EasyManua.ls Logo

HP J8692A User Manual

HP J8692A
778 pages
To Next Page IconTo Next Page
To Next Page IconTo Next Page
Page #1 background imageLoading...
Page #1 background image
HP Switch Software
3500 switches
3500yl switches
5400zl switches
6200yl switches
6600 switches
8200zl switches
Software version K.15.06
September 2011
Access Security Guide

Table of Contents

Other manuals for HP J8692A

Question and Answer IconNeed help?

Do you have a question about the HP J8692A and is the answer not in the manual?

HP J8692A Specifications

General IconGeneral
BrandHP
ModelJ8692A
CategorySwitch
LanguageEnglish

Summary

Security Overview

Introduction

Provides an overview of the switch's security features.

Access Security Features

Overview of the switch’s access security features, authentication protocols, and methods.

Network Security Features

Outlines features and defense mechanisms for protecting access through the switch to the network.

Getting Started with Access Security

Provides guidelines on preparing the switch for secure network operation and covers potential threats.

SNMP Security Guidelines

Details the default settings and security guidelines for SNMP access.

Precedence of Security Options

Explains how port-based security options and client-based attributes are prioritized.

Configuring Username and Password Security

Overview

Details console access levels and password configurations for security.

Configuring Local Password Security

Describes setting manager and operator passwords using the menu interface.

CLI: Setting Passwords and Usernames

Explains how to set local passwords and usernames using the CLI.

Saving Security Credentials in a Config File

Covers storing and viewing security settings in the running-config file.

Front-Panel Security

Explains features related to front-panel buttons for security operations.

Virus Throttling (Connection-Rate Filtering)

Overview of Connection-Rate Filtering

Explains the impact of malicious agents and describes current detection methods.

Features and Benefits

Highlights connection-rate filtering as a countermeasure tool for worm-type IT security threats.

Configuring Connection-Rate Filtering

Details commands to enable connection-rate filtering on the switch and per-port.

Configuring and Applying Connection-Rate ACLs

Explains how to create and apply ACLs to connection-rate filtering policies.

Web and MAC Authentication

Overview

Describes port-based security measures for protecting networks and switches.

How Web and MAC Authentication Operate

Details the client authentication process with RADIUS server.

Configuring Web Authentication

Provides steps for configuring Web authentication on the switch.

Configuring MAC Authentication on the Switch

Details steps for configuring MAC authentication on switch ports.

Customizable HTML Templates

Describes how to create customized login web pages to improve the 'look and feel'.

TACACS+ Authentication

Overview

Explains how TACACS+ enables a central server for access control.

General Authentication Setup Procedure

Outlines steps for setting up and testing TACACS+ authentication.

Configuring TACACS+ on the Switch

Provides steps for configuring TACACS+ operation on the switch.

How Authentication Operates

Describes the general authentication process using a TACACS+ server.

Controlling WebAgent Access When Using TACACS+ Authentication

Explains how TACACS+ authentication does not affect WebAgent access.

RADIUS Authentication, Authorization, and Accounting

Overview

Explains how RADIUS enables authentication, authorization, and accounting.

Accounting Services

Describes how RADIUS accounting collects resource consumption data.

RADIUS-Administered Commands Authorization

Enables RADIUS server control of authenticated client's access to CLI commands.

Terminology

Defines AAA, CHAP, CoS, EAP, EXEC Session, Host, NAS, RADIUS, RADIUS Client, RADIUS Host, RADIUS Server.

Configuring the Switch for RADIUS Authentication

Describes how to configure the switch to interact with a RADIUS server.

Configuring RADIUS Accounting

Details steps for configuring RADIUS accounting on the switch.

Configuring RADIUS Server Support for Switch Services

Overview

Provides information for configuring CoS, rate-limiting, and ACL client services on a RADIUS server.

RADIUS Server Configuration for CoS (802.1p Priority) and Rate-Limiting

Guidelines for configuring RADIUS servers to apply features dynamically.

Configuring and Using Dynamic (RADIUS-Assigned) Access Control Lists

Describes how to apply RADIUS-assigned ACLs on the switch.

Configuring Secure Shell (SSH)

Overview

Explains SSHv2 for remote access via encrypted paths.

Prerequisite for Using SSH

Details requirements for using SSH as an SSH server.

Steps for Configuring and Using SSH for Switch and Client Authentication

Provides general steps for configuring SSH for two-way authentication.

Configuring the Switch for SSH Operation

Details commands used for configuring SSH operation.

SSH Client Public-Key Authentication

Explains client public-key authentication to the switch.

Configuring Secure Socket Layer (SSL)

Overview

Explains SSLv3 and TLSv1 for remote web access via encrypted paths.

Prerequisite for Using SSL

Details requirements for using the switch as an SSL server.

Steps for Configuring and Using SSL for Switch and Client Authentication

Outlines general steps for configuring SSL for switch and client authentication.

Configuring the Switch for SSL Operation

Details CLI commands for generating certificates and enabling SSL.

IPv4 Access Control Lists (ACLs)

Introduction

Describes ACLs as lists of ACEs to permit or deny IP packets.

Overview of Options for Applying IPv4 ACLs on the Switch

Explains static and dynamic ACL applications.

Command Summary for Standard IPv4 ACLs

Provides a summary of commands for standard IPv4 ACLs.

Command Summary for IPv4 Extended ACLs

Provides a summary of commands for IPv4 extended ACLs.

Terminology

Defines ACE, ACL, ACL ID, ACL Mask, CIDR, DA, Deny, Dynamic Port ACL, Extended ACL, IDENTIFIER, Implicit Deny, Inbound Traffic, NAME-STR, Named ACL, Numbered ACL.

IPv4 Static ACL Operation

Describes how static IPv4 ACLs operate on the switch.

Planning an ACL Application

Suggests steps for planning and configuring ACLs.

ACL Configuration Structure

Explains the basic structure of an ACL, including identity, type, and ACEs.

Configuring Advanced Threat Protection

Introduction

Discusses the need for additional protection from network attacks.

DHCP Snooping

Protects the network from common DHCP attacks.

Dynamic ARP Protection

Protects the network from ARP cache poisoning.

Dynamic IP Lockdown

Prevents IP source address spoofing on a per-port and per-VLAN basis.

Configuring DHCP Snooping Trusted Ports

Configures trusted ports for DHCP snooping.

Configuring Authorized Server Addresses

Adds authorized DHCP server addresses to the binding database.

Traffic/Security Filters and Monitors

Overview

Describes applicable switch models for Traffic/Security filters.

Introduction

Explains configuring static filters to forward or drop unwanted traffic.

Filter Types and Operation

Describes Static Filter types: Source-Port, Multicast, Protocol.

Source-Port Filters

Enables the switch to forward or drop traffic from end nodes to specific destination ports.

Named Source-Port Filters

Allows specifying named source-port filters for multiple ports and trunks.

Configuring Traffic/Security Filters

Provides procedures for specifying filter types and actions.

Configuring Port-Based and User-Based Access Control (802.1X)

Overview

Explains how 802.1X simplifies security by providing access control.

Why Use Port-Based or User-Based Access Control?

Discusses exposure to unauthorized use and malicious attacks.

802.1X User-Based Access Control

Provides client-level security allowing LAN access to authenticated clients.

802.1X Port-Based Access Control

Provides port-level security allowing LAN access only on ports with single client authentication.

General Setup Procedure for 802.1X Access Control

Outlines steps to configure 802.1X operation.

Configuring Switch Ports as 802.1X Authenticators

Details commands for configuring switch ports as 802.1X authenticators.

802.1X Open VLAN Mode

Provides a path for clients needing 802.1X supplicant software.

Configuring and Monitoring Port Security

Overview

Describes applicable features: Port Security, MAC Lockdown, MAC Lockout.

Port Security

Enables configuring MAC addresses of authorized devices per port.

MAC Lockdown

Provides permanent assignment of MAC address to a specific port.

MAC Lockout

Enables blocking a specific MAC address.

Reading Intrusion Alerts and Resetting Alert Flags

Explains how the switch detects and notifies of security violations.

Using Authorized IP Managers

Overview

Describes the Authorized IP Managers feature for determining station access.

Options

Details configurable options: authorized manager addresses and access privileges.

Access Levels

Explains Manager and Operator access levels.

Defining Authorized Management Stations

Describes how to authorize single or multiple stations for access.

CLI: Viewing and Configuring Authorized IP Managers

Covers viewing and configuring authorized IP managers via the CLI.

WebAgent: Configuring IP Authorized Managers

Explains how to configure IP Authorized Managers using the WebAgent.

Building IP Masks

Explains how IP Mask parameters recognize authorized manager station IP addresses.

Key Management System

Overview

Provides support for advanced routing capabilities and security mechanisms.

Terminology

Defines Key Chain, Time-Independent Key, Time-Dependent key, Key Management System (KMS) Enabled Protocol.

Configuring Key Chain Management

Covers creating key chain entries and assigning keys.

Creating and Deleting Key Chain Entries

Details the process of creating and deleting key chain entries.

Assigning a Time-Independent Key to a Chain

Explains assigning keys with no activation or deactivation time constraints.

Assigning Time-Dependent Keys to a Chain

Explains assigning keys with activate and deactivate time constraints.

Related product manuals