HPE FlexFabric 5940 SERIES

To Next Page

HPE FlexFabric 5940 Switch Series

Security Configuration Guide

Part number: 5200-1030a

Software version: Release 2508 and later verison

Document version: 6W101-20161101

Main Page

Default Chapter3
- Table of Contents3
Configuring AAA14
- Overview14
- FIPS Compliance32
- AAA Configuration Considerations and Task List32
- Configuring AAA Schemes33
- Configuring AAA Methods for ISP Domains59
- Configuring the RADIUS Session-Control Feature66
- Configuring the RADIUS DAE Server Feature66
- Changing the DSCP Priority for RADIUS Packets67
- Configuring the RADIUS Attribute Translation Feature67
- Setting the Maximum Number of Concurrent Login Users69
- Configuring a NAS-ID Profile69
- Configuring the Device ID70
- Displaying and Maintaining AAA70
- AAA Configuration Examples70
- Troubleshooting RADIUS81
- Troubleshooting HWTACACS82
- Troubleshooting LDAP82
  - LDAP Authentication Failure82
802.1X Overview84
- 802.1X Architecture84
- Controlled/Uncontrolled Port and Port Authorization Status84
- 802.1X-Related Protocols85
  - Packet Formats85
  - EAP over RADIUS86
- 802.1X Authentication Initiation87
  - 802.1X Client as the Initiator87
  - Access Device as the Initiator87
- 802.1X Authentication Procedures88
Configuring 802.1X92
- Access Control Methods92
- 802.1X VLAN Manipulation92
  - Authorization VLAN92
  - Guest VLAN94
  - Auth-Fail VLAN95
  - Critical VLAN96
  - Critical Voice VLAN98
- Using 802.1X Authentication with Other Features99
  - ACL Assignment99
  - User Profile Assignment99
  - EAD Assistant99
  - Redirect URL Assignment100
- Configuration Prerequisites100
- 802.1X Configuration Task List100
- Enabling 802.1X101
- Enabling EAP Relay or EAP Termination101
- Setting the Port Authorization State102
- Specifying an Access Control Method102
- Setting the Maximum Number of Concurrent 802.1X Users on a Port103
- Setting the Maximum Number of Authentication Request Attempts103
- Setting the 802.1X Authentication Timeout Timers103
- Configuring Online User Handshake104
  - Configuration Guidelines104
  - Configuration Procedure104
- Configuring the Authentication Trigger Feature105
  - Configuration Guidelines105
  - Configuration Procedure105
- Specifying a Mandatory Authentication Domain on a Port105
- Setting the Quiet Timer106
- Configuring 802.1X Reauthentication106
  - Overview106
  - Configuration Restrictions and Guidelines107
  - Configuring 802.1X Periodic Reauthentication107
  - Configuring 802.1X Manual Reauthentication107
  - Enabling the Keep-Online Feature108
- Configuring an 802.1X Guest VLAN108
  - Configuration Guidelines108
  - Configuration Prerequisites109
  - Configuration Procedure109
- Enabling 802.1X Guest VLAN Assignment Delay109
- Configuring an 802.1X Auth-Fail VLAN110
  - Configuration Guidelines110
  - Configuration Prerequisites110
  - Configuration Procedure111
- Configuring an 802.1X Critical VLAN111
  - Configuration Guidelines111
  - Configuration Prerequisites111
- Enabling the 802.1X Critical Voice VLAN112
  - Configuration Restrictions and Guidelines112
  - Configuration Prerequisites112
  - Configuration Procedure112
- Specifying Supported Domain Name Delimiters112
- Enabling 802.1X User IP Freezing113
- Sending 802.1X Protocol Packets out of a Port Without VLAN Tags113
- Setting the Maximum Number of 802.1X Authentication Attempts for MAC Authenticated Users114
- Configuring the EAD Assistant Feature114
- Displaying and Maintaining 802.1X115
- 802.1X Authentication Configuration Examples115
  - Basic 802.1X Authentication Configuration Example115
  - Guest VLAN and Authorization VLAN Configuration Example117
  - 802.1X with ACL Assignment Configuration Example120
  - With EAD Assistant Configuration Example (with DHCP Relay Agent)121
  - With EAD Assistant Configuration Example (with DHCP Server)124
- Troubleshooting 802.1X126
  - EAD Assistant URL Redirection Failure126
Configuring MAC Authentication128
- Overview128
- Configuration Prerequisites132
- Configuration Task List132
- Enabling MAC Authentication132
- Specifying a MAC Authentication Domain133
- Configuring the User Account Format133
- Configuring MAC Authentication Timers134
- Setting the Maximum Number of Concurrent MAC Authentication Users on a Port134
- Enabling MAC Authentication Multi-VLAN Mode on a Port135
- Configuring MAC Authentication Delay135
- Enabling Parallel Processing of MAC Authentication and 802.1X Authentication136
  - Configuration Restrictions and Guidelines136
  - Configuration Procedure136
- Configuring a MAC Authentication Guest VLAN137
- Configuring a MAC Authentication Critical VLAN138
- Enabling the MAC Authentication Critical Voice VLAN138
  - Configuration Prerequisites138
  - Configuration Procedure139
- Configuring Periodic MAC Reauthentication139
- Enabling MAC Authentication Offline Detection140
- Displaying and Maintaining MAC Authentication141
- MAC Authentication Configuration Examples141
Configuring Portal Authentication149
- Overview149
  - Extended Portal Functions149
  - Portal System Components149
  - Portal System Using the Local Portal Web Server151
  - Interaction between Portal System Components151
  - Portal Authentication Modes152
  - Portal Support for EAP152
  - Portal Authentication Process153
  - Portal Packet Filtering Rules155
  - MAC-Based Quick Portal Authentication155
- Portal Configuration Task List156
- Configuration Prerequisites157
- Configuring a Portal Authentication Server157
- Configuring a Portal Web Server158
- Enabling Portal Authentication159
  - Configuration Restrictions and Guidelines159
  - Configuration Procedure160
- Specifying a Portal Web Server160
- Controlling Portal User Access161
  - Configuring a Portal-Free Rule161
  - Configuring an Authentication Source Subnet162
  - Configuring an Authentication Destination Subnet163
  - Setting the Maximum Number of Portal Users163
  - Specifying a Portal Authentication Domain164
  - Specifying a Preauthentication Domain165
  - Specifying a Preauthentication IP Address Pool for Portal Users165
  - Enabling Strict-Checking on Portal Authorization Information166
  - Enabling Portal Authentication Only for DHCP Users167
  - Enabling Outgoing Packets Filtering on a Portal-Enabled Interface167
- Configuring Portal Detection Features167
  - Configuring Online Detection of Portal Users167
  - Configuring Portal Authentication Server Detection168
  - Configuring Portal Web Server Detection169
  - Configuring Portal User Synchronization170
- Configuring the Portal Fail-Permit Feature171
- Configuring BAS-IP for Portal Packets Sent to the Portal Authentication Server171
- Enabling Portal Roaming172
- Specifying a Format for the NAS-Port-ID Attribute173
- Specifying the Device ID173
- Logging out Online Portal Users173
- Configuring Web Redirect174
- Applying a NAS-ID Profile to an Interface174
- Configuring the Local Portal Web Server Feature175
  - Customizing Authentication Pages175
  - Configuring a Local Portal Web Server177
- Enabling ARP or ND Entry Conversion for Portal Clients178
- Configuring MAC-Based Quick Portal Authentication178
  - Configuring a MAC Binding Server178
  - Specifying a MAC Binding Server on an Interface179
- Enabling Logging for User Logins and Logouts180
- Displaying and Maintaining Portal180
- Portal Configuration Examples181
  - Configuring Direct Portal Authentication181
  - Configuring Re-DHCP Portal Authentication189
  - Configuring Cross-Subnet Portal Authentication192
  - Configuring Extended Direct Portal Authentication196
  - Configuring Extended Re-DHCP Portal Authentication199
  - Configuring Extended Cross-Subnet Portal Authentication203
  - Configuring Portal Server Detection and Portal User Synchronization206
  - Configuring Direct Portal Authentication with a Preauthentication Domain214
  - Configuring Re-DHCP Portal Authentication with a Preauthentication Domain216
  - Configuring Direct Portal Authentication Using Local Portal Web Server218
- Troubleshooting Portal221
  - No Portal Authentication Page Is Pushed for Users221
  - Cannot Log out Portal Users on the Access Device222
  - Cannot Log out Portal Users on the RADIUS Server222
  - Users Logged out by the Access Device Still Exist on the Portal Authentication Server222
  - Re-DHCP Portal Authenticated Users Cannot Log in Successfully223
Configuring Port Security224
- Overview224
  - Port Security Features224
  - Port Security Modes224
- Configuration Task List227
- Enabling Port Security227
- Setting Port Security's Limit on the Number of Secure MAC Addresses on a Port228
- Setting the Port Security Mode229
- Configuring Port Security Features230
  - Configuring NTK230
  - Configuring Intrusion Protection231
- Configuring Secure MAC Addresses231
  - Configuration Prerequisites232
  - Configuration Procedure232
- Ignoring Authorization Information from the Server233
- Enabling MAC Move233
- Enabling the Authorization-Fail-Offline Feature234
- Applying a NAS-ID Profile to Port Security234
- Enabling SNMP Notifications for Port Security235
- Displaying and Maintaining Port Security235
- Port Security Configuration Examples235
- Troubleshooting Port Security244
  - Cannot Set the Port Security Mode244
  - Cannot Configure Secure MAC Addresses244
Configuring User Profiles246
- Overview246
- User Profile Configuration Task List246
- Configuration Restrictions and Guidelines246
- Configuring a User Profile246
- Displaying and Maintaining User Profiles247
- User Profile Configuration Example247
Configuring Password Control252
- Overview252
- FIPS Compliance255
- Password Control Configuration Task List255
- Enabling Password Control256
- Setting Global Password Control Parameters256
- Setting User Group Password Control Parameters257
- Setting Local User Password Control Parameters258
- Setting Super Password Control Parameters259
- Displaying and Maintaining Password Control259
- Password Control Configuration Example260
Configuring Keychains263
- Overview263
- Configuration Procedure263
- Displaying and Maintaining Keychain264
- Keychain Configuration Example264
Managing Public Keys269
- Overview269
- FIPS Compliance269
- Creating a Local Key Pair269
- Distributing a Local Host Public Key271
  - Exporting a Host Public Key271
  - Displaying a Host Public Key271
- Destroying a Local Key Pair272
- Configuring a Peer Host Public Key272
  - Importing a Peer Host Public Key from a Public Key File272
  - Entering a Peer Host Public Key273
- Displaying and Maintaining Public Keys273
- Examples of Public Key Management273
  - Example for Entering a Peer Host Public Key273
  - Example for Importing a Public Key from a Public Key File275
Configuring PKI278
- Overview278
- FIPS Compliance280
- PKI Configuration Task List280
- Configuring a PKI Entity281
- Configuring a PKI Domain281
- Requesting a Certificate283
- Aborting a Certificate Request285
- Obtaining Certificates285
- Verifying PKI Certificates287
  - Verifying Certificates with CRL Checking287
  - Verifying Certificates Without CRL Checking288
- Specifying the Storage Path for the Certificates and Crls288
- Exporting Certificates289
- Removing a Certificate289
- Configuring a Certificate-Based Access Control Policy290
- Displaying and Maintaining PKI291
- PKI Configuration Examples291
- Troubleshooting PKI Configuration307
Configuring Ipsec312
- Overview312
- FIPS Compliance316
- Ipsec Tunnel Establishment316
- Implementing ACL-Based Ipsec316
- Configuring Ipsec for Ipv6 Routing Protocols329
  - Configuration Task List329
  - Configuring a Manual Ipsec Profile330
- Configuring SNMP Notifications for Ipsec331
- Configuring Ipsec Fragmentation331
- Setting the Maximum Number of Ipsec Tunnels332
- Displaying and Maintaining Ipsec332
- Ipsec Configuration Examples333
  - Configuring a Manual Mode Ipsec Tunnel for Ipv4 Packets333
  - Configuring Ipsec for Ripng335
Configuring IKE339
- Overview339
- FIPS Compliance341
- IKE Configuration Prerequisites341
- IKE Configuration Task List341
- Configuring an IKE Profile342
- Configuring an IKE Proposal344
- Configuring an IKE Keychain345
- Configuring the Global Identity Information346
- Configuring the IKE Keepalive Feature346
- Configuring the IKE NAT Keepalive Feature347
- Configuring IKE DPD347
- Enabling Invalid SPI Recovery348
- Setting the Maximum Number of IKE Sas348
- Configuring SNMP Notifications for IKE349
- Displaying and Maintaining IKE349
- IKE Configuration Examples350
  - Configuring an IKE-Based Ipsec Tunnel for Ipv4 Packets350
  - Main Mode IKE with Pre-Shared Key Authentication Configuration Example352
- Troubleshooting IKE355
Configuring Ikev2360
- Overview360
- Ikev2 Configuration Task List361
- Configuring an Ikev2 Profile362
- Configuring an Ikev2 Policy365
- Configuring an Ikev2 Proposal365
- Configuring an Ikev2 Keychain367
- Configure Global Ikev2 Parameters368
- Displaying and Maintaining Ikev2369
- Troubleshooting Ikev2369
Configuring SSH371
- Overview371
- FIPS Compliance373
- Configuring the Device as an SSH Server374
- Configuring the Device as an Stelnet Client380
- Configuring the Device as an SFTP Client384
- Configuring the Device as an SCP Client389
- Specifying Algorithms for SSH2392
- Displaying and Maintaining SSH393
- Stelnet Configuration Examples394
- SFTP Configuration Examples411
- SCP Configuration Examples421
  - SCP Configuration Example with Password Authentication421
  - SCP Configuration Example Based on Suite B Algorithms422
- NETCONF over SSH Configuration Example with Password Authentication429
  - Network Requirements429
  - Verifying the Configuration431
Configuring SSL432
- Overview432
  - SSL Security Services432
  - SSL Protocol Stack432
- FIPS Compliance433
- SSL Configuration Task List433
- Configuring an SSL Server Policy433
- Configuring an SSL Client Policy435
- Displaying and Maintaining SSL437
Configuring Attack Detection and Prevention438
- Overview438
- Attacks that the Device Can Prevent438
- Attack Detection and Prevention Configuration Task List441
- Configuring an Attack Defense Policy442
- Configuring TCP Fragment Attack Prevention449
- Enabling the Login Delay450
- Displaying and Maintaining Attack Detection and Prevention450
- Attack Detection and Prevention Configuration Examples451
  - Attack Defense Policy Device Application Configuration Example451
Configuring TCP Attack Prevention455
- Overview455
- Configuring Naptha Attack Prevention455
Configuring IP Source Guard456
- Overview456
  - Static IPSG Bindings456
  - Dynamic IPSG Bindings457
- IPSG Configuration Task List457
- Configuring the Ipv4Sg Feature458
  - Enabling Ipv4Sg on an Interface458
  - Configuring a Static Ipv4Sg Binding458
- Configuring the Ipv6Sg Feature459
  - Enabling Ipv6Sg on an Interface459
  - Configuring a Static Ipv6Sg Binding460
- Displaying and Maintaining IPSG460
- IPSG Configuration Examples461
Configuring ARP Attack Protection468
- ARP Attack Protection Configuration Task List468
- Configuring Unresolvable IP Attack Protection468
- Configuring ARP Packet Rate Limit470
  - Configuration Guidelines471
  - Configuration Procedure471
- Configuring Source MAC-Based ARP Attack Detection471
- Configuring ARP Packet Source MAC Consistency Check474
- Configuring ARP Active Acknowledgement474
- Configuring Authorized ARP474
- Configuring ARP Attack Detection477
- Configuring ARP Scanning and Fixed ARP485
  - Configuration Restrictions and Guidelines485
  - Configuration Procedure485
- Configuring ARP Gateway Protection485
- Configuring ARP Filtering487
- Configuring ARP Sender IP Address Checking488
Configuring ND Attack Defense490
- Overview490
- ND Attack Defense Configuration Task List490
- Enabling Source MAC Consistency Check for ND Messages490
- Configuring ND Attack Detection491
- Configuring RA Guard494
Configuring Urpf499
- Overview499
- Enabling Urpf502
- Displaying and Maintaining Urpf502
- Global Urpf Configuration Example503
  - Network Requirements503
  - Configuration Procedure503
Configuring Crypto Engines504
- Overview504
- Displaying and Maintaining Crypto Engines504
Configuring FIPS505
- Overview505
- Configuration Restrictions and Guidelines505
- Configuring FIPS Mode506
- FIPS Self-Tests508
- Displaying and Maintaining FIPS510
- FIPS Configuration Examples510
Document Conventions and Icons515
- Conventions515
- Network Topology Icons516
Support and Other Resources517
- Accessing Hewlett Packard Enterprise Support517
- Accessing Updates517
Index520

Other manuals for HPE FlexFabric 5940 SERIES

Fundamentals Command Reference289 pages

Configuration Guide334 pages

Command Reference139 pages

Need help?

Do you have a question about the HPE FlexFabric 5940 SERIES and is the answer not in the manual?

HPE FlexFabric 5940 SERIES Specifications

General

Brand	HPE
Model	FlexFabric 5940 SERIES
Category	Switch
Language	English

Related product manuals

HPE FlexFabric 5950 Series

451 pages

HPE FlexFabric 5710 Series

69 pages

HPE FlexFabric 5700 Series

314 pages

HPE FlexNetwork 5130 EI Series

314 pages

HPE FlexNetwork 5510 HI Series

572 pages

HPE FlexNetwork 5130 HI SERIES

378 pages

FlexNetwork 5130 24G 4SFP+ 1-slot HI

HPE OfficeConnect 1420 Series

26 pages

HPE OfficeConnect 1820 Series

15 pages

HPE FlexFabric 5940 SERIES - User Manual

Table of Contents

Other manuals for HPE FlexFabric 5940 SERIES

HPE FlexFabric 5940 SERIES Specifications

Related product manuals