HP PROCURVE 2910AL

To Next Page

To Previous Page

HP ProCurve 2910al Switch

February 2009

W.14.03

Access Security Guide

Main Page

Table of Contents5
Electronic Publications21
Product Documentation21
Printed Publications21
About Your Switch Manual Set21
Software Feature Index22
Security Overview27
Contents27
Introduction28
About this Guide28
For more Information28
Access Security Features29
Network Security Features33
Getting Started with Access Security36
Physical Security36
Quick Start: Using the Management Interface Wizard37
CLI: Management Interface Wizard38
Web: Management Interface Wizard39
SNMP Security Guidelines42
Precedence of Security Options44
Precedence of Port-Based Security Options44
Precedence of Client-Based Authentication: Dynamic Configuration Arbiter44
Network Immunity Manager45
Arbitrating Client-Specific Attributes46
Procurve Identity-Driven Manager (IDM)48
Configuring Username and Password Security49
Contents49
Overview51
Configuring Local Password Security54
Menu: Setting Passwords54
CLI: Setting Passwords and Usernames56
Web: Setting Passwords and Usernames57
SNMP: Setting Passwords and Usernames57
Saving Security Credentials in a58
Config File58
Benefits of Saving Security Credentials58
Enabling the Storage and Display of Security Credentials59
Security Settings that Can be Saved59
Local Manager and Operator Passwords60
Password Command Options61
SNMP Security Credentials62
802.1X Port-Access Credentials63
TACACS+ Encryption Key Authentication63
SSH Client Public-Key Authentication64
RADIUS Shared-Secret Key Authentication64
Operating Notes67
Restrictions69
Front-Panel Security71
When Security Is Important71
Front-Panel Button Functions72
Clear Button72
Reset Button73
Restoring the Factory Default Configuration73
Configuring Front-Panel Security74
Disabling the Clear Password Function of the Clear Button on the Switch's Front Panel77
Re-Enabling the Clear Button on the Switch's Front Panel and Setting or Changing the "Reset-On-Clear" Operation78
Changing the Operation of the Reset+Clear Combination79
Disabling or Re-Enabling the Password Recovery Process80
Password Recovery80
Password Recovery Process82
Web and MAC Authentication85
Contents85
Overview86
Web Authentication86
MAC Authentication87
Concurrent Web and MAC Authentication87
Authorized and Unauthorized Client Vlans88
RADIUS-Based Authentication89
Wireless Clients89
How Web and MAC Authentication Operate89
Web-Based Authentication90
MAC-Based Authentication92
Terminology94
Operating Rules and Notes95
Setup Procedure for Web/Mac Authentication97
Before You Configure Web/Mac Authentication97
Configuring the RADIUS Server to Support MAC Authentication99
Configuring the Switch to Access a RADIUS Server100
Configuring Web Authentication102
Overview102
Configuration Commands for Web Authentication103
Show Commands for Web Authentication110
Configuring MAC Authentication on the Switch116
Overview116
Configuration Commands for MAC Authentication117
Show Commands for MAC-Based Authentication120
Client Status126
TACACS+ Authentication128
Overview128
Terminology Used in TACACS Applications129
General System Requirements131
General Authentication Setup Procedure131
Configuring TACACS+ on the Switch134
Before You Begin134
CLI Commands Described in this Section135
Viewing the Switch's Current Authentication Configuration135
Viewing the Switch's Current TACACS+ Server Contact Configuration136
Configuring the Switch's Authentication Methods137
Using the Privilege-Mode Option for Login137
Authentication Parameters139
Configuring the TACACS+ Server for Single Login139
Configuring the Switch's TACACS+ Server Access144
How Authentication Operates150
General Authentication Process Using a TACACS+ Server150
Local Authentication Process151
Using the Encryption Key152
General Operation152
Encryption Options in the Switch152
Controlling Web Browser Interface Access When Using TACACS+ Authentication153
Messages Related to TACACS+ Operation154
Operating Notes155
RADIUS Authentication and Accounting157
Contents158
Overview159
Authentication Services159
SNMP Access to the Switch's Authentication Configuration MIB160
Accounting Services160
RADIUS-Administered Cos and Rate-Limiting160
Terminology161
Switch Operating Rules for RADIUS162
General RADIUS Setup Procedure163
Configuring the Switch for RADIUS Authentication164
Outline of the Steps for Configuring RADIUS Authentication165
Configure Authentication for the Access Methods You Want RADIUS to Protect166
Enable the (Optional) Access Privilege Option169
Configure the Switch to Access a RADIUS Server171
Configure the Switch's Global RADIUS Parameters173
Using SNMP to View and Configure Switch Authentication Features177
Changing and Viewing the SNMP Access Configuration178
Local Authentication Process180
Controlling Web Browser Interface Access181
Commands Authorization182
Enabling Authorization183
Displaying Authorization Information184
Configuring Commands Authorization on a RADIUS Server184
Using Vendor Specific Attributes (Vsas)184
Example Configuration on Cisco Secure ACS for MS Windows186
Example Configuration on Cisco Secure ACS for MS Windows 5-30186
Example Configuration Using Freeradius188
Additional RADIUS Attributes190
Configuring RADIUS Accounting191
Operating Rules for RADIUS Accounting193
Steps for Configuring RADIUS Accounting193
Configure the Switch to Access a RADIUS Server194
Configure Accounting Types and the Controls for Sending Reports to the RADIUS Server196
Optional) Configure Session Blocking and Interim Updating Options198
General RADIUS Statistics199
Viewing RADIUS Statistics199
RADIUS Authentication Statistics201
RADIUS Accounting Statistics202
Changing RADIUS-Server Access Order203
Messages Related to RADIUS Operation206
Configuring RADIUS Server Support207
For Switch Services207
Overview209
RADIUS Server Configuration for Per-Port Cos (802.1P Priority) and Rate-Limiting210
Applied Rates for RADIUS-Assigned Rate Limits211
Viewing the Currently Active Per-Port Cos and Rate-Limiting Configuration Specified by a RADIUS Server212
Configuring and Using RADIUS-Assigned Access Control Lists215
Introduction215
Terminology215
Overview of RADIUS-Assigned, Dynamic Acls218
Contrasting Dynamic (RADIUS-Assigned) and Static Acls219
How a RADIUS Server Applies a RADIUS-Assigned220
ACL to a Switch Port220
General ACL Features, Planning, and Configuration221
The Packet-Filtering Process222
Operating Rules for RADIUS-Assigned Acls223
Configuring an ACL in a RADIUS Server223
Nas-Filter-Rule-Options224
Configuring ACE Syntax in RADIUS Servers225
Example Using the Standard Attribute (92) in an Ipv4 ACL226
Example of Configuring a RADIUS-Assigned ACL Using the Freeradius Application227
Format Details for Aces Configured in a RADIUS-Assigned ACL229
Acls230
Configuration Notes230
Configuring the Switch to Support RADIUS-Assigned230
Displaying the Current RADIUS-Assigned ACL Activity232
On the Switch232
ICMP Type Numbers and Keywords234
Event Log Messages235
Causes of Client Deauthentication Immediately after Authenticating236
Monitoring Shared Resources236
Configuring Secure Shell (SSH)238
Overview238
- Terminology239
Prerequisite for Using SSH240
Public Key Formats240
Steps for Configuring and Using SSH for Switch and Client Authentication241
General Operating Rules and Notes243
Assigning a Local Login (Operator) and Enable (Manager) Password244
Configuring the Switch for SSH Operation244
Generating the Switch's Public and Private Key Pair245
Configuring Key Lengths248
Providing the Switch's Public Key to Clients248
Enabling SSH on the Switch and Anticipating SSH Client Contact Behavior251
Configuring the Switch for SSH Authentication255
Use an SSH Client to Access the Switch259
Further Information on SSH Client Public-Key Authentication259
Messages Related to SSH Operation265
Logging Messages266
Debug Logging266
Configuring Secure Socket Layer (SSL)268
- Overview268
Terminology269
Authentication271
Prerequisite for Using SSL271
Steps for Configuring and Using SSL for Switch and Client271
General Operating Rules and Notes272
Configuring the Switch for SSL Operation273
Assigning a Local Login (Operator) and Enabling (Manager) Password273
Generating the Switch's Server Host Certificate274
To Generate or Erase the Switch's Server Certificate275
With the CLI275
Comments on Certificate Fields276
Generate a Self-Signed Host Certificate with the Web Browser Interface278
Generate a Self-Signed Host Certificate with the Web278
Browser Interface278
Generate a CA-Signed Server Host Certificate with the Web Browser Interface281
Enabling SSL on the Switch and Anticipating SSL Browser Contact Behavior283
Using the CLI Interface to Enable SSL285
Using the Web Browser Interface to Enable SSL285
Common Errors in SSL Setup287
Ipv4 Access Control Lists (Acls)289
Contents289
Introduction292
Overview of Options for Applying Ipv4 Acls on the Switch294
Static ACLS294
Dynamic Port Acls294
Overview of Options for Applying Ipv4 Acls on the Switch295
Terminology298
Dynamic Port Acls298
ACL Applications302
Types of Ipv4 Acls302
Overview302
Static Port ACL and Dynamic Port ACL Applications303
Dynamic (RADIUS-Assigned) Port ACL Applications303
Multiple Acls on an Interface304
Features Common to All ACL Applications304
General Steps for Planning and Configuring Acls306
Ipv4 Static ACL Operation308
Introduction308
The Packet-Filtering Process308
Planning an ACL Application312
Ipv4 Traffic Management and Improved Network Performance312
Security313
Guidelines for Planning the Structure of a Static ACL314
Ipv4 ACL Configuration and Operating Rules315
How an ACE Uses a Mask to Screen Packets for Matches316
What Is the Difference between Network (or Subnet) Masks and the Masks Used with Acls316
Rules for Defining a Match between a Packet and an Access Control Entry (ACE)317
Configuring and Assigning an Ipv4 ACL322
Overview322
General Steps for Implementing Acls322
Options for Permit/Deny Policies323
ACL Configuration Structure323
Standard ACL Structure324
Extended ACL Configuration Structure325
ACL Configuration Factors327
The Sequence of Entries in an ACL Is Significant327
To an Interface329
A Configured ACL Has no Effect until You Apply It329
You Can Assign an ACL Name or Number to an Interface Even if the ACL Does Not Exist in the Switch's Configuration329
Allowing for the Implied Deny Function329
A Configured ACL Has no Effect until You Apply It to an Interface329
Using the CLI to Create an ACL330
General ACE Rules330
Using CIDR Notation to Enter the Ipv4 ACL Mask331
Configuring Standard Acls332
Configuring Named, Standard Acls337
Creating Numbered, Standard Acls337
Configuring Extended Acls341
Configuring Named, Extended Acls343
Configuring Numbered, Extended Acls353
Adding or Removing an ACL Assignment on an Interface361
Filtering Inbound Ipv4 Traffic Per Port361
Deleting an ACL362
General Editing Rules363
Editing an Existing ACL363
Using the CLI to Edit Acls363
Sequence Numbering in Acls364
Inserting an ACE in an Existing ACL365
Deleting an ACE from an Existing ACL367
Resequencing the Aces in an ACL368
Attaching a Remark to an ACE369
Operating Notes for Remarks372
Displaying ACL Configuration Data373
Display an ACL Summary374
Display the Content of All Acls on the Switch375
Display Static Port ACL Assignments376
Displaying the Content of a Specific ACL377
Display All Acls and Their Assignments in the Routing Switch Startup-Config File and Running-Config File379
Monitoring Static ACL Performance380
Creating or Editing Acls Offline382
Creating or Editing an ACL Offline382
The Offline Process382
Enable ACL "Deny" Logging384
Requirements for Using ACL Logging384
ACL Logging Operation385
Enabling ACL Logging on the Switch386
General ACL Operating Notes387
Configuring Advanced Threat Protection390
Introduction390
DHCP Snooping391
Overview391
Enabling DHCP Snooping392
Enabling DHCP Snooping on VLANS394
Configuring DHCP Snooping Trusted Ports395
Configuring Authorized Server Addresses396
Using DHCP Snooping with Option 82396
Changing the Remote-ID from a MAC to an IP Address398
Disabling the MAC Address Check398
The DHCP Binding Database399
Operational Notes400
Log Messages401
Dynamic ARP Protection403
Introduction403
Enabling Dynamic ARP Protection405
Configuring Trusted Ports405
Adding an IP-To-MAC Binding to the DHCP Database407
Configuring Additional Validation Checks on ARP Packets408
Verifying the Configuration of Dynamic ARP Protection408
Displaying ARP Packet Statistics409
Monitoring Dynamic ARP Protection410
Using the Instrumentation Monitor411
Operating Notes412
Configuring Instrumentation Monitor413
Examples414
Viewing the Current Instrumentation Monitor Configuration415
Traffic/Security Filters and Monitors418
Overview418
Introduction418
Using Port Trunks with Filters419
Filter Types and Operation419
Filter Limits419
Source-Port Filters420
Operating Rules for Source-Port Filters420
Example421
Named Source-Port Filters422
Operating Rules for Named Source-Port Filters422
Defining and Configuring Named Source-Port Filters423
Viewing a Named Source-Port Filter425
Using Named Source-Port Filters425
Static Multicast Filters431
Protocol Filters432
Configuring Traffic/Security Filters433
Configuring a Source-Port Traffic Filter434
Example of Creating a Source-Port Filter435
Configuring a Filter on a Port Trunk435
Editing a Source-Port Filter436
Configuring a Multicast or Protocol Traffic Filter437
Filter Indexing438
Displaying Traffic/Security Filters439
User-Based Access Control (802.1X)441
Overview443
Why Use Port-Based or User-Based Access Control443
General Features443
User Authentication Methods444
802.1X User-Based Access Control444
Overview444
802.1X Port-Based Access Control445
Alternative to Using a RADIUS Server446
Accounting446
Terminology446
General 802.1X Authenticator Operation449
Example of the Authentication Process449
VLAN Membership Priority450
General Operating Rules and Notes452
General Setup Procedure for 802.1X Access Control455
Do These Steps before You Configure 802.1X Operation455
Overview: Configuring 802.1X Authentication on the Switch458
Configuring Switch Ports as 802.1X Authenticators459
Enable 802.1X Authentication on Selected Ports460
Enable the Selected Ports as Authenticators and Enable the (Default) Port-Based Authentication460
Enable the Selected Ports as Authenticators and Enable460
The (Default) Port-Based Authentication460
Specify User-Based Authentication or Return to Port-Based Authentication461
Reconfigure Settings for Port-Access462
Example: Configuring Port-Based 802.1X Authentication462
Example: Configuring User-Based 802.1X Authentication462
Configure the 802.1X Authentication Method466
Enter the RADIUS Host IP Address(Es)467
Enable 802.1X Authentication on the Switch467
Optional: Reset Authenticator Operation468
Optional: Configure 802.1X Controlled Directions468
Wake-On-LAN Traffic469
Operating Notes469
Example: Configuring 802.1X Controlled Directions470
802.1X Open VLAN Mode471
Introduction471
VLAN Membership Priorities472
Use Models for 802.1X Open VLAN Modes473
Operating Rules for Authorized-Client and Unauthorized-Client Vlans478
Setting up and Configuring 802.1X Open VLAN Mode482
802.1X Open VLAN Operating Notes486
- Option for Authenticator Ports: Configure Port-Security to Allow Only 802.1X-Authenticated Devices487
Port-Security487
Port-Security488
- Configuring Switch Ports to Operate as Supplicants for 802.1X Connections to Other Switches489
Example489
Supplicant Port Configuration491
Show Commands for Port-Access Authenticator493
Displaying 802.1X Configuration, Statistics, and Counters493
Viewing 802.1X Open VLAN Mode Status502
Show Commands for Port-Access Supplicant506
How RADIUS/802.1X Authentication Affects VLAN Operation507
VLAN Assignment on a Port508
Operating Notes508
Example of Untagged VLAN Assignment in a RADIUS-Based Authentication Session510
Enabling the Use of GVRP-Learned Dynamic Vlans in Authentication Sessions513
Messages Related to 802.1X Operation515
Configuring and Monitoring Port Security517
Overview519
Port Security520
Basic Operation520
Eavesdrop Protection521
Blocking Unauthorized Traffic521
Port Security521
Trunk Group Exclusion522
Planning Port Security523
Port Security Command Options and Operation524
Configuring Port Security528
Retention of Static Addresses533
MAC Lockdown538
MAC Lockdown539
Differences between MAC Lockdown and Port Security540
MAC Lockdown Operating Notes541
Deploying MAC Lockdown542
MAC Lockout546
MAC Lockout547
Port Security and MAC Lockout548
Web: Displaying and Configuring Port Security Features549
Reading Intrusion Alerts and Resetting Alert Flags549
Notice of Security Violations549
How the Intrusion Log Operates550
Keeping the Intrusion Log Current by Resetting Alert Flags551
Menu: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags552
CLI: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags553
- Using the Event Log to Find Intrusion Alerts555
Web: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags556
Operating Notes for Port Security557
Using Authorized IP Managers560
Overview560
Options561
Access Levels561
Defining Authorized Management Stations561
Overview of IP Mask Operation562
Menu: Viewing and Configuring IP Authorized Managers563
CLI: Viewing and Configuring Authorized IP Managers564
Web: Configuring IP Authorized Managers566
Web Proxy Servers566
Web-Based Help567
Interface567
Using a Web Proxy Server to Access the Web Browser567
How to Eliminate the Web Proxy Server567
Building IP Masks568
Configuring Multiple Stations Per Authorized Manager IP Entry568
Additional Examples for Authorizing Multiple Stations570
Operating Notes571
Operating Notes572
Key Management System574
Overview574
Terminology574
Configuring Key Chain Management575
Creating and Deleting Key Chain Entries575
Assigning a Time-Independent Key to a Chain576
Assigning Time-Dependent Keys to a Chain577

HP PROCURVE 2910AL

Table of Contents

Other manuals for HP PROCURVE 2910AL

Related product manuals