HP 5120 SI Series Security Configuration Guide

HP 5120 SI Series

385 pages

To Next Page

To Next Page

Page #1 background image

Loading...

Page #1 background image

HP 5120 SI Switch Series

Security

Configuration Guide

Part number: 5998-1815

Software version: Release 1513

Document version: 6W100-20130830

Table of Contents

Configuration Guide1
Table of Contents3
AAA Configuration13
- AAA Overview13
- FIPS Compliance26
- AAA Configuration Considerations and Task List26
- Configuring AAA Schemes28
- Configuring AAA Methods for ISP Domains48
- Tearing down User Connections Forcibly55
- Configuring a NAS ID-VLAN Binding55
- Displaying and Maintaining AAA56
- AAA Configuration Examples56
- Troubleshooting AAA67
  - Troubleshooting RADIUS67
  - Troubleshooting HWTACACS68
802.1X Fundamentals69
- Architecture of 802.1X69
- Controlled/Uncontrolled Port and Pot Authorization Status69
- 802.1X-Related Protocols70
  - Packet Format70
  - EAP over RADIUS72
- Initiating 802.1X Authentication72
  - 802.1X Client as the Initiator72
  - Access Device as the Initiator72
- 802.1X Authentication Procedures73
802.1X Configuration77
- HP Implementation of 802.1X77
  - Access Control Methods77
  - Using 802.1X Authentication with Other Features77
- Configuring 802.1X82
- Displaying and Maintaining 802.1X93
- 802.1X Configuration Examples94
EAD Fast Deployment Configuration101
- EAD Fast Deployment Overview101
  - EAD Fast Deployment Implementation101
- Configuring EAD Fast Deployment101
  - Configuration Prerequisites101
  - Configuration Procedure102
- Displaying and Maintaining EAD Fast Deployment103
- EAD Fast Deployment Configuration Example103
- Troubleshooting EAD Fast Deployment105
  - Web Browser Users Cannot be Correctly Redirected105
MAC Authentication Configuration107
- MAC Authentication Overview107
- Using MAC Authentication with Other Features108
- MAC Authentication Configuration Task List109
- Basic Configuration for MAC Authentication110
  - Configuration Prerequisites110
  - Configuration Procedure110
- Specifying an Authentication Domain for MAC Authentication Users111
- Configuring a MAC Authentication Guest VLAN112
  - Configuration Prerequisites112
  - Configuration Procedure112
- Configuring a MAC Authentication Critical VLAN113
  - Configuration Prerequisites113
  - Configuration Procedure113
- Displaying and Maintaining MAC Authentication113
- MAC Authentication Configuration Examples114
Portal Configuration120
- Overview120
- Portal Configuration Task List128
- Configuration Prerequisites129
- Specifying the Portal Server130
  - Specifying the Local Portal Server for Layer 2 Portal Authentication130
  - Specifying a Portal Server for Layer 3 Portal Authentication130
- Configuring the Local Portal Server131
  - Customizing Authentication Pages131
  - Configuring the Local Portal Server134
- Enabling Portal Authentication135
  - Enabling Layer 2 Portal Authentication135
  - Enabling Layer 3 Portal Authentication135
- Controlling Access of Portal Users136
- Specifying an Auth-Fail VLAN for Portal Authentication140
- Configuring RADIUS Related Attributes140
  - Specifying NAS-Port-Type for an Interface141
  - Specifying a NAS ID Profile for an Interface141
- Specifying a Source IP Address for Outgoing Portal Packets142
- Specifying an Auto Redirection URL for Authenticated Portal Users142
- Configuring Portal Detection Functions143
- Logging off Portal Users146
- Displaying and Maintaining Portal146
- Portal Configuration Examples147
- Troubleshooting Portal171
  - Inconsistent Keys on the Access Device and the Portal Server171
  - Incorrect Server Port Number on the Access Device172
Triple Authentication Configuration173
- Introduction to Triple Authentication173
- Triple Authentication Configuration Task List175
- Triple Authentication Configuration Examples175
  - Triple Authentication Basic Function Configuration Example175
  - Triple Authentication Supporting VLAN Assignment and Auth-Fail VLAN Configuration Example178
Port Security Configuration183
- Port Security Overview183
- Port Security Configuration Task List187
- Enabling Port Security187
  - Configuration Prerequisites187
  - Configuration Procedure187
- Setting the Maximum Number of Secure MAC Addresses188
- Setting the Port Security Mode188
  - Configuration Prerequisites188
  - Configuration Procedure189
- Configuring Port Security Features190
- Configuring Secure MAC Addresses191
  - Configuration Prerequisites192
  - Configuration Procedure192
- Ignoring Authorization Information from the Server192
- Displaying and Maintaining Port Security193
- Port Security Configuration Examples193
- Troubleshooting Port Security202
User Profile Configuration204
- User Profile Overview204
- User Profile Configuration Task List204
- Creating a User Profile205
  - Configuration Prerequisites205
- Configuring a User Profile205
- Enabling a User Profile206
- Displaying and Maintaining User Profile206
Password Control Configuration207
- Password Control Overview207
- FIPS Compliance209
- Password Control Configuration Task List210
- Configuring Password Control210
- Displaying and Maintaining Password Control214
- Password Control Configuration Example215
HABP Configuration218
- Introduction to HABP218
- Configuring HABP219
  - Configuring the HABP Server219
  - Configuring an HABP Client219
- Displaying and Maintaining HABP220
- HABP Configuration Example220
  - Network Requirements220
  - Configuration Procedure221
Public Key Configuration223
- Asymmetric Key Algorithm Overview223
- FIPS Compliance224
- Configuring the Local Asymmetric Key Pair224
- Configuring a Remote Host's Public Key226
- Displaying and Maintaining Public Keys227
- Public Key Configuration Examples227
  - Configuring a Remote Host's Public Key Manually227
  - Importing a Remote Host's Public Key from a Public Key File229
PKI Configuration232
- Introduction to PKI232
- PKI Configuration Task List235
- Configuring an Entity DN235
- Configuring a PKI Domain236
- Submitting a PKI Certificate Request238
  - Submitting a Certificate Request in Auto Mode238
  - Submitting a Certificate Request in Manual Mode239
- Retrieving a Certificate Manually240
- Configuring PKI Certificate Verification240
- Destroying a Local RSA Key Pair242
- Deleting a Certificate242
- Configuring an Access Control Policy242
- Displaying and Maintaining PKI243
- PKI Configuration Examples243
- Troubleshooting PKI251
SSH2.0 Configuration254
- SSH2.0 Overview254
  - Introduction to SSH2.0254
  - SSH Operation254
- FIPS Compliance257
- Configuring the Device as an SSH Server257
- Configuring the Device as an SSH Client262
- Displaying and Maintaining SSH264
- SSH Server Configuration Examples265
  - When Switch Acts as Server for Password Authentication265
  - When Switch Acts as Server for Publickey Authentication267
- SSH Client Configuration Examples272
  - When Switch Acts as Client for Password Authentication272
  - When Switch Acts as Client for Publickey Authentication275
SFTP Configuration278
- SFTP Overview278
- Configuring the Device as an SFTP Server278
- Configuring the Device an SFTP Client279
- SFTP Client Configuration Example282
- SFTP Server Configuration Example285
SCP Configuration288
- SCP Overview288
- Configuring the Switch as an SCP Server288
- Configuring the Switch as the SCP Client289
  - SCP Client Configuration Example289
  - SCP Server Configuration Example290
SSL Configuration292
- SSL Overview292
  - SSL Security Mechanism292
  - SSL Protocol Stack293
- FIPS Compliance294
- SSL Configuration Task List294
- Configuring an SSL Server Policy294
- Configuring an SSL Client Policy297
  - Configuration Prerequisites297
  - Configuration Procedure297
- Displaying and Maintaining SSL298
- Troubleshooting SSL298
  - SSL Handshake Failure298
TCP Attack Protection Configuration300
- TCP Attack Protection Overview300
- Enabling the SYN Cookie Feature300
- Enabling Protection against Naptha Attacks301
- Displaying and Maintaining TCP Attack Protection301
IP Source Guard Configuration302
- IP Source Guard Overview302
- IP Source Guard Entries302
- Configuring Ipv4 Source Guard303
- Configuring Ipv6 Source Guard305
- Displaying and Maintaining IP Source Guard307
- IP Source Guard Configuration Examples308
- Troubleshooting IP Source Guard315
  - Neither Static nor Dynamic IP Source Guard Can be Configured315
ARP Attack Protection Configuration316
- ARP Attack Protection Overview316
- ARP Attack Protection Configuration Task List316
- Configuring ARP Packet Rate Limit317
- Configuring Source MAC Address Based ARP Attack Detection318
- Configuring ARP Packet Source MAC Address Consistency Check319
  - Introduction319
  - Configuration Procedure319
- Configuring ARP Active Acknowledgement319
- Configuring ARP Detection320
- Configuring ARP Gateway Protection327
- Configuring ARP Filtering329
ND Attack Defense Configuration331
- Introduction to ND Attack Defense331
- Enabling Source MAC Consistency Check for ND Packets332
- Configuring the ND Detection Function332
- ND Detection Configuration Example334
SAVI Configuration337
- SAVI Overview337
- Global SAVI Configuration337
- SAVI Configuration in Dhcpv6-Only Address Assignment Scenario338
- SAVI Configuration in SLAAC-Only Address Assignment Scenario340
- SAVI Configuration in Dhcpv6+Slaac Address Assignment Scenario342
System-Guard Configuration345
- Configuring System-Guard345
- Displaying System-Guard346
- System-Guard Configuration Example346
  - Network Requirements346
  - Configuration Procedure346
Configuring FIPS347
- Overview347
- FIPS Self-Tests347
- Configuration Procedure348
  - Enabling the FIPS Mode348
  - Triggering a Self-Test349
- Displaying and Maintaining FIPS349
- FIPS Configuration Example349
Configuring Ipsec352
- Overview352
  - Basic Concepts352
  - Protocols and Standards355
- Configuring Ipsec355
- Implementing ACL-Based Ipsec355
- Displaying and Maintaining Ipsec364
- Ipsec Configuration Examples364
  - IKE-Based Ipsec Tunnel for Ipv4 Packets Configuration Example364
Configuring IKE367
- Overview367
- IKE Configuration Task List369
- Configuring a Name for the Local Security Gateway370
- Configuring an IKE Proposal370
- Configuring an IKE Peer371
- Setting Keepalive Timers373
- Setting the NAT Keepalive Timer373
- Configuring a DPD Detector374
- Disabling Next Payload Field Checking374
- Displaying and Maintaining IKE375
- IKE Configuration Example375
- Troubleshooting IKE378
Support and Other Resources380
- Contacting HP380
  - Subscription Service380
- Related Information380
  - Documents380
  - Command Conventions381

Other manuals for HP 5120 SI Series

Command Reference395 pages

Specification33 pages

Questions and Answers:

Need help?

Do you have a question about the HP 5120 SI Series and is the answer not in the manual?

HP 5120 SI Series Specifications

General

Brand	HP
Model	5120 SI Series
Category	Switch
Language	English

Related product manuals

Preview: HP 5120 EI Switch Series

HP 5120 EI Switch Series

Preview: HP 5120 series

Preview: HP 5120 EI Series

HP 5120 EI Series

Preview: HP A3100-8 v2 SI

HP A3100-8 v2 SI

Preview: HP A5500 SI Switch Series

HP A5500 SI Switch Series

Preview: HP 5130 EI series

HP 5130 EI series

Preview: HP 5130-24G-4SFP+ EI

HP 5130-24G-4SFP+ EI

Preview: HP 5130 EI Switch Series

HP 5130 EI Switch Series

HP HPE 5140 24G 4SFP+ EI

Preview: HP FlexNetwork 5130 HI series

HP FlexNetwork 5130 HI series

Preview: HP FlexNetwork 5140 EI Series

HP FlexNetwork 5140 EI Series

Preview: HP 5920