HP 3600 v2 Series Security Configuration Guide

HP 3600 v2 Series

398 pages

To Next Page

To Next Page

To Previous Page

To Previous Page

Page #371 background image

Loading...

Page #371 background image

360

Figure 138 Network diagram

Configuration procedure

1. Configure Switch A

# Enable strict URPF check.

<SwitchA> system-view

[SwitchA] ip urpf strict

2. Configure Switch B

# Enable strict URPF check.

<SwitchB> system-view

[SwitchB] ip urpf strict

Table of Contents

Configuration Guide1
Table of Contents3
AAA Configuration12
- AAA Overview12
- AAA Configuration Considerations and Task List26
- Configuring AAA Schemes27
- Configuring AAA Methods for ISP Domains50
- Tearing down User Connections56
- Configuring a NAS ID-VLAN Binding57
- Specifying the Device ID Used in Stateful Failover Mode57
- Configuring a Switch as a RADIUS Server58
- Displaying and Maintaining AAA59
- AAA Configuration Examples60
- Troubleshooting AAA86
  - Troubleshooting RADIUS86
  - Troubleshooting HWTACACS87
802.1X Fundamentals88
- 802.1X Architecture88
- Controlled/Uncontrolled Port and Port Authorization Status88
- 802.1X-Related Protocols89
  - Packet Formats90
  - EAP over RADIUS91
- Initiating 802.1X Authentication91
  - 802.1X Client as the Initiator91
  - Access Device as the Initiator92
- 802.1X Authentication Procedures92
802.1X Configuration96
- HP Implementation of 802.1X96
  - Access Control Methods96
  - Using 802.1X Authentication with Other Features96
- Configuring 802.1X99
- Displaying and Maintaining 802.1X109
- 802.1X Configuration Examples109
EAD Fast Deployment Configuration117
- EAD Fast Deployment Overview117
  - EAD Fast Deployment Implementation117
- Configuring EAD Fast Deployment117
  - Configuration Prerequisites117
  - Configuration Procedure117
- Displaying and Maintaining EAD Fast Deployment119
- EAD Fast Deployment Configuration Example119
- Troubleshooting EAD Fast Deployment121
  - Web Browser Users Cannot be Correctly Redirected121
MAC Authentication Configuration122
- MAC Authentication Overview122
- Using MAC Authentication with Other Features123
- MAC Authentication Configuration Task List124
- Basic Configuration for MAC Authentication124
  - Configuration Prerequisites124
  - Configuration Procedure124
- Specifying an Authentication Domain for MAC Authentication Users125
- Configuring a MAC Authentication Guest VLAN126
  - Configuration Prerequisites126
  - Configuration Procedure126
- Displaying and Maintaining MAC Authentication127
- MAC Authentication Configuration Examples127
Portal Configuration134
- Portal Overview134
- Portal Configuration Task List146
- Configuration Prerequisites147
- Specifying the Portal Server147
  - Specifying the Local Portal Server for Layer 2 Portal Authentication147
  - Specifying a Portal Server for Layer 3 Portal Authentication148
- Configuring the Local Portal Server149
  - Customizing Authentication Pages149
  - Configuring the Local Portal Server152
- Enabling Portal Authentication152
  - Enabling Layer 2 Portal Authentication153
  - Enabling Layer 3 Portal Authentication153
- Controlling Access of Portal Users154
- Specifying an Auth-Fail VLAN for Portal Authentication158
- Configuring RADIUS Related Attributes159
  - Specifying NAS-Port-Type for an Interface159
  - Specifying a NAS ID Profile for an Interface160
- Specifying a Source IP Address for Outgoing Portal Packets160
- Configuring Portal Stateful Failover161
- Specifying an Auto Redirection URL for Authenticated Portal Users163
- Configuring Portal Detection Functions163
- Logging off Portal Users166
- Displaying and Maintaining Portal166
- Portal Configuration Examples167
- Troubleshooting Portal199
  - Inconsistent Keys on the Access Device and the Portal Server199
  - Incorrect Server Port Number on the Access Device200
Triple Authentication Configuration201
- Triple Authentication Overview201
  - Triple Authentication Mechanism201
  - Using Triple Authentication with Other Features202
- Configuring Triple Authentication203
- Triple Authentication Configuration Examples203
  - Triple Authentication Basic Function Configuration Example203
  - Triple Authentication Supporting VLAN Assignment and Auth-Fail VLAN Configuration Example206
Port Security Configuration211
- Port Security Overview211
- Port Security Configuration Task List214
- Enabling Port Security215
  - Configuration Prerequisites215
  - Configuration Procedure215
- Setting Port Security's Limit on the Number of MAC Addresses on a Port215
- Setting the Port Security Mode216
  - Configuration Prerequisites216
  - Configuration Procedure216
- Configuring Port Security Features217
- Configuring Secure MAC Addresses219
  - Configuration Prerequisites219
  - Configuration Procedure220
- Ignoring Authorization Information from the Server220
- Displaying and Maintaining Port Security221
- Port Security Configuration Examples221
- Troubleshooting Port Security231
User Profile Configuration233
- User Profile Overview233
- User Profile Configuration Task List233
- Creating a User Profile233
  - Configuration Prerequisites233
  - Creating a User Profile234
- Configuring a User Profile234
  - Configuration Guidelines234
  - Configuration Procedure234
- Enabling a User Profile235
- Displaying and Maintaining User Profiles235
HABP Configuration236
- HABP Overview236
- Configuring HABP237
  - Configuring the HABP Server237
  - Configuring an HABP Client237
- Displaying and Maintaining HABP238
- HABP Configuration Example238
Public Key Configuration241
- Overview241
- Public Key Configuration Task List241
- Configuring a Local Asymmetric Key Pair on the Local Device242
- Specifying the Peer Public Key on the Local Device244
- Displaying and Maintaining Public Keys245
- Public Key Configuration Examples246
  - Manually Specifying the Peer Public Key on the Local Device246
  - Importing a Peer Public Key from a Public Key File247
PKI Configuration251
- Introduction to PKI251
- PKI Configuration Task List253
- Configuring an Entity DN254
- Configuring a PKI Domain255
- Submitting a PKI Certificate Request257
  - Submitting a Certificate Request in Auto Mode257
  - Submitting a Certificate Request in Manual Mode257
- Retrieving a Certificate Manually258
- Configuring PKI Certificate Verification259
  - Configuring CRL-Checking-Enabled PKI Certificate Verification259
  - Configuring CRL-Checking-Disabled PKI Certificate Verification260
- Destroying a Local RSA Key Pair260
- Deleting a Certificate261
- Configuring an Access Control Policy261
- Displaying and Maintaining PKI262
- PKI Configuration Examples262
- Troubleshooting PKI270
Ipsec Configuration272
- Ipsec Overview272
- Configuring Ipsec for Ipv6 Routing Protocols275
  - Configuring an Ipsec Proposal275
  - Configuring an Ipsec Policy276
- Displaying and Maintaining Ipsec278
- Ipsec for Ripng Configuration Example278
SSH2.0 Configuration283
- SSH2.0 Overview283
- Configuring the Switch as an SSH Server286
- Configuring the Switch as an SSH Client291
- Displaying and Maintaining SSH293
- SSH Server Configuration Examples294
  - When the Switch Acts as a Server for Password Authentication294
  - When the Switch Acts as a Server for Publickey Authentication296
- SSH Client Configuration Examples301
  - When Switch Acts as Client for Password Authentication301
  - When Switch Acts as Client for Publickey Authentication304
SFTP Configuration307
- SFTP Overview307
- Configuring the Switch as an SFTP Server307
- Configuring the Switch an SFTP Client308
- SFTP Client Configuration Example311
- SFTP Server Configuration Example314
SSL Configuration317
- SSL Overview317
  - SSL Security Mechanism317
  - SSL Protocol Stack318
- SSL Configuration Task List318
- Configuring an SSL Server Policy318
- Configuring an SSL Client Policy321
  - Configuration Prerequisites322
  - Configuration Procedure322
- Displaying and Maintaining SSL322
- Troubleshooting SSL323
  - SSL Handshake Failure323
TCP Attack Protection Configuration324
- TCP Attack Protection Overview324
- Enabling the SYN Cookie Feature324
- Displaying and Maintaining TCP Attack Protection325
IP Source Guard Configuration326
- IP Source Guard Overview326
  - Static IP Source Guard Binding Entries326
  - Dynamic IP Source Guard Binding Entries327
- IP Source Guard Configuration Task List327
- Configuring the Ipv4 Source Guard Function327
- Configuring the Ipv6 Source Guard Function329
- Displaying and Maintaining IP Source Guard331
- IP Source Guard Configuration Examples332
- Troubleshooting IP Source Guard340
  - Neither Static Binding Entries nor the Dynamic Binding Function Can be Configured340
ARP Attack Protection Configuration341
- ARP Attack Protection Overview341
- ARP Attack Protection Configuration Task List341
- Configuring ARP Defense against IP Packet Attacks342
- Configuring ARP Packet Rate Limit345
  - Introduction345
- Configuring Source MAC Address Based ARP Attack Detection346
- Configuring ARP Packet Source MAC Address Consistency Check348
  - Introduction348
  - Configuration Procedure348
- Configuring ARP Active Acknowledgement348
  - Configuration Procedure349
- Configuring ARP Detection349
- Configuring ARP Automatic Scanning and Fixed ARP356
  - Introduction356
  - Configuration Procedure356
- Configuring ARP Gateway Protection357
- Configuring ARP Filtering359
ND Attack Defense Configuration361
- Introduction to ND Attack Defense361
- Enabling Source MAC Consistency Check for ND Packets362
- Configuring the ND Detection Function362
- ND Detection Configuration Example364
- Network Diagram364
URPF Configuration366
- URPF Overview366
- Configuring URPF370
- URPF Configuration Example370
MFF Configuration372
- MFF Overview372
- Configuring MFF374
- Displaying and Maintaining MFF376
- MFF Configuration Examples376
SAVI Configuration383
- SAVI Overview383
- Global SAVI Configuration383
- SAVI Configuration in Dhcpv6-Only Address Assignment Scenario384
- SAVI Configuration in SLAAC-Only Address Assignment Scenario386
- SAVI Configuration in Dhcpv6+Slaac Address Assignment Scenario388
Blacklist Configuration391
- Blacklist Overview391
- Configuring the Blacklist Feature391
- Displaying and Maintaining the Blacklist391
- Blacklist Configuration Example392
  - Network Requirements392
  - Verifying the Configuration392
Support and Other Resources393
- Contacting HP393
  - Subscription Service393
- Related Information393
  - Documents393
  - Websites393
- Conventions394
- Command Conventions394
Index396

Other manuals for HP 3600 v2 Series

Command Reference479 pages

Installation Guide62 pages

Compliance And Safety Manual51 pages

Configuration Guide449 pages

Questions and Answers:

Need help?

Do you have a question about the HP 3600 v2 Series and is the answer not in the manual?

HP 3600 v2 Series Specifications

General

Brand	HP
Model	3600 v2 Series
Category	Switch
Language	English

Related product manuals

Preview: HP A3100-8 v2 SI

HP A3100-8 v2 SI

Preview: HP A3100-8 v2 EI

HP A3100-8 v2 EI

HP A3100 v2 Series

Preview: HP 3500 Series

HP ProCurve 3500

Preview: HP ProCurve 3500-24

HP ProCurve 3500-24

Preview: HP Aruba 3810M Series

HP Aruba 3810M Series

Preview: HP ProCurve 3400cl-48G

HP ProCurve 3400cl-48G

HP ProCurve 3500yl Series