HP 3600 v2 Series

To Next Page

HP 3600 v2 Switch Series

Security

Configuration Guide

Part number: 5998-2355

Software version: Release 2101

Document version: 6W101-20130930

Main Page

Configuration Guide1
Table of Contents3
AAA Configuration12
- AAA Overview12
- AAA Configuration Considerations and Task List26
- Configuring AAA Schemes27
- Configuring AAA Methods for ISP Domains50
- Tearing down User Connections56
- Configuring a NAS ID-VLAN Binding57
- Specifying the Device ID Used in Stateful Failover Mode57
- Configuring a Switch as a RADIUS Server58
- Displaying and Maintaining AAA59
- AAA Configuration Examples60
- Troubleshooting AAA86
  - Troubleshooting RADIUS86
  - Troubleshooting HWTACACS87
802.1X Fundamentals88
- 802.1X Architecture88
- Controlled/Uncontrolled Port and Port Authorization Status88
- 802.1X-Related Protocols89
  - Packet Formats90
  - EAP over RADIUS91
- Initiating 802.1X Authentication91
  - 802.1X Client as the Initiator91
  - Access Device as the Initiator92
- 802.1X Authentication Procedures92
802.1X Configuration96
- HP Implementation of 802.1X96
  - Access Control Methods96
  - Using 802.1X Authentication with Other Features96
- Configuring 802.1X99
- Displaying and Maintaining 802.1X109
- 802.1X Configuration Examples109
EAD Fast Deployment Configuration117
- EAD Fast Deployment Overview117
  - EAD Fast Deployment Implementation117
- Configuring EAD Fast Deployment117
  - Configuration Prerequisites117
  - Configuration Procedure117
- Displaying and Maintaining EAD Fast Deployment119
- EAD Fast Deployment Configuration Example119
- Troubleshooting EAD Fast Deployment121
  - Web Browser Users Cannot be Correctly Redirected121
MAC Authentication Configuration122
- MAC Authentication Overview122
- Using MAC Authentication with Other Features123
- MAC Authentication Configuration Task List124
- Basic Configuration for MAC Authentication124
  - Configuration Prerequisites124
  - Configuration Procedure124
- Specifying an Authentication Domain for MAC Authentication Users125
- Configuring a MAC Authentication Guest VLAN126
  - Configuration Prerequisites126
  - Configuration Procedure126
- Displaying and Maintaining MAC Authentication127
- MAC Authentication Configuration Examples127
Portal Configuration134
- Portal Overview134
- Portal Configuration Task List146
- Configuration Prerequisites147
- Specifying the Portal Server147
  - Specifying the Local Portal Server for Layer 2 Portal Authentication147
  - Specifying a Portal Server for Layer 3 Portal Authentication148
- Configuring the Local Portal Server149
  - Customizing Authentication Pages149
  - Configuring the Local Portal Server152
- Enabling Portal Authentication152
  - Enabling Layer 2 Portal Authentication153
  - Enabling Layer 3 Portal Authentication153
- Controlling Access of Portal Users154
- Specifying an Auth-Fail VLAN for Portal Authentication158
- Configuring RADIUS Related Attributes159
  - Specifying NAS-Port-Type for an Interface159
  - Specifying a NAS ID Profile for an Interface160
- Specifying a Source IP Address for Outgoing Portal Packets160
- Configuring Portal Stateful Failover161
- Specifying an Auto Redirection URL for Authenticated Portal Users163
- Configuring Portal Detection Functions163
- Logging off Portal Users166
- Displaying and Maintaining Portal166
- Portal Configuration Examples167
- Troubleshooting Portal199
  - Inconsistent Keys on the Access Device and the Portal Server199
  - Incorrect Server Port Number on the Access Device200
Triple Authentication Configuration201
- Triple Authentication Overview201
  - Triple Authentication Mechanism201
  - Using Triple Authentication with Other Features202
- Configuring Triple Authentication203
- Triple Authentication Configuration Examples203
  - Triple Authentication Basic Function Configuration Example203
  - Triple Authentication Supporting VLAN Assignment and Auth-Fail VLAN Configuration Example206
Port Security Configuration211
- Port Security Overview211
- Port Security Configuration Task List214
- Enabling Port Security215
  - Configuration Prerequisites215
  - Configuration Procedure215
- Setting Port Security's Limit on the Number of MAC Addresses on a Port215
- Setting the Port Security Mode216
  - Configuration Prerequisites216
  - Configuration Procedure216
- Configuring Port Security Features217
- Configuring Secure MAC Addresses219
  - Configuration Prerequisites219
  - Configuration Procedure220
- Ignoring Authorization Information from the Server220
- Displaying and Maintaining Port Security221
- Port Security Configuration Examples221
- Troubleshooting Port Security231
User Profile Configuration233
- User Profile Overview233
- User Profile Configuration Task List233
- Creating a User Profile233
  - Configuration Prerequisites233
  - Creating a User Profile234
- Configuring a User Profile234
  - Configuration Guidelines234
  - Configuration Procedure234
- Enabling a User Profile235
- Displaying and Maintaining User Profiles235
HABP Configuration236
- HABP Overview236
- Configuring HABP237
  - Configuring the HABP Server237
  - Configuring an HABP Client237
- Displaying and Maintaining HABP238
- HABP Configuration Example238
Public Key Configuration241
- Overview241
- Public Key Configuration Task List241
- Configuring a Local Asymmetric Key Pair on the Local Device242
- Specifying the Peer Public Key on the Local Device244
- Displaying and Maintaining Public Keys245
- Public Key Configuration Examples246
  - Manually Specifying the Peer Public Key on the Local Device246
  - Importing a Peer Public Key from a Public Key File247
PKI Configuration251
- Introduction to PKI251
- PKI Configuration Task List253
- Configuring an Entity DN254
- Configuring a PKI Domain255
- Submitting a PKI Certificate Request257
  - Submitting a Certificate Request in Auto Mode257
  - Submitting a Certificate Request in Manual Mode257
- Retrieving a Certificate Manually258
- Configuring PKI Certificate Verification259
  - Configuring CRL-Checking-Enabled PKI Certificate Verification259
  - Configuring CRL-Checking-Disabled PKI Certificate Verification260
- Destroying a Local RSA Key Pair260
- Deleting a Certificate261
- Configuring an Access Control Policy261
- Displaying and Maintaining PKI262
- PKI Configuration Examples262
- Troubleshooting PKI270
Ipsec Configuration272
- Ipsec Overview272
- Configuring Ipsec for Ipv6 Routing Protocols275
  - Configuring an Ipsec Proposal275
  - Configuring an Ipsec Policy276
- Displaying and Maintaining Ipsec278
- Ipsec for Ripng Configuration Example278
SSH2.0 Configuration283
- SSH2.0 Overview283
- Configuring the Switch as an SSH Server286
- Configuring the Switch as an SSH Client291
- Displaying and Maintaining SSH293
- SSH Server Configuration Examples294
  - When the Switch Acts as a Server for Password Authentication294
  - When the Switch Acts as a Server for Publickey Authentication296
- SSH Client Configuration Examples301
  - When Switch Acts as Client for Password Authentication301
  - When Switch Acts as Client for Publickey Authentication304
SFTP Configuration307
- SFTP Overview307
- Configuring the Switch as an SFTP Server307
- Configuring the Switch an SFTP Client308
- SFTP Client Configuration Example311
- SFTP Server Configuration Example314
SSL Configuration317
- SSL Overview317
  - SSL Security Mechanism317
  - SSL Protocol Stack318
- SSL Configuration Task List318
- Configuring an SSL Server Policy318
- Configuring an SSL Client Policy321
  - Configuration Prerequisites322
  - Configuration Procedure322
- Displaying and Maintaining SSL322
- Troubleshooting SSL323
  - SSL Handshake Failure323
TCP Attack Protection Configuration324
- TCP Attack Protection Overview324
- Enabling the SYN Cookie Feature324
- Displaying and Maintaining TCP Attack Protection325
IP Source Guard Configuration326
- IP Source Guard Overview326
  - Static IP Source Guard Binding Entries326
  - Dynamic IP Source Guard Binding Entries327
- IP Source Guard Configuration Task List327
- Configuring the Ipv4 Source Guard Function327
- Configuring the Ipv6 Source Guard Function329
- Displaying and Maintaining IP Source Guard331
- IP Source Guard Configuration Examples332
- Troubleshooting IP Source Guard340
  - Neither Static Binding Entries nor the Dynamic Binding Function Can be Configured340
ARP Attack Protection Configuration341
- ARP Attack Protection Overview341
- ARP Attack Protection Configuration Task List341
- Configuring ARP Defense against IP Packet Attacks342
- Configuring ARP Packet Rate Limit345
  - Introduction345
- Configuring Source MAC Address Based ARP Attack Detection346
- Configuring ARP Packet Source MAC Address Consistency Check348
  - Introduction348
  - Configuration Procedure348
- Configuring ARP Active Acknowledgement348
  - Configuration Procedure349
- Configuring ARP Detection349
- Configuring ARP Automatic Scanning and Fixed ARP356
  - Introduction356
  - Configuration Procedure356
- Configuring ARP Gateway Protection357
- Configuring ARP Filtering359
ND Attack Defense Configuration361
- Introduction to ND Attack Defense361
- Enabling Source MAC Consistency Check for ND Packets362
- Configuring the ND Detection Function362
- ND Detection Configuration Example364
- Network Diagram364
URPF Configuration366
- URPF Overview366
- Configuring URPF370
- URPF Configuration Example370
MFF Configuration372
- MFF Overview372
- Configuring MFF374
- Displaying and Maintaining MFF376
- MFF Configuration Examples376
SAVI Configuration383
- SAVI Overview383
- Global SAVI Configuration383
- SAVI Configuration in Dhcpv6-Only Address Assignment Scenario384
- SAVI Configuration in SLAAC-Only Address Assignment Scenario386
- SAVI Configuration in Dhcpv6+Slaac Address Assignment Scenario388
Blacklist Configuration391
- Blacklist Overview391
- Configuring the Blacklist Feature391
- Displaying and Maintaining the Blacklist391
- Blacklist Configuration Example392
  - Network Requirements392
  - Verifying the Configuration392
Support and Other Resources393
- Contacting HP393
  - Subscription Service393
- Related Information393
  - Documents393
  - Websites393
- Conventions394
- Command Conventions394
Index396

Table of Contents

Other manuals for HP 3600 v2 Series

Related product manuals