EasyManua.ls Logo

HP PROCURVE 2910AL

HP PROCURVE 2910AL
594 pages
To Next Page IconTo Next Page
To Next Page IconTo Next Page
Loading...
Access Security Guide
ProCurve Switches
W.14.03
2910al
www.procurve.com

Table of Contents

Other manuals for HP PROCURVE 2910AL

Question and Answer IconNeed help?

Do you have a question about the HP PROCURVE 2910AL and is the answer not in the manual?

HP PROCURVE 2910AL Specifications

General IconGeneral
ModelHP ProCurve 2910al
Switching Capacity128 Gbps
Throughput95.2 Mpps
ManagementWeb, CLI, SNMP
Jumbo Frame SupportYes
ManageableYes
Power100-240 VAC
Power SupplyInternal
Operating Temperature0°C to 45°C (32°F to 113°F)
StackingYes
MAC Address Table Size32000 entries
Routing ProtocolRIP, OSPF
FeaturesIPv6, VLAN, QoS, ACLs
Operating Humidity15% to 95% non-condensing
Uplink Ports4
Power over EthernetYes (PoE+ models available)

Summary

1 Security Overview

Introduction

Provides an overview of the security features included on your switch.

Access Security Features

Overview of the switch’s access security features, authentication protocols, and methods.

Network Security Features

Outlines features and defense mechanisms for protecting access through the switch to the network.

Getting Started with Access Security

Enforces a security policy to ensure ease of access is not used by unauthorized persons.

SNMP Security Guidelines

Provides guidelines for controlling SNMP access to the switch and preventing unauthorized access.

Precedence of Security Options

Explains how port-based security options and client-based attributes are prioritized on the switch.

ProCurve Identity-Driven Manager (IDM)

A plug-in to ProCurve Manager Plus that uses RADIUS-based technologies for user-centric network access management.

2 Configuring Username and Password Security

Overview

Details features and access levels for username and password security.

Configuring Local Password Security

Provides methods for setting, deleting, and recovering passwords via Menu, CLI, and Web interfaces.

Saving Security Credentials in a Config File

Explains how to store and display security settings in the running-config file.

Front-Panel Security

Covers features to prevent malicious users from resetting passwords or gaining physical access.

3 Web and MAC Authentication

Overview

Introduces Web and MAC authentication for port-based security on network edges.

How Web and MAC Authentication Operate

Explains the process of Web and MAC authentication via RADIUS server.

Operating Rules and Notes

Details rules for concurrent authentication, port access management, and VLAN interactions.

Setup Procedure for WebMAC Authentication

Outlines the steps for configuring Web and MAC authentication, including server setup.

Configuring Web Authentication

Provides commands and procedures for configuring Web authentication.

Configuring MAC Authentication on the Switch

Provides commands and procedures for configuring MAC authentication.

Client Status

Describes possible client status information reported by the 'show... clients' command.

4 TACACS+ Authentication

Overview

Explains TACACS+ authentication for centralizing access control and privilege levels.

General System Requirements

Lists the necessary components for using TACACS+ authentication.

General Authentication Setup Procedure

Details the process for setting up and testing TACACS+ service to prevent lockouts.

Configuring TACACS+ on the Switch

Outlines steps and commands for configuring TACACS+ operation on the switch.

How Authentication Operates

Describes the general authentication process using a TACACS+ server.

Controlling Web Browser Interface Access When Using TACACS+ Authentication

Provides methods to prevent unauthorized access through the web browser interface.

Messages Related to TACACS+ Operation

Lists and explains CLI messages generated during TACACS+ operation.

Operating Notes

Provides important notes and considerations for TACACS+ operation.

5 RADIUS Authentication and Accounting

Overview

Introduces RADIUS for user identity verification and network resource usage tracking.

RADIUS-Administered CoS and Rate-Limiting

Explains how RADIUS can assign CoS and rate-limiting attributes.

Switch Operating Rules for RADIUS

Details the rules and requirements for using RADIUS authentication.

General RADIUS Setup Procedure

Provides preparation steps and information for configuring RADIUS on the switch.

Configuring the Switch for RADIUS Authentication

Outlines the steps and commands for configuring RADIUS authentication.

Using SNMP To View and Configure Switch Authentication Features

Describes how to use SNMP for accessing and managing switch authentication settings.

Local Authentication Process

Explains how the switch reverts to local authentication when RADIUS is unavailable.

Controlling Web Browser Interface Access

Provides methods to prevent unauthorized web browser access.

Commands Authorization

Details how RADIUS authorization controls access to CLI commands.

Configuring RADIUS Accounting

Explains how to configure RADIUS accounting for user activity and system events.

Viewing RADIUS Statistics

Provides commands to view general, authentication, and accounting statistics.

Changing RADIUS-Server Access Order

Describes how to modify the order in which the switch accesses RADIUS servers.

Messages Related to RADIUS Operation

Lists and explains messages related to RADIUS operation and potential issues.

6 Configuring RADIUS Server Support for Switch Services

Overview

Provides information on setting up a RADIUS server for switch features like CoS, Rate-Limiting, and ACLs.

RADIUS Server Configuration for Per-Port CoS (802.1 p Priority) and Rate-Limiting

Guidelines for dynamically applying CoS and Rate-Limiting to authenticated clients.

Viewing the Currently Active Per-Port CoS and Rate Limiting Configuration Specified by a RADIUS Server

Displays the CoS and Rate-Limiting settings imposed by the RADIUS server on active client sessions.

Configuring and Using RADIUS-Assigned Access Control Lists

Describes how to apply RADIUS-assigned ACLs on the switch for IP traffic filtering.

Contrasting Dynamic (RADIUS-Assigned) and Static ACLs

Highlights key differences between static ACLs and dynamic RADIUS-assigned ACLs.

How a RADIUS Server Applies a RADIUS-Assigned ACL to a Switch Port

Explains how ACLs are identified and invoked by client credentials.

General ACL Features, Planning, and Configuration

Suggests a process for using RADIUS-assigned ACLs to establish access policies.

Configuring an ACL in a RADIUS Server

Provides guidelines for configuring RADIUS servers for RADIUS-assigned ACLs.

Configuring ACE Syntax in RADIUS Servers

Details the syntax and operating information for ACLs configured in a RADIUS server.

Example Configuration Using FreeRADIUS

Illustrates configuring RADIUS-assigned ACL support for client identification methods.

Format Details for ACEs Configured in a RADIUS-Assigned ACL

Explains the structure of a RADIUS-assigned ACL for filtering authenticated client traffic.

Configuration Notes

Provides notes on explicitly permitting/denying IP traffic and ACL structure.

7 Configuring Secure Shell (SSH)

Overview

Introduces SSHv2 for secure remote access and authenticated transactions.

Prerequisite for Using SSH

Details requirements for using the switch as an SSH server, including client applications.

Steps for Configuring and Using SSH for Switch and Client Authentication

Outlines general steps for configuring SSH for two-way authentication.

Further Information on SSH Client Public-Key Authentication

Provides details on client public-key authentication and storage of public keys.

Messages Related to SSH Operation

Lists and explains messages related to SSH operation and potential issues.

8 Configuring Secure Socket Layer (SSL)

Overview

Introduces SSL/TLS for secure remote web access via encrypted paths.

Prerequisite for Using SSL

Details requirements for using the switch as an SSL server, including browser applications.

Steps for Configuring and Using SSL for Switch and Client Authentication

Outlines general steps for configuring SSL for switch and client authentication.

Common Errors in SSL setup

Lists common errors encountered during SSL setup and their possible causes.

9 IPv4 Access Control Lists (ACLs)

Introduction

Defines ACLs and describes how to configure, apply, and edit IPv4 ACLs.

Overview of Options for Applying IPv4 ACLs on the Switch

Explains static and dynamic ACL applications and their types.

IPv4 Static ACL Operation

Describes the operation of static ACLs, including packet filtering and sequential comparison.

Planning an ACL Application

Guides on defining policies, identifying traffic, designing ACLs, and positioning them.

Configuring Standard ACLs

Details commands for creating, editing, and managing standard ACLs.

Configuring Extended ACLs

Details commands for creating, editing, and managing extended ACLs.

Configuring Named, Extended ACLs

Provides steps for creating and configuring named extended ACLs.

Adding or Removing an ACL Assignment On an Interface

Explains how to assign or remove ACLs from switch interfaces.

Editing an Existing ACL

Covers editing ACLs using sequence numbers via CLI or offline methods.

Displaying ACL Configuration Data

Lists commands to display ACL summaries, configurations, and assignments.

Monitoring Static ACL Performance

Describes how to monitor ACL performance using statistics counters.

Creating or Editing ACLs Offline

Provides an alternative method for creating or editing large ACLs using offline files.

Enable ACL Deny Logging

Explains how to enable ACL logging to generate messages for explicit 'deny' actions.

General ACL Operating Notes

Covers notes on ACL limitations, IP traffic screening, and logging.

10 Configuring Advanced Threat Protection

Introduction

Introduces advanced threat protection features for network defense.

DHCP Snooping

Protects the network from common DHCP attacks like address spoofing and exhaustion.

Dynamic ARP Protection

Protects the network from ARP cache poisoning attacks.

Using the Instrumentation Monitor

Detects anomalies caused by security attacks or irregular operations using operating parameters.

11 TrafficSecurity Filters and Monitors

Overview

Describes applicable switch models and features for traffic/security filters.

Filter Types and Operation

Explains how static filters work and their limitations.

Source-Port Filters

Enables forwarding or dropping traffic from indicated source ports to specific destination ports.

Named Source-Port Filters

Allows specification of named filters for multiple ports and trunks.

Static Multicast Filters

Enables forwarding or dropping multicast traffic to specific destination ports.

Protocol Filters

Enables forwarding or dropping traffic based on protocol type.

Configuring TrafficSecurity Filters

Provides procedures to specify filter types and actions on the switch.

Configuring a Source-Port Traffic Filter

Specifies inbound ports and defines actions for destination ports/trunks.

Editing a Source-Port Filter

Allows changing the action for destination ports/trunks in an existing source-port filter.

Configuring a Multicast or Protocol Traffic Filter

Configures filters for multicast addresses or protocol types.

Filter Indexing

Explains how filters are assigned index numbers and how they are managed.

Displaying TrafficSecurity Filters

Lists all filters by index number and displays individual filter details.

12 Configuring Port-Based and User-Based Access Control (802.1 X)

Overview

Introduces 802.1X access control for network security and user profile management.

General Features

Highlights key 802.1X features including authenticator/supplicant operation and user-based control.

General Setup Procedure for 802.1 X Access Control

Outlines prerequisite steps and general procedures for configuring 802.1X access control.

Overview: Configuring 802.1 X Authentication on the Switch

Details the steps for configuring 802.1X authentication on switch ports.

Configuring Switch Ports as 802.1 X Authenticators

Provides commands and procedures for configuring switch ports as 802.1X authenticators.

802.1 X Open VLAN Mode

Describes Open VLAN mode for clients needing to acquire 802.1X supplicant software.

Displaying 802.1 X Configuration, Statistics, and Counters

Provides commands to display 802.1X configuration, statistics, and counters.

How RADIUS802.1 X Authentication Affects VLAN Operation

Explains how RADIUS/802.1X authentication impacts VLAN assignments.

13 Configuring and Monitoring Port Security

Overview

Introduces port security features including basic operation and MAC lockdown.

Port Security

Covers configuring port security, authorized addresses, and intrusion detection.

MAC Lockdown

Explains MAC Lockdown for permanent MAC address assignment and preventing hijacking.

MAC Lockout

Enables blocking specific MAC addresses from sending or receiving traffic.

Web: Displaying and Configuring Port Security Features

Describes how to check for intrusions and configure port security via the web interface.

Reading Intrusion Alerts and Resetting Alert Flags

Explains how to view, acknowledge, and reset port intrusion alerts.

14 Using Authorized IP Managers

Overview

Introduces the Authorized IP Managers feature for controlling network access via IP addresses.

Defining Authorized Management Stations

Covers authorizing single stations or groups of stations for management access.

Overview of IP Mask Operation

Explains how IP masks are used to recognize authorized manager station IP addresses.

Menu: Viewing and Configuring IP Authorized Managers

Details how to view and configure IP authorized managers using the menu interface.

CLI: Viewing and Configuring Authorized IP Managers

Provides CLI commands for viewing and configuring authorized IP managers.

Web: Configuring IP Authorized Managers

Describes how to configure IP authorized managers using the web browser interface.

Building IP Masks

Explains how IP masks define authorized manager station IP addresses.

Operating Notes

Provides security precautions and notes on IP managers and web proxy servers.

15 Key Management System

Overview

Introduces the Key Management System (KMS) for configuring security mechanisms.

Configuring Key Chain Management

Details steps for creating and assigning keys to key chains.

Assigning a Time-Independent Key to a Chain

Explains how to assign a key with no time constraints for a key chain entry.

Assigning Time-Dependent Keys to a Chain

Explains how to assign keys with activate and deactivate times for a key chain entry.

Related product manuals