User Moving
158
Specifying an Auth-Fail VLAN for Portal Authentication
158
Configuring RADIUS Related Attributes
159
Specifying NAS-Port-Type for an Interface
159
Specifying a NAS ID Profile for an Interface
160
Specifying a Source IP Address for Outgoing Portal Packets
160
Configuring Portal Stateful Failover
161
Specifying an Auto Redirection URL for Authenticated Portal Users
162
Configuring Portal Detection Functions
163
Configuring Online Layer 2 Portal User Detection
163
Configuring the Portal Server Detection Function
163
Configuring Portal User Information Synchronization
165
Logging off Portal Users
166
Displaying and Maintaining Portal
166
Portal Configuration Examples
167
Configuring Direct Portal Authentication
167
Configuring Re-DHCP Portal Authentication
171
Configuring Cross-Subnet Portal Authentication
173
Configuring Direct Portal Authentication with Extended Functions
175
Configuring Re-DHCP Portal Authentication with Extended Functions
177
Configuring Cross-Subnet Portal Authentication with Extended Functions
180
Configuring Portal Stateful Failover
182
Configuring Portal Server Detection and Portal User Information Synchronization
189
Configuring Layer 2 Portal Authentication
195
Troubleshooting Portal
198
Inconsistent Keys on the Access Device and the Portal Server
198
Incorrect Server Port Number on the Access Device
199
Configuring Triple Authentication
200
Overview
200
Triple Authentication Mechanism
200
Using Triple Authentication with Other Features
201
Configuring Triple Authentication
201
Triple Authentication Configuration Examples
202
Triple Authentication Basic Function Configuration Example
202
Triple Authentication Supporting VLAN Assignment and Auth-Fail VLAN Configuration Example
204
Configuring Port Security
210
Overview
210
Port Security Features
210
Port Security Modes
211
Working with Guest VLAN and Auth-Fail VLAN
213
Configuration Task List
213
Enabling Port Security
214
Setting Port Security's Limit on the Number of MAC Addresses on a Port
214
Setting the Port Security Mode
215
Configuration Prerequisites
215
Configuration Procedure
215
Configuring Port Security Features
216
Configuring NTK
216
Configuring Intrusion Protection
216
Enabling Port Security Traps
217
Configuring Secure MAC Addresses
217
Configuration Prerequisites
218
Configuration Procedure
218
Ignoring Authorization Information
219
Displaying and Maintaining Port Security
220
Port Security Configuration Examples
220
Configuring the Autolearn Mode
220
Configuring the Userloginwithoui Mode
223
Configuring the Macaddresselseuserloginsecure Mode
227
Troubleshooting Port Security
230
Cannot Set the Port Security Mode
230
Cannot Configure Secure MAC Addresses
230
Cannot Change Port Security Mode When a User Is Online
231
Configuring a User Profile
232
Overview
232
User Profile Configuration Task List
232
Creating a User Profile
232
Applying a Qos Policy
233
Enabling a User Profile
233
Displaying and Maintaining User Profiles
234
Configuring Password Control
235
Overview
235
FIPS Compliance
237
Password Control Configuration Task List
238
Configuring Password Control
238
Enabling Password Control
238
Setting Global Password Control Parameters
239
Setting User Group Password Control Parameters
241
Setting Local User Password Control Parameters
241
Setting Super Password Control Parameters
242
Setting a Local User Password in Interactive Mode
242
Displaying and Maintaining Password Control
243
Password Control Configuration Example
243
Configuring HABP
246
Overview
246
Configuring HABP
247
Configuring the HABP Server
247
Configuring an HABP Client
247
Displaying and Maintaining HABP
248
HABP Configuration Example
248
Managing Public Keys
251
Overview
251
FIPS Compliance
251
Configuration Task List
252
Creating a Local Asymmetric Key Pair
252
Displaying or Exporting the Local Host Public Key
253
Destroying a Local Asymmetric Key Pair
254
Specifying the Peer Public Key on the Local Device
255
Displaying and Maintaining Public Keys
256
Public Key Configuration Examples
256
Manually Specifying the Peer Public Key on the Local Device
256
Importing a Peer Public Key from a Public Key File
258
Configuring PKI
261
Overview
261
PKI Terms
261
PKI Architecture
262
PKI Operation
263
PKI Applications
263
PKI Configuration Task List
263
Configuring an Entity DN
264
Configuring a PKI Domain
265
Configuration Guidelines
266
Configuration Procedure
266
Submitting a PKI Certificate Request
267
Submitting a Certificate Request in Auto Mode
267
Submitting a Certificate Request in Manual Mode
267
Retrieving a Certificate Manually
269
Configuration Guidelines
269
Configuration Procedure
269
Configuring PKI Certificate Verification
269
Configuration Guidelines
270
Configuring CRL-Checking-Enabled PKI Certificate Verification
270
Configuring CRL-Checking-Disabled PKI Certificate Verification
270
Destroying a Local RSA Key Pair
271
Deleting a Certificate
271
Configuring an Access Control Policy
271
Displaying and Maintaining PKI
272
PKI Configuration Examples
272
Certificate Request from an RSA Keon CA Server
273
Certificate Request from a Windows 2003 CA Server
276
Certificate Attribute Access Control Policy Configuration Example
279
Troubleshooting PKI
280
Failed to Retrieve a CA Certificate
280
Failed to Request a Local Certificate
281
Failed to Retrieve Crls
281
Configuring Ipsec
283
Overview
283
Basic Concepts
283
Ipsec for Ipv6 Routing Protocols
286
Protocols and Standards
286
FIPS Compliance
286
Configuring Ipsec
286
Implementing ACL-Based Ipsec
286
Feature Restrictions and Guidelines
286
ACL-Based Ipsec Configuration Task List
287
Configuring Acls
287
Configuring an Ipsec Proposal
289
Configuring an Ipsec Policy
290
Applying an Ipsec Policy Group to an Interface
294
Configuring the Ipsec Session Idle Timeout
294
Enabling ACL Checking of De-Encapsulated Ipsec Packets
295
Configuring the Ipsec Anti-Replay Function
295
Configuring Packet Information Pre-Extraction
296
Configuring Ipsec for Ipv6 Routing Protocols
296
Displaying and Maintaining Ipsec
297
Ipsec Configuration Examples
298
IKE-Based Ipsec Tunnel for Ipv4 Packets Configuration Example
298
Ipsec for Ripng Configuration Example
300
Configuring IKE
304
Overview
304
IKE Security Mechanism
304
IKE Operation
304
IKE Functions
305
Relationship between IKE and Ipsec
306
Protocols and Standards
306
IKE Configuration Task List
306
Configuring a Name for the Local Security Gateway
307
Configuring an IKE Proposal
307
Configuring an IKE Peer
308
Setting Keepalive Timers
310
Setting the NAT Keepalive Timer
310
Configuring a DPD Detector
311
Disabling Next Payload Field Checking
311
Displaying and Maintaining IKE
312
IKE Configuration Example
312
Troubleshooting IKE
315
Invalid User ID
315
Proposal Mismatch
315
Failing to Establish an Ipsec Tunnel
316
ACL Configuration Error
316
Configuring SSH2.0
317
Overview
317
SSH Operation
317
SSH Connection Across Vpns
319
FIPS Compliance
320
Configuring the Switch as an SSH Server
320
SSH Server Configuration Task List
320
Generating Local Key Pairs
320
Enabling the SSH Server Function
321
Configuring the User Interfaces for SSH Clients
321
Configuring a Client's Host Public Key
322
Configuring an SSH User
323
Setting the SSH Management Parameters
324
Setting the DSCP Value for Packets Sent by the SSH Server
325
Configuring the Switch as an SSH Client
326
SSH Client Configuration Task List
326
Specifying a Source IP Address/Interface for the SSH Client
326
Configuring Whether First-Time Authentication Is Supported
326
Establishing a Connection between the SSH Client and Server
327
Setting the DSCP Value for Packets Sent by the SSH Client
328
Displaying and Maintaining SSH
329
SSH Server Configuration Examples
329
When the Switch Acts as a Server for Password Authentication
330
When the Switch Acts as a Server for Publickey Authentication
332
SSH Client Configuration Examples
337
When Switch Acts as Client for Password Authentication
337
When Switch Acts as Client for Publickey Authentication
340
Configuring SFTP
343
Overview
343
FIPS Compliance
343
Configuring the Switch as an SFTP Server
343
Enabling the SFTP Server
343
Configuring the SFTP Connection Idle Timeout Period
344
Configuring the Switch as an SFTP Client
344
Specifying a Source IP Address or Interface for the SFTP Client
344
Establishing a Connection to the SFTP Server
345
Working with SFTP Directories
345
Working with SFTP Files
346
Displaying Help Information
347
Terminating the Connection to the Remote SFTP Server
347
Setting the DSCP Value for Packets Sent by the SFTP Client
347
SFTP Client Configuration Example
348
SFTP Server Configuration Example
351
Configuring SCP
354
Overview
354
FIPS Compliance
354
Configuring the Switch as an SCP Server
354
Configuring the Switch as the SCP Client
355
SCP Client Configuration Example
355
SCP Server Configuration Example
356
Configuring SSL
358
Overview
358
SSL Security Mechanism
358
SSL Protocol Stack
358
FIPS Compliance
359
Configuration Task List
359
Configuring an SSL Server Policy
359
SSL Server Policy Configuration Example
361
Configuring an SSL Client Policy
363
Displaying and Maintaining SSL
364
Troubleshooting SSL
364
Configuring TCP Attack Protection
365
Overview
365
Enabling the SYN Cookie Feature
365
Configuring TCP Fragment Attack Protection
366
Displaying and Maintaining TCP Attack Protection
366
Configuring IP Source Guard
367
Overview
367
Static IP Source Guard Binding Entries
367
Dynamic IP Source Guard Binding Entries
368
Configuration Task List
368
Configuring the Ipv4 Source Guard Feature
369
Configuring Ipv4 Source Guard on an Interface
369
Configuring a Static Ipv4 Source Guard Binding Entry
370
Setting the Maximum Number of Ipv4 Source Guard Binding Entries
371
Configuring the Ipv6 Source Guard Feature
372
Configuring Ipv6 Source Guard on an Interface
372
Configuring a Static Ipv6 Source Guard Binding Entry
373
Setting the Maximum Number of Ipv6 Source Guard Binding Entries
374
Displaying and Maintaining IP Source Guard
374
IP Source Guard Configuration Examples
375
Static Ipv4 Source Guard Configuration Example
375
Dynamic Ipv4 Source Guard Using DHCP Snooping Configuration Example
377
Dynamic Ipv4 Source Guard Using DHCP Relay Configuration Example
378
Static Ipv6 Source Guard Configuration Example
379
Dynamic Ipv6 Source Guard Using Dhcpv6 Snooping Configuration Example
380
Dynamic Ipv6 Source Guard Using ND Snooping Configuration Example
381
Global Static IP Source Guard Configuration Example
382
Troubleshooting IP Source Guard
384
Configuring ARP Attack Protection
385
Overview
385
ARP Attack Protection Configuration Task List
385
Configuring ARP Defense against IP Packet Attacks
386
Configuring ARP Source Suppression
386
Enabling ARP Black Hole Routing
387
Displaying and Maintaining ARP Defense against IP Packet Attacks
387
Configuration Example
387
Configuring ARP Packet Rate Limit
389
Introduction
389
Configuration Procedure
389
Configuring Source MAC Address Based ARP Attack Detection
390
Configuration Procedure
390
Displaying and Maintaining Source MAC Address Based ARP Attack Detection
391
Configuration Example
391
Configuring ARP Packet Source MAC Address Consistency Check
392
Introduction
392
Configuration Procedure
392
Configuring ARP Active Acknowledgement
392
Configuration Procedure
393
Configuring ARP Detection
393
Introduction
393
Configuring User Validity Check
393
Configuring ARP Packet Validity Check
394
Configuring ARP Restricted Forwarding
395
Configuring the ARP Detection Logging Function
396
Displaying and Maintaining ARP Detection
396
User Validity Check Configuration Example
396
User Validity Check and ARP Packet Validity Check Configuration Example
398
ARP Restricted Forwarding Configuration Example
399
Configuring ARP Automatic Scanning and Fixed ARP
401
Configuration Guidelines
401
Configuration Procedure
401
Configuring ARP Gateway Protection
402
Configuration Guidelines
402
Configuration Procedure
402
Configuration Example
402
Configuring ARP Filtering
403
Configuration Guidelines
403
Configuration Procedure
403
Configuration Example
404
Configuring ND Attack Defense
405
Overview
405
Enabling Source MAC Consistency Check for ND Packets
406
Configuring the ND Detection Function
406
Introduction to ND Detection
406
Configuration Guidelines
407
Configuration Procedure
407
Displaying and Maintaining ND Detection
407
ND Detection Configuration Example
408
Network Requirements
408
Configuration Procedure
408
Configuring URPF
410
Overview
410
URPF Check Modes
410
How URPF Works
410
Network Application
413
Configuring URPF
413
URPF Configuration Example
413
Configuring MFF
415
Overview
415
Basic Concepts
416
Operation Modes
416
Working Mechanism
417
Protocols and Standards
417
Configuring MFF
418
Configuration Prerequisites
418
Enabling MFF
418
Configuring a Network Port
418
Enabling Periodic Gateway Probe
418
Specifying the IP Addresses of Servers
419
Displaying and Maintaining MFF
419
MFF Configuration Examples
420
Auto-Mode MFF Configuration Example in a Tree Network
420
Auto-Mode MFF Configuration Example in a Ring Network
421
Manual-Mode MFF Configuration Example in a Tree Network
423
Manual-Mode MFF Configuration Example in a Ring Network
424
Configuring SAVI
427
Overview
427
Configuring Global SAVI
427
SAVI Configuration in Dhcpv6-Only Address Assignment Scenario
428
Network Requirements
428
Configuration Considerations
428
Packet Check Principles
429
Configuration Procedure
429
SAVI Configuration in SLAAC-Only Address Assignment Scenario
430
Network Requirements
430
Configuration Considerations
430
Packet Check Principles
431
Configuration Procedure
431
SAVI Configuration in Dhcpv6+Slaac Address Assignment Scenario
432
Network Requirements
432
Configuration Considerations
432
Packet Check Principles
433
Configuration Procedure
433
Configuring Blacklist
435
Overview
435
Configuring the Blacklist Feature
435
Displaying and Maintaining the Blacklist
435
Blacklist Configuration Example
436
Network Requirements
436
Configuration Procedure
436
Verifying the Configuration
436
Configuring FIPS
438
Overview
438
FIPS Self-Tests
438
Power-Up Self-Test
438
Conditional Self-Tests
438
Triggering a Self-Test
438
Configuration Procedure
439
Enabling the FIPS Mode
439
Triggering a Self-Test
440
Displaying and Maintaining FIPS
440
FIPS Configuration Example
440
Network Requirements
440
Configuration Procedure
440
Verifying the Configuration
441
Support and Other Resources
443
Contacting HP
443
Subscription Service
443
Related Information
443
Documents
443
Websites
443
Conventions
444
Index
446
Other manuals for HP 3600 v2 Series
Command Reference
479 pages
Installation Guide
62 pages
Security Configuration Guide
398 pages
Compliance And Safety Manual
51 pages
4
Based on 1 rating
Ask a question
Give review
Questions and Answers:
Need help?
Do you have a question about the HP 3600 v2 Series and is the answer not in the manual?
Ask a question
HP 3600 v2 Series Specifications
General
Brand
HP
Model
3600 v2 Series
Category
Switch
Language
English
Related product manuals
HP A3100-8 v2 SI
193 pages
HP A3100-8 v2 EI
189 pages
HP A3100 v2 Series
56 pages
HP 3500YL
450 pages
HP 336045-B21
9 pages
HP 3500 Series
554 pages
HP 3800 Series
78 pages
HP ProCurve 3500
130 pages
HP ProCurve 3500-24
80 pages
HP Aruba 3810M Series
102 pages
HP ProCurve 3400cl-48G
108 pages
HP ProCurve 3500yl Series
390 pages
To Next PageTo Next PageTo Previous PageTo Previous Page
Loading...
Need help?
General