HP 5500 HI Series User Manual

HP 5500 HI Series

444 pages

To Next Page

To Next Page

Page #1 background image

Loading...

Page #1 background image

HP 5500 HI Switch Series

Security

Configuration Guide

Part number: 5998-2383

Software version: Release 5203 and Release 5206

Document version: 6W102-20140228

Table of Contents

Configuration Guide1
Table of Contents3
Configuring AAA14
- AAA Overview14
- FIPS Compliance28
- AAA Configuration Considerations and Task List28
- Configuring AAA Schemes29
- Configuring AAA Methods for ISP Domains54
- Tearing down User Connections60
- Configuring a NAS ID-VLAN Binding60
- Specifying the Device ID Used in Stateful Failover Mode61
- Configuring a Switch as a RADIUS Server61
- Displaying and Maintaining AAA63
- AAA Configuration Examples63
- Troubleshooting AAA75
  - Troubleshooting RADIUS75
  - Troubleshooting HWTACACS76
802.1X Overview77
- 802.1X Architecture77
- Controlled/Uncontrolled Port and Port Authorization Status77
- 802.1X-Related Protocols78
  - Packet Formats78
  - EAP over RADIUS80
- Initiating 802.1X Authentication80
  - 802.1X Client as the Initiator80
  - Access Device as the Initiator80
- 802.1X Authentication Procedures81
Configuring 802.1X85
- HP Implementation of 802.1X85
  - Access Control Methods85
  - Using 802.1X Authentication with Other Features85
- Configuration Prerequisites90
- 802.1X Configuration Task List91
- Enabling 802.1X91
  - Configuration Guidelines91
  - Configuration Procedure92
- Enabling EAP Relay or EAP Termination92
- Setting the Port Authorization State93
- Specifying an Access Control Method93
- Setting the Maximum Number of Concurrent 802.1X Users on a Port94
- Setting the Maximum Number of Authentication Request Attempts94
- Setting the 802.1X Authentication Timeout Timers95
- Configuring the Online User Handshake Function95
  - Configuration Guidelines95
  - Configuration Procedure96
- Configuring the Authentication Trigger Function96
  - Configuration Guidelines96
  - Configuration Procedure97
- Specifying a Mandatory Authentication Domain on a Port97
- Configuring the Quiet Timer97
- Enabling the Periodic Online User Re-Authentication Function98
  - Configuration Guidelines98
  - Configuration Procedure98
- Configuring a Port to Send EAPOL Frames Untagged99
- Setting the Maximum Number of 802.1X Authentication Attempts for MAC Authentication Users99
- Configuring a VLAN Group99
- Configuring an 802.1X Guest VLAN100
  - Configuration Guidelines100
  - Configuration Prerequisites101
  - Configuration Procedure101
- Configuring an 802.1X Auth-Fail VLAN101
  - Configuration Guidelines101
  - Configuration Prerequisites102
  - Configuration Procedure102
- Configuring an 802.1X Critical VLAN102
  - Configuration Guidelines102
  - Configuration Prerequisites103
  - Configuration Procedure103
- Specifying Supported Domain Name Delimiters103
- Displaying and Maintaining 802.1X104
- 802.1X Authentication Configuration Example104
  - Network Requirements104
  - Configuration Procedure105
  - Verifying the Configuration106
- With Guest VLAN and VLAN Assignment Configuration Example107
  - Network Requirements107
  - Configuration Procedure108
  - Verifying the Configuration109
- With ACL Assignment Configuration Example109
  - Network Requirements109
  - Configuration Procedure110
  - Verifying the Configuration110
Configuring EAD Fast Deployment112
- Overview112
  - Free IP112
  - URL Redirection112
- Configuration Prerequisites112
- Configuring a Free IP112
- Configuring the Redirect URL113
- Setting the EAD Rule Timer113
- Displaying and Maintaining EAD Fast Deployment113
- EAD Fast Deployment Configuration Example114
- Troubleshooting EAD Fast Deployment116
  - Web Browser Users Cannot be Correctly Redirected116
Configuring MAC Authentication117
- Overview117
- Using MAC Authentication with Other Features118
- Configuration Task List119
- Basic Configuration for MAC Authentication119
  - Configuring MAC Authentication Globally120
  - Configuring MAC Authentication on a Port120
- Specifying a MAC Authentication Domain121
- Configuring a MAC Authentication Guest VLAN121
- Configuring a MAC Authentication Critical VLAN122
- Configuring MAC Authentication Delay123
- Enabling MAC Authentication Multi-VLAN Mode123
- Displaying and Maintaining MAC Authentication124
- MAC Authentication Configuration Examples124
Configuring Portal Authentication131
- Overview131
- Portal Configuration Task List142
- Configuration Prerequisites143
- Specifying the Portal Server144
  - Specifying the Local Portal Server for Layer 2 Portal Authentication144
  - Specifying a Portal Server for Layer 3 Portal Authentication145
- Configuring the Local Portal Server145
  - Customizing Authentication Pages145
  - Configuring the Local Portal Server148
- Enabling Portal Authentication149
  - Enabling Layer 2 Portal Authentication149
  - Enabling Layer 3 Portal Authentication149
- Controlling Access of Portal Users150
- Specifying an Auth-Fail VLAN for Portal Authentication154
- Configuring RADIUS Related Attributes155
  - Specifying NAS-Port-Type for an Interface155
  - Specifying a NAS ID Profile for an Interface155
- Specifying a Source IP Address for Outgoing Portal Packets156
- Configuring Portal Stateful Failover156
- Specifying an Auto Redirection URL for Authenticated Portal Users158
- Configuring Portal Detection Functions159
- Logging off Portal Users161
- Displaying and Maintaining Portal162
- Portal Configuration Examples163
- Troubleshooting Portal196
  - Inconsistent Keys on the Access Device and the Portal Server196
  - Incorrect Server Port Number on the Access Device196
Configuring Triple Authentication198
- Overview198
  - Triple Authentication Mechanism198
  - Using Triple Authentication with Other Features199
- Configuring Triple Authentication199
- Triple Authentication Configuration Examples200
  - Triple Authentication Basic Function Configuration Example200
  - Triple Authentication Supporting VLAN Assignment and Auth-Fail VLAN Configuration Example202
Configuring Port Security208
- Overview208
- Configuration Task List211
- Enabling Port Security212
- Setting Port Security's Limit on the Number of MAC Addresses on a Port212
- Setting the Port Security Mode213
  - Configuration Prerequisites213
  - Configuration Procedure213
- Configuring Port Security Features214
- Configuring Secure MAC Addresses215
  - Configuration Prerequisites216
  - Configuration Procedure216
- Ignoring Authorization Information217
- Displaying and Maintaining Port Security217
- Port Security Configuration Examples218
- Troubleshooting Port Security227
Configuring a User Profile230
- Overview230
- User Profile Configuration Task List230
- Creating a User Profile230
- Applying a Qos Policy231
- Enabling a User Profile231
- Displaying and Maintaining User Profiles232
Configuring Password Control233
- Overview233
- FIPS Compliance235
- Password Control Configuration Task List236
- Configuring Password Control236
- Displaying and Maintaining Password Control240
- Password Control Configuration Example241
Configuring HABP244
- Overview244
- Configuring HABP245
  - Configuring the HABP Server245
  - Configuring an HABP Client245
- Displaying and Maintaining HABP246
- HABP Configuration Example246
Managing Public Keys249
- Overview249
- FIPS Compliance249
- Configuration Task List250
- Creating a Local Asymmetric Key Pair250
- Displaying or Exporting the Local Host Public Key251
- Destroying a Local Asymmetric Key Pair252
- Specifying the Peer Public Key on the Local Device252
- Displaying and Maintaining Public Keys253
- Public Key Configuration Examples254
  - Manually Specifying the Peer Public Key on the Local Device254
  - Importing a Peer Public Key from a Public Key File256
Configuring PKI259
- Overview259
- PKI Configuration Task List261
- Configuring an Entity DN262
- Configuring a PKI Domain263
  - Configuration Guidelines264
  - Configuration Procedure264
- Submitting a PKI Certificate Request264
  - Submitting a Certificate Request in Auto Mode265
  - Submitting a Certificate Request in Manual Mode265
- Retrieving a Certificate Manually266
  - Configuration Guidelines266
  - Configuration Procedure267
- Configuring PKI Certificate Verification267
- Destroying a Local RSA Key Pair268
- Deleting a Certificate269
- Configuring an Access Control Policy269
- Displaying and Maintaining PKI269
- PKI Configuration Examples270
- Troubleshooting PKI278
Configuring Ipsec280
- Overview280
- FIPS Compliance283
- Configuring Ipsec283
- Implementing ACL-Based Ipsec283
- Configuring Ipsec for Ipv6 Routing Protocols293
- Displaying and Maintaining Ipsec294
- Ipsec Configuration Examples294
  - IKE-Based Ipsec Tunnel for Ipv4 Packets Configuration Example294
  - Ipsec for Ripng Configuration Example297
Configuring IKE301
- FIPS Compliance301
- Overview301
- IKE Configuration Task List303
- Configuring a Name for the Local Security Gateway304
- Configuring an IKE Proposal304
- Configuring an IKE Peer305
- Setting Keepalive Timers307
- Setting the NAT Keepalive Timer307
- Configuring a DPD Detector308
- Disabling Next Payload Field Checking308
- Displaying and Maintaining IKE309
- IKE Configuration Example309
- Troubleshooting IKE312
Configuring SSH2.0314
- Overview314
  - SSH Operation314
  - SSH Connection Across Vpns316
- FIPS Compliance317
- Configuring the Switch as an SSH Server317
- Configuring the Switch as an SSH Client322
- Displaying and Maintaining SSH325
- SSH Server Configuration Examples326
  - When the Switch Acts as a Server for Password Authentication326
  - When the Switch Acts as a Server for Publickey Authentication328
- SSH Client Configuration Examples333
  - When Switch Acts as Client for Password Authentication333
  - When Switch Acts as Client for Publickey Authentication336
Configuring SFTP339
- Overview339
- FIPS Compliance339
- Configuring the Switch as an SFTP Server339
  - Enabling the SFTP Server339
  - Configuring the SFTP Connection Idle Timeout Period340
- Configuring the Switch as an SFTP Client340
- SFTP Client Configuration Example344
- SFTP Server Configuration Example347
Configuring SCP350
- Overview350
- FIPS Compliance350
- Configuring the Switch as an SCP Server350
- Configuring the Switch as the SCP Client351
  - SCP Client Configuration Example352
  - SCP Server Configuration Example353
Configuring SSL355
- Overview355
  - SSL Security Mechanism355
  - SSL Protocol Stack355
- FIPS Compliance356
- Configuration Task List356
- Configuring an SSL Server Policy356
  - SSL Server Policy Configuration Example358
- Configuring an SSL Client Policy360
- Displaying and Maintaining SSL360
- Troubleshooting SSL361
Configuring TCP Attack Protection362
- Overview362
- Enabling the SYN Cookie Feature362
- Displaying and Maintaining TCP Attack Protection362
Configuring IP Source Guard364
- Overview364
  - Static IP Source Guard Entries364
  - Dynamic IP Source Guard Binding Entries365
- Configuration Task List365
- Configuring the Ipv4 Source Guard Function366
- Configuring the Ipv6 Source Guard Function369
- Displaying and Maintaining IP Source Guard371
- IP Source Guard Configuration Examples372
- Troubleshooting IP Source Guard381
Configuring ARP Attack Protection382
- Overview382
- ARP Attack Protection Configuration Task List382
- Configuring ARP Defense against IP Packet Attacks383
- Configuring ARP Packet Rate Limit385
  - Introduction385
  - Configuration Procedure385
- Configuring Source MAC Address Based ARP Attack Detection386
- Configuring ARP Packet Source MAC Address Consistency Check389
  - Introduction389
  - Configuration Procedure389
- Configuring ARP Active Acknowledgement389
- Configuring ARP Detection390
- Configuring ARP Automatic Scanning and Fixed ARP397
  - Configuration Guidelines398
  - Configuration Procedure398
- Configuring ARP Gateway Protection398
  - Configuration Procedure399
  - Configuration Example399
- Configuring ARP Filtering400
Configuring ND Attack Defense402
- Overview402
- Enabling Source MAC Consistency Check for ND Packets403
- Configuring the ND Detection Function403
- ND Detection Configuration Example405
  - Network Requirements405
  - Configuration Procedure405
Configuring URPF407
- Overview407
- Configuring URPF410
- URPF Configuration Example410
Configuring MFF412
- Overview412
- Configuring MFF414
- Displaying and Maintaining MFF416
- MFF Configuration Examples416
Configuring SAVI423
- Overview423
- Configuring Global SAVI423
- SAVI Configuration in Dhcpv6-Only Address Assignment Scenario424
- SAVI Configuration in SLAAC-Only Address Assignment Scenario426
- SAVI Configuration in Dhcpv6+Slaac Address Assignment Scenario428
Configuring Blacklist431
- Overview431
- Configuring the Blacklist Feature431
- Displaying and Maintaining the Blacklist431
- Blacklist Configuration Example432
Configuring FIPS434
- Overview434
- FIPS Self-Tests434
- Configuration Procedure435
  - Enabling the FIPS Mode435
  - Triggering a Self-Test436
- Displaying and Maintaining FIPS436
- FIPS Configuration Example436
Support and Other Resources439
- Contacting HP439
  - Subscription Service439
- Related Information439
  - Documents439
  - Websites439
- Conventions440
Index442

Other manuals for HP 5500 HI Series

Command Reference292 pages

Installation Guide72 pages

Questions and Answers:

Need help?

Do you have a question about the HP 5500 HI Series and is the answer not in the manual?

HP 5500 HI Series Specifications

General

Brand	HP
Model	5500 HI Series
Category	Switch
Language	English

Related product manuals

Preview: HP 5500 EI series

HP 5500 EI series

Preview: HP FlexNetwork 5130 HI series

HP FlexNetwork 5130 HI series

Preview: HP A5500 HI Series

HP A5500 HI Series

Preview: HP 5300

Preview: HP 5400 zl

Preview: HP 5120 series

Preview: HP 5800 Series

Preview: HP 5130 EI series

HP 5130 EI series

Preview: HP ProCurve 5400zl

HP ProCurve 5400zl

HP ProCurve 5406zl

HP ProCurve 5412ZL