EasyManua.ls Logo

HP ProCurve Switch 2650 User Manual

HP ProCurve Switch 2650
184 pages
To Next Page IconTo Next Page
To Next Page IconTo Next Page
Page #1 background imageLoading...
Page #1 background image
hp procurve
switch 2650 and switch 6108
access security guide
www.hp.com/go/hpprocurve

Table of Contents

Question and Answer IconNeed help?

Do you have a question about the HP ProCurve Switch 2650 and is the answer not in the manual?

HP ProCurve Switch 2650 Specifications

General IconGeneral
Switching Capacity13.6 Gbps
Forwarding Rate10.1 Mpps
LayerLayer 2
Form FactorRack-mountable
Flash Memory8 MB
Jumbo Frame SupportYes
Power SupplyInternal
ManagementWeb, CLI, SNMP
FeaturesVLAN support, IGMP snooping, QoS
Operating Temperature0°C to 45°C (32°F to 113°F)
Operating Humidity15% to 95% (non-condensing)
Ports48 x 10/100
MAC Address Table Size8, 000 entries

Summary

1 Configuring Username and Password Security

Overview

Explains the security features for console access, including Manager and Operator levels, and password pair configuration.

Configuring Local Password Security

Details how to set, delete, and recover local passwords for switch management via Menu, CLI, or Web interface.

CLI: Setting Passwords and Usernames

Provides CLI commands for configuring manager and operator passwords and optional usernames for secure access.

Web: Setting Passwords and Usernames

Guides users on configuring usernames and passwords for switch access via the web browser interface.

2 TACACS+ Authentication

Overview

Introduces TACACS+ authentication for centralizing access control and managing user privileges across multiple switches.

General System Requirements

Outlines the necessary components for using TACACS+ authentication, including server applications and switch configuration.

General Authentication Setup Procedure

Provides a general procedure for setting up and testing TACACS+ authentication to prevent accidental lockouts.

Configuring TACACS+ on the Switch

Details the CLI commands and steps required to configure TACACS+ operation on the switch.

Configuring the Switch’s Authentication Methods

Explains how to configure AAA authentication methods for console and Telnet access using local, TACACS+, or RADIUS.

Configuring the Switch’s TACACS+ Server Access

Guides on configuring TACACS+ server parameters, including host IP addresses, encryption keys, and timeout values.

How Authentication Operates

Describes the general process of TACACS+ authentication, including server interactions and local fallback.

Controlling Web Browser Interface Access When Using TACACS+ Authentication

Provides methods to prevent unauthorized web browser access when TACACS+ authentication is enabled.

Messages Related to TACACS+ Operation

Lists and explains common CLI messages generated during TACACS+ operation for troubleshooting.

3 RADIUS Authentication and Accounting

Overview

Introduces RADIUS for user authentication and network resource accounting, supporting up to three servers.

Terminology

Defines key terms used in RADIUS authentication and accounting, such as CHAP, EAP, NAS, and Shared Secret Key.

General RADIUS Setup Procedure

Outlines the preparation steps needed before configuring RADIUS authentication on the switch.

Configuring the Switch for RADIUS Authentication

Details the steps to configure RADIUS authentication for various access methods like Serial, Telnet, SSH, and Port-Access.

Configuring RADIUS Accounting

Explains how to configure RADIUS accounting for collecting and sending user activity and system event data to a RADIUS server.

Viewing RADIUS Statistics

Describes how to view general RADIUS configuration and server-specific statistics for monitoring.

Changing RADIUS-Server Access Order

Provides instructions on how to modify the order in which the switch accesses configured RADIUS servers.

Messages Related to RADIUS Operation

Lists and explains common messages encountered during RADIUS operation for troubleshooting purposes.

4 Configuring Secure Shell (SSH)

Overview

Introduces SSH for secure remote access via encrypted paths, supporting client public-key and user password authentication.

Terminology

Defines key terms related to SSH, including SSH Server, Key Pair, PEM, Private Key, Public Key, and Enable Level.

Prerequisite for Using SSH

Specifies the requirement of installing a publicly or commercially available SSH client application on management computers.

Public Key Format Requirement

Details the need for client public keys to be in non-encoded ASCII format for switch compatibility.

Steps for Configuring and Using SSH for Switch and Client Authentication

Provides a comprehensive guide for setting up and using SSH for bidirectional authentication between switch and client.

Configuring the Switch for SSH Operation

Guides users through assigning local passwords, generating key pairs, enabling SSH, and configuring authentication methods.

MoreInformation on SSH Client Public-Key Authentication

Offers additional details on client public-key authentication, including steps for creating and copying public keys.

Messages Related to SSH Operation

Lists and explains common messages related to SSH operation, aiding in troubleshooting.

5 Configuring Port-Based Access Control (802.1x)

Overview

Explains the purpose and general features of 802.1x for port-based access control, including authenticator and supplicant roles.

How 802.1x Operates

Details the operation of 802.1x for authenticator and supplicant roles, covering RADIUS and local authentication processes.

General Setup Procedure for Port-Based Access Control (802.1x)

Outlines the steps required before configuring 802.1x, including local passwords, port determination, and RADIUS server setup.

Configuring Switch Ports as 802.1x Authenticators

Guides on configuring switch ports to act as 802.1x authenticators, including disabling LACP and enabling authentication.

Configuring Switch Ports To Operate As Supplicants for 802.1x Connections to Other Switches

Explains how to configure switch ports to act as 802.1x supplicants for secure links between switches.

Displaying 802.1x Configuration, Statistics, and Counters

Details commands for displaying 802.1x status, including port authenticator and supplicant configurations and statistics.

How 802.1x Authentication Affects VLAN Operation

Explains how 802.1x authentication impacts VLAN assignments and temporary port VLAN membership changes.

Messages Related to 802.1x Operation

Lists and explains common operating messages for 802.1x, aiding in troubleshooting issues.

6 Configuring and Monitoring Port Security

Overview

Introduces Port Security for configuring MAC address lists to authorize network access per port.

Basic Operation

Explains the default port security operation and how intruders are detected and blocked from network transmission.

Planning Port Security

Guides users on planning port security configurations, including port selection, authorized devices, and violation notifications.

Port Security Command Options and Operation

Details CLI commands for port security, including learn modes, address limits, MAC addresses, and action parameters.

Web: Displaying and Configuring Port Security Features

Guides on using the web browser interface to display and configure port security settings and authorized addresses.

Reading Intrusion Alerts and Resetting Alert Flags

Explains how the switch notifies of security violations, sets alert flags, and how to reset them via CLI, Menu, or Web.

Operating Notes for Port Security

Provides essential notes on port security, including identifying intruders, proxy servers, and LACP compatibility.

7 Using Authorized IP Managers

Overview

Introduces the Authorized IP Managers feature for enhancing switch security using IP addresses and masks.

Options

Details the configurable options for Authorized IP Managers, including manager addresses and access privileges.

Defining Authorized Management Stations

Explains how to authorize single stations or groups of stations using IP addresses and IP masks for management access.

Overview of IP Mask Operation

Explains how IP masks are used to define ranges of authorized IP addresses for management access to the switch.

Menu: Viewing and Configuring IP Authorized Managers

Guides on viewing and configuring IP Authorized Managers using the switch's console menu interface.

CLI: Viewing and Configuring Authorized IP Managers

Provides CLI commands for viewing and configuring authorized IP managers, including listing current entries.

Web: Configuring IP Authorized Managers

Guides on configuring IP Authorized Managers through the switch's web browser interface for managing access.

Building IP Masks

Details how to construct IP masks for defining ranges of authorized IP addresses for management stations.

Operating Notes

Provides security precautions, notes on modem access, duplicate IPs, and web proxy server configurations for IP Managers.

Related product manuals