HP FlexFabric 5700 series

To Next Page

HP FlexFabric 5700 Switch Series

Security

Configuration Guide

Part number: 5998-6696

Software version: Release 2416

Document version: 6W100-20150130

Main Page

Configuration Guide1
Table of Contents3
Configuring AAA13
- Overview13
- FIPS Compliance28
- AAA Configuration Considerations and Task List28
- Configuring AAA Schemes30
- Configuring AAA Methods for ISP Domains53
- Enabling the Session-Control Feature58
- Setting the Maximum Number of Concurrent Login Users59
- Configuring a NAS-ID Profile59
- Displaying and Maintaining AAA60
- AAA Configuration Examples60
- Troubleshooting RADIUS71
- Troubleshooting HWTACACS72
- Troubleshooting LDAP72
802.1X Overview74
- 802.1X Architecture74
- Controlled/Uncontrolled Port and Port Authorization Status74
- 802.1X-Related Protocols75
  - Packet Formats75
  - EAP over RADIUS76
- 802.1X Authentication Initiation77
  - 802.1X Client as the Initiator77
  - Access Device as the Initiator77
- 802.1X Authentication Procedures78
Configuring 802.1X83
- Access Control Methods83
- 802.1X VLAN Manipulation83
  - Authorization VLAN83
  - Guest VLAN85
  - Auth-Fail VLAN86
  - Critical VLAN88
- Using 802.1X Authentication with Other Features89
  - ACL Assignment89
  - User Profile Assignment90
  - EAD Assistant90
- Configuration Prerequisites91
- 802.1X Configuration Task List91
- Enabling 802.1X91
- Enabling EAP Relay or EAP Termination92
- Setting the Port Authorization State93
- Specifying an Access Control Method93
- Setting the Maximum Number of Concurrent 802.1X Users on a Port93
- Setting the Maximum Number of Authentication Request Attempts94
- Setting the 802.1X Authentication Timeout Timers94
- Configuring the Online User Handshake Feature95
  - Configuration Guidelines95
  - Configuration Procedure95
- Configuring the Authentication Trigger Feature95
  - Configuration Guidelines96
  - Configuration Procedure96
- Specifying a Mandatory Authentication Domain on a Port96
- Configuring the Quiet Timer97
- Enabling the Periodic Online User Reauthentication Feature97
- Configuring an 802.1X Guest VLAN98
  - Configuration Guidelines98
  - Configuration Prerequisites98
  - Configuration Procedure99
- Configuring an 802.1X Auth-Fail VLAN99
  - Configuration Guidelines99
  - Configuration Prerequisites99
  - Configuration Procedure100
- Configuring an 802.1X Critical VLAN100
  - Configuration Guidelines100
  - Configuration Prerequisites100
- Specifying Supported Domain Name Delimiters101
- Configuring the EAD Assistant Feature101
- Displaying and Maintaining 802.1X102
- 802.1X Authentication Configuration Examples102
  - Basic 802.1X Authentication Configuration Example102
  - Guest VLAN and Authorization VLAN Configuration Example105
  - 802.1X with ACL Assignment Configuration Example107
  - 802.1X with EAD Assistant Configuration Example109
- Troubleshooting 802.1X EAD Assistant for Web Browser Users112
Configuring MAC Authentication113
- Overview113
- Configuration Prerequisites116
- Configuration Task List117
- Enabling MAC Authentication117
- Specifying a MAC Authentication Domain118
- Configuring the User Account Format118
- Setting MAC Authentication Timers119
- Setting the Maximum Number of Concurrent MAC Authentication Users on a Port119
- Enabling MAC Authentication Multi-VLAN Mode on a Port120
- Configuring MAC Authentication Delay120
- Configuring a MAC Authentication Guest VLAN121
- Configuring a MAC Authentication Critical VLAN121
- Configuring the Keep-Online Feature122
- Displaying and Maintaining MAC Authentication123
- MAC Authentication Configuration Examples123
Configuring Portal Authentication130
- Overview130
- Portal Configuration Task List135
- Configuration Prerequisites135
- Configuring a Portal Authentication Server136
- Configuring a Portal Web Server137
- Enabling Portal Authentication on an Interface137
  - Configuration Restrictions and Guidelines137
  - Configuration Procedure138
- Referencing a Portal Web Server for an Interface138
- Controlling Portal User Access138
- Configuring Portal Detection Features142
- Configuring the Portal Fail-Permit Feature146
- Configuring BAS-IP for Unsolicited Portal Packets Sent to the Portal Authentication Server146
- Applying a NAS-ID Profile to an Interface147
- Enabling Portal Roaming148
- Logging out Portal Users148
- Displaying and Maintaining Portal148
- Portal Configuration Examples149
- Troubleshooting Portal182
Configuring Port Security185
- Overview185
  - Port Security Features185
  - Port Security Modes185
- Configuration Task List188
- Enabling Port Security189
- Setting Port Security's Limit on the Number of Secure MAC Addresses on a Port189
- Setting the Port Security Mode190
- Configuring Port Security Features191
  - Configuring NTK191
  - Configuring Intrusion Protection191
- Configuring Secure MAC Addresses192
  - Configuration Prerequisites193
  - Configuration Procedure193
- Ignoring Authorization Information from the Server194
- Enabling MAC Move194
- Applying NAS-ID Profile to Port Security195
- Enabling the Authorization-Fail-Offline Feature196
- Displaying and Maintaining Port Security196
- Port Security Configuration Examples196
- Troubleshooting Port Security205
  - Cannot Set the Port Security Mode205
  - Cannot Configure Secure MAC Addresses205
Configuring Password Control206
- Overview206
- FIPS Compliance209
- Password Control Configuration Task List209
- Enabling Password Control210
- Setting Global Password Control Parameters210
- Setting User Group Password Control Parameters211
- Setting Local User Password Control Parameters212
- Setting Super Password Control Parameters213
- Displaying and Maintaining Password Control214
- Password Control Configuration Example214
Managing Public Keys218
- Overview218
- FIPS Compliance218
- Creating a Local Key Pair219
  - Configuration Guidelines219
  - Configuration Procedure219
- Distributing a Local Host Public Key220
  - Exporting a Host Public Key220
  - Displaying a Host Public Key221
- Destroying a Local Key Pair221
- Configuring a Peer Host Public Key222
  - Importing a Peer Host Public Key from a Public Key File222
  - Entering a Peer Host Public Key222
- Displaying and Maintaining Public Keys223
- Examples of Public Key Management223
  - Example for Entering a Peer Host Public Key223
  - Example for Importing a Public Key from a Public Key File225
Configuring PKI228
- Overview228
- FIPS Compliance230
- PKI Configuration Task List230
- Configuring a PKI Entity231
- Configuring a PKI Domain232
- Requesting a Certificate234
- Aborting a Certificate Request236
- Obtaining Certificates236
- Verifying PKI Certificates237
  - Verifying Certificates with CRL Checking238
  - Verifying Certificates Without CRL Checking238
- Specifying the Storage Path for the Certificates and Crls239
- Exporting Certificates239
- Removing a Certificate240
- Configuring a Certificate-Based Access Control Policy240
- Displaying and Maintaining PKI241
- PKI Configuration Examples242
- Troubleshooting PKI Configuration257
Configuring Ipsec262
- Overview262
- FIPS Compliance266
- Ipsec Tunnel Establishment266
- Implementing ACL-Based Ipsec267
- Configuring Ipsec for Ipv6 Routing Protocols281
  - Configuration Task List281
  - Configuring a Manual Ipsec Profile281
- Configuring SNMP Notifications for Ipsec282
- Displaying and Maintaining Ipsec283
- Ipsec Configuration Examples284
Configuring IKE293
- Overview293
- FIPS Compliance295
- IKE Configuration Prerequisites295
- IKE Configuration Task List295
- Configuring an IKE Profile296
- Configuring an IKE Proposal298
- Configuring an IKE Keychain299
- Configuring the Global Identity Information300
- Configuring the IKE Keepalive Function301
- Configuring the IKE NAT Keepalive Function301
- Configuring IKE DPD302
- Enabling Invalid SPI Recovery303
- Setting the Maximum Number of IKE Sas303
- Configuring SNMP Notifications for IKE303
- Displaying and Maintaining IKE304
- IKE Configuration Examples304
  - Main Mode IKE with Pre-Shared Key Authentication Configuration Example304
  - Verifying the Configuration307
- Troubleshooting IKE307
Configuring SSH312
- Overview312
  - How SSH Works312
  - SSH Authentication Methods313
- FIPS Compliance314
- Configuring the Device as an SSH Server315
- Configuring the Device as an Stelnet Client322
- Configuring the Device as an SFTP Client324
- Configuring the Device as an SCP Client327
- Displaying and Maintaining SSH329
- Stelnet Configuration Examples329
- SFTP Configuration Examples343
- SCP File Transfer with Password Authentication349
  - Network Requirements349
  - Configuration Procedure349
- NETCONF over SSH Configuration Example with Password Authentication351
Configuring SSL354
- Overview354
  - SSL Security Services354
  - SSL Protocol Stack354
- FIPS Compliance355
- SSL Configuration Task List355
- Configuring an SSL Server Policy355
- Configuring an SSL Client Policy356
- Displaying and Maintaining SSL357
Configuring IP Source Guard358
- Overview358
  - Static IPSG Bindings359
  - Dynamic IPSG Bindings359
- IPSG Configuration Task List360
- Configuring the Ipv4Sg Feature360
  - Enabling Ipv4Sg on an Interface360
  - Configuring a Static Ipv4Sg Binding361
- Configuring the Ipv6Sg Feature361
  - Enabling Ipv6Sg on an Interface361
  - Configuring a Static Ipv6Sg Binding362
- Displaying and Maintaining IPSG362
- IPSG Configuration Examples363
Configuring ARP Attack Protection369
- ARP Attack Protection Configuration Task List369
- Configuring Unresolvable IP Attack Protection369
- Configuring ARP Packet Rate Limit372
  - Configuration Guidelines372
  - Configuration Procedure372
- Configuring Source MAC-Based ARP Attack Detection373
- Configuring ARP Packet Source MAC Consistency Check375
- Configuring ARP Active Acknowledgement375
- Configuring Authorized ARP376
  - Configuration Procedure376
- Configuring ARP Detection376
- Configuring ARP Scanning and Fixed ARP382
  - Configuration Restrictions and Guidelines382
  - Configuration Procedure383
- Configuring ARP Gateway Protection383
  - Configuration Guidelines383
  - Configuration Example384
- Configuring ARP Filtering384
Configuring MFF387
- Overview387
- Configuring MFF389
- Displaying and Maintaining MFF391
- MFF Configuration Examples391
  - Manual-Mode MFF Configuration Example in a Tree Network391
  - Manual-Mode MFF Configuration Example in a Ring Network392
Configuring Crypto Engines395
- Overview395
- Displaying and Maintaining Crypto Engines395
Configuring FIPS396
- Overview396
- Configuration Restrictions and Guidelines396
- Configuring FIPS Mode397
- FIPS Self-Tests400
- Displaying and Maintaining FIPS401
- FIPS Configuration Examples402
Configuring User Profiles407
- Overview407
- Configuration Task List407
- Configuration Restrictions and Guidelines407
- Creating a User Profile407
- Configuring Parameters for a User Profile408
  - Configuring Qos Parameters for Traffic Management408
- Displaying and Maintaining User Profiles408
- User Profile Configuration Examples408
  - Local 802.1X Authentication/Authorization with Qos Policy Configuration Example408
Configuring Attack Detection and Prevention413
- Overview413
- Configuring TCP Fragment Attack Prevention413
Configuring ND Attack Defense414
- Overview414
- Configuring Source MAC Consistency Check for ND Packets414
Support and Other Resources415
- Contacting HP415
  - Subscription Service415
- Related Information415
  - Documents415
  - Websites415
- Conventions416
Index418

Other manuals for HP FlexFabric 5700 series

Configuration Guide185 pages

Need help?

Do you have a question about the HP FlexFabric 5700 series and is the answer not in the manual?

HP FlexFabric 5700 series Specifications

General

Layer Support	L2/L3
Routing Protocol	OSPF, BGP, RIP, IS-IS, Static Routing
Remote Management Protocol	SNMP, CLI, Web
Features	VXLAN
Compliant Standards	IEEE 802.1D, 802.1Q, 802.1w, 802.1s, 802.3ad
Operating Temperature	0°C to 45°C
Operating Humidity	10% to 90% (non-condensing)
VLANs	4K