ProCurve 2900 - Page 3

To Next Page

To Previous Page

ProCurve Switch 2900

January 2008

T.13.01

Access Security Guide

Main Page

Table of Contents5
Product Documentation17
About Your Switch Manual Set17
Feature Index18
Security Overview23
Contents23
Introduction25
About this Guide25
Switch Access Security25
For more Information25
Default Configuration Settings and Access Security26
Local Manager Password26
Inbound Telnet Access and Web Browser Access26
SNMP Access (Simple Network Management Protocol)27
Front-Panel Access and Physical Security28
Secure File Transfers28
TACACS+ Authentication29
RADIUS Authentication29
Secure Management VLAN29
Authorized IP Managers29
Other Provisions for Management Access Security29
Network Security Features30
802.1X Access Control30
Web and MAC Authentication30
Secure Shell (SSH)31
Secure Socket Layer (Sslv3/Tlsv1)31
Traffic/Security Filters31
Port Security, MAC Lockdown, and MAC Lockout32
Identity-Driven Manager (IDM)33
Key Management System (KMS)33
Dynamic Configuration Arbiter34
Network Immunity Manager35
Arbitrating Client-Specific Attributes36
Configuring Username and Password Security39
Contents39
Overview41
Configuring Local Password Security44
Menu: Setting Passwords44
CLI: Setting Passwords and Usernames46
Web: Setting Passwords and Usernames47
Benefits of Saving Security Credentials48
Config File48
Saving Security Credentials in a48
Enabling the Storage and Display of Security Credentials49
Security Settings that Can be Saved50
Local Manager and Operator Passwords50
Password Command Options51
SNMP Security Credentials52
802.1X Port-Access Credentials52
TACACS+ Encryption Key Authentication53
RADIUS Shared-Secret Key Authentication54
SSH Client Public-Key Authentication54
Operating Notes57
Restrictions59
Front-Panel Security61
When Security Is Important61
Front-Panel Button Functions62
Clear Button62
Reset Button63
Restoring the Factory Default Configuration63
Configuring Front-Panel Security64
Disabling the Clear Password Function of the Clear Button on the Switch's Front Panel67
Re-Enabling the Clear Button on the Switch's Front Panel and Setting or Changing the "Reset-On-Clear" Operation68
Changing the Operation of the Reset+Clear Combination69
Password Recovery70
Disabling or Re-Enabling the Password Recovery Process70
Password Recovery Process72
Web and MAC Authentication73
Contents73
Overview75
Web Authentication75
MAC Authentication76
Authorized and Unauthorized Client Vlans76
RADIUS-Based Authentication77
Wireless Clients77
How Web and MAC Authentication Operate78
Web-Based Authentication78
Customized Login Web Pages81
MAC-Based Authentication81
Terminology83
Operating Rules and Notes84
Setup Procedure for Web/Mac Authentication86
Before You Configure Web/Mac Authentication86
Configuring the RADIUS Server to Support MAC Authentication89
Using Customized Login Web Pages for Enhanced Web Authentication89
Configuring a DNS Server for Enhanced Web Authentication100
Configuring the Switch to Access a RADIUS Server100
Configuring Web Authentication102
Overview102
Configuration Commands for Web Authentication104
Show Commands for Web Authentication111
Configuring MAC Authentication on the Switch117
Overview117
Configuration Commands for MAC Authentication118
Show Commands for MAC-Based Authentication121
Client Status126
TACACS+ Authentication127
Contents127
Overview128
Terminology Used in TACACS Applications129
General System Requirements131
General Authentication Setup Procedure131
Configuring TACACS+ on the Switch134
Before You Begin134
CLI Commands Described in this Section135
Viewing the Switch's Current Authentication Configuration135
Viewing the Switch's Current TACACS+ Server Contact Configuration136
Configuring the Switch's Authentication Methods136
Using the Privilege-Mode Option for Login137
Authentication Parameters138
Configuring the TACACS+ Server for Single Login139
Configuring the Switch's TACACS+ Server Access144
How Authentication Operates150
General Authentication Process Using a TACACS+ Server150
Local Authentication Process151
Using the Encryption Key152
General Operation152
Encryption Options in the Switch153
Controlling Web Browser Interface Access When Using TACACS+ Authentication154
Messages Related to TACACS+ Operation154
Operating Notes155
RADIUS Authentication and Accounting159
Overview159
Authentication Services159
RADIUS-Administered Cos160
Accounting Services160
Terminology161
Switch Operating Rules for RADIUS162
General RADIUS Setup Procedure163
Configuring the Switch for RADIUS Authentication164
Outline of the Steps for Configuring RADIUS Authentication165
Configure Authentication for the Access Methods You Want RADIUS to Protect166
Enable the (Optional) Access Privilege Option169
Configure the Switch to Access a RADIUS Server170
Configure the Switch's Global RADIUS Parameters173
Local Authentication Process177
Controlling Web Browser Interface Access178
Commands Authorization179
Enabling Authorization180
Displaying Authorization Information181
Configuring Commands Authorization on a RADIUS Server181
Using Vendor Specific Attributes (Vsas)181
Example Configuration on Cisco Secure ACS for MS Windows183
Example Configuration on Cisco Secure ACS for MS Windows 5-27183
Example Configuration Using Freeradius185
VLAN Assignment in an Authentication Session187
Tagged and Untagged VLAN Attributes188
Additional RADIUS Attributes189
Configuring RADIUS Accounting190
Operating Rules for RADIUS Accounting191
Steps for Configuring RADIUS Accounting192
Configure the Switch to Access a RADIUS Server193
Configure Accounting Types and the Controls for Sending Reports to the RADIUS Server194
Optional) Configure Session Blocking and Interim Updating Options196
Viewing RADIUS Statistics198
General RADIUS Statistics198
RADIUS Authentication Statistics200
RADIUS Accounting Statistics201
Changing RADIUS-Server Access Order202
Messages Related to RADIUS Operation205
Configuring Secure Shell (SSH)208
Overview208
Terminology209
Prerequisite for Using SSH211
Public Key Formats211
Steps for Configuring and Using SSH for Switch and Client Authentication212
General Operating Rules and Notes214
Configuring the Switch for SSH Operation215
Enable (Manager) Password215
Assigning a Local Login (Operator) and Enable (Manager) Password215
Generating the Switch's Public and Private Key Pair216
Providing the Switch's Public Key to Clients219
Enabling SSH on the Switch and Anticipating SSH Client Contact Behavior221
Configuring the Switch for SSH Authentication224
Use an SSH Client to Access the Switch228
Further Information on SSH Client Public-Key Authentication228
Messages Related to SSH Operation234
Configuring Secure Socket Layer (SSL)238
Overview238
Terminology239
Prerequisite for Using SSL241
Steps for Configuring and Using SSL for Switch and Client241
Authentication241
General Operating Rules and Notes242
Configuring the Switch for SSL Operation243
Assigning a Local Login (Operator) and Enable (Manager)Password243
Generating the Switch's Server Host Certificate244
To Generate or Erase the Switch's Server Certificate245
With the CLI245
Comments on Certificate Fields246
Generate a Self-Signed Host Certificate with the Web Browser Interface248
Generate a CA-Signed Server Host Certificate with the Web Browser Interface251
Enabling SSL on the Switch and Anticipating SSL Browser Contact Behavior253
Using the CLI Interface to Enable SSL255
Using the Web Browser Interface to Enable SSL255
Common Errors in SSL Setup257
Introduction260
Overview260
Traffic/Security Filters and Monitors260
Filter Limits261
Using Port Trunks with Filters261
Filter Types and Operation261
Source-Port Filters262
Operating Rules for Source-Port Filters262
Example263
Named Source-Port Filters264
Operating Rules for Named Source-Port Filters264
Defining and Configuring Named Source-Port Filters265
Viewing a Named Source-Port Filter267
Using Named Source-Port Filters267
Static Multicast Filters273
Protocol Filters274
Configuring Traffic/Security Filters275
Configuring a Source-Port Traffic Filter276
Example of Creating a Source-Port Filter277
Configuring a Filter on a Port Trunk277
Editing a Source-Port Filter278
Configuring a Multicast or Protocol Traffic Filter279
Filter Indexing280
Displaying Traffic/Security Filters281
Configuring Port-Based and User-Based Access Control (802.1X)283
Contents283
Overview286
Why Use Port-Based or User-Based Access Control286
General Features286
User Authentication Methods287
802.1X User-Based Access Control287
802.1X Port-Based Access Control288
Terminology289
Alternative to Using a RADIUS Server289
Accounting289
General 802.1X Authenticator Operation292
Example of the Authentication Process292
VLAN Membership Priority293
General Operating Rules and Notes295
General Setup Procedure for 802.1X Access Control297
Do These Steps before You Configure 802.1X Operation297
Overview: Configuring 802.1X Authentication on the Switch300
Configuring Switch Ports as 802.1X Authenticators301
Enable 802.1X Authentication on Selected Ports302
Enable the Selected Ports as Authenticators and Enable the (Default) Port-Based Authentication302
Specify User-Based Authentication or Return to Port-Based Authentication303
Example: Configuring User-Based 802.1X Authentication304
Example: Configuring Port-Based 802.1X Authentication304
Reconfigure Settings for Port-Access304
Configure the 802.1X Authentication Method308
Enter the RADIUS Host IP Address(Es)309
Enable 802.1X Authentication on the Switch309
Optional: Configure 802.1X Controlled Directions310
Optional: Reset Authenticator Operation310
Wake-On-LAN Traffic311
Operating Notes311
Example: Configuring 802.1X Controlled Directions312
802.1X Open VLAN Mode313
Introduction313
VLAN Membership Priorities314
Use Models for 802.1X Open VLAN Modes315
Operating Rules for Authorized-Client and Unauthorized-Client Vlans320
Setting up and Configuring 802.1X Open VLAN Mode324
802.1X Open VLAN Operating Notes328
- Option for Authenticator Ports: Configure Port-Security to Allow Only 802.1X-Authenticated Devices329
Port-Security330
Configuring Switch Ports to Operate as Supplicants for 802.1X Connections to Other Switches331
Example331
Supplicant Port Configuration333
Displaying 802.1X Configuration, Statistics, and Counters335
Show Commands for Port-Access Authenticator335
Viewing 802.1X Open VLAN Mode Status344
Show Commands for Port-Access Supplicant346
How RADIUS/802.1X Authentication Affects VLAN Operation347
VLAN Assignment on a Port348
Operating Notes348
Example of Untagged VLAN Assignment in a RADIUS-Based Authentication Session350
Enabling the Use of GVRP-Learned Dynamic Vlans in Authentication Sessions353
Operating Note355
Messages Related to 802.1X Operation356
Configuring and Monitoring Port Security357
Contents357
Overview359
Port Security360
Basic Operation360
Eavesdrop Protection361
Blocking Unauthorized Traffic361
Trunk Group Exclusion362
Planning Port Security363
Port Security Command Options and Operation364
Port Security Display Options364
Configuring Port Security368
Retention of Static Addresses372
MAC Lockdown378
Differences between MAC Lockdown and Port Security379
MAC Lockdown Operating Notes380
Deploying MAC Lockdown381
MAC Lockout385
Port Security and MAC Lockout387
Web: Displaying and Configuring Port Security Features388
Reading Intrusion Alerts and Resetting Alert Flags388
Notice of Security Violations388
How the Intrusion Log Operates389
Keeping the Intrusion Log Current by Resetting Alert Flags390
Menu: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags391
CLI: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags392
- Using the Event Log to Find Intrusion Alerts394
Web: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags395
Operating Notes for Port Security396
Using Authorized IP Managers400
Overview400
Options401
Access Levels401
Defining Authorized Management Stations402
Overview of IP Mask Operation402
Menu: Viewing and Configuring IP Authorized Managers403
Listing the Switch's Current Authorized IP Manager(S)404
CLI: Viewing and Configuring Authorized IP Managers404
Configuring IP Authorized Managers for the Switch405
Web: Configuring IP Authorized Managers407
Web Proxy Servers407
How to Eliminate the Web Proxy Server407
Configuring One Station Per Authorized Manager IP Entry408
Using a Web Proxy Server to Access the Web408
Browser Interface408
Building IP Masks408
Web-Based Help408
Using a Web Proxy Server to Access the Web Browser Interface408
Configuring Multiple Stations Per Authorized Manager IP Entry409
Additional Examples for Authorizing Multiple Stations411
Operating Notes411
Key Management System414
Overview414
Terminology414
Configuring Key Chain Management415
Creating and Deleting Key Chain Entries415
Assigning a Time-Independent Key to a Chain416
Assigning Time-Dependent Keys to a Chain417
- Index421

ProCurve 2900 - Page 3

Table of Contents

Related product manuals