HP FlexFabric 5700 series

To Next Page

HP FlexFabric 5700 Switch Series

Security

Configuration Guide

Part number: 5998-6696

Software version: Release 2416

Document version: 6W100-20150130

Main Page

Configuration Guide1
Table of Contents3
Configuring AAA13
- Overview13
- FIPS Compliance28
- AAA Configuration Considerations and Task List28
- Configuring AAA Schemes30
- Configuring AAA Methods for ISP Domains53
- Enabling the Session-Control Feature58
- Setting the Maximum Number of Concurrent Login Users59
- Configuring a NAS-ID Profile59
- Displaying and Maintaining AAA60
- AAA Configuration Examples60
- Troubleshooting RADIUS71
- Troubleshooting HWTACACS72
- Troubleshooting LDAP72
802.1X Overview74
- 802.1X Architecture74
- Controlled/Uncontrolled Port and Port Authorization Status74
- 802.1X-Related Protocols75
  - Packet Formats75
  - EAP over RADIUS76
- 802.1X Authentication Initiation77
  - 802.1X Client as the Initiator77
  - Access Device as the Initiator77
- 802.1X Authentication Procedures78
Configuring 802.1X83
- Access Control Methods83
- 802.1X VLAN Manipulation83
  - Authorization VLAN83
  - Guest VLAN85
  - Auth-Fail VLAN86
  - Critical VLAN88
- Using 802.1X Authentication with Other Features89
  - ACL Assignment89
  - User Profile Assignment90
  - EAD Assistant90
- Configuration Prerequisites91
- 802.1X Configuration Task List91
- Enabling 802.1X91
- Enabling EAP Relay or EAP Termination92
- Setting the Port Authorization State93
- Specifying an Access Control Method93
- Setting the Maximum Number of Concurrent 802.1X Users on a Port93
- Setting the Maximum Number of Authentication Request Attempts94
- Setting the 802.1X Authentication Timeout Timers94
- Configuring the Online User Handshake Feature95
  - Configuration Guidelines95
  - Configuration Procedure95
- Configuring the Authentication Trigger Feature95
  - Configuration Guidelines96
  - Configuration Procedure96
- Specifying a Mandatory Authentication Domain on a Port96
- Configuring the Quiet Timer97
- Enabling the Periodic Online User Reauthentication Feature97
- Configuring an 802.1X Guest VLAN98
  - Configuration Guidelines98
  - Configuration Prerequisites98
  - Configuration Procedure99
- Configuring an 802.1X Auth-Fail VLAN99
  - Configuration Guidelines99
  - Configuration Prerequisites99
  - Configuration Procedure100
- Configuring an 802.1X Critical VLAN100
  - Configuration Guidelines100
  - Configuration Prerequisites100
- Specifying Supported Domain Name Delimiters101
- Configuring the EAD Assistant Feature101
- Displaying and Maintaining 802.1X102
- 802.1X Authentication Configuration Examples102
  - Basic 802.1X Authentication Configuration Example102
  - Guest VLAN and Authorization VLAN Configuration Example105
  - 802.1X with ACL Assignment Configuration Example107
  - 802.1X with EAD Assistant Configuration Example109
- Troubleshooting 802.1X EAD Assistant for Web Browser Users112
Configuring MAC Authentication113
- Overview113
- Configuration Prerequisites116
- Configuration Task List117
- Enabling MAC Authentication117
- Specifying a MAC Authentication Domain118
- Configuring the User Account Format118
- Setting MAC Authentication Timers119
- Setting the Maximum Number of Concurrent MAC Authentication Users on a Port119
- Enabling MAC Authentication Multi-VLAN Mode on a Port120
- Configuring MAC Authentication Delay120
- Configuring a MAC Authentication Guest VLAN121
- Configuring a MAC Authentication Critical VLAN121
- Configuring the Keep-Online Feature122
- Displaying and Maintaining MAC Authentication123
- MAC Authentication Configuration Examples123
Configuring Portal Authentication130
- Overview130
- Portal Configuration Task List135
- Configuration Prerequisites135
- Configuring a Portal Authentication Server136
- Configuring a Portal Web Server137
- Enabling Portal Authentication on an Interface137
  - Configuration Restrictions and Guidelines137
  - Configuration Procedure138
- Referencing a Portal Web Server for an Interface138
- Controlling Portal User Access138
- Configuring Portal Detection Features142
- Configuring the Portal Fail-Permit Feature146
- Configuring BAS-IP for Unsolicited Portal Packets Sent to the Portal Authentication Server146
- Applying a NAS-ID Profile to an Interface147
- Enabling Portal Roaming148
- Logging out Portal Users148
- Displaying and Maintaining Portal148
- Portal Configuration Examples149
- Troubleshooting Portal182
Configuring Port Security185
- Overview185
  - Port Security Features185
  - Port Security Modes185
- Configuration Task List188
- Enabling Port Security189
- Setting Port Security's Limit on the Number of Secure MAC Addresses on a Port189
- Setting the Port Security Mode190
- Configuring Port Security Features191
  - Configuring NTK191
  - Configuring Intrusion Protection191
- Configuring Secure MAC Addresses192
  - Configuration Prerequisites193
  - Configuration Procedure193
- Ignoring Authorization Information from the Server194
- Enabling MAC Move194
- Applying NAS-ID Profile to Port Security195
- Enabling the Authorization-Fail-Offline Feature196
- Displaying and Maintaining Port Security196
- Port Security Configuration Examples196
- Troubleshooting Port Security205
  - Cannot Set the Port Security Mode205
  - Cannot Configure Secure MAC Addresses205
Configuring Password Control206
- Overview206
- FIPS Compliance209
- Password Control Configuration Task List209
- Enabling Password Control210
- Setting Global Password Control Parameters210
- Setting User Group Password Control Parameters211
- Setting Local User Password Control Parameters212
- Setting Super Password Control Parameters213
- Displaying and Maintaining Password Control214
- Password Control Configuration Example214
Managing Public Keys218
- Overview218
- FIPS Compliance218
- Creating a Local Key Pair219
  - Configuration Guidelines219
  - Configuration Procedure219
- Distributing a Local Host Public Key220
  - Exporting a Host Public Key220
  - Displaying a Host Public Key221
- Destroying a Local Key Pair221
- Configuring a Peer Host Public Key222
  - Importing a Peer Host Public Key from a Public Key File222
  - Entering a Peer Host Public Key222
- Displaying and Maintaining Public Keys223
- Examples of Public Key Management223
  - Example for Entering a Peer Host Public Key223
  - Example for Importing a Public Key from a Public Key File225
Configuring PKI228
- Overview228
- FIPS Compliance230
- PKI Configuration Task List230
- Configuring a PKI Entity231
- Configuring a PKI Domain232
- Requesting a Certificate234
- Aborting a Certificate Request236
- Obtaining Certificates236
- Verifying PKI Certificates237
  - Verifying Certificates with CRL Checking238
  - Verifying Certificates Without CRL Checking238
- Specifying the Storage Path for the Certificates and Crls239
- Exporting Certificates239
- Removing a Certificate240
- Configuring a Certificate-Based Access Control Policy240
- Displaying and Maintaining PKI241
- PKI Configuration Examples242
- Troubleshooting PKI Configuration257
Configuring Ipsec262
- Overview262
- FIPS Compliance266
- Ipsec Tunnel Establishment266
- Implementing ACL-Based Ipsec267
- Configuring Ipsec for Ipv6 Routing Protocols281
  - Configuration Task List281
  - Configuring a Manual Ipsec Profile281
- Configuring SNMP Notifications for Ipsec282
- Displaying and Maintaining Ipsec283
- Ipsec Configuration Examples284
Configuring IKE293
- Overview293
- FIPS Compliance295
- IKE Configuration Prerequisites295
- IKE Configuration Task List295
- Configuring an IKE Profile296
- Configuring an IKE Proposal298
- Configuring an IKE Keychain299
- Configuring the Global Identity Information300
- Configuring the IKE Keepalive Function301
- Configuring the IKE NAT Keepalive Function301
- Configuring IKE DPD302
- Enabling Invalid SPI Recovery303
- Setting the Maximum Number of IKE Sas303
- Configuring SNMP Notifications for IKE303
- Displaying and Maintaining IKE304
- IKE Configuration Examples304
  - Main Mode IKE with Pre-Shared Key Authentication Configuration Example304
  - Verifying the Configuration307
- Troubleshooting IKE307
Configuring SSH312
- Overview312
  - How SSH Works312
  - SSH Authentication Methods313
- FIPS Compliance314
- Configuring the Device as an SSH Server315
- Configuring the Device as an Stelnet Client322
- Configuring the Device as an SFTP Client324
- Configuring the Device as an SCP Client327
- Displaying and Maintaining SSH329
- Stelnet Configuration Examples329
- SFTP Configuration Examples343
- SCP File Transfer with Password Authentication349
  - Network Requirements349
  - Configuration Procedure349
- NETCONF over SSH Configuration Example with Password Authentication351
Configuring SSL354
- Overview354
  - SSL Security Services354
  - SSL Protocol Stack354
- FIPS Compliance355
- SSL Configuration Task List355
- Configuring an SSL Server Policy355
- Configuring an SSL Client Policy356
- Displaying and Maintaining SSL357
Configuring IP Source Guard358
- Overview358
  - Static IPSG Bindings359
  - Dynamic IPSG Bindings359
- IPSG Configuration Task List360
- Configuring the Ipv4Sg Feature360
  - Enabling Ipv4Sg on an Interface360
  - Configuring a Static Ipv4Sg Binding361
- Configuring the Ipv6Sg Feature361
  - Enabling Ipv6Sg on an Interface361
  - Configuring a Static Ipv6Sg Binding362
- Displaying and Maintaining IPSG362
- IPSG Configuration Examples363
Configuring ARP Attack Protection369
- ARP Attack Protection Configuration Task List369
- Configuring Unresolvable IP Attack Protection369
- Configuring ARP Packet Rate Limit372
  - Configuration Guidelines372
  - Configuration Procedure372
- Configuring Source MAC-Based ARP Attack Detection373
- Configuring ARP Packet Source MAC Consistency Check375
- Configuring ARP Active Acknowledgement375
- Configuring Authorized ARP376
  - Configuration Procedure376
- Configuring ARP Detection376
- Configuring ARP Scanning and Fixed ARP382
  - Configuration Restrictions and Guidelines382
  - Configuration Procedure383
- Configuring ARP Gateway Protection383
  - Configuration Guidelines383
  - Configuration Example384
- Configuring ARP Filtering384
Configuring MFF387
- Overview387
- Configuring MFF389
- Displaying and Maintaining MFF391
- MFF Configuration Examples391
  - Manual-Mode MFF Configuration Example in a Tree Network391
  - Manual-Mode MFF Configuration Example in a Ring Network392
Configuring Crypto Engines395
- Overview395
- Displaying and Maintaining Crypto Engines395
Configuring FIPS396
- Overview396
- Configuration Restrictions and Guidelines396
- Configuring FIPS Mode397
- FIPS Self-Tests400
- Displaying and Maintaining FIPS401
- FIPS Configuration Examples402
Configuring User Profiles407
- Overview407
- Configuration Task List407
- Configuration Restrictions and Guidelines407
- Creating a User Profile407
- Configuring Parameters for a User Profile408
  - Configuring Qos Parameters for Traffic Management408
- Displaying and Maintaining User Profiles408
- User Profile Configuration Examples408
  - Local 802.1X Authentication/Authorization with Qos Policy Configuration Example408
Configuring Attack Detection and Prevention413
- Overview413
- Configuring TCP Fragment Attack Prevention413
Configuring ND Attack Defense414
- Overview414
- Configuring Source MAC Consistency Check for ND Packets414
Support and Other Resources415
- Contacting HP415
  - Subscription Service415
- Related Information415
  - Documents415
  - Websites415
- Conventions416
Index418

Brand	HP
Model	FlexFabric 5700 series
Category	Switch
Language	English

HP FlexFabric 5700 series

Table of Contents

Other manuals for HP FlexFabric 5700 series

HP FlexFabric 5700 series Specifications

Related product manuals