Home
HP
Switch
ProCurve 3400cl-24G
HP ProCurve 3400cl-24G Access Security Guide
5
of 1
of 1 rating
404 pages
Give review
Manual
Specs
To Next Page
To Next Page
To Previous Page
To Previous Page
Loading...
Virus Throttling (5300xl Switches Only)
Configuring and Applyi
ng Connectio
n-Rate ACLs
incl
The new switch configur
ation
udes the ACL configur
ed in
figure 3-11.
Shows the assignment of the
above connection-r
ate ACL to
VLAN 15.
Figure 3-12. Example of Switc
h Configuration Display w
ith a Connectio
n-Rate ACL
3-29
82
84
Table of Contents
Default Chapter
5
Default Chapter
5
Table of Contents
5
Product Documentation
17
About Your Switch Manual Set
17
Feature Index
18
Contents
23
Getting Started
23
Conventions
24
Feature Descriptions by Model
24
Introduction
24
Keys
26
Port Identity Examples
26
Sources for more Information
26
Getting Documentation from the Web
28
Online Help
29
Need Only a Quick Start
30
Overview of Access Security Features
31
General Switch Traffic Security Guideline
32
Applications for Access Control Lists (Acls)
33
To Set up and Install the Switch in Your Network
31
Configuring Username and Password Security
36
Overview
36
Configuring Local Password Security
39
Menu: Setting Passwords
39
CLI: Setting Passwords and Usernames
41
Front-Panel Security
42
Web: Setting Passwords and Usernames
42
When Security Is Important
43
Front-Panel Button Functions
44
Clear Button
45
Reset Button
45
Restoring the Factory Default Configuration
45
Configuring Front-Panel Security
47
Disabling the Clear Password Function of the Clear Button on the Switch's Front Panel
49
Re-Enabling the Clear Button on the Switch's Front Panel and Setting or Changing the "Reset-On-Clear" Operation
50
Changing the Operation of the Reset+Clear Combination
51
Disabling or Re-Enabling the Password Recovery Process
52
Password Recovery
52
Password Recovery Process
54
Contents
55
Virus Throttling (5300Xl Switches Only)
55
Introduction
57
Filtering Options
59
General Operation of Connection-Rate Filtering
59
Application Options
60
Sensitivity to Connection Rate Detection
60
Terminology
61
Operating Rules
62
For a Network that Is Relatively Attack-Free
63
For a Network that Appears to be under Significant Attack
64
Basic Connection-Rate Filtering Configuration
65
Global and Per-Port Configuration
65
Enabling Connection-Rate Filtering and Configuring Sensitivity
66
Configuring the Per-Port Filtering Mode
67
Example of a Basic Connection-Rate Filtering Configuration
68
Viewing and Managing Connection-Rate Status
70
Viewing the Connection-Rate Configuration
70
Listing and Unblocking the Currently-Blocked Hosts
72
Configuring and Applying Connection-Rate Acls
74
Connection-Rate ACL Operation
75
Configuring a Connection-Rate ACL Using Source IP Address Criteria
76
Configuring a Connection-Rate ACL Using UDP/TCP Criteria
77
Applying Connection-Rate Acls
80
Using CIDR Notation to Enter the ACE Mask
80
Example of Using an ACL in a Connection-Rate Configuration
81
Connection-Rate ACL Operating Notes
84
Connection-Rate Log and Trap Messages
85
General Configuration Guidelines
63
Contents
87
Web and MAC Authentication
87
Overview
88
Client Options
89
General Features
90
Authenticator Operation
91
How Web and MAC Authentication Operate
91
Web-Based Authentication
91
MAC-Based Authentication
93
Terminology
95
Operating Rules and Notes
96
General Setup Procedure for Web/Mac Authentication
98
Do These Steps before You Configure Web/Mac Authentication
98
Additional Information for Configuring the RADIUS Server to Support MAC Authentication
99
Configuring the Switch to Access a RADIUS Server
100
Configuring Web Authentication on the Switch
102
Overview
102
Configure the Switch for Web-Based Authentication
103
Configuring MAC Authentication on the Switch
107
Overview
107
Configure the Switch for MAC-Based Authentication
108
Show Status and Configuration of Web-Based Authentication
111
Show Status and Configuration of MAC-Based Authentication
112
Client Status
114
Contents
115
TACACS+ Authentication
115
Overview
116
Terminology Used in TACACS Applications
117
General Authentication Setup Procedure
119
General System Requirements
119
Before You Begin
122
Configuring TACACS+ on the Switch
122
CLI Commands Described in this Section
123
Viewing the Switch's Current Authentication Configuration
123
Viewing the Switch's Current TACACS+ Server Contact Configuration
124
Configuring the Switch's Authentication Methods
125
Configuring the Switch's TACACS+ Server Access
129
How Authentication Operates
134
General Authentication Process Using a TACACS+ Server
134
Local Authentication Process
136
Encryption Options in the Switch
137
General Operation
137
Using the Encryption Key
137
Controlling Web Browser Interface Access When Using TACACS+ Authentication
138
Controlling Web Browser Interface Access When Using TACACS
138
Authentication
138
Messages Related to TACACS+ Operation
139
Operating Notes
139
Contents
141
RADIUS Authentication and Accounting
141
Authentication Services
143
Overview
143
Accounting Services
144
RADIUS-Administered Cos and Rate-Limiting
144
Terminology
144
Switch Operating Rules for RADIUS
145
General RADIUS Setup Procedure
147
Configuring the Switch for RADIUS Authentication
148
Outline of the Steps for Configuring RADIUS Authentication
149
Configure Authentication for the Access Methods You Want RADIUS
150
To Protect
150
Enable the (Optional) Access Privilege Option
152
Configure the Switch to Access a RADIUS Server
153
Configure the Switch's Global RADIUS Parameters
155
Local Authentication Process
159
Controlling Web Browser Interface Access
160
Configuring the RADIUS Server
161
Services
161
Viewing the Currently Active Per-Port Cos and Rate-Limiting Configuration Specified by a RADIUS Server
162
RADIUS-Assigned Access Control Lists
165
Terminology
167
General Operation
169
The Packet-Filtering Process
170
Determining Traffic Policies
173
General Steps
173
Planning the Acls Needed to Enforce Designated
174
Planning the Acls Needed to Enforce Designated Traffic Policies
174
Traffic Policies
174
Operating Rules for RADIUS-Based Acls
176
Configuring an ACL in a RADIUS Server
178
Configuring the Switch to Support RADIUS-Based Acls
182
Displaying the Current RADIUS-Based ACL Activity
184
On the Switch
184
Event Log Messages
186
Causes of Client Deauthentication Immediately after Authenticating
187
Configuring RADIUS Accounting
188
Operating Rules for RADIUS Accounting
189
Steps for Configuring RADIUS Accounting
190
Configure the Switch to Access a RADIUS Server
191
Configure Accounting Types and the Controls for Sending Reports to the RADIUS Server
192
Optional) Configure Session Blocking and Interim Updating
194
Viewing RADIUS Statistics
196
General RADIUS Statistics
196
RADIUS Authentication Statistics
197
RADIUS Accounting Statistics
198
Changing RADIUS-Server Access Order
200
Messages Related to RADIUS Operation
201
Configuring Secure Shell (SSH)
204
Overview
204
Terminology
205
Prerequisite for Using SSH
207
Public Key Formats
207
Steps for Configuring and Using SSH for Switch and Client Authentication
208
General Operating Rules and Notes
210
Assigning a Local Login (Operator) and Enable (Manager) Password
211
Generating the Switch's Public and Private Key Pair
212
Providing the Switch's Public Key to Clients
214
Enabling SSH on the Switch and Anticipating SSH Client Contact
217
Behavior
217
Configuring the Switch for SSH Authentication
220
Use an SSH Client to Access the Switch
223
Further Information on SSH Client Public-Key Authentication
224
Messages Related to SSH Operation
229
Configuring the Switch for SSH Operation
211
Configuring Secure Socket Layer (SSL)
232
Overview
232
Terminology
233
Prerequisite for Using SSL
235
Steps for Configuring and Using SSL for Switch and Client Authentication
235
General Operating Rules and Notes
236
Assigning a Local Login (Operator) and Enable (Manager)Password
237
Configuring the Switch for SSL Operation
237
Generating the Switch's Server Host Certificate
239
To Generate or Erase the Switch's Server Certificate
240
With the CLI
240
Comments on Certificate Fields
241
Generate a Self-Signed Host Certificate with the Web Browser
243
Interface
243
Generate a CA-Signed Server Host Certificate with the Web Browser
245
Enabling SSL on the Switch and Anticipating SSL Browser Contact
247
Behavior
247
Using the CLI Interface to Enable SSL
249
Using the Web Browser Interface to Enable SSL
249
Common Errors in SSL Setup
251
Introduction
254
Overview
254
Traffic/Security Filters
254
Filter Limits
255
Filter Types and Operation
255
Using Port Trunks with Filters
255
Operating Rules for Source-Port Filters
256
Source-Port Filters
256
Example
257
Named Source-Port Filters
258
Operating Rules for Named Source-Port Filters
258
Defining and Configuring Named Source-Port Filters
259
Using Named Source-Port Filters
260
Static Multicast Filters (5300Xl Only)
266
Protocol Filters (5300Xl Only)
267
Configuring Traffic/Security Filters
268
Configuring a Source-Port Traffic Filter
268
Example of Creating a Source-Port Filter
269
Configuring a Filter on a Port Trunk
270
Configuring a Multicast or Protocol Traffic Filter (5300Xl Switches Only)
271
Editing a Source-Port Filter
271
Displaying Traffic/Security Filters
273
Filter Indexing
273
Viewing a Named Source-Port Filter
260
Configuring Port-Based and Client-Based Access Control (802.1X)
275
Contents
275
Overview
277
Why Use Port-Based or Client-Based Access Control
277
General Features
277
User Authentication Methods
278
Terminology
279
General 802.1X Authenticator Operation
282
Example of the Authentication Process
282
VLAN Membership Priority
283
General Operating Rules and Notes
285
General Setup Procedure for Port-Based Access Control (802.1X)
287
Do These Steps before You Configure 802.1X Operation
287
Overview: Configuring 802.1X Authentication on the Switch
287
Configuring Switch Ports as 802.1X Authenticators
289
Enable 802.1X Authentication on Selected Ports
289
Configure the 802.1X Authentication Method
293
Enter the RADIUS Host IP Address(Es)
294
Enable 802.1X Authentication on the Switch
295
802.1X Open VLAN Mode
295
Introduction
295
VLAN Membership Priorities
296
Use Models for 802.1X Open VLAN Modes
297
Operating Rules for Authorized-Client and Unauthorized-Client Vlans
301
Setting up and Configuring 802.1X Open VLAN Mode
305
802.1X Open VLAN Operating Notes
309
Option for Authenticator Ports: Configure Port-Security to Allow Only 802.1X-Authenticated Devices
310
Configuring Switch Ports to Operate as Supplicants for 802.1X Connections to Other Switches
312
Example
312
To Other Switches
312
Supplicant Port Configuration
314
Displaying 802.1X Configuration, Statistics, and Counters
316
Show Commands for Port-Access Authenticator
316
Viewing 802.1X Open VLAN Mode Status
318
Show Commands for Port-Access Supplicant
322
How RADIUS/802.1X Authentication Affects VLAN Operation
323
Messages Related to 802.1X Operation
327
Configuring and Monitoring Port Security
329
Contents
329
Overview
331
Port Security
332
Basic Operation
332
Eavesdrop Protection (Series 5300Xl Switches)
333
Blocking Unauthorized Traffic
334
Trunk Group Exclusion
334
Planning Port Security
335
Port Security Command Options and Operation
336
Port Security Display Options
336
Configuring Port Security
339
Retention of Static Addresses
344
MAC Lockdown
349
Differences between MAC Lockdown and Port Security
351
MAC Lockdown Operating Notes
352
Deploying MAC Lockdown
353
MAC Lockout
357
Port Security and MAC Lockout
359
Reading Intrusion Alerts and Resetting Alert Flags
360
Notice of Security Violations
360
How the Intrusion Log Operates
361
Keeping the Intrusion Log Current by Resetting Alert Flags
362
Menu: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags
363
CLI: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags
364
Using the Event Log to Find Intrusion Alerts
366
Web: Checking for Intrusions, Listing Intrusion Alerts, and Resetting
367
Alert Flags
368
Web: Displaying and Configuring Port Security Features
360
Operating Notes for Port Security
368
Using Authorized IP Managers
372
Overview
372
Options
373
Access Levels
373
Defining Authorized Management Stations
374
Overview of IP Mask Operation
374
Menu: Viewing and Configuring IP Authorized Managers
375
CLI: Viewing and Configuring Authorized IP Managers
376
Listing the Switch's Current Authorized IP Manager(S)
376
Configuring IP Authorized Managers for the Switch
377
Web: Configuring IP Authorized Managers
379
Building IP Masks
379
Configuring One Station Per Authorized Manager IP Entry
379
Configuring Multiple Stations Per Authorized Manager IP Entry
380
Additional Examples for Authorizing Multiple Stations
382
Operating Notes
382
Key Management System
386
Overview
386
Terminology
386
Configuring Key Chain Management
387
Creating and Deleting Key Chain Entries
387
Assigning a Time-Independent Key to a Chain
388
Assigning Time-Dependent Keys to a Chain
389
Index
393
Other manuals for HP ProCurve 3400cl-24G
Management Guide
664 pages
5
Based on 1 rating
Ask a question
Give review
Questions and Answers:
Need help?
Do you have a question about the HP ProCurve 3400cl-24G and is the answer not in the manual?
Ask a question
HP ProCurve 3400cl-24G Specifications
General
Brand
HP
Model
ProCurve 3400cl-24G
Category
Switch
Language
English
Related product manuals
HP ProCurve 3400cl-48G
108 pages
HP ProCurve Series 3400cl
197 pages
HP ProCurve 3500
130 pages
HP ProCurve 3500-24
80 pages
HP ProCurve 3500yl-24G
2 pages
HP ProCurve 3500yl Series
390 pages
HP ProCurve
236 pages
HP ProCurve 2650
524 pages
HP ProCurve 2610
364 pages
HP ProCurve 2810
40 pages
HP ProCurve 1810G
80 pages
HP ProCurve Series
110 pages
To Next PageTo Next PageTo Previous PageTo Previous Page
Loading...
Need help?
General