Operating Notes - HP ProCurve 2910al Access Security Manual

Operating Notes

■ If you configure Authorized IP Managers on the switch, it is not necessary
to include any devices used as TACACS+ servers in the authorized man­
ager list. That is, authentication traffic between a TACACS+ server and
the switch is not subject to Authorized IP Manager controls configured
on the switch. Also, the switch does not attempt TACACS+ authentication
for a management station that the Authorized IP Manager list excludes
because, independent of TACACS+, the switch already denies access to
such stations.
When TACACS+ is not enabled on the switch—or when the switch's only
■
designated TACACS+ servers are not accessible— setting a local Operator
password without also setting a local Manager password does not protect
the switch from manager-level access by unauthorized persons.
When using the copy command to transfer a configuration to a TFTP
■
server, any optional, server-specific and global encryption keys (page 4­
18) in the TACACS configuration will not be included in the transferred
file. Otherwise, a security breach could occur, allowing access to the
TACACS+ username/password information.
TACACS+ Authentication

Operating Notes

4-29