ProCurve 2610 - Web and MAC Authentication; Overview; Client Options; General Features

To Next Page

To Previous Page

ProCurve

Switch 2610 Series

Switch 2610-PWR Series

December 2007

Access Security Guide

Main Page

Table of Contents5
Product Documentation17
Software Feature Index18
Introduction24
Overview of Access Security Features24
Getting Started24
Management Access Security Protection25
General Switch Traffic Security Guidelines26
Command Syntax Statements27
Feature Descriptions by Model27
Conventions27
Command Prompts28
Screen Simulations28
Port Identity Examples28
Sources for more Information29
Need Only a Quick Start30
IP Addressing30
To Set up and Install the Switch in Your Network31
Overview34
Configuring Username and Password Security34
Configuring Local Password Security36
Menu: Setting Passwords36
CLI: Setting Passwords and Usernames37
Web: Setting Passwords and Usernames38
Front-Panel Security39
When Security Is Important39
Front-Panel Button Functions40
Configuring Front-Panel Security42
Password Recovery48
Password Recovery Process50
Web and MAC Authentication53
Contents53
Overview54
Client Options55
General Features56
How Web and MAC Authentication Operate57
Authenticator Operation57
Terminology61
Operating Rules and Notes62
General Setup Procedure for Web/Mac Authentication64
Do These Steps before You Configure Web/Mac Authentication64
Additional Information for Configuring the RADIUS Server to Support MAC Authentication65
Configuring the Switch to Access a RADIUS Server67
Configuring Web Authentication70
Overview70
Configure the Switch for Web-Based Authentication71
Configuring MAC Authentication on the Switch75
Overview75
Configure the Switch for MAC-Based Authentication76
Show Commands for Web-Based Authentication80
Show Commands for MAC-Based Authentication83
Show Client Status85
Contents87
TACACS+ Authentication87
Overview88
Terminology Used in TACACS Applications89
General System Requirements91
General Authentication Setup Procedure91
Before You Begin94
Configuring TACACS+ on the Switch94
CLI Commands Described in this Section95
Viewing the Switch's Current Authentication Configuration95
Viewing the Switch's Current TACACS+ Server Contact96
Configuration96
Configuring the Switch's Authentication Methods96
Configuring the Switch's TACACS+ Server Access103
How Authentication Operates108
General Authentication Process Using a TACACS+ Server108
Local Authentication Process110
Using the Encryption Key111
Controlling Web Browser Interface Access When Using TACACS112
Authentication112
Messages Related to TACACS+ Operation113
Operating Notes114
RADIUS Authentication and Accounting115
Contents115
Overview117
Terminology118
Switch Operating Rules for RADIUS119
General RADIUS Setup Procedure120
Configuring the Switch for RADIUS Authentication121
Outline of the Steps for Configuring RADIUS Authentication122
Configure Authentication for the Access Methods You Want RADIUS to Protect123
Configure the Switch to Access a RADIUS Server126
Configure the Switch's Global RADIUS Parameters128
Local Authentication Process132
Authentication133
Controlling Web Browser Interface Access When Using RADIUS133
Overview133
Configuring RADIUS Authorization133
Controlling Web Browser Interface Access When Using RADIUS Authentication133
Commands Authorization Type134
Enabling Authorization with the CLI134
Showing Authorization Information135
Configuring the RADIUS Server135
- Example Configuration on Cisco Secure Acs for Ms Windows137
- Example Configuration Using Freeradius140
Configuring RADIUS Accounting141
Operating Rules for RADIUS Accounting142
Steps for Configuring RADIUS Accounting143
- Reports to the Radius Server145
- Updating Options147
Viewing RADIUS Statistics148
General RADIUS Statistics148
RADIUS Authentication Statistics150
RADIUS Accounting Statistics151
Changing RADIUS-Server Access Order152
Messages Related to RADIUS Operation154
Configuring RADIUS Server Support for Switch Services155
Contents155
Overview156
Configuring the RADIUS Server for Cos Services157
Viewing the Currently Active Per-Port Cos Configuration Specified by a RADIUS Server157
Configuring and Using RADIUS-Assigned Access Control Lists160
Introduction160
Terminology160
Overview of RADIUS-Assigned, Dynamic Port Acls163
Contrasting Dynamic and Static Acls165
How a RADIUS Server Applies a Dynamic Port ACL166
To a Switch Port166
General ACL Features, Planning, and Configuration167
The Packet-Filtering Process168
Operating Rules for Dynamic Port Acls168
Configuring an ACL in a RADIUS Server169
Configuring ACE Syntax in RADIUS Servers172
Configuring the Switch to Support Dynamic Port174
Acls174
Displaying the Current Dynamic Port ACL Activity175
On the Switch175
Event Log Messages178
Causes of Client Deauthentication Immediately after Authenticating179
Monitoring Shared Resources179
Configuring Secure Shell (SSH)181
Contents181
Overview182
Terminology184
Public Key Formats185
Prerequisite for Using SSH185
Steps for Configuring and Using SSH for Switch and Client Authentication186
General Operating Rules and Notes188
Configuring the Switch for SSH Operation189
Assign Local Login (Operator) and Enable (Manager) Password189
Generate the Switch's Public and Private Key Pair190
Provide the Switch's Public Key to Clients192
Enable SSH on the Switch and Anticipate SSH Client195
Contact Behavior195
Configure the Switch for SSH Authentication198
Use an SSH Client to Access the Switch201
Further Information on SSH Client Public-Key Authentication202
Messages Related to SSH Operation208
Configuring Secure Socket Layer (SSL)211
Contents211
Overview212
Terminology213
Prerequisite for Using SSL215
Steps for Configuring and Using SSL for Switch and Client Authentication215
General Operating Rules and Notes216
Configuring the Switch for SSL Operation217
Assign Local Login (Operator) and Enable (Manager) Password217
Generate the Switch's Server Host Certificate219
Comments on Certificate Fields221
Enable SSL on the Switch and Anticipate SSL Browser Contact227
Behavior231
Common Errors in SSL Setup231
Contents233
Access Control Lists (Acls)233
Optional Network Management Applications235
Introduction235
ACL Applications235
Optional PCM and IDM Applications236
General Application Options236
Introduction236
Terminology238
Overview241
Types of IP Acls241
ACL Inbound Application Points241
Features Common to All Acls242
General Steps for Planning and Configuring Acls243
ACL Operation244
Introduction244
The Packet-Filtering Process245
Planning an ACL Application248
Switch Resource Usage248
Managing ACL Resource Consumption250
Traffic Management and Improved Network Performance254
Security254
Guidelines for Planning the Structure of an ACL255
ACL Configuration and Operating Rules256
How an ACE Uses a Mask to Screen Packets for Matches257
Configuring and Assigning an ACL264
Overview264
ACL Configuration Structure265
ACL Configuration Factors268
Using the CLI to Create an ACL270
Configuring and Assigning a Numbered, Standard ACL271
Configuring and Assigning a Numbered, Extended ACL276
Configuring a Named ACL282
Enabling or Disabling ACL Filtering on an Interface284
Deleting an ACL from the Switch285
Displaying ACL Data286
Display an ACL Summary286
Display the Content of All Acls on the Switch287
Display the ACL Assignments for an Interface288
Displaying the Content of a Specific ACL289
Displaying the Current ACL Resources291
Display All Acls and Their Assignments in292
The Switch Startup-Config File and Running-Config File292
Display All Acls and Their Assignments in the Switch Startup-Config File and Running-Config File292
Using the CLI to Edit Acls292
Editing Acls and Creating an ACL Offline292
Working Offline to Create or Edit an ACL295
Enable ACL "Deny" Logging299
Requirements for Using ACL Logging299
ACL Logging Operation299
Enabling ACL Logging on the Switch300
Operating Notes for ACL Logging302
General ACL Operating Notes303
- Traffic/Security Filters306
Overview306
General Operation306
Applying a Source Port Filter in a Multinetted VLAN307
Using Source-Port Filters308
Operating Rules for Source-Port Filters308
Configuring a Source-Port Filter309
Viewing a Source-Port Filter311
Filter Indexing313
Editing a Source-Port Filter313
Using Named Source-Port Filters314
- Configuring Port-Based and User-Based Access Control (802.1X)325
Contents325
Overview327
Why Use Port-Based or User-Based Access Control327
General Features327
User Authentication Methods328
Terminology330
Example of the Authentication Process333
General 802.1X Authenticator Operation333
VLAN Membership Priority334
General Operating Rules and Notes336
General Setup Procedure for 802.1X Access Control338
Do These Steps before You Configure 802.1X Operation338
Overview: Configuring 802.1X Authentication on the Switch340
Configuring Switch Ports as 802.1X Authenticators341
Enable 802.1X Authentication on Selected Ports342
Reconfigure Settings for Port-Access344
Configure the 802.1X Authentication Method348
Enter the RADIUS Host IP Address(Es)349
Enable 802.1X Authentication on the Switch350
Optional: Reset Authenticator Operation350
Optional: Configure 802.1X Controlled Directions350
802.1X Open VLAN Mode353
Introduction353
VLAN Membership Priorities354
Use Models for 802.1X Open VLAN Modes355
Operating Rules for Authorized-Client and Unauthorized-Client Vlans360
Setting up and Configuring 802.1X Open VLAN Mode364
802.1X Open VLAN Operating Notes368
Option for Authenticator Ports: Configure Port-Security to Allow Only 802.1X-Authenticated Devices369
Port-Security370
Configuring Switch Ports to Operate as Supplicants for 802.1X Connections to Other Switches371
Example371
Supplicant Port Configuration372
Displaying 802.1X Configuration, Statistics, and Counters375
Show Commands for Port-Access Authenticator375
Viewing 802.1X Open VLAN Mode Status378
Show Commands for Port-Access Supplicant381
How RADIUS/802.1X Authentication Affects VLAN Operation382
VLAN Assignment on a Port383
Operating Notes383
Example of Untagged VLAN Assignment in a RADIUS-Based Authentication Session385
Enabling the Use of GVRP-Learned Dynamic Vlans in Authentication Sessions388
Operating Note390
Messages Related to 802.1X Operation391
- Configuring and Monitoring Port Security393
Contents393
Basic Operation394
Overview394
Eavesdrop Protection395
Blocking Unauthorized Traffic395
Trunk Group Exclusion396
Planning Port Security397
Port Security Command Options and Operation398
Retention of Static MAC Addresses402
Displaying Current Port Security Settings402
Configuring Port Security404
MAC Lockdown409
Differences between MAC Lockdown and Port Security411
Deploying MAC Lockdown413
MAC Lockout417
Port Security and MAC Lockout419
Web: Displaying and Configuring Port Security Features419
Reading Intrusion Alerts and Resetting Alert Flags420
Notice of Security Violations420
How the Intrusion Log Operates421
Keeping the Intrusion Log Current by Resetting Alert Flags421
Using the Event Log to Find Intrusion Alerts426
Web: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags427
Operating Notes for Port Security427
- Using Authorized IP Managers429
Contents429
Overview430
Configuration Options431
Access Levels431
Defining Authorized Management Stations432
Overview of IP Mask Operation432
Menu: Viewing and Configuring IP Authorized Managers433
CLI: Viewing and Configuring Authorized IP Managers434
Configuring Ip Authorized Managers for the Switch435
Web: Configuring IP Authorized Managers437
Web Proxy Servers437
Web-Based Help438
Building IP Masks438
Configuring One Station Per Authorized Manager IP Entry438
Configuring Multiple Stations Per Authorized Manager IP Entry439
Additional Examples for Authorizing Multiple Stations441
Operating Notes441

ProCurve 2610 - Web and MAC Authentication; Overview; Client Options; General Features

Table of Contents

Related product manuals