HP ProCurve 6120G/XG User Manual

3. Enabling SSL on the Switch and Anticipating SSL
Browser Contact Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-17
Using the CLI Interface to Enable SSL . . . . . . . . . . . . . . . . . . . . . 8-19
Using the Web Browser Interface to Enable SSL . . . . . . . . . . . . . 8-19
Common Errors in SSL setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-21
9 IPv4 Access Control Lists (ACLs)
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-1
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-4
ACL Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-4
Optional Network Management Applications . . . . . . . . . . . . . . . . . . . . 9-4
Optional PCM and IDM Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-5
General Application Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-5
Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-7
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-10
Types of IP ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-10
ACL Inbound Application Points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-10
Features Common to All ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-11
General Steps for Planning and Configuring ACLs . . . . . . . . . . . . . . . 9-12
ACL Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-13
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-13
The Packet-Filtering Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-14
Planning an ACL Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-17
Switch Resource Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-17
Prioritizing and Monitoring ACL and QoS, Feature Usage . . . . . 9-17
ACL Resource Usage and Monitoring . . . . . . . . . . . . . . . . . . . . . . 9-17
Rule Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-18
Managing ACL Resource Consumption . . . . . . . . . . . . . . . . . . . . . . . . 9-19
Oversubscribing Available Resources . . . . . . . . . . . . . . . . . . . . . . 9-19
Troubleshooting a Shortage of Resources . . . . . . . . . . . . . . . . . . 9-19
Example of ACL Resource Usage . . . . . . . . . . . . . . . . . . . . . . . . . 9-20
Viewing the Current Rule Usage . . . . . . . . . . . . . . . . . . . . . . . . . . 9-20
Traffic Management and Improved Network Performance . . . . . . 9-23
Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-23
xi

HP ProCurve 6120G/XG Specifications

General

Brand	HP
Model	ProCurve 6120G/XG
Category	Switch
Language	English

Summary

Security Overview

Access Security Features

Overview of the switch’s access security features, authentication protocols, and methods.

Network Security Features

Configuring Username and Password Security

Configuring Local Password Security

Describes how to configure local passwords for operator and manager access levels.

Front-Panel Security

Details front-panel security features for disabling button functions and managing password recovery.

Password Recovery

Web and MAC Authentication

Configuring Web Authentication

Describes how to configure the switch for Web authentication.

Configuring MAC Authentication on the Switch

Details how to configure MAC authentication on the switch.

TACACS+ Authentication

Configuring TACACS+ on the Switch

Guides the user through the process of configuring TACACS+ on the switch.

RADIUS Authentication, Authorization, and Accounting

General RADIUS Setup Procedure

Provides steps for preparing and testing the RADIUS service.

Configuring the Switch for RADIUS Authentication

Outlines the commands for configuring RADIUS authentication on the switch.

Configuring RADIUS Server Support for Switch Services

RADIUS Server Configuration for Per-Port CoS (802.1p Priority) and Rate-Limiting

Guidelines for configuring RADIUS to dynamically apply CoS and Rate-Limiting.

Configuring and Using RADIUS-Assigned Access Control Lists

Describes how to apply RADIUS-assigned ACLs on the switch.

Configuring Secure Shell (SSH)

Steps for Configuring and Using SSH for Switch and Client Authentication

Provides steps for configuring and using SSH for two-way authentication.

Configuring the Switch for SSH Operation

Details SSH-related CLI commands and their operations.

Configuring Secure Socket Layer (SSL)

Steps for Configuring and Using SSL for Switch and Client Authentication

Provides general steps for configuring and using SSL.

Configuring the Switch for SSL Operation

IPv4 Access Control Lists (ACLs)

ACL Operation

Planning an ACL Application

Configuring Advanced Threat Protection

DHCP Snooping

Protects the network from common DHCP attacks like address spoofing.

Dynamic ARP Protection

Protects the network from ARP cache poisoning attacks.

Dynamic IP Lockdown

Prevents IP source address spoofing on a per-port and per-VLAN basis.

Traffic/Security Filters and Monitors

Source-Port Filters

Named Source-Port Filters

Configuring Traffic/Security Filters

Provides procedures to specify filter types and actions on the switch.

Configuring Port-Based and User-Based Access Control (802.1X)

802.1X User-Based Access Control

802.1X Port-Based Access Control

General 802.1X Authenticator Operation

General Setup Procedure for 802.1X Access Control

Configuring Switch Ports as 802.1X Authenticators

Details how to configure ports to operate as 802.1X authenticators.

802.1X Open VLAN Mode

Configuring and Monitoring Port Security

Port Security

Explains basic operation, intruder protection, and eavesdrop prevention.

MAC Lockdown

MAC Lockout

Reading Intrusion Alerts and Resetting Alert Flags