HP ProCurve 2600-PWR Series

To Next Page

To Previous Page

TACACS+ Authentication

Operating Notes

 When TACACS+ is not enabled on the switch—or when the switch’s

only designated TACACS+ servers are not accessible— setting a local

Operator password without also setting a local Manager password

does not protect the switch from manager-level access by unautho-

rized persons.)

4-26

Main Page

Table of Contents5
Getting Started14
Introduction and Applicable Switches14
About the Feature Descriptions14
Overview of Access Security Features15
General Switch Traffic Security Guideline17
Command Syntax Conventions18
Simulating Display Output18
Command Prompts18
Screen Simulations19
Port Identity Convention for Examples19
Related Publications19
Getting Documentation from the Web21
Sources for more Information22
Need Only a Quick Start23
To Set up and Install the Switch in Your Network23
Contents25
Overview26
Configuring Username and Password Security26
Configuring Local Password Security28
Menu: Setting Passwords28
CLI: Setting Passwords and Usernames29
Web: Setting Passwords and Usernames30
Front-Panel Security31
When Security Is Important31
Front-Panel Button Functions33
Configuring Front-Panel Security36
Password Recovery41
Password Recovery Process43
Web and MAC Authentication for the Series 2600/2600-PWR and 2800 Switches45
Contents45
Overview46
Client Options47
General Features48
How Web and MAC Authentication Operate49
Authenticator Operation49
Terminology53
Operating Rules and Notes54
Do These Steps before You Configure Web/Mac Authentication56
General Setup Procedure for Web/Mac Authentication56
Additional Information for Configuring the RADIUS Server to Support MAC Authentication58
Configuring the Switch to Access a RADIUS Server59
Configuring Web Authentication on the Switch61
Overview61
Configure the Switch for Web-Based Authentication62
Configuring MAC Authentication on the Switch66
Overview66
Configure the Switch for MAC-Based Authentication67
Show Status and Configuration of Web-Based Authentication70
Show Status and Configuration of MAC-Based Authentication72
Client Status74
Contents75
Overview76
TACACS+ Authentication76
Terminology Used in TACACS Applications77
General System Requirements79
General Authentication Setup Procedure79
Configuring TACACS+ on the Switch82
Beforeyou Begin82
CLI Commands Described in this Section83
Viewing the Switch's Current Authentication Configuration83
Viewing the Switch's Current TACACS+ Server Contact Configuration84
Configuring the Switch's Authentication Methods85
Configuring the Switch's TACACS+ Server Access89
How Authentication Operates94
General Authentication Process Using a TACACS+ Server94
Local Authentication Process96
Using the Encryption Key97
Controlling Web Browser Interface Access When Using TACACS+ Authentication98
Controlling Web Browser Interface Access When Using TACACS98
Authentication98
Messages Related to TACACS+ Operation99
Operating Notes99
RADIUS Authentication and Accounting101
Contents101
Overview102
Terminology103
Switch Operating Rules for RADIUS104
General RADIUS Setup Procedure105
Outline of the Steps for Configuring RADIUS Authentication106
Configuring the Switch for RADIUS Authentication106
Configure Authentication for the Access Methods You Want RADIUS108
To Protect108
Configure the Switch to Access a RADIUS Server110
Configure the Switch's Global RADIUS Parameters112
Local Authentication Process116
Controlling Web Browser Interface Access When Using RADIUS Authentication117
Configuring RADIUS Accounting117
Authentication117
Operating Rules for RADIUS Accounting119
Steps for Configuring RADIUS Accounting119
Configuring RADIUS Accounting119
Reports to the Radius Server122
Viewing RADIUS Statistics125
General RADIUS Statistics125
RADIUS Authentication Statistics127
RADIUS Accounting Statistics128
Changing RADIUS-Server Access Order129
Messages Related to RADIUS Operation131
Configuring Secure Shell (SSH)133
Contents133
Overview134
Terminology136
Prerequisite for Using SSH137
Public Key Formats137
Steps for Configuring and Using SSH for Switch and Client Authentication138
General Operating Rules and Notes140
Configuring the Switch for SSH Operation141
Assigning a Local Login (Operator) and Enable (Manager) Password141
Generating the Switch's Public and Private Key Pair142
Providing the Switch's Public Key to Clients144
Enabling SSH on the Switch and Anticipating SSH Client Contact147
Behavior147
Configuring the Switch for SSH Authentication150
Use an SSH Client to Access the Switch153
Further Information on SSH Client Public-Key Authentication153
Messages Related to SSH Operation159
Configuring Secure Socket Layer (SSL)161
Contents161
Overview162
Terminology163
Prerequisite for Using SSL165
Steps for Configuring and Using SSL for Switch and Client Authentication165
General Operating Rules and Notes166
Configuring the Switch for SSL Operation167
Assigning a Local Login (Operator) and Enable (Manager)Password167
Generating the Switch's Server Host Certificate169
Comments on Certificate Fields171
Enabling SSL on the Switch and Anticipating SSL Browser Contact177
Behavior181
Common Errors in SSL Setup181
Contents183
Configuring Port-Based Access Control (802.1X)183
General Features185
Why Use Port-Based Access Control185
Overview185
How 802.1X Operates188
Authenticator Operation188
Switch-Port Supplicant Operation189
Terminology190
General Operating Rules and Notes192
General Setup Procedure for Port-Based Access Control (802.1X)194
Do These Steps before You Configure 802.1X Operation194
Overview: Configuring 802.1X Authentication on the Switch195
Configuring Switch Ports as 802.1X Authenticators197
Enable 802.1X Authentication on Selected Ports197
Configure the 802.1X Authentication Method201
Enable 802.1X Authentication on the Switch202
Enter the RADIUS Host IP Address(Es)202
802.1X Open VLAN Mode203
Introduction203
Use Models for 802.1X Open VLAN Modes204
Operating Rules for Authorized-Client and Unauthorized-Client Vlans207
Setting up and Configuring 802.1X Open VLAN Mode209
802.1X Open VLAN Operating Notes213
Option for Authenticator Ports: Configure Port-Security to Allow Only214
802.1X Devices214
To Other Switches216
Displaying 802.1X Configuration, Statistics, and Counters220
Show Commands for Port-Access Authenticator220
Viewing 802.1X Open VLAN Mode Status222
Show Commands for Port-Access Supplicant225
How RADIUS/802.1X Authentication Affects VLAN Operation226
Messages Related to 802.1X Operation230
Configuring and Monitoring Port Security231
Contents231
Overview232
Basic Operation232
Blocking Unauthorized Traffic233
Trunk Group Exclusion234
Planning Port Security235
Port Security Command Options and Operation236
Retention of Static MAC Addresses240
Displaying Current Port Security Settings240
Configuring Port Security242
MAC Lockdown247
Differences between MAC Lockdown and Port Security249
Deploying MAC Lockdown251
MAC Lockout255
Port Security and MAC Lockout257
Web: Displaying and Configuring Port Security Features257
Reading Intrusion Alerts and Resetting Alert Flags258
Notice of Security Violations258
How the Intrusion Log Operates259
Keeping the Intrusion Log Current by Resetting Alert Flags259
Using the Event Log to Find Intrusion Alerts265
Web: Checking for Intrusions, Listing Intrusion Alerts, and Resetting265
Operating Notes for Port Security266
Alert Flags266
Contents269
Traffic/Security Filters269
(HP Procurve Series 2600/2600-PWR and 2800 Switches)269
Overview270
Using Source-Port Filters272
Operating Rules for Source-Port Filters272
Configuring a Source-Port Filter273
Viewing a Source-Port Filter275
Filter Indexing276
Editing a Source-Port Filter277
Contents279
Overview280
Using Authorized IP Managers280
Options281
Access Levels281
Defining Authorized Management Stations282
Overview of IP Mask Operation282
Menu: Viewing and Configuring IP Authorized Managers283
CLI: Viewing and Configuring Authorized IP Managers284
Configuring Ip Authorized Managers for the Switch285
Web: Configuring IP Authorized Managers287
Building Ip Masks287
Configuring One Station Per Authorized Manager Ip Entry287
Configuring Multiple Stations Per Authorized Manager Ip Entry289
Additional Examples for Authorizing Multiple Stations291

HP ProCurve 2600-PWR Series

Table of Contents

Related product manuals