HP 5120 SI Series

HP 5120 SI Series

385 pages

To Next Page

To Next Page

Loading...

HP 5120 SI Switch Series

Security

Configuration Guide

Part number: 5998-1815

Software version: Release 1513

Document version: 6W100-20130830

Table of Contents

Configuration Guide1
Table of Contents3
AAA Configuration13
- AAA Overview13
- FIPS Compliance26
- AAA Configuration Considerations and Task List26
- Configuring AAA Schemes28
- Configuring AAA Methods for ISP Domains48
- Tearing down User Connections Forcibly55
- Configuring a NAS ID-VLAN Binding55
- Displaying and Maintaining AAA56
- AAA Configuration Examples56
- Troubleshooting AAA67
  - Troubleshooting RADIUS67
  - Troubleshooting HWTACACS68
802.1X Fundamentals69
- Architecture of 802.1X69
- Controlled/Uncontrolled Port and Pot Authorization Status69
- 802.1X-Related Protocols70
  - Packet Format70
  - EAP over RADIUS72
- Initiating 802.1X Authentication72
  - 802.1X Client as the Initiator72
  - Access Device as the Initiator72
- 802.1X Authentication Procedures73
802.1X Configuration77
- HP Implementation of 802.1X77
  - Access Control Methods77
  - Using 802.1X Authentication with Other Features77
- Configuring 802.1X82
- Displaying and Maintaining 802.1X93
- 802.1X Configuration Examples94
EAD Fast Deployment Configuration101
- EAD Fast Deployment Overview101
  - EAD Fast Deployment Implementation101
- Configuring EAD Fast Deployment101
  - Configuration Prerequisites101
  - Configuration Procedure102
- Displaying and Maintaining EAD Fast Deployment103
- EAD Fast Deployment Configuration Example103
- Troubleshooting EAD Fast Deployment105
  - Web Browser Users Cannot be Correctly Redirected105
MAC Authentication Configuration107
- MAC Authentication Overview107
- Using MAC Authentication with Other Features108
- MAC Authentication Configuration Task List109
- Basic Configuration for MAC Authentication110
  - Configuration Prerequisites110
  - Configuration Procedure110
- Specifying an Authentication Domain for MAC Authentication Users111
- Configuring a MAC Authentication Guest VLAN112
  - Configuration Prerequisites112
  - Configuration Procedure112
- Configuring a MAC Authentication Critical VLAN113
  - Configuration Prerequisites113
  - Configuration Procedure113
- Displaying and Maintaining MAC Authentication113
- MAC Authentication Configuration Examples114
Portal Configuration120
- Overview120
- Portal Configuration Task List128
- Configuration Prerequisites129
- Specifying the Portal Server130
  - Specifying the Local Portal Server for Layer 2 Portal Authentication130
  - Specifying a Portal Server for Layer 3 Portal Authentication130
- Configuring the Local Portal Server131
  - Customizing Authentication Pages131
  - Configuring the Local Portal Server134
- Enabling Portal Authentication135
  - Enabling Layer 2 Portal Authentication135
  - Enabling Layer 3 Portal Authentication135
- Controlling Access of Portal Users136
- Specifying an Auth-Fail VLAN for Portal Authentication140
- Configuring RADIUS Related Attributes140
  - Specifying NAS-Port-Type for an Interface141
  - Specifying a NAS ID Profile for an Interface141
- Specifying a Source IP Address for Outgoing Portal Packets142
- Specifying an Auto Redirection URL for Authenticated Portal Users142
- Configuring Portal Detection Functions143
- Logging off Portal Users146
- Displaying and Maintaining Portal146
- Portal Configuration Examples147
- Troubleshooting Portal171
  - Inconsistent Keys on the Access Device and the Portal Server171
  - Incorrect Server Port Number on the Access Device172
Triple Authentication Configuration173
- Introduction to Triple Authentication173
- Triple Authentication Configuration Task List175
- Triple Authentication Configuration Examples175
  - Triple Authentication Basic Function Configuration Example175
  - Triple Authentication Supporting VLAN Assignment and Auth-Fail VLAN Configuration Example178
Port Security Configuration183
- Port Security Overview183
- Port Security Configuration Task List187
- Enabling Port Security187
  - Configuration Prerequisites187
  - Configuration Procedure187
- Setting the Maximum Number of Secure MAC Addresses188
- Setting the Port Security Mode188
  - Configuration Prerequisites188
  - Configuration Procedure189
- Configuring Port Security Features190
- Configuring Secure MAC Addresses191
  - Configuration Prerequisites192
  - Configuration Procedure192
- Ignoring Authorization Information from the Server192
- Displaying and Maintaining Port Security193
- Port Security Configuration Examples193
- Troubleshooting Port Security202
User Profile Configuration204
- User Profile Overview204
- User Profile Configuration Task List204
- Creating a User Profile205
  - Configuration Prerequisites205
- Configuring a User Profile205
- Enabling a User Profile206
- Displaying and Maintaining User Profile206
Password Control Configuration207
- Password Control Overview207
- FIPS Compliance209
- Password Control Configuration Task List210
- Configuring Password Control210
- Displaying and Maintaining Password Control214
- Password Control Configuration Example215
HABP Configuration218
- Introduction to HABP218
- Configuring HABP219
  - Configuring the HABP Server219
  - Configuring an HABP Client219
- Displaying and Maintaining HABP220
- HABP Configuration Example220
  - Network Requirements220
  - Configuration Procedure221
Public Key Configuration223
- Asymmetric Key Algorithm Overview223
- FIPS Compliance224
- Configuring the Local Asymmetric Key Pair224
- Configuring a Remote Host's Public Key226
- Displaying and Maintaining Public Keys227
- Public Key Configuration Examples227
  - Configuring a Remote Host's Public Key Manually227
  - Importing a Remote Host's Public Key from a Public Key File229
PKI Configuration232
- Introduction to PKI232
- PKI Configuration Task List235
- Configuring an Entity DN235
- Configuring a PKI Domain236
- Submitting a PKI Certificate Request238
  - Submitting a Certificate Request in Auto Mode238
  - Submitting a Certificate Request in Manual Mode239
- Retrieving a Certificate Manually240
- Configuring PKI Certificate Verification240
- Destroying a Local RSA Key Pair242
- Deleting a Certificate242
- Configuring an Access Control Policy242
- Displaying and Maintaining PKI243
- PKI Configuration Examples243
- Troubleshooting PKI251
SSH2.0 Configuration254
- SSH2.0 Overview254
  - Introduction to SSH2.0254
  - SSH Operation254
- FIPS Compliance257
- Configuring the Device as an SSH Server257
- Configuring the Device as an SSH Client262
- Displaying and Maintaining SSH264
- SSH Server Configuration Examples265
  - When Switch Acts as Server for Password Authentication265
  - When Switch Acts as Server for Publickey Authentication267
- SSH Client Configuration Examples272
  - When Switch Acts as Client for Password Authentication272
  - When Switch Acts as Client for Publickey Authentication275
SFTP Configuration278
- SFTP Overview278
- Configuring the Device as an SFTP Server278
- Configuring the Device an SFTP Client279
- SFTP Client Configuration Example282
- SFTP Server Configuration Example285
SCP Configuration288
- SCP Overview288
- Configuring the Switch as an SCP Server288
- Configuring the Switch as the SCP Client289
  - SCP Client Configuration Example289
  - SCP Server Configuration Example290
SSL Configuration292
- SSL Overview292
  - SSL Security Mechanism292
  - SSL Protocol Stack293
- FIPS Compliance294
- SSL Configuration Task List294
- Configuring an SSL Server Policy294
- Configuring an SSL Client Policy297
  - Configuration Prerequisites297
  - Configuration Procedure297
- Displaying and Maintaining SSL298
- Troubleshooting SSL298
  - SSL Handshake Failure298
TCP Attack Protection Configuration300
- TCP Attack Protection Overview300
- Enabling the SYN Cookie Feature300
- Enabling Protection against Naptha Attacks301
- Displaying and Maintaining TCP Attack Protection301
IP Source Guard Configuration302
- IP Source Guard Overview302
- IP Source Guard Entries302
- Configuring Ipv4 Source Guard303
- Configuring Ipv6 Source Guard305
- Displaying and Maintaining IP Source Guard307
- IP Source Guard Configuration Examples308
- Troubleshooting IP Source Guard315
  - Neither Static nor Dynamic IP Source Guard Can be Configured315
ARP Attack Protection Configuration316
- ARP Attack Protection Overview316
- ARP Attack Protection Configuration Task List316
- Configuring ARP Packet Rate Limit317
- Configuring Source MAC Address Based ARP Attack Detection318
- Configuring ARP Packet Source MAC Address Consistency Check319
  - Introduction319
  - Configuration Procedure319
- Configuring ARP Active Acknowledgement319
- Configuring ARP Detection320
- Configuring ARP Gateway Protection327
- Configuring ARP Filtering329
ND Attack Defense Configuration331
- Introduction to ND Attack Defense331
- Enabling Source MAC Consistency Check for ND Packets332
- Configuring the ND Detection Function332
- ND Detection Configuration Example334
SAVI Configuration337
- SAVI Overview337
- Global SAVI Configuration337
- SAVI Configuration in Dhcpv6-Only Address Assignment Scenario338
- SAVI Configuration in SLAAC-Only Address Assignment Scenario340
- SAVI Configuration in Dhcpv6+Slaac Address Assignment Scenario342
System-Guard Configuration345
- Configuring System-Guard345
- Displaying System-Guard346
- System-Guard Configuration Example346
  - Network Requirements346
  - Configuration Procedure346
Configuring FIPS347
- Overview347
- FIPS Self-Tests347
- Configuration Procedure348
  - Enabling the FIPS Mode348
  - Triggering a Self-Test349
- Displaying and Maintaining FIPS349
- FIPS Configuration Example349
Configuring Ipsec352
- Overview352
  - Basic Concepts352
  - Protocols and Standards355
- Configuring Ipsec355
- Implementing ACL-Based Ipsec355
- Displaying and Maintaining Ipsec364
- Ipsec Configuration Examples364
  - IKE-Based Ipsec Tunnel for Ipv4 Packets Configuration Example364
Configuring IKE367
- Overview367
- IKE Configuration Task List369
- Configuring a Name for the Local Security Gateway370
- Configuring an IKE Proposal370
- Configuring an IKE Peer371
- Setting Keepalive Timers373
- Setting the NAT Keepalive Timer373
- Configuring a DPD Detector374
- Disabling Next Payload Field Checking374
- Displaying and Maintaining IKE375
- IKE Configuration Example375
- Troubleshooting IKE378
Support and Other Resources380
- Contacting HP380
  - Subscription Service380
- Related Information380
  - Documents380
  - Command Conventions381

Other manuals for HP 5120 SI Series

Command Reference395 pages

Specification33 pages

Related product manuals

Preview: HP 5120 EI Switch Series

HP 5120 EI Switch Series

Preview: HP 5120 series

Preview: HP 5120 EI Series

HP 5120 EI Series

Preview: HP A3100-8 v2 SI

HP A3100-8 v2 SI

Preview: HP A5500 SI Switch Series

HP A5500 SI Switch Series

Preview: HP 5130 EI series

HP 5130 EI series

Preview: HP 5130-24G-4SFP+ EI

HP 5130-24G-4SFP+ EI

Preview: HP 5130 EI Switch Series

HP 5130 EI Switch Series

HP HPE 5140 24G 4SFP+ EI

Preview: HP FlexNetwork 5130 HI series

HP FlexNetwork 5130 HI series

Preview: HP FlexNetwork 5140 EI Series

HP FlexNetwork 5140 EI Series

Preview: HP 5920