HP 5920 Series - Configuration Guide Manual

To Next Page

HP 5920 & 5900 Switch Series

Security

Configuration Guide

Part number: 5998-5310a

Software version: Release 23xx

Document version: 6W101-20150320

Main Page

Configuration Guide1
Table of Contents3
Configuring AAA12
Overview12
Radius13
Hwtacacs18
Ldap20
AAA Implementation on the Device22
AAA for MPLS L3Vpns24
Protocols and Standards25
RADIUS Attributes25
FIPS Compliance28
AAA Configuration Considerations and Task List28
Configuring AAA Schemes29
Configuring Local Users29
Configuring User Group Attributes32
Configuring RADIUS Schemes33
Configuring HWTACACS Schemes43
Configuring LDAP Schemes50
Configuring AAA Methods for ISP Domains53
Configuration Prerequisites53
Creating an ISP Domain53
Configuring ISP Domain Attributes54
Configuring Authentication Methods for an ISP Domain54
Configuring Authorization Methods for an ISP Domain55
Configuring Accounting Methods for an ISP Domain56
Enabling the Session-Control Feature57
Setting the Maximum Number of Concurrent Login Users58
Displaying and Maintaining AAA58
AAA Configuration Examples58
AAA for SSH Users by an HWTACACS Server58
Local Authentication, HWTACACS Authorization, and RADIUS Accounting for SSH Users60
Authentication and Authorization for SSH Users by a RADIUS Server62
Authentication for SSH Users by an LDAP Server65
Troubleshooting RADIUS70
RADIUS Authentication Failure70
RADIUS Packet Delivery Failure70
RADIUS Accounting Error71
Troubleshooting HWTACACS71
Troubleshooting LDAP71
802.1X Overview73
802.1X Architecture73
Controlled/Uncontrolled Port and Port Authorization Status73
802.1X-Related Protocols74
Packet Formats74
EAP over RADIUS75
802.1X Authentication Initiation76
802.1X Client as the Initiator76
Access Device as the Initiator76
802.1X Authentication Procedures77
Comparing EAP Relay and EAP Termination77
EAP Relay78
EAP Termination79
Configuring 802.1X81
HP Implementation of 802.1X81
Configuration Prerequisites81
802.1X Configuration Task List81
Enabling 802.1X82
Enabling EAP Relay or EAP Termination82
Setting the Port Authorization State83
Specifying an Access Control Method83
Setting the Maximum Number of Concurrent 802.1X Users on a Port83
Setting the Maximum Number of Authentication Request Attempts84
Setting the 802.1X Authentication Timeout Timers84
Configuring the Online User Handshake Feature85
Configuring the Authentication Trigger Feature85
Configuration Guidelines85
Configuration Procedure85
Specifying a Mandatory Authentication Domain on a Port86
Configuring the Quiet Timer86
Enabling the Periodic Online User Reauthentication Feature87
Displaying and Maintaining 802.1X87
802.1X Authentication Configuration Example87
Network Requirements87
Configuration Procedure88
Verifying the Configuration89
Configuring MAC Authentication90
Overview90
User Account Policies90
Authentication Methods90
Configuration Prerequisites91
Configuration Task List91
Enabling MAC Authentication91
Specifying a MAC Authentication Domain92
Configuring the User Account Format92
Configuring MAC Authentication Timers93
Setting the Maximum Number of Concurrent MAC Authentication Users on a Port93
Configuring MAC Authentication Delay94
Displaying and Maintaining MAC Authentication94
MAC Authentication Configuration Examples95
Local MAC Authentication Configuration Example95
RADIUS-Based MAC Authentication Configuration Example96
Configuring Portal Authentication99
Overview99
Extended Portal Functions99
Portal System Components100
Interaction between Portal System Components101
Portal Authentication Modes101
Portal Authentication Process102
Portal Configuration Task List104
Configuration Prerequisites105
Configuring a Portal Authentication Server105
Configuring a Portal Web Server106
Enabling Portal Authentication on an Interface106
Configuration Restrictions and Guidelines107
Configuration Procedure107
Referencing a Portal Web Server for an Interface107
Controlling Portal User Access108
Configuring a Portal-Free Rule108
Configuring an Authentication Source Subnet109
Configuring an Authentication Destination Subnet110
Setting the Maximum Number of Portal Users111
Specifying a Portal Authentication Domain111
Configuring Portal Detection Functions112
Configuring Online Detection of Portal Users112
Configuring Portal Authentication Server Detection113
Configuring Portal Web Server Detection114
Configuring Portal User Synchronization114
Configuring the Portal Fail-Permit Function115
Configuring BAS-IP for Unsolicited Portal Packets Sent to the Portal Authentication Server116
Enabling Portal Roaming117
Logging out Portal Users117
Displaying and Maintaining Portal117
Portal Configuration Examples118
Configuring Direct Portal Authentication118
Configuring Re-DHCP Portal Authentication126
Configuring Cross-Subnet Portal Authentication130
Configuring Extended Direct Portal Authentication133
Configuring Extended Re-DHCP Portal Authentication136
Configuring Extended Cross-Subnet Portal Authentication139
Configuring Portal Server Detection and Portal User Synchronization143
Configuring Cross-Subnet Portal Authentication for MPLS L3Vpns151
Troubleshooting Portal153
No Portal Authentication Page Is Pushed for Users153
Cannot Log out Portal Users on the Access Device153
Cannot Log out Portal Users on the RADIUS Server154
Users Logged out by the Access Device Still Exist on the Portal Authentication Server154
Re-DHCP Portal Authenticated Users Cannot Log in Successfully155
Configuring Port Security156
Overview156
Port Security Features156
Port Security Modes156
Configuration Task List159
Enabling Port Security160
Setting Port Security's Limit on the Number of Secure MAC Addresses on a Port160
Setting the Port Security Mode161
Configuring Port Security Features162
Configuring NTK162
Configuring Intrusion Protection162
Configuring Secure MAC Addresses163
Configuration Prerequisites164
Configuration Procedure164
Ignoring Authorization Information from the Server164
Enabling MAC Move165
Displaying and Maintaining Port Security165
Port Security Configuration Examples166
Autolearn Configuration Example166
Userloginwithoui Configuration Example167
Configure Aaa168
Macaddresselseuserloginsecure Configuration Example170
Troubleshooting Port Security173
Cannot Set the Port Security Mode173
Cannot Configure Secure MAC Addresses174
Configuring Password Control175
Overview175
Password Setting175
Password Updating and Expiration176
User Login Control177
Password Not Displayed in any Form177
Logging178
FIPS Compliance178
Password Control Configuration Task List178
Enabling Password Control178
Setting Global Password Control Parameters179
Setting User Group Password Control Parameters180
Setting Local User Password Control Parameters181
Setting Super Password Control Parameters182
Displaying and Maintaining Password Control182
Password Control Configuration Example183
Network Requirements183
Configuration Procedure183
Verifying the Configuration184
Managing Public Keys186
Overview186
FIPS Compliance186
Creating a Local Key Pair187
Configuration Guidelines187
Configuration Procedure188
Distributing a Local Host Public Key188
Exporting a Host Public Key to a File188
Exporting a Host Public Key and Saving It to a File189
Displaying a Host Public Key189
Destroying a Local Key Pair190
Configuring a Peer Host Public Key190
Importing a Peer Host Public Key from a Public Key File191
Entering a Peer Host Public Key191
Displaying and Maintaining Public Keys191
Examples of Public Key Management191
Example for Entering a Peer Host Public Key191
Example for Importing a Public Key from a Public Key File193
Configuring PKI196
Overview196
PKI Terminology196
PKI Architecture197
PKI Operation197
PKI Applications198
Support for MPLS L3VPN198
FIPS Compliance199
PKI Configuration Task List199
Configuring a PKI Entity199
Configuring a PKI Domain200
Requesting a Certificate203
Configuration Guidelines203
Configuring Automatic Certificate Request203
Manually Requesting a Certificate204
Aborting a Certificate Request205
Obtaining Certificates205
Configuration Prerequisites205
Configuration Guidelines205
Configuration Procedure206
Verifying PKI Certificates206
Verifying Certificates with CRL Checking206
Verifying Certificates Without CRL Checking207
Specifying the Storage Path for the Certificates and Crls207
Exporting Certificates208
Removing a Certificate208
Configuring a Certificate Access Control Policy209
Displaying and Maintaining PKI210
PKI Configuration Examples210
Requesting a Certificate from an RSA Keon CA Server211
Requesting a Certificate from a Windows Server 2003 CA Server213
Requesting a Certificate from an Openca Server217
Certificate Import and Export Configuration Example220
Troubleshooting PKI Configuration225
Failed to Obtain the CA Certificate225
Failed to Obtain Local Certificates226
Failed to Request Local Certificates227
Failed to Obtain Crls227
Failed to Import the CA Certificate228
Failed to Import a Local Certificate228
Failed to Export Certificates229
Failed to Set the Storage Path229
Configuring Ipsec231
Overview231
Security Protocols and Encapsulation Modes232
Security Association233
Authentication and Encryption234
Ipsec Implementation234
Protocols and Standards235
Ipsec Tunnel Establishment235
Implementing ACL-Based Ipsec236
Feature Restrictions and Guidelines236
ACL-Based Ipsec Configuration Task List236
Configuring an ACL237
Configuring an Ipsec Transform Set238
Configuring a Manual Ipsec Policy239
Configuring an IKE-Based Ipsec Policy241
Applying an Ipsec Policy to an Interface245
Enabling ACL Checking for De-Encapsulated Packets245
Configuring the Ipsec Anti-Replay Function246
Binding a Source Interface to an Ipsec Policy247
Enabling Qos Pre-Classify247
Enabling Logging of Ipsec Packets248
Configuring the DF Bit of Ipsec Packets248
Configuring Ipsec for Ipv6 Routing Protocols249
Configuration Task List249
Configuring a Manual Ipsec Profile249
Configuring SNMP Notifications for Ipsec251
Displaying and Maintaining Ipsec251
Ipsec Configuration Examples252
Configuring a Manual Mode Ipsec Tunnel for Ipv4 Packets252
Configuring an IKE-Based Ipsec Tunnel for Ipv4 Packets254
Configuring Ipsec for Ripng257
Configuring IKE261
Overview261
IKE Negotiation Process261
IKE Security Mechanism262
Protocols and Standards263
FIPS Compliance263
IKE Configuration Prerequisites263
IKE Configuration Task List263
Configuring an IKE Profile264
Configuring an IKE Proposal266
Configuring an IKE Keychain267
Configuring the Global Identity Information268
Configuring the IKE Keepalive Function269
Configuring the IKE NAT Keepalive Function270
Configuring IKE DPD270
Enabling Invalid SPI Recovery271
Setting the Maximum Number of IKE Sas271
Configuring SNMP Notifications for IKE272
Displaying and Maintaining IKE272
IKE Configuration Examples273
Main Mode IKE with Pre-Shared Key Authentication Configuration Example273
Verifying the Configuration275
Troubleshooting IKE275
IKE Negotiation Failed Because no Matching IKE Proposals Were Found275
IKE Negotiation Failed Because no IKE Proposals or IKE Keychains Are Referenced Correctly276
Ipsec SA Negotiation Failed Because no Matching Ipsec Transform Sets Were Found277
Ipsec SA Negotiation Failed Due to Invalid Identity Information277
Configuring SSH280
Overview280
How SSH Works280
SSH Authentication Methods281
FIPS Compliance282
Configuring the Device as an SSH Server283
SSH Server Configuration Task List283
Generating Local Key Pairs283
Enabling the SSH Server Function284
Enabling the SFTP Server Function285
Configuring NETCONF over SSH285
Configuring the User Lines for SSH Login285
Configuring a Client's Host Public Key286
Configuring an SSH User287
Setting the SSH Management Parameters288
Configuring the Device as an Stelnet Client289
Stelnet Client Configuration Task List289
Specifying the Source IP Address for SSH Packets290
Establishing a Connection to an Stelnet Server290
Configuring the Device as an SFTP Client292
SFTP Client Configuration Task List292
Specifying the Source IP Address for SFTP Packets292
Establishing a Connection to an SFTP Server292
Working with SFTP Directories294
Working with SFTP Files294
Displaying Help Information294
Terminating the Connection with the SFTP Server295
Configuring the Device as an SCP Client295
Displaying and Maintaining SSH297
Stelnet Configuration Examples297
Password Authentication Enabled Stelnet Server Configuration Example297
Publickey Authentication Enabled Stelnet Server Configuration Example300
Password Authentication Enabled Stelnet Client Configuration Example305
Publickey Authentication Enabled Stelnet Client Configuration Example308
SFTP Configuration Examples310
Password Authentication Enabled SFTP Server Configuration Example310
Publickey Authentication Enabled SFTP Client Configuration Example312
SCP Configuration Examples315
SCP File Transfer with Password Authentication316
NETCONF over SSH Configuration Example with Password Authentication317
Network Requirements317
Configuration Procedure318
Verifying the Configuration319
Configuring SSL320
Overview320
SSL Security Services320
SSL Protocol Stack320
FIPS Compliance321
SSL Configuration Task List321
Configuring an SSL Server Policy321
Configuring an SSL Client Policy323
Displaying and Maintaining SSL324
Configuring IP Source Guard325
Overview325
Static IP Source Guard Binding Entries326
Dynamic IP Source Guard Binding Entries326
IP Source Guard Configuration Task List327
Configuring the Ipv4 Source Guard Function327
Enabling Ipv4 Source Guard on an Interface327
Configuring a Static Ipv4 Source Guard Binding Entry328
Configuring the Ipv6 Source Guard Function329
Enabling Ipv6 Source Guard on an Interface329
Configuring a Static Ipv6 Source Guard Binding Entry330
Displaying and Maintaining IP Source Guard330
IP Source Guard Configuration Examples331
Static Ipv4 Source Guard Configuration Example331
Dynamic Ipv4 Source Guard Using DHCP Snooping Configuration Example333
Dynamic Ipv4 Source Guard Using DHCP Relay Configuration Example334
Static Ipv6 Source Guard Configuration Example335
Dynamic Ipv6 Source Guard Using Dhcpv6 Snooping Configuration Example335
Configuring ARP Attack Protection337
ARP Attack Protection Configuration Task List337
Configuring Unresolvable IP Attack Protection337
Configuring ARP Source Suppression338
Configuring ARP Blackhole Routing338
Displaying and Maintaining Unresolvable IP Attack Protection339
Configuration Example339
Configuring ARP Packet Rate Limit340
Configuration Guidelines340
Configuration Procedure340
Configuring Source MAC-Based ARP Attack Detection341
Configuration Procedure341
Displaying and Maintaining Source MAC-Based ARP Attack Detection342
Configuration Example342
Configuring ARP Packet Source MAC Consistency Check343
Configuring ARP Active Acknowledgement343
Configuring Authorized ARP344
Configuration Procedure344
Configuration Example (on a DHCP Server)344
Configuration Example (on a DHCP Relay Agent)345
Enable Dhcp346
Configuring ARP Detection347
Configuring User Validity Check347
Configuring ARP Packet Validity Check348
Configuring ARP Restricted Forwarding349
Displaying and Maintaining ARP Detection349
User Validity Check and ARP Packet Validity Check Configuration Example350
Configuring ARP Scanning and Fixed ARP351
Configuration Restrictions and Guidelines351
Configuration Procedure352
Configuring ARP Gateway Protection352
Configuration Guidelines352
Configuration Example353
Configuring ARP Filtering353
Configuration Guidelines354
Configuration Procedure354
Configuration Example354
Configuring MFF356
Overview356
Basic Concepts357
MFF Operation Modes358
MFF Working Mechanism358
Protocols and Standards358
Configuring MFF358
Enabling MFF358
Configuring a Network Port359
Enabling Periodic Gateway Probe359
Specifying the IP Addresses of Servers359
Displaying and Maintaining MFF360
MFF Configuration Examples360
Manual-Mode MFF Configuration Example in a Tree Network360
Manual-Mode MFF Configuration Example in a Ring Network362
Configuring Urpf364
Overview364
Urpf Check Modes364
Urpf Operation364
Network Application367
Configuring Urpf367
Displaying and Maintaining Urpf368
Urpf Configuration Example368
Configuring Crypto Engines369
Overview369
Displaying and Maintaining Crypto Engines369
Configuring FIPS370
Overview370
Configuration Restrictions and Guidelines370
Configuring FIPS Mode371
Entering FIPS Mode371
Configuration Changes in FIPS Mode372
Exiting FIPS Mode373
FIPS Self-Tests374
Power-Up Self-Tests374
Conditional Self-Tests375
Triggering Self-Tests376
Displaying and Maintaining FIPS376
FIPS Configuration Examples376
Entering FIPS Mode through Automatic Reboot376
Entering FIPS Mode through Manual Reboot377
Exiting FIPS Mode through Automatic Reboot379
Exiting FIPS Mode through Manual Reboot379
Configuring Attack Detection and Prevention381
Overview381
Configuring TCP Fragment Attack Prevention381
Index382

HP 5920 Series - Configuration Guide Manual

Table of Contents

Other manuals for HP 5920 Series

Related product manuals