HP 5500 HI Series User Manual (English)

To Next Page

HP 5500 HI Switch Series

Security

Configuration Guide

Part number: 5998-2383

Software version: Release 5203 and Release 5206

Document version: 6W102-20140228

Configuration Guide1
Table of Contents3
Configuring AAA14
- AAA Overview14
- FIPS Compliance28
- AAA Configuration Considerations and Task List28
- Configuring AAA Schemes29
- Configuring AAA Methods for ISP Domains54
- Tearing down User Connections60
- Configuring a NAS ID-VLAN Binding60
- Specifying the Device ID Used in Stateful Failover Mode61
- Configuring a Switch as a RADIUS Server61
- Displaying and Maintaining AAA63
- AAA Configuration Examples63
- Troubleshooting AAA75
  - Troubleshooting RADIUS75
  - Troubleshooting HWTACACS76
802.1X Overview77
- 802.1X Architecture77
- Controlled/Uncontrolled Port and Port Authorization Status77
- 802.1X-Related Protocols78
  - Packet Formats78
  - EAP over RADIUS80
- Initiating 802.1X Authentication80
  - 802.1X Client as the Initiator80
  - Access Device as the Initiator80
- 802.1X Authentication Procedures81
Configuring 802.1X85
- HP Implementation of 802.1X85
  - Access Control Methods85
  - Using 802.1X Authentication with Other Features85
- Configuration Prerequisites90
- 802.1X Configuration Task List91
- Enabling 802.1X91
  - Configuration Guidelines91
  - Configuration Procedure92
- Enabling EAP Relay or EAP Termination92
- Setting the Port Authorization State93
- Specifying an Access Control Method93
- Setting the Maximum Number of Concurrent 802.1X Users on a Port94
- Setting the Maximum Number of Authentication Request Attempts94
- Setting the 802.1X Authentication Timeout Timers95
- Configuring the Online User Handshake Function95
  - Configuration Guidelines95
  - Configuration Procedure96
- Configuring the Authentication Trigger Function96
  - Configuration Guidelines96
  - Configuration Procedure97
- Specifying a Mandatory Authentication Domain on a Port97
- Configuring the Quiet Timer97
- Enabling the Periodic Online User Re-Authentication Function98
  - Configuration Guidelines98
  - Configuration Procedure98
- Configuring a Port to Send EAPOL Frames Untagged99
- Setting the Maximum Number of 802.1X Authentication Attempts for MAC Authentication Users99
- Configuring a VLAN Group99
- Configuring an 802.1X Guest VLAN100
  - Configuration Guidelines100
  - Configuration Prerequisites101
  - Configuration Procedure101
- Configuring an 802.1X Auth-Fail VLAN101
  - Configuration Guidelines101
  - Configuration Prerequisites102
  - Configuration Procedure102
- Configuring an 802.1X Critical VLAN102
  - Configuration Guidelines102
  - Configuration Prerequisites103
  - Configuration Procedure103
- Specifying Supported Domain Name Delimiters103
- Displaying and Maintaining 802.1X104
- 802.1X Authentication Configuration Example104
  - Network Requirements104
  - Configuration Procedure105
  - Verifying the Configuration106
- With Guest VLAN and VLAN Assignment Configuration Example107
  - Network Requirements107
  - Configuration Procedure108
  - Verifying the Configuration109
- With ACL Assignment Configuration Example109
  - Network Requirements109
  - Configuration Procedure110
  - Verifying the Configuration110
Configuring EAD Fast Deployment112
- Overview112
  - Free IP112
  - URL Redirection112
- Configuration Prerequisites112
- Configuring a Free IP112
- Configuring the Redirect URL113
- Setting the EAD Rule Timer113
- Displaying and Maintaining EAD Fast Deployment113
- EAD Fast Deployment Configuration Example114
- Troubleshooting EAD Fast Deployment116
  - Web Browser Users Cannot be Correctly Redirected116
Configuring MAC Authentication117
- Overview117
- Using MAC Authentication with Other Features118
- Configuration Task List119
- Basic Configuration for MAC Authentication119
  - Configuring MAC Authentication Globally120
  - Configuring MAC Authentication on a Port120
- Specifying a MAC Authentication Domain121
- Configuring a MAC Authentication Guest VLAN121
- Configuring a MAC Authentication Critical VLAN122
- Configuring MAC Authentication Delay123
- Enabling MAC Authentication Multi-VLAN Mode123
- Displaying and Maintaining MAC Authentication124
- MAC Authentication Configuration Examples124
Configuring Portal Authentication131
- Overview131
- Portal Configuration Task List142
- Configuration Prerequisites143
- Specifying the Portal Server144
  - Specifying the Local Portal Server for Layer 2 Portal Authentication144
  - Specifying a Portal Server for Layer 3 Portal Authentication145
- Configuring the Local Portal Server145
  - Customizing Authentication Pages145
  - Configuring the Local Portal Server148
- Enabling Portal Authentication149
  - Enabling Layer 2 Portal Authentication149
  - Enabling Layer 3 Portal Authentication149
- Controlling Access of Portal Users150
- Specifying an Auth-Fail VLAN for Portal Authentication154
- Configuring RADIUS Related Attributes155
  - Specifying NAS-Port-Type for an Interface155
  - Specifying a NAS ID Profile for an Interface155
- Specifying a Source IP Address for Outgoing Portal Packets156
- Configuring Portal Stateful Failover156
- Specifying an Auto Redirection URL for Authenticated Portal Users158
- Configuring Portal Detection Functions159
- Logging off Portal Users161
- Displaying and Maintaining Portal162
- Portal Configuration Examples163
- Troubleshooting Portal196
  - Inconsistent Keys on the Access Device and the Portal Server196
  - Incorrect Server Port Number on the Access Device196
Configuring Triple Authentication198
- Overview198
  - Triple Authentication Mechanism198
  - Using Triple Authentication with Other Features199
- Configuring Triple Authentication199
- Triple Authentication Configuration Examples200
  - Triple Authentication Basic Function Configuration Example200
  - Triple Authentication Supporting VLAN Assignment and Auth-Fail VLAN Configuration Example202
Configuring Port Security208
- Overview208
- Configuration Task List211
- Enabling Port Security212
- Setting Port Security's Limit on the Number of MAC Addresses on a Port212
- Setting the Port Security Mode213
  - Configuration Prerequisites213
  - Configuration Procedure213
- Configuring Port Security Features214
- Configuring Secure MAC Addresses215
  - Configuration Prerequisites216
  - Configuration Procedure216
- Ignoring Authorization Information217
- Displaying and Maintaining Port Security217
- Port Security Configuration Examples218
- Troubleshooting Port Security227
Configuring a User Profile230
- Overview230
- User Profile Configuration Task List230
- Creating a User Profile230
- Applying a Qos Policy231
- Enabling a User Profile231
- Displaying and Maintaining User Profiles232
Configuring Password Control233
- Overview233
- FIPS Compliance235
- Password Control Configuration Task List236
- Configuring Password Control236
- Displaying and Maintaining Password Control240
- Password Control Configuration Example241
Configuring HABP244
- Overview244
- Configuring HABP245
  - Configuring the HABP Server245
  - Configuring an HABP Client245
- Displaying and Maintaining HABP246
- HABP Configuration Example246
Managing Public Keys249
- Overview249
- FIPS Compliance249
- Configuration Task List250
- Creating a Local Asymmetric Key Pair250
- Displaying or Exporting the Local Host Public Key251
- Destroying a Local Asymmetric Key Pair252
- Specifying the Peer Public Key on the Local Device252
- Displaying and Maintaining Public Keys253
- Public Key Configuration Examples254
  - Manually Specifying the Peer Public Key on the Local Device254
  - Importing a Peer Public Key from a Public Key File256
Configuring PKI259
- Overview259
- PKI Configuration Task List261
- Configuring an Entity DN262
- Configuring a PKI Domain263
  - Configuration Guidelines264
  - Configuration Procedure264
- Submitting a PKI Certificate Request264
  - Submitting a Certificate Request in Auto Mode265
  - Submitting a Certificate Request in Manual Mode265
- Retrieving a Certificate Manually266
  - Configuration Guidelines266
  - Configuration Procedure267
- Configuring PKI Certificate Verification267
- Destroying a Local RSA Key Pair268
- Deleting a Certificate269
- Configuring an Access Control Policy269
- Displaying and Maintaining PKI269
- PKI Configuration Examples270
- Troubleshooting PKI278
Configuring Ipsec280
- Overview280
- FIPS Compliance283
- Configuring Ipsec283
- Implementing ACL-Based Ipsec283
- Configuring Ipsec for Ipv6 Routing Protocols293
- Displaying and Maintaining Ipsec294
- Ipsec Configuration Examples294
  - IKE-Based Ipsec Tunnel for Ipv4 Packets Configuration Example294
  - Ipsec for Ripng Configuration Example297
Configuring IKE301
- FIPS Compliance301
- Overview301
- IKE Configuration Task List303
- Configuring a Name for the Local Security Gateway304
- Configuring an IKE Proposal304
- Configuring an IKE Peer305
- Setting Keepalive Timers307
- Setting the NAT Keepalive Timer307
- Configuring a DPD Detector308
- Disabling Next Payload Field Checking308
- Displaying and Maintaining IKE309
- IKE Configuration Example309
- Troubleshooting IKE312
Configuring SSH2.0314
- Overview314
  - SSH Operation314
  - SSH Connection Across Vpns316
- FIPS Compliance317
- Configuring the Switch as an SSH Server317
- Configuring the Switch as an SSH Client322
- Displaying and Maintaining SSH325
- SSH Server Configuration Examples326
  - When the Switch Acts as a Server for Password Authentication326
  - When the Switch Acts as a Server for Publickey Authentication328
- SSH Client Configuration Examples333
  - When Switch Acts as Client for Password Authentication333
  - When Switch Acts as Client for Publickey Authentication336
Configuring SFTP339
- Overview339
- FIPS Compliance339
- Configuring the Switch as an SFTP Server339
  - Enabling the SFTP Server339
  - Configuring the SFTP Connection Idle Timeout Period340
- Configuring the Switch as an SFTP Client340
- SFTP Client Configuration Example344
- SFTP Server Configuration Example347
Configuring SCP350
- Overview350
- FIPS Compliance350
- Configuring the Switch as an SCP Server350
- Configuring the Switch as the SCP Client351
  - SCP Client Configuration Example352
  - SCP Server Configuration Example353
Configuring SSL355
- Overview355
  - SSL Security Mechanism355
  - SSL Protocol Stack355
- FIPS Compliance356
- Configuration Task List356
- Configuring an SSL Server Policy356
  - SSL Server Policy Configuration Example358
- Configuring an SSL Client Policy360
- Displaying and Maintaining SSL360
- Troubleshooting SSL361
Configuring TCP Attack Protection362
- Overview362
- Enabling the SYN Cookie Feature362
- Displaying and Maintaining TCP Attack Protection362
Configuring IP Source Guard364
- Overview364
  - Static IP Source Guard Entries364
  - Dynamic IP Source Guard Binding Entries365
- Configuration Task List365
- Configuring the Ipv4 Source Guard Function366
- Configuring the Ipv6 Source Guard Function369
- Displaying and Maintaining IP Source Guard371
- IP Source Guard Configuration Examples372
- Troubleshooting IP Source Guard381
Configuring ARP Attack Protection382
- Overview382
- ARP Attack Protection Configuration Task List382
- Configuring ARP Defense against IP Packet Attacks383
- Configuring ARP Packet Rate Limit385
  - Introduction385
  - Configuration Procedure385
- Configuring Source MAC Address Based ARP Attack Detection386
- Configuring ARP Packet Source MAC Address Consistency Check389
  - Introduction389
  - Configuration Procedure389
- Configuring ARP Active Acknowledgement389
- Configuring ARP Detection390
- Configuring ARP Automatic Scanning and Fixed ARP397
  - Configuration Guidelines398
  - Configuration Procedure398
- Configuring ARP Gateway Protection398
  - Configuration Procedure399
  - Configuration Example399
- Configuring ARP Filtering400
Configuring ND Attack Defense402
- Overview402
- Enabling Source MAC Consistency Check for ND Packets403
- Configuring the ND Detection Function403
- ND Detection Configuration Example405
  - Network Requirements405
  - Configuration Procedure405
Configuring URPF407
- Overview407
- Configuring URPF410
- URPF Configuration Example410
Configuring MFF412
- Overview412
- Configuring MFF414
- Displaying and Maintaining MFF416
- MFF Configuration Examples416
Configuring SAVI423
- Overview423
- Configuring Global SAVI423
- SAVI Configuration in Dhcpv6-Only Address Assignment Scenario424
- SAVI Configuration in SLAAC-Only Address Assignment Scenario426
- SAVI Configuration in Dhcpv6+Slaac Address Assignment Scenario428
Configuring Blacklist431
- Overview431
- Configuring the Blacklist Feature431
- Displaying and Maintaining the Blacklist431
- Blacklist Configuration Example432
Configuring FIPS434
- Overview434
- FIPS Self-Tests434
- Configuration Procedure435
  - Enabling the FIPS Mode435
  - Triggering a Self-Test436
- Displaying and Maintaining FIPS436
- FIPS Configuration Example436
Support and Other Resources439
- Contacting HP439
  - Subscription Service439
- Related Information439
  - Documents439
  - Websites439
- Conventions440
Index442

Other manuals for HP 5500 HI Series

Command Reference292 pages

Installation Guide72 pages

Need help?

Do you have a question about the HP 5500 HI Series and is the answer not in the manual?

HP 5500 HI Series Specifications

General

Switch Type	Managed
Input voltage	100-240 VAC
Product Series	HP 5500 HI
Ports	48 x 10/100/1000
Uplink Ports	4 x SFP+
Management	CLI, Web, SNMP
Dimensions	17.32 x 16.54 x 1.72 in
MAC Address Table Size	32, 000 entries
Routing Protocol	OSPF, BGP, RIP, IS-IS
Operating temperature range	0°C to 45°C (32°F to 113°F)
Operating Humidity	10% to 90% (noncondensing)