Home
HP
Switch
5500 HI Series
HP 5500 HI Series User Manual
4
of 1
of 1 rating
444 pages
Give review
Manual
Specs
To Next Page
To Next Page
To Previous Page
To Previous Page
Loading...
235
<SwitchA> display habp
Global HABP information:
HABP Mode: Server
Sending HABP request packets every 50 seconds
Bypass VLAN: 1
# Display HABP MAC address table entries.
<SwitchA> display habp table
MAC Holdtime Receive Port
001f-3c00-0030 53 GigabitEthernet1/0/2
001f-3c00-0031 53 GigabitEthernet1/0/1
247
249
Table of Contents
Configuration Guide
1
Table of Contents
3
Configuring AAA
14
AAA Overview
14
Radius
15
Hwtacacs
20
Domain-Based User Management
22
RADIUS Server Feature of the Switch
23
AAA for MPLS L3Vpns
24
Protocols and Standards
24
RADIUS Attributes
25
FIPS Compliance
28
AAA Configuration Considerations and Task List
28
Configuring AAA Schemes
29
Configuring Local Users
29
Configuring RADIUS Schemes
34
Configuring HWTACACS Schemes
47
Configuring AAA Methods for ISP Domains
54
Configuration Prerequisites
54
Creating an ISP Domain
54
Configuring ISP Domain Attributes
54
Configuring AAA Authentication Methods for an ISP Domain
56
Configuring AAA Authorization Methods for an ISP Domain
57
Configuring AAA Accounting Methods for an ISP Domain
59
Tearing down User Connections
60
Configuring a NAS ID-VLAN Binding
60
Specifying the Device ID Used in Stateful Failover Mode
61
Configuring a Switch as a RADIUS Server
61
RADIUS Server Functions Configuration Task List
61
Configuring a RADIUS User
61
Specifying a RADIUS Client
62
Displaying and Maintaining AAA
63
AAA Configuration Examples
63
AAA for Telnet Users by an HWTACACS Server
63
AAA for Telnet Users by Separate Servers
64
Authentication/Authorization for Ssh/Telnet Users by a RADIUS Server
66
Level Switching Authentication for Telnet Users by an HWTACACS Server
69
RADIUS Authentication and Authorization for Telnet Users by a Switch
73
Troubleshooting AAA
75
Troubleshooting RADIUS
75
Troubleshooting HWTACACS
76
802.1X Overview
77
802.1X Architecture
77
Controlled/Uncontrolled Port and Port Authorization Status
77
802.1X-Related Protocols
78
Packet Formats
78
EAP over RADIUS
80
Initiating 802.1X Authentication
80
802.1X Client as the Initiator
80
Access Device as the Initiator
80
802.1X Authentication Procedures
81
A Comparison of EAP Relay and EAP Termination
81
EAP Relay
82
EAP Termination
83
Configuring 802.1X
85
HP Implementation of 802.1X
85
Access Control Methods
85
Using 802.1X Authentication with Other Features
85
Configuration Prerequisites
90
802.1X Configuration Task List
91
Enabling 802.1X
91
Configuration Guidelines
91
Configuration Procedure
92
Enabling EAP Relay or EAP Termination
92
Setting the Port Authorization State
93
Specifying an Access Control Method
93
Setting the Maximum Number of Concurrent 802.1X Users on a Port
94
Setting the Maximum Number of Authentication Request Attempts
94
Setting the 802.1X Authentication Timeout Timers
95
Configuring the Online User Handshake Function
95
Configuration Guidelines
95
Configuration Procedure
96
Configuring the Authentication Trigger Function
96
Configuration Guidelines
96
Configuration Procedure
97
Specifying a Mandatory Authentication Domain on a Port
97
Configuring the Quiet Timer
97
Enabling the Periodic Online User Re-Authentication Function
98
Configuration Guidelines
98
Configuration Procedure
98
Configuring a Port to Send EAPOL Frames Untagged
99
Setting the Maximum Number of 802.1X Authentication Attempts for MAC Authentication Users
99
Configuring a VLAN Group
99
Configuring an 802.1X Guest VLAN
100
Configuration Guidelines
100
Configuration Prerequisites
101
Configuration Procedure
101
Configuring an 802.1X Auth-Fail VLAN
101
Configuration Guidelines
101
Configuration Prerequisites
102
Configuration Procedure
102
Configuring an 802.1X Critical VLAN
102
Configuration Guidelines
102
Configuration Prerequisites
103
Configuration Procedure
103
Specifying Supported Domain Name Delimiters
103
Displaying and Maintaining 802.1X
104
802.1X Authentication Configuration Example
104
Network Requirements
104
Configuration Procedure
105
Verifying the Configuration
106
With Guest VLAN and VLAN Assignment Configuration Example
107
Network Requirements
107
Configuration Procedure
108
Verifying the Configuration
109
With ACL Assignment Configuration Example
109
Network Requirements
109
Configuration Procedure
110
Verifying the Configuration
110
Configuring EAD Fast Deployment
112
Overview
112
Free IP
112
URL Redirection
112
Configuration Prerequisites
112
Configuring a Free IP
112
Configuring the Redirect URL
113
Setting the EAD Rule Timer
113
Displaying and Maintaining EAD Fast Deployment
113
EAD Fast Deployment Configuration Example
114
Network Requirements
114
Configuration Procedure
115
Verifying the Configuration
115
Troubleshooting EAD Fast Deployment
116
Web Browser Users Cannot be Correctly Redirected
116
Configuring MAC Authentication
117
Overview
117
User Account Policies
117
Authentication Approaches
117
MAC Authentication Timers
118
Using MAC Authentication with Other Features
118
VLAN Assignment
118
ACL Assignment
118
Guest VLAN
118
Critical VLAN
119
Configuration Task List
119
Basic Configuration for MAC Authentication
119
Configuring MAC Authentication Globally
120
Configuring MAC Authentication on a Port
120
Specifying a MAC Authentication Domain
121
Configuring a MAC Authentication Guest VLAN
121
Configuring a MAC Authentication Critical VLAN
122
Configuring MAC Authentication Delay
123
Enabling MAC Authentication Multi-VLAN Mode
123
Displaying and Maintaining MAC Authentication
124
MAC Authentication Configuration Examples
124
Local MAC Authentication Configuration Example
124
RADIUS-Based MAC Authentication Configuration Example
126
ACL Assignment Configuration Example
128
Configuring Portal Authentication
131
Overview
131
Extended Portal Functions
131
Portal System Components
131
Portal System Using the Local Portal Server
133
Portal Authentication Modes
134
Portal Support for EAP
135
Layer 2 Portal Authentication Process
136
Layer 3 Portal Authentication Process
137
Portal Stateful Failover
140
Portal Authentication Across Vpns
142
Portal Configuration Task List
142
Configuration Prerequisites
143
Specifying the Portal Server
144
Specifying the Local Portal Server for Layer 2 Portal Authentication
144
Specifying a Portal Server for Layer 3 Portal Authentication
145
Configuring the Local Portal Server
145
Customizing Authentication Pages
145
Configuring the Local Portal Server
148
Enabling Portal Authentication
149
Enabling Layer 2 Portal Authentication
149
Enabling Layer 3 Portal Authentication
149
Controlling Access of Portal Users
150
Configuring a Portal-Free Rule
150
Configuring an Authentication Source Subnet
151
Setting the Maximum Number of Online Portal Users
152
Specifying an Authentication Domain for Portal Users
152
Configuring Layer 2 Portal Authentication to Support Web Proxy
153
Enabling Support for Portal User Moving
153
Specifying an Auth-Fail VLAN for Portal Authentication
154
Configuring RADIUS Related Attributes
155
Specifying NAS-Port-Type for an Interface
155
Specifying a NAS ID Profile for an Interface
155
Specifying a Source IP Address for Outgoing Portal Packets
156
Configuring Portal Stateful Failover
156
Specifying an Auto Redirection URL for Authenticated Portal Users
158
Configuring Portal Detection Functions
159
Configuring Online Layer 2 Portal User Detection
159
Configuring the Portal Server Detection Function
159
Configuring Portal User Information Synchronization
161
Logging off Portal Users
161
Displaying and Maintaining Portal
162
Portal Configuration Examples
163
Configuring Direct Portal Authentication
163
Configuring Re-DHCP Portal Authentication
167
Configuring Cross-Subnet Portal Authentication
169
Configuring Direct Portal Authentication with Extended Functions
171
Configuring Re-DHCP Portal Authentication with Extended Functions
173
Configuring Cross-Subnet Portal Authentication with Extended Functions
175
Configuring Portal Stateful Failover
177
Configuring Switch a
181
Configuring Switch B
183
Configuring Portal Server Detection and Portal User Information Synchronization
185
Cross-Subnet Portal Authentication Across Vpns
190
Configuring Layer 2 Portal Authentication
192
Troubleshooting Portal
196
Inconsistent Keys on the Access Device and the Portal Server
196
Incorrect Server Port Number on the Access Device
196
Configuring Triple Authentication
198
Overview
198
Triple Authentication Mechanism
198
Using Triple Authentication with Other Features
199
Configuring Triple Authentication
199
Triple Authentication Configuration Examples
200
Triple Authentication Basic Function Configuration Example
200
Triple Authentication Supporting VLAN Assignment and Auth-Fail VLAN Configuration Example
202
Configuring Port Security
208
Overview
208
Port Security Features
208
Port Security Modes
208
Working with Guest VLAN and Auth-Fail VLAN
211
Configuration Task List
211
Enabling Port Security
212
Setting Port Security's Limit on the Number of MAC Addresses on a Port
212
Setting the Port Security Mode
213
Configuration Prerequisites
213
Configuration Procedure
213
Configuring Port Security Features
214
Configuring NTK
214
Configuring Intrusion Protection
214
Enabling Port Security Traps
215
Configuring Secure MAC Addresses
215
Configuration Prerequisites
216
Configuration Procedure
216
Ignoring Authorization Information
217
Displaying and Maintaining Port Security
217
Port Security Configuration Examples
218
Configuring the Autolearn Mode
218
Configuring the Userloginwithoui Mode
220
Configuring the Macaddresselseuserloginsecure Mode
225
Troubleshooting Port Security
227
Cannot Set the Port Security Mode
227
Cannot Configure Secure MAC Addresses
228
Cannot Change Port Security Mode When a User Is Online
228
Configuring a User Profile
230
Overview
230
User Profile Configuration Task List
230
Creating a User Profile
230
Applying a Qos Policy
231
Enabling a User Profile
231
Displaying and Maintaining User Profiles
232
Configuring Password Control
233
Overview
233
FIPS Compliance
235
Password Control Configuration Task List
236
Configuring Password Control
236
Enabling Password Control
236
Setting Global Password Control Parameters
237
Setting User Group Password Control Parameters
238
Setting Local User Password Control Parameters
239
Setting Super Password Control Parameters
240
Setting a Local User Password in Interactive Mode
240
Displaying and Maintaining Password Control
240
Password Control Configuration Example
241
Configuring HABP
244
Overview
244
Configuring HABP
245
Configuring the HABP Server
245
Configuring an HABP Client
245
Displaying and Maintaining HABP
246
HABP Configuration Example
246
Managing Public Keys
249
Overview
249
FIPS Compliance
249
Configuration Task List
250
Creating a Local Asymmetric Key Pair
250
Displaying or Exporting the Local Host Public Key
251
Destroying a Local Asymmetric Key Pair
252
Specifying the Peer Public Key on the Local Device
252
Displaying and Maintaining Public Keys
253
Public Key Configuration Examples
254
Manually Specifying the Peer Public Key on the Local Device
254
Importing a Peer Public Key from a Public Key File
256
Configuring PKI
259
Overview
259
PKI Terms
259
PKI Architecture
260
PKI Operation
260
PKI Applications
261
PKI Configuration Task List
261
Configuring an Entity DN
262
Configuring a PKI Domain
263
Configuration Guidelines
264
Configuration Procedure
264
Submitting a PKI Certificate Request
264
Submitting a Certificate Request in Auto Mode
265
Submitting a Certificate Request in Manual Mode
265
Retrieving a Certificate Manually
266
Configuration Guidelines
266
Configuration Procedure
267
Configuring PKI Certificate Verification
267
Configuration Guidelines
267
Configuring CRL-Checking-Enabled PKI Certificate Verification
267
Configuring CRL-Checking-Disabled PKI Certificate Verification
268
Destroying a Local RSA Key Pair
268
Deleting a Certificate
269
Configuring an Access Control Policy
269
Displaying and Maintaining PKI
269
PKI Configuration Examples
270
Certificate Request from an RSA Keon CA Server
270
Certificate Request from a Windows 2003 CA Server
273
Certificate Attribute Access Control Policy Configuration Example
276
Troubleshooting PKI
278
Failed to Retrieve a CA Certificate
278
Failed to Request a Local Certificate
278
Failed to Retrieve Crls
279
Configuring Ipsec
280
Overview
280
Basic Concepts
280
Ipsec for Ipv6 Routing Protocols
283
Protocols and Standards
283
FIPS Compliance
283
Configuring Ipsec
283
Implementing ACL-Based Ipsec
283
Feature Restrictions
283
ACL-Based Ipsec Configuration Task List
284
Configuring Acls
284
Configuring an Ipsec Proposal
286
Configuring an Ipsec Policy
287
Applying an Ipsec Policy Group to an Interface
291
Configuring the Ipsec Session Idle Timeout
291
Enabling ACL Checking of De-Encapsulated Ipsec Packets
292
Configuring the Ipsec Anti-Replay Function
292
Configuring Packet Information Pre-Extraction
293
Configuring Ipsec for Ipv6 Routing Protocols
293
Displaying and Maintaining Ipsec
294
Ipsec Configuration Examples
294
IKE-Based Ipsec Tunnel for Ipv4 Packets Configuration Example
294
Ipsec for Ripng Configuration Example
297
Configuring IKE
301
FIPS Compliance
301
Overview
301
IKE Security Mechanism
301
IKE Operation
302
IKE Functions
302
Relationship between IKE and Ipsec
303
Protocols and Standards
303
IKE Configuration Task List
303
Configuring a Name for the Local Security Gateway
304
Configuring an IKE Proposal
304
Configuring an IKE Peer
305
Setting Keepalive Timers
307
Setting the NAT Keepalive Timer
307
Configuring a DPD Detector
308
Disabling Next Payload Field Checking
308
Displaying and Maintaining IKE
309
IKE Configuration Example
309
Troubleshooting IKE
312
Invalid User ID
312
Proposal Mismatch
312
Failing to Establish an Ipsec Tunnel
313
ACL Configuration Error
313
Configuring SSH2.0
314
Overview
314
SSH Operation
314
SSH Connection Across Vpns
316
FIPS Compliance
317
Configuring the Switch as an SSH Server
317
SSH Server Configuration Task List
317
Generating DSA or RSA Key Pairs
317
Enabling the SSH Server Function
318
Configuring the User Interfaces for SSH Clients
318
Configuring a Client Public Key
319
Configuring an SSH User
320
Setting the SSH Management Parameters
321
Setting the DSCP Value for Packets Sent by the SSH Server
322
Configuring the Switch as an SSH Client
322
SSH Client Configuration Task List
322
Specifying a Source IP Address/Interface for the SSH Client
323
Configuring Whether First-Time Authentication Is Supported
323
Establishing a Connection between the SSH Client and Server
324
Setting the DSCP Value for Packets Sent by the SSH Client
325
Displaying and Maintaining SSH
325
SSH Server Configuration Examples
326
When the Switch Acts as a Server for Password Authentication
326
When the Switch Acts as a Server for Publickey Authentication
328
SSH Client Configuration Examples
333
When Switch Acts as Client for Password Authentication
333
When Switch Acts as Client for Publickey Authentication
336
Configuring SFTP
339
Overview
339
FIPS Compliance
339
Configuring the Switch as an SFTP Server
339
Enabling the SFTP Server
339
Configuring the SFTP Connection Idle Timeout Period
340
Configuring the Switch as an SFTP Client
340
Specifying a Source IP Address or Interface for the SFTP Client
340
Establishing a Connection to the SFTP Server
340
Working with SFTP Directories
341
Working with SFTP Files
342
Displaying Help Information
343
Terminating the Connection to the Remote SFTP Server
343
Setting the DSCP Value for Packets Sent by the SFTP Client
343
SFTP Client Configuration Example
344
SFTP Server Configuration Example
347
Configuring SCP
350
Overview
350
FIPS Compliance
350
Configuring the Switch as an SCP Server
350
Configuring the Switch as the SCP Client
351
SCP Client Configuration Example
352
SCP Server Configuration Example
353
Configuring SSL
355
Overview
355
SSL Security Mechanism
355
SSL Protocol Stack
355
FIPS Compliance
356
Configuration Task List
356
Configuring an SSL Server Policy
356
SSL Server Policy Configuration Example
358
Configuring an SSL Client Policy
360
Displaying and Maintaining SSL
360
Troubleshooting SSL
361
Configuring TCP Attack Protection
362
Overview
362
Enabling the SYN Cookie Feature
362
Displaying and Maintaining TCP Attack Protection
362
Configuring IP Source Guard
364
Overview
364
Static IP Source Guard Entries
364
Dynamic IP Source Guard Binding Entries
365
Configuration Task List
365
Configuring the Ipv4 Source Guard Function
366
Configuring Ipv4 Source Guard on a Port
366
Configuring a Static Ipv4 Source Guard Entry
367
Setting the Maximum Number of Ipv4 Source Guard Binding Entries
368
Configuring the Ipv6 Source Guard Function
369
Configuring Ipv6 Source Guard on a Port
369
Configuring a Static Ipv6 Source Guard Entry
370
Setting the Maximum Number of Ipv6 Source Guard Entries
371
Displaying and Maintaining IP Source Guard
371
IP Source Guard Configuration Examples
372
Static Ipv4 Source Guard Configuration Example
372
Dynamic Ipv4 Source Guard Using DHCP Snooping Configuration Example
374
Dynamic Ipv4 Source Guard Using DHCP Relay Configuration Example
375
Static Ipv6 Source Guard Configuration Example
376
Dynamic Ipv6 Source Guard Using Dhcpv6 Snooping Configuration Example
377
Dynamic Ipv6 Source Guard Using ND Snooping Configuration Example
378
Global Static IP Source Guard Configuration Example
379
Troubleshooting IP Source Guard
381
Configuring ARP Attack Protection
382
Overview
382
ARP Attack Protection Configuration Task List
382
Configuring ARP Defense against IP Packet Attacks
383
Configuring ARP Source Suppression
383
Enabling ARP Black Hole Routing
384
Displaying and Maintaining ARP Defense against IP Packet Attacks
384
Configuration Example
384
Configuring ARP Packet Rate Limit
385
Introduction
385
Configuration Procedure
385
Configuring Source MAC Address Based ARP Attack Detection
386
Configuration Procedure
386
Displaying and Maintaining Source MAC Address Based ARP Attack Detection
387
Configuration Example
387
Configuring ARP Packet Source MAC Address Consistency Check
389
Introduction
389
Configuration Procedure
389
Configuring ARP Active Acknowledgement
389
Configuring ARP Detection
390
Introduction
390
Configuring User Validity Check
390
Configuring ARP Packet Validity Check
391
Configuring ARP Restricted Forwarding
392
Configuring the ARP Detection Logging Function
392
Displaying and Maintaining ARP Detection
393
User Validity Check Configuration Example
393
User Validity Check and ARP Packet Validity Check Configuration Example
394
ARP Restricted Forwarding Configuration Example
396
Configuring ARP Automatic Scanning and Fixed ARP
397
Configuration Guidelines
398
Configuration Procedure
398
Configuring ARP Gateway Protection
398
Configuration Procedure
399
Configuration Example
399
Configuring ARP Filtering
400
Configuration Guidelines
400
Configuration Procedure
400
Configuration Example
400
Configuring ND Attack Defense
402
Overview
402
Enabling Source MAC Consistency Check for ND Packets
403
Configuring the ND Detection Function
403
Introduction to ND Detection
403
Configuration Guidelines
404
Configuration Procedure
404
Displaying and Maintaining ND Detection
404
ND Detection Configuration Example
405
Network Requirements
405
Configuration Procedure
405
Configuring URPF
407
Overview
407
URPF Check Modes
407
How URPF Works
407
Network Application
410
Configuring URPF
410
URPF Configuration Example
410
Configuring MFF
412
Overview
412
Basic Concepts
413
Operation Modes
413
Working Mechanism
414
Protocols and Standards
414
Configuring MFF
414
Configuration Prerequisites
414
Enabling MFF
415
Configuring a Network Port
415
Enabling Periodic Gateway Probe
415
Specifying the IP Addresses of Servers
415
Displaying and Maintaining MFF
416
MFF Configuration Examples
416
Auto-Mode MFF Configuration Example in a Tree Network
416
Auto-Mode MFF Configuration Example in a Ring Network
418
Manual-Mode MFF Configuration Example in a Tree Network
420
Manual-Mode MFF Configuration Example in a Ring Network
421
Configuring SAVI
423
Overview
423
Configuring Global SAVI
423
SAVI Configuration in Dhcpv6-Only Address Assignment Scenario
424
Network Requirements
424
Configuration Considerations
424
Packet Check Principles
425
Configuration Procedure
425
SAVI Configuration in SLAAC-Only Address Assignment Scenario
426
Network Requirements
426
Configuration Considerations
426
Packet Check Principles
427
Configuration Procedure
427
SAVI Configuration in Dhcpv6+Slaac Address Assignment Scenario
428
Network Requirements
428
Configuration Considerations
428
Packet Check Principles
429
Configuration Procedure
429
Configuring Blacklist
431
Overview
431
Configuring the Blacklist Feature
431
Displaying and Maintaining the Blacklist
431
Blacklist Configuration Example
432
Network Requirements
432
Configuration Procedure
432
Verifying the Configuration
432
Configuring FIPS
434
Overview
434
FIPS Self-Tests
434
Power-Up Self-Test
434
Conditional Self-Tests
434
Triggering a Self-Test
434
Configuration Procedure
435
Enabling the FIPS Mode
435
Triggering a Self-Test
436
Displaying and Maintaining FIPS
436
FIPS Configuration Example
436
Network Requirements
436
Configuration Procedure
436
Verifying the Configuration
437
Support and Other Resources
439
Contacting HP
439
Subscription Service
439
Related Information
439
Documents
439
Websites
439
Conventions
440
Index
442
Other manuals for HP 5500 HI Series
Command Reference
292 pages
Installation Guide
72 pages
4
Based on 1 rating
Ask a question
Give review
Questions and Answers:
Need help?
Do you have a question about the HP 5500 HI Series and is the answer not in the manual?
Ask a question
HP 5500 HI Series Specifications
General
Brand
HP
Model
5500 HI Series
Category
Switch
Language
English
Related product manuals
HP 5500 EI series
424 pages
HP FlexNetwork 5130 HI series
306 pages
HP A5500 HI Series
62 pages
HP 5900
86 pages
HP 5300
35 pages
HP 5400 zl
134 pages
HP 5120 series
161 pages
HP 5800 Series
396 pages
HP 5130 EI series
166 pages
HP ProCurve 5400zl
765 pages
HP ProCurve 5406zl
460 pages
HP ProCurve 5412ZL
460 pages
To Next PageTo Next PageTo Previous PageTo Previous Page
Loading...
Need help?
General
