Page 1 6200yl Access Security Guide 5400zl 3500yl ProCurve Switches K.11.XX www.procurve.com...
Page 3 ProCurve Series 5400zl Switches Series 3500yl Switches 6200yl Switch January 2006 K.11.XX Access Security Guide...
Page 4 OpenSSL Project for use in the OpenSSL Toolkit. For more information on OpenSSL, visit The only warranties for HP products and services are set http://www.openssl.org. forth in the express warranty statements accompanying such products and services. Nothing herein should be This product includes cryptographic software written by construed as constituting an additional warranty.
Page 5: Table Of Contents
Contents Product Documentation About Your Switch Manual Set ....... . 1-xv Feature Index .
Page 6 2 Configuring Username and Password Security Contents ............2-1 Overview .
Page 7 General Configuration Guidelines ......3-9 For a network that is relatively attack-free: ..... 3-9 For a network that appears to be under significant attack: .
Page 8 General Setup Procedure for Web/MAC Authentication ..4-12 Do These Steps Before You Configure Web/MAC Authentication . . 4-12 Additional Information for Configuring the RADIUS Server To Support MAC Authentication ..... 4-13 Configuring the Switch To Access a RADIUS Server .
Page 9 General Operation ........5-23 Encryption Options in the Switch .
Page 10 Viewing RADIUS Statistics ........6-29 General RADIUS Statistics .
Page 11 8 Configuring Secure Socket Layer (SSL) Contents ............8-1 Overview .
Page 12 Filter Types and Operation ........9-3 Source-Port Filters .
Page 13 General 802.1X Authenticator Operation ..... . 10-9 Example of the Authentication Process ......10-9 VLAN Membership Priority .
Page 14 Displaying 802.1X Configuration, Statistics, and Counters ..10-46 Show Commands for Port-Access Authenticator ....10-46 Viewing 802.1X Open VLAN Mode Status ..... 10-48 Show Commands for Port-Access Supplicant .
Page 15 Menu: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags ....... . 11-37 CLI: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags .
Page 16 Configuring Key Chain Management ......13-3 Creating and Deleting Key Chain Entries ..... . . 13-3 Assigning a Time-Independent Key to a Chain .
Page 17: Product Documentation
Product Documentation About Your Switch Manual Set The switch manual set includes the following documentation: ■ Read Me First—a printed guide shipped with your switch. Provides software update information, product notes, and other information. Installation and Getting Started Guide—a printed guide shipped with ■...
Page 18: Feature Index
Product Documentation Feature Index Feature Index For the manual set supporting your switch model, the following feature index indicates which manual to consult for information on a given software feature. Feature Management Advanced Multicast Access Traffic Security Configuration Management Routing Guide 802.1Q VLAN Tagging 802.1X Port-Based Priority...
Page 19 Product Documentation Feature Index Feature Management Advanced Multicast Access Traffic Security Configuration Management Routing Guide Factory Default Settings Flow Control (802.3x) File Management File Transfers Friendly Port Names Guaranteed Minimum Bandwidth (GMB) GVRP Identity-Driven Management (IDM) IGMP Interface Access (Telnet, Console/Serial, Web) IP Addressing IP Routing Jumbos Support...
Page 20 Product Documentation Feature Index Feature Management Advanced Multicast Access Traffic Security Configuration Management Routing Guide Network Management Applications (SNMP) OpenView Device Management OSPF Passwords and Password Clear Protection PIM-DM; PIM-SM Ping Port Configuration Port Monitoring Port Security Port Status Port Trunking (LACP) Port-Based Access Control Port-Based Priority (802.1Q) Power over Ethernet (PoE)
Page 21 Product Documentation Feature Index Feature Management Advanced Multicast Access Traffic Security Configuration Management Routing Guide SFLOW SFTP SNMPv3 Software Downloads (SCP/SFTP, TFPT, Xmodem) Source-Port Filters Spanning Tree (STP, RSTP, MSTP) SSHv2 (Secure Shell) Encryption SSL (Secure Socket Layer) Stack Management (3500yl and 6200yl switches only) Syslog System Information TACACS+ Authentication...
Page 22 Product Documentation Feature Index...
Page 23: Getting Started
Getting Started Contents Introduction ..........1-2 Conventions .
Page 24: Introduction
Getting Started Introduction Introduction This Management and Configuration Guide is intended for use with the following switches: ■ ProCurve Switch 5406zl ProCurve Switch 5412zl ■ ■ ProCurve Switch 3500yl-24G-PWR Intelligent Edge ■ ProCurve Switch 3500yl-48G-PWR Intelligent Edge ProCurve Switch 6200yl-24G mGBIC Premium Edge ■...
Page 25: Command Syntax Statements
Getting Started Conventions Command Syntax Statements Syntax: ip < default-gateway < ip-addr >> | routing > Syntax: show interfaces [port-list ] ■ Vertical bars ( | ) separate alternative, mutually exclusive elements. ■ Square brackets ( [ ] ) indicate optional elements. Braces ( <...
Page 26: Screen Simulations
Getting Started Conventions Screen Simulations Displayed Text. Figures containing simulated screen text and command output look like this: ProCurve> show version Image stamp: /sw/code/build/info March 1, 2006 13:43:13 K.11.01 139 ProCurve> Figure 1-1. Example of a Figure Showing a Simulated Screen In some cases, brief command-output sequences appear without figure iden...
Page 27: Sources For More Information
Getting Started Sources for More Information Sources for More Information For additional information about switch operation and features not covered in this guide, consult the following sources: ■ Feature Index—For information on which product manual to consult for a given software feature, refer to the “Feature Index” on page xvi. N o t e For the latest version of all ProCurve switch documentation, including Release Notes covering recently added features, visit the ProCurve Network...
Page 28 Getting Started Sources for More Information Management and Configuration Guide—Use this guide for information ■ on topics such as: • various interfaces available on the switch • memory and configuration operation • interface access • IP addressing • time protocols •...
Page 29: Getting Documentation From The Web
Getting Started Sources for More Information Getting Documentation From the Web 1. Go to the ProCurve Networking web site at http://www.procurve.com Click on Technical support. Click on Product manuals. Click on the product for which you want to view or download a manual. Online Help If you need information on specific parameters in the menu interface, refer to the online help provided in the interface.
Page 30: Need Only A Quick Start
Getting Started Need Only a Quick Start? If you need information on specific features in the ProCurve Web Browser Interface (hereafter referred to as the “web browser interface”), use the online help available for the web browser interface. For more information on web browser Help options, refer to “Online Help for the ProCurve Web Browser Interface”...
Page 31: To Set Up And Install The Switch In Your Network
Getting Started To Set Up and Install the Switch in Your Network To Set Up and Install the Switch in Your Network Physical Installation Use the ProCurve Installation and Getting Started Guide (shipped with the switch) for the following: ■ Notes, cautions, and warnings related to installing and using the switch and its related modules ■...
Page 32: Overview Of Access Security Features
Getting Started Overview of Access Security Features Overview of Access Security Features ■ Virus Throttling (page 3-1): Enables notification of worm-like behavior detected in inbound routed traffic and, depending on how you configure the feature, also throttles or blocks such traffic. This feature also provides a method for allowing legitimate, high connection-rate traffic from a given host while still protecting your network from possibly malicious traffic from other hosts.
Page 33: General Switch Traffic Security Guideline
Getting Started General Switch Traffic Security Guideline Port Security (page 11-1): Enables a switch port to maintain a unique ■ list of MAC addresses defining which specific devices are allowed to access the network through that port. Also enables a port to detect, prevent, and log access attempts by unauthorized devices.
Page 34: Applications For Access Control Lists (Acls)
Getting Started Applications for Access Control Lists (ACLs) Applications for Access Control Lists (ACLs) Layer 3 IP filtering with Access Control Lists (ACLs) enables you to improve network performance and restrict network use by creating policies for: ■ Switch Management Access: Permits or denies in-band management access.
Page 35: Configuring Username And Password Security
Configuring Username and Password Security Contents Contents ............2-1 Overview .
Page 36: Overview
Configuring Username and Password Security Overview Overview Feature Default Menu Set Usernames none — — page 2-8 Set a Password none page 2-5 page 2-7 page 2-8 Delete Password Protection page 2-6 page 2-7 page 2-8 show front-panel-security — page 1-13 —...
Page 37 Configuring Username and Password Security Overview Level Actions Permitted Manager: Access to all console interface areas. This is the default level. That is, if a Manager password has not been set prior to starting the current console session, then anyone having access to the console can access any area of the console interface.
Page 38 Configuring Username and Password Security Overview N o t e The manager and operator passwords and (optional) usernames control access to the menu interface, CLI, and web browser interface. If you configure only a Manager password (with no Operator password), and in a later session the Manager password is not entered correctly in response to a prompt from the switch, then the switch does not allow management access for that session.
Page 39: Configuring Local Password Security
Configuring Username and Password Security Configuring Local Password Security Configuring Local Password Security Menu: Setting Passwords As noted earlier in this section, usernames are optional. Configuring a user- name requires either the CLI or the web browser interface. From the Main Menu select: 3.
Page 40 Configuring Username and Password Security Configuring Local Password Security To Delete Password Protection (Including Recovery from a Lost Password): This procedure deletes all usernames (if configured) and pass- words (Manager and Operator). If you have physical access to the switch, press and hold the Clear button (on the front of the switch) for a minimum of one second to clear all password protection, then enter new passwords as described earlier in this chapter.
Page 41: Cli: Setting Passwords And Usernames
Configuring Username and Password Security Configuring Local Password Security CLI: Setting Passwords and Usernames Commands Used in This Section password See below. Configuring Manager and Operator Passwords. Syntax: [ no ] password <manager | operator > [ user-name ASCII-STR ] [ no ] password <...
Page 42: Web: Setting Passwords And Usernames
Configuring Username and Password Security Front-Panel Security Web: Setting Passwords and Usernames In the web browser interface you can enter passwords and (optional) user- names. To Configure (or Remove) Usernames and Passwords in the Web Browser Interface. Click on the tab.
Page 43: When Security Is Important
Configuring Username and Password Security Front-Panel Security When Security Is Important Some customers require a high level of security for information. Also, the Health Insurance Portability and Accountability Act (HIPAA) of 1996 requires that systems handling and transmitting confidential medical records must be secure.
Page 44: Front-Panel Button Functions
Configuring Username and Password Security Front-Panel Security Front-Panel Button Functions The front panel of the switch includes the Reset button and the Clear button. Reset Button Clear Button Reset Clear Figure 2-4. Front-Panel Button Locations on a ProCurve Series 5400zl Switch Clear Button Pressing the Clear button alone for one second resets the password(s) con- figured on the switch.
Page 45: Reset Button
Configuring Username and Password Security Front-Panel Security Reset Button Pressing the Reset button alone for one second causes the switch to reboot. Reset Clea Figure 2-6. Press and hold the Reset Button for One Second To Reboot the Switch Restoring the Factory Default Configuration You can also use the Reset button together with the Clear button (Reset+Clear) to restore the factory default configuration for the switch.
Page 46: Configuring Front-Panel Security
Configuring Username and Password Security Front-Panel Security Release the Reset button. Reset Clea 4. When the Test LED to the right of the Clear button begins flashing, release the Clear button. Reset Clea It can take approximately 20-25 seconds for the switch to reboot. This process restores the switch configuration to the factory default settings.
Page 47 Configuring Username and Password Security Front-Panel Security • Configure the Clear button to reboot the switch after clearing any local usernames and passwords. This provides an immediate, visual means (plus an Event Log message) for verifying that any usernames and passwords in the switch have been cleared. •...
Page 48: Disabling The Clear Password Function Of The Clear Button On The Switch's Front Panel
Configuring Username and Password Security Front-Panel Security Password Recovery: Shows whether the switch is configured with the ability to recover a lost password. (Refer to “Password Recovery Process” on page 2-20.) (Default: Enabled.) CAUTION: Disabling this option removes the ability to recover a password on the switch.
Page 49 Configuring Username and Password Security Front-Panel Security Indicates the command has disabled the Clear button on the switch’s front panel. In this case the Show command does not include the reset- on-clear status because it is inoperable while the Clear Password functionality is disabled, and must be reconfigured whenever Clear Password is re-enabled .
Page 50: Re-Enabling The Clear Button On The Switch's Front Panel And Setting Or Changing The "Reset-On-Clear" Operation
Configuring Username and Password Security Front-Panel Security Re-Enabling the Clear Button on the Switch’s Front Panel and Setting or Changing the “Reset-On-Clear” Operation Syntax: [no] front-panel-security password-clear reset-on-clear This command does both of the following: • Re-enables the password-clearing function of the Clear button on the switch’s front panel.
Page 51: Changing The Operation Of The Reset+Clear Combination
Configuring Username and Password Security Front-Panel Security Shows password-clear disabled. Enables password-clear, with reset-on- clear disabled by the “no” statement at the beginning of the command. Shows password-clear enabled, with reset-on-clear disabled. Figure 2-9. Example of Re-Enabling the Clear Button’s Default Operation Changing the Operation of the Reset+Clear Combination In their default configuration, using the Reset+Clear buttons in the combina...
Page 52: Password Recovery
Configuring Username and Password Security Front-Panel Security The command to disable the factory-reset operation produces this caution. To complete the command, press [Y]. To abort the command, press [N]. Completes the command to disable the factory reset option. Displays the current front- panel-security configuration, with Factory Reset disabled.
Page 53 Configuring Username and Password Security Front-Panel Security Syntax: [no] front-panel-security password-recovery Enables or (using the “no” form of the command) disables the ability to recover a lost password. When this feature is enabled, the switch allows management access through the password recovery process described below. This provides a method for recovering from a lost manager username (if configured) and password.
Page 54: Password Recovery Process
Configuring Username and Password Security Front-Panel Security Figure 2-11. Example of the Steps for Disabling Password-Recovery Password Recovery Process If you have lost the switch’s manager username/password, but password- recovery is enabled, then you can use the Password Recovery Process to gain management access to the switch with an alternate password supplied by ProCurve.
Page 55 Configuring Username and Password Security Front-Panel Security 2-21...
Page 56 Configuring Username and Password Security Front-Panel Security 2-22...
Page 57: Virus Throttling
Virus Throttling Contents Introduction ..........3-3 General Operation of Connection-Rate Filtering .
Page 58 Virus Throttling Contents Operating Notes ..........3-30 Connection-Rate Log and Trap Messages .
Page 59: Introduction
Virus Throttling Introduction Introduction Feature Default Menu Global Configuration and Sensitivity Disabled — 3-12 — Per-Port Configuration None — 3-13 — Listing and Unblocking Blocked Hosts — 3-18 — Viewing the Current Configuration — 3-16 — Configuring Connection-Rate ACLs None —...
Page 60 Virus Throttling Introduction deployed to hosts, the network remains functional and the overall distribution of the malicious code is limited. Connection-Rate filtering is a countermeasure tool you can use in your inci dent-management program to help detect an manage worm-type IT security threats received in inbound routed traffic.
Page 61: General Operation Of Connection-Rate Filtering
Virus Throttling General Operation of Connection-Rate Filtering General Operation of Connection-Rate Filtering Connection-Rate filtering enables notification of worm-like behavior detected in inbound routed traffic and, depending on how you configure the feature, also throttles or blocks such traffic. This feature also provides a method for allowing legitimate, high connection-rate traffic from a given host while still protecting your network from possibly malicious traffic from other hosts.
Page 62: Sensitivity To Connection Rate Detection
Virus Throttling General Operation of Connection-Rate Filtering Sensitivity to Connection Rate Detection The switch includes a global sensitivity setting that enables adjusting the ability of connection-rate filtering to detect relatively high instances of con nection-rate attempts from a given source. Application Options For the most part, normal network traffic is distinct from the traffic exhibited by malicious agents.
Page 63: Terminology
Virus Throttling Terminology Terminology Bridged Traffic: See “Switched Traffic”, below. DA: The acronym for Destination Address. In an IP packet, this is the destination IP address carried in the header, and identifies the destination intended by the packet’s originator. See also “SA”. Routed Traffic: Traffic moving from an SA in one VLAN to a DA in a different VLAN.
Page 64: Operating Rules
Virus Throttling Operating Rules Operating Rules ■ When configuring or changing the configuration of connection-rate filters in the switch, execute the clear arp command to reset the routing table. Connection-Rate filtering is triggered by inbound IP routed traffic ■ exhibiting high rates of IP connections to new hosts. Inbound switched traffic with high IP connection rates does not trigger connection-rate filtering.
Page 65: General Configuration Guidelines
Virus Throttling General Configuration Guidelines General Configuration Guidelines As stated earlier, connection-rate filtering is triggered only by routed, inbound traffic generating a relatively high number of new IP connection requests from the same host. Thus, for the switch to apply connection-rate filters, IP routing and multiple VLANs with member ports must first be configured.
Page 66: For A Network That Appears To Be Under Significant Attack
Virus Throttling General Configuration Guidelines Note On a given VLAN, to unblock the hosts that have been blocked by the connection-rate feature, use the vlan < vid > connection-rate filter unblock command. 10. Maintain a practice of carefully monitoring the Event Log or configured trap receivers for any sign of high connectivity-rate activity that could indicate an attack by malicious code.
Page 67: Basic Connection-Rate Filtering Configuration
Virus Throttling Basic Connection-Rate Filtering Configuration Basic Connection-Rate Filtering Configuration Command Page Global and Per-Port Configuration connection-rate-filter sensitivity < low | medium | high | aggressive > 3-12 filter connection-rate < port-list > < notify-only | throttle | block > 3-13 show connection-rate-filter <...
Page 68: Enabling Connection-Rate Filtering And Configuring Sensitivity
Virus Throttling Basic Connection-Rate Filtering Configuration Enabling Connection-Rate Filtering and Configuring Sensitivity Syntax: connection-rate-filter sensitivity < low | medium | high | aggressive > no connection-rate-filter This command: Enables connection-rate filtering. ■ ■ Sets the global sensitivity level at which the switch interprets a given host’s attempts to connect to a series of different devices as a possible attack by a malicious agent residing in the host.
Page 69: Configuring The Per-Port Filtering Mode
Virus Throttling Basic Connection-Rate Filtering Configuration Configuring the Per-Port Filtering Mode Syntax: filter connection-rate < port-list > < notify-only | throttle | block > no filter connection-rate < port-list > Configures the per-port policy for responding to detection of a relatively high number of inbound, routed IP connection attempts from a given source.
Page 70: Example Of A Basic Connection-Rate Filtering Configuration
Virus Throttling Basic Connection-Rate Filtering Configuration Example of a Basic Connection-Rate Filtering Configuration Switch 5400zl Switch VLAN 1 15.45.100.1 Server VLAN 10 Switch Server 15.45.200.1 Server VLAN 15 15.45.300.1 Switch Company Intranet Server Figure 3-2. Sample Network Basic Configuration. Suppose that in the sample network, the administra tor wanted to enable connection-rate filtering and configure the following response to high connection-rate traffic on the switch: Ports B1 - B3: Throttle traffic from the transmitting host(s).
Page 71 Virus Throttling Basic Connection-Rate Filtering Configuration Enables connection-rate filtering and sets the sensitivity to “low”. Configures the desired responses to inbound, high connectivity-rate traffic on the various ports. Indicates that connectivity-rate filtering is enabled at the “low” sensitivity setting. Shows the per-port configuration for the currently enabled connectivity-rate filtering.
Page 72: Viewing And Managing Connection-Rate Status
Virus Throttling Basic Connection-Rate Filtering Configuration Viewing and Managing Connection-Rate Status The commands in this section describe how to: View the current connection-rate configuration ■ ■ List the currently blocked hosts Unblock currently blocked hosts (on a per-VLAN basis). ■ Viewing the Connection-Rate Configuration Use the following command to view the basic connection-rate configuration.
Page 73 Virus Throttling Basic Connection-Rate Filtering Configuration To view the complete connection-rate configuration, including any ACLs (page 3-20), use show config (for the startup-config file) or show running (for the running-config file). For example: Entry showing that connection-rate-filtering is enabled and set to “medium” sensitivity.
Page 74: Listing And Unblocking The Currently-Blocked Hosts
Virus Throttling Basic Connection-Rate Filtering Configuration Listing and Unblocking the Currently-Blocked Hosts Syntax: show connection-rate-filter < all-hosts | blocked-hosts | throttled-hosts > all-hosts: Lists, by VLAN membership, all hosts currently detected in a throttling or blocking state, along with a state indicator.
Page 75 Virus Throttling Basic Connection-Rate Filtering Configuration Note ProCurve recommends that, before you unblock a host that has been blocked by connection-rate filtering, you inspect the host with current antivirus tools and remove any malicious agents that pose a threat to your network. If a trusted host frequently triggers connection-rate blocking with legitimate, high connection-rate traffic, then you may want to consider either changing the sensitivity level on the associated port or configuring a connection-rate...
Page 76: Configuring And Applying Connection-Rate Acls
Virus Throttling Configuring and Applying Connection-Rate ACLs Configuring and Applying Connection- Rate ACLs Command Page ip access-list connection-rate-filter < crf-list-name > 3-22, 3-23 < filter | ignore > ip < any | host < ip-addr > | ip-addr < mask >> 3-22 <...
Page 77: Connection-Rate Acl Operation
Virus Throttling Configuring and Applying Connection-Rate ACLs Note Connection-Rate ACLs are a special case of the switch’s ACL feature. If you need information on other applications of ACLs or more detailed information on how ACLs operate, refer to the chapter titled “Access Control Lists (ACLs)” in the Advanced Traffic Management Guide for your switch.
Page 78: Configuring A Connection-Rate Acl Using Source Ip Address Criteria
Virus Throttling Configuring and Applying Connection-Rate ACLs Configuring a Connection-Rate ACL Using Source IP Address Criteria (To configure a connection-rate ACL using UDP/TCP criteria, go to page 3-23.) Syntax: ip access-list connection-rate-filter < crf-list-name > Creates a connection-rate-filter ACL and puts the CLI into the access control entry (ACE) context: ProCurve(config-crf-nacl)# If the ACL already exists, this command simply puts the...
Page 79: Configuring A Connection-Rate Acl Using Udp/Tcp Criteria
Virus Throttling Configuring and Applying Connection-Rate ACLs Configuring a Connection-Rate ACL Using UDP/TCP Criteria (To configure a connection-rate ACL using source IP address criteria, turn to page 3-22.) Syntax: ip access-list connection-rate-filter < crf-list-name > Creates a connection-rate-filter ACL and puts the CLI into the access control entry (ACE) context: ProCurve(config-crf-nacl)# If the ACL already exists, this command simply puts...
Page 80 Virus Throttling Configuring and Applying Connection-Rate ACLs ip-addr < mask-length >: Applies the ACEs action (filter or ignore) to IP traffic having an SA within the range defined by either: < src-ip-addr/cidr-mask-bits> <src-ip-addr < mask >> Use this criterion for traffic received from either a subnet or a group of IP addresses.
Page 81 Virus Throttling Configuring and Applying Connection-Rate ACLs < tcp-data > or < udp-data > TCP or UDP Port Number or (Well- Known) Port Name: Use the TCP or UDP port number required for the desired match. The switch also accepts certain well-known TCP or UDP port names as alternates to their corre...
Page 82: Applying Connection-Rate Acls
Virus Throttling Configuring and Applying Connection-Rate ACLs Applying Connection-Rate ACLs To apply a connection-rate ACL, use the access group command described below. Note that this command differs from the access group command for non-connection-rate ACLs. Syntax: [no] vlan < vid > ip access-group < crf-list-name > connection-rate-filter This command applies a connection-rate access control list (ACL) to inbound traffic on ports in the specified VLAN that are configured for connection-rate filtering.
Page 83: Example Of Using An Acl In A Connection-Rate Configuration
Virus Throttling Configuring and Applying Connection-Rate ACLs For more on ACE masks, refer to “How an ACE Uses a Mask To Screen Packets for Matches” in the chapter titled “Access Control Lists” in the Advanced Traffic Management Guide for your switch. Example of Using an ACL in a Connection-Rate Configuration This example adds connection-rate ACLs to the basic example on page 3-14.
Page 84 Virus Throttling Configuring and Applying Connection-Rate ACLs The administrator needs to maintain blocking protection from the “Company Intranet” while allowing access to the server at 15.45.50.17. Because the server is carefully maintained as a trusted device, the administrator’s solution is to configure a connection-rate ACL that causes the switch to ignore (circumvent) connection-rate filtering for inbound traffic from the server, while maintaining the filtering for all other inbound routed traffic on port D2.
Page 85 Virus Throttling Configuring and Applying Connection-Rate ACLs The new switch configuration includes the ACL configured in figure 3-11. Shows the assignment of the above connection-rate ACL to VLAN 15. Figure 3-12. Example of Switch Configuration Display with a Connection-Rate ACL 3-29...
Page 86: Operating Notes
Virus Throttling Operating Notes Operating Notes ■ Ace Types: A connection-rate ACL allows you to configure two types of ACEs (Access Control Entries): ignore < source-criteria >: This ACE type directs the switch to permit • all inbound traffic meeting the configured < source-criteria > without filtering the traffic through the connection-rate policy configured on the port through which the traffic entered the switch.
Page 87: Connection-Rate Log And Trap Messages
Virus Throttling Connection-Rate Log and Trap Messages Monitoring Shared Resources: Active instances of throttling or ■ blocking a client that is generating a high rate of connection requests uses internal routing switch resources that are shared with several other features. The routing switch provides ample resources for all features.
Page 88 Virus Throttling Connection-Rate Log and Trap Messages — This page is intentionally unused. — 3-32...
Page 89: Web And Mac Authentication
Web and MAC Authentication Contents Overview ........... . . 4-2 Client Options .
Page 90: Overview
Web and MAC Authentication Overview Overview Feature Default Menu Configure Web Authentication — 4-17 — Configure MAC Authentication — 4-22 — Display Web Authentication Status and Configuration — 4-26 — Display MAC Authentication Status and Configuration — 4-27 — Web and MAC Authentication are designed for employment on the “edge” of a network to provide port-based security measures for protecting private networks and the switch itself from unauthorized access.
Page 91: Client Options
Web and MAC Authentication Overview password, and grants or denies network access in the same way that it does for clients capable of interactive logons. (The process does not use either a client device configuration or a logon session.) MAC authentication is well- suited for clients that are not capable of providing interactive logons, such as telephones, printers, and wireless access points.
Page 92 Web and MAC Authentication Overview On a port configured for Web or MAC Authentication, the switch ■ operates as a port-access authenticator using a RADIUS server and the CHAP protocol. Inbound traffic is processed by the switch alone, until authentication occurs. Some traffic from the switch is available to an unauthorized client (for example, broadcast or unknown desti...
Page 93: How Web And Mac Authentication Operate
Web and MAC Authentication How Web and MAC Authentication Operate How Web and MAC Authentication Operate Authenticator Operation Before gaining access to the network clients first present their authentication credentials to the switch. The switch then verifies the supplied credentials with a RADIUS authentication server.
Page 94 Web and MAC Authentication How Web and MAC Authentication Operate Figure 4-2. Progress Message During Authentication If the client is authenticated and the maximum number of clients allowed on the port (client-limit) has not been reached, the port is assigned to a static, untagged VLAN for network access.
Page 95: Mac-Based Authentication
Web and MAC Authentication How Web and MAC Authentication Operate moves have not been enabled (client-moves) on the ports, the session ends and the client must reauthenticate for network access. At the end of the session the port returns to its pre-authentication state. Any changes to the port’s VLAN memberships made while it is an authorized port take affect at the end of the session.
Page 96 Web and MAC Authentication How Web and MAC Authentication Operate 4. If neither 1, 2, or 3, above, apply, then the client session does not have access to any statically configured, untagged VLANs and client access is blocked. The assigned port VLAN remains in place until the session ends. Clients may be forced to reauthenticate after a fixed period of time (reauth-period) or at any time during a session (reauthenticate).
Page 97: Terminology
Web and MAC Authentication Terminology Terminology Authorized-Client VLAN: Like the Unauthorized-Client VLAN, this is a conventional, static, untagged, port-based VLAN previously configured on the switch by the System Administrator. The intent in using this VLAN is to provide authenticated clients with network access and services. When the client connection terminates, the port drops its membership in this VLAN.
Page 98: Operating Rules And Notes
Web and MAC Authentication Operating Rules and Notes Operating Rules and Notes ■ The switch supports concurrent 802.1X and either Web- or MAC- authentication operation on a port (with up to 32 clients allowed). However, concurrent operation of Web- or MAC-authentication with other types of authentication on the same port is not supported.
Page 99 Web and MAC Authentication Operating Rules and Notes • During an authenticated client session, the following hierarchy deter- mines a port’s VLAN membership: 1. If there is a RADIUS-assigned VLAN, then, for the duration of the client session, the port belongs to this VLAN and temporarily drops all other VLAN memberships.
Page 100: General Setup Procedure For Web/Mac Authentication
Web and MAC Authentication General Setup Procedure for Web/MAC Authentication Web- or MAC-based authentication and LACP cannot both be enabled ■ on the same port. N o t e o n Web / The switch does not allow Web or MAC Authentication and LACP to both be M A C enabled at the same time on the same port.
Page 101: Additional Information For Configuring The Radius Server To Support Mac Authentication
Web and MAC Authentication General Setup Procedure for Web/MAC Authentication c. If there is neither a RADIUS-assigned VLAN or an “Authorized VLAN” for an authenticated client session on a port, then the port’s VLAN membership remains unchanged during authenticated client ses sions.
Page 102: Configuring The Switch To Access A Radius Server
Web and MAC Authentication Configuring the Switch To Access a RADIUS Server Configure the client device’s (hexadecimal) MAC address as both ■ username and password. Be careful to configure the switch to use the same format that the RADIUS server uses. Otherwise, the server will deny access.
Page 103: Configuring The Switch To Access A Radius Server
Web and MAC Authentication Configuring the Switch To Access a RADIUS Server Syntax: [no] radius-server [host < ip-address >] Adds a server to the RADIUS configuration or (with no) deletes a server from the configuration. You can config ure up to three RADIUS server addresses. The switch uses the first server it successfully accesses.
Page 104 Web and MAC Authentication Configuring the Switch To Access a RADIUS Server For example, to configure the switch to access a RADIUS server at IP address 192.168.32.11 using a server specific shared secret key of ‘1A7rd’ Figure 4-4. Example of Configuring a Switch To Access a RADIUS Server 4-16...
Page 105: Configuring Web Authentication On The Switch
Web and MAC Authentication Configuring Web Authentication on the Switch Configuring Web Authentication on the Switch Overview 1. If you have not already done so, configure a local username and password pair on the switch. 2. Identify or create a redirect URL for use by authenticated clients. ProCurve recommends that you provide a redirect URL when using Web Authentication.
Page 106: Configure The Switch For Web-Based Authentication
Web and MAC Authentication Configuring Web Authentication on the Switch Configure the Switch for Web-Based Authentication Command Page Configuration Level aaa port-access web-based dhcp-addr 4-18 aaa port-access web-based dhcp-lease 4-18 [no] aaa port-access web-based [e] < port-list > 4-19 [auth-vid] 4-19 [client-limit] 4-19...
Page 107 Web and MAC Authentication Configuring Web Authentication on the Switch Syntax: [no] aaa port-access web-based [e] < port-list> Enables web-based authentication on the specified ports. Use the no form of the command to disable web- based authentication on the specified ports. Syntax: aaa port-access web-based [e] <...
Page 108 Web and MAC Authentication Configuring Web Authentication on the Switch aaa port-access web-based [e] < port-list > Syntax: [logoff-period] <60-9999999>] Specifies the period, in seconds, that the switch enforces for an implicit logoff. This parameter is equivalent to the MAC age interval in a traditional switch sense.
Page 109 Web and MAC Authentication Configuring Web Authentication on the Switch Syntax: aaa port-access web-based [e] < port-list > [redirect-url <url>] no aaa port-access web-based [e] < port-list > [redirect-url] Specifies the URL that a user is redirected to after a successful login.
Page 110: Configuring Mac Authentication On The Switch
Web and MAC Authentication Configuring MAC Authentication on the Switch Syntax: aaa port-access web-based [e] < port-list > [unauth-vid <vid> ] no aaa port-access web-based [e] < port-list > [unauth-vid] Specifies the VLAN to use for a client that fails authen tication.
Page 111: Configure The Switch For Mac-Based Authentication
Web and MAC Authentication Configuring MAC Authentication on the Switch Configure the Switch for MAC-Based Authentication Command Page Configuration Level aaa port-access mac-based addr-format 4-23 [no] aaa port-access mac-based [e] < port-list > 4-23 [addr-limit] 4-24 [addr-moves] 4-24 [auth-vid] 4-24 [logoff-period] 4-24 [max-requests]...
Page 112 Web and MAC Authentication Configuring MAC Authentication on the Switch Syntax: aaa port-access mac-based [e] < port-list > [addr-limit <1-32>] Specifies the maximum number of authenticated MACs to allow on the port. (Default: 1) Note: On switches where MAC Auth and 802.1X can operate concurrently, this limit includes the total number of clients authenticated through both methods.
Page 113 Web and MAC Authentication Configuring MAC Authentication on the Switch Syntax: aaa port-access mac-based [e] < port-list > [quiet-period <1 - 65535>] Specifies the time period, in seconds, the switch should wait before attempting an authentication request for a MAC address that failed authentication. (Default: 60 seconds) Syntax: aaa port-access mac-based [e] <...
Page 114: Show Status And Configuration Of Web-Based Authentication
Web and MAC Authentication Show Status and Configuration of Web-Based Authentication Show Status and Configuration of Web- Based Authentication Command Page port-list show port-access [ ] web-based 4-26 [clients] 4-26 [config] 4-26 [config [auth-server]] 4-27 [config [web-server]] 4-27 port-list show port-access web-based config detail 4-27 Syntax:...
Page 115: Show Status And Configuration Of Mac-Based Authentication
Web and MAC Authentication Show Status and Configuration of MAC-Based Authentication Syntax: show port-access [port-list] web-based [config [auth-server]] Shows Web Authentication settings for all ports or the specified ports, along with the RADIUS server specific settings for the timeout wait, the number of timeout failures before authentication fails, and the length of time between authentication requests.
Page 116 Web and MAC Authentication Show Status and Configuration of MAC-Based Authentication Syntax: show port-access [port-list] mac-based [clients]] Shows the port address, MAC address, session status, and elapsed session time for attached clients on all ports or the specified ports. Ports with multiple clients have an entry for each attached client.
Page 117: Client Status
Web and MAC Authentication Client Status Client Status The table below shows the possible client status information that may be reported by a Web-based or MAC-based ‘show... clients’ command. Reported Status Available Network Possible Explanations Connection authenticated Authorized VLAN Client authenticated. Remains connected until logoff-period or reauth-period expires.
Page 118 Web and MAC Authentication Client Status —This page intentionally unused— 4-30...
Page 119: Tacacs+ Authentication
TACACS+ Authentication Contents Overview ........... . . 5-2 Terminology Used in TACACS Applications: .
Page 120: Overview
TACACS+ Authentication Overview Overview Feature Default Menu view the switch’s authentication configuration — page 5-9 — view the switch’s TACACS+ server contact — page — configuration 5-10 configure the switch’s authentication methods disabled — page — 5-11 configure the switch to contact TACACS+ server(s) disabled —...
Page 121: Terminology Used In Tacacs Applications
TACACS+ Authentication Terminology Used in TACACS Applications: TACACS+ server for authentication services. If the switch fails to connect to any TACACS+ server, it defaults to its own locally assigned passwords for authentication control if it has been configured to do so. For both Console and Telnet access you can configure a login (read-only) and an enable (read/ write) privilege level access.
Page 122 TACACS+ Authentication Terminology Used in TACACS Applications: face. (Using the menu interface you can assign a local password, but not a username.) Because this method assigns passwords to the switch instead of to individuals who access the switch, you must distribute the password information on each switch to everyone who needs to access the switch, and you must configure and manage password protection on a per-switch basis.
Page 123: General System Requirements
TACACS+ Authentication General System Requirements General System Requirements To use TACACS+ authentication, you need the following: A TACACS+ server application installed and configured on one or ■ more servers or management stations in your network. (There are several TACACS+ software packages available.) A switch configured for TACACS+ authentication, with access to one ■...
Page 124: General Authentication Setup Procedure
TACACS+ Authentication General Authentication Setup Procedure other access type (console, in this case) open in case the Telnet access fails due to a configuration problem. The following procedure outlines a general setup procedure. Note If a complete access lockout occurs on the switch as a result of a TACACS+ configuration, see “Troubleshooting TACACS+ Operation”...
Page 125 TACACS+ Authentication General Authentication Setup Procedure N o t e o n When a TACACS+ server authenticates an access request from a switch, Privil ege Levels it includes a privilege level code for the switch to use in determining which privilege level to grant to the terminal requesting access.
Page 126: Configuring Tacacs+ On The Switch
TACACS+ Authentication Configuring TACACS+ on the Switch configuration in your TACACS+ server application for mis-configura tions or missing data that could affect the server’s interoperation with the switch. 8. After your testing shows that Telnet access using the TACACS+ server is working properly, configure your TACACS+ server application for console access.
Page 127: Cli Commands Described In This Section
TACACS+ Authentication Configuring TACACS+ on the Switch CLI Commands Described in this Section Command Page show authentication 5-9 show tacacs 5-10 aaa authentication 5-11 through 5-14 console Telnet num-attempts <1-10 > tacacs-server 5-15 host < ip-addr > 5-15 5-19 timeout < 1-255 > 5-20 Viewing the Switch’s Current Authentication Configuration...
Page 128: Viewing The Switch's Current Tacacs+ Server Contact Configuration
TACACS+ Authentication Configuring TACACS+ on the Switch Viewing the Switch’s Current TACACS+ Server Contact Configuration This command lists the timeout period, encryption key, and the IP addresses of the first-choice and backup TACACS+ servers the switch can contact. Syntax: show tacacs For example, if the switch was configured for a first-choice and two backup TACACS+ server addresses, the default timeout period, and paris-1 for a (global) encryption key, show tacacs would produce a listing similar to the...
Page 129: Configuring The Switch's Authentication Methods
TACACS+ Authentication Configuring TACACS+ on the Switch Configuring the Switch’s Authentication Methods The aaa authentication command configures the access control for console port and Telnet access to the switch. That is, for both access methods, aaa authentication specifies whether to use a TACACS+ server or the switch’s local authentication, or (for some secondary scenarios) no authentication (meaning that if the primary method fails, authentication is denied).
Page 130 TACACS+ Authentication Configuring TACACS+ on the Switch Table 5-1. AAA Authentication Parameters Name Default Range Function console Specifies whether the command is configuring authentication for the console port - or - or Telnet access method for the switch. telnet enable Specifies the privilege level for the access method being configured.
Page 131 TACACS+ Authentication Configuring TACACS+ on the Switch Table 5-2. Primary/Secondary Authentication Table Access Method and Authentication Options Effect on Access Attempts Privilege Level Primary Secondary Console — Login local none* Local username/password access only. tacacs local If Tacacs+ server unavailable, uses local username/password access. Console —...
Page 132 TACACS+ Authentication Configuring TACACS+ on the Switch For example, here is a set of access options and the corresponding commands to configure them: Console Login (Operator or Read-Only) Access: Primary using TACACS+ server. Secondary using Local. ProCurve (config)# aaa authentication console login tacacs local Console Enable (Manager or Read/Write) Access: Primary using TACACS+ server.
Page 133: Configuring The Switch's Tacacs+ Server Access
TACACS+ Authentication Configuring TACACS+ on the Switch Configuring the Switch’s TACACS+ Server Access The tacacs-server command configures these parameters: The host IP address(es) for up to three TACACS+ servers; one first- ■ choice and up to two backups. Designating backup servers provides for a continuation of authentication services in case the switch is unable to contact the first-choice server.
Page 134 TACACS+ Authentication Configuring TACACS+ on the Switch Syntax: tacacs-server host < ip-addr > [key < key-string >] Adds a TACACS+ server and optionally assigns a server-specific encryption key [no] tacacs-server host < ip-addr > Removes a TACACS+ server assignment (including its server- specific encryption key, if any) tacacs-server key <key-string>...
Page 135 TACACS+ Authentication Configuring TACACS+ on the Switch Name Default Range host <ip-addr> [key <key-string> none Specifies the IP address of a device running a TACACS+ server application. Optionally, can also specify the unique, per- server encryption key to use when each assigned server has its own, unique key. For more on the encryption key, see “Using the Encryption Key”...
Page 136 TACACS+ Authentication Configuring TACACS+ on the Switch Name Default Range key <key-string> none (null) n/a Specifies the optional, global “encryption key” that is also assigned in the TACACS+ server(s) that the switch will access for authentication. This option is subordinate to any “per-server” encryption keys you assign, and applies only to accessing TACACS+ servers for which you have not given the switch a “per-server”...
Page 137 TACACS+ Authentication Configuring TACACS+ on the Switch The “10” server is now the “first-choice” TACACS+ authentication device. Figure 5-5. Example of the Switch After Assigning a Different “First-Choice” Server To remove the 10.28.227.15 device as a TACACS+ server, you would use this command: ProCurve(config)# no tacacs-server host 10.28.227.15 Configuring an Encryption Key.
Page 138: How Authentication Operates
TACACS+ Authentication How Authentication Operates To delete a per-server encryption key in the switch, re-enter the tacacs-server host command without the key parameter. For example, if you have north01 configured as the encryption key for a TACACS+ server with an IP address of 10.28.227.104 and you want to eliminate the key, you would use this command: ProCurve(config)# tacacs-server host 10.28.227.104 Note...
Page 139 TACACS+ Authentication How Authentication Operates Using figure 5-6, above, after either switch detects an operator’s logon request from a remote or directly connected terminal, the following events occur: 1. The switch queries the first-choice TACACS+ server for authentication of the request. •...
Page 140: Local Authentication Process
TACACS+ Authentication How Authentication Operates Local Authentication Process When the switch is configured to use TACACS+, it reverts to local authentica tion only if one of these two conditions exists: “Local” is the authentication option for the access method being used. ■...
Page 141: Using The Encryption Key
TACACS+ Authentication How Authentication Operates Using the Encryption Key General Operation When used, the encryption key (sometimes termed “key”, “secret key”, or “secret”) helps to prevent unauthorized intruders on the network from reading username and password information in TACACS+ packets moving between the switch and a TACACS+ server.
Page 142: Controlling Web Browser Interface
TACACS+ Authentication Controlling Web Browser Interface Access When Using TACACS+ Authentication For example, you would use the next command to configure a global encryp tion key in the switch to match a key entered as in two target north40campus TACACS+ servers. (That is, both servers use the same key for your switch.) Note that you do not need the server IP addresses to configure a global key in the switch: ProCurve(config)# tacacs-server key north40campus...
Page 143: Messages Related To Tacacs+ Operation
TACACS+ Authentication Messages Related to TACACS+ Operation Messages Related to TACACS+ Operation The switch generates the CLI messages listed below. However, you may see other messages generated in your TACACS+ server application. For informa tion on such messages, refer to the documentation you received with the application.
Page 144 TACACS+ Authentication Operating Notes When TACACS+ is not enabled on the switch—or when the switch’s ■ only designated TACACS+ servers are not accessible— setting a local Operator password without also setting a local Manager password does not protect the switch from manager-level access by unautho rized persons.) 5-26...
Page 145 RADIUS Authentication and Accounting Contents Overview ........... . . 6-3 Authentication Services .
Page 146 RADIUS Authentication and Accounting Contents RADIUS Accounting Statistics ....... . 6-32 Changing RADIUS-Server Access Order .
Page 147: Overview
RADIUS Authentication and Accounting Overview Overview Feature Default Menu Configuring RADIUS Authentication None Configuring RADIUS Accounting None 6-21 Viewing RADIUS Statistics 6-29 RADIUS (Remote Authentication Dial-In User Service) enables you to use up to three servers (one primary server and one or two backups) and maintain separate authentication and accounting for each RADIUS server employed.
Page 148: Accounting Services
RADIUS Authentication and Accounting Terminology Note The switch does not support RADIUS security for SNMP (network manage ment) access. For information on blocking access through the web browser interface, refer to “Controlling Web Browser Interface Access” on page 6-20. Accounting Services RADIUS accounting on the switch collects resource consumption data and forwards it to the RADIUS server.
Page 149: Switch Operating Rules For Radius
RADIUS Authentication and Accounting Switch Operating Rules for RADIUS NAS (Network Access Server): In this case, a ProCurve switch configured for RADIUS security operation. RADIUS (Remote Authentication Dial In User Service): RADIUS Client: The device that passes user information to designated RADIUS servers.
Page 150 RADIUS Authentication and Accounting Switch Operating Rules for RADIUS When this type of failure occurs, the switch prompts the client again to enter a username and password. In this case, use the local user- name (if any) and password configured on the switch itself. ■...
Page 151: General Radius Setup Procedure
RADIUS Authentication and Accounting General RADIUS Setup Procedure General RADIUS Setup Procedure Preparation: 1. Configure one to three RADIUS servers to support the switch. (That is, one primary server and one or two backups.) Refer to the documentation provided with the RADIUS server application. Before configuring the switch, collect the information outlined below.
Page 152: Configuring The Switch For Radius Authentication
RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication • Determine how many times you want the switch to try contacting a RADIUS server before trying another RADIUS server or quitting. (This depends on how many RADIUS servers you have configured the switch to access.) •...
Page 153: Outline Of The Steps For Configuring Radius Authentication
RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication Outline of the Steps for Configuring RADIUS Authentication There are three main steps to configuring RADIUS authentication: 1. Configure RADIUS authentication for controlling access through one or more of the following •...
Page 154: Configure Authentication For The Access Methods
RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication • Timeout Period: The timeout period the switch waits for a RADIUS server to reply. (Default: 5 seconds; range: 1 to 15 seconds.) • Retransmit Attempts: The number of retries when there is no server response to a RADIUS authentication request.
Page 155 RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication radius (or tacacs) for primary authentication, you must configure local for the secondary method. This prevents the possibility of being completely locked out of the switch in the event that all primary access methods fail. Syntax: aaa authentication <...
Page 156: Enable The (Optional) Access Privilege Option
RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication 2. Enable the (Optional) Access Privilege Option In the default RADIUS operation, the switch automatically admits any authen ticated client to the Login (Operator) privilege level, even if the RADIUS server specifies Enable (Manager) access for that client.
Page 157: Configure The Switch To Access A Radius Server
RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication — Continued from the preceding page. — The no form of the command returns the switch to the default RADIUS authentication operation. The default behavior for most interfaces is that a client authorized by the RADIUS server for Enable (Manager) access will be prompted twice, once for Login (Operator) access and once for Enable access.
Page 158 RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication [acct-port < port-number >] Optional. Changes the UDP destination port for account ing requests to the specified RADIUS server. If you do not use this option with the radius-server host command, the switch automatically assigns the default accounting port number.
Page 159: Configure The Switch's Global Radius Parameters
RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication Figure 6-3. Sample Configuration for RADIUS Server Before Changing the Key and Adding Another Server To make the changes listed prior to figure 6-3, you would do the following: Changes the key for the existing server to “source0127”...
Page 160 RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication Global server key: The server key the switch will use for contacts ■ with all RADIUS servers for which there is not a server-specific key configured by radius-server host < ip-address > key < key-string >. This key is optional if you configure a server-specific key for each RADIUS server entered in the switch.
Page 161 RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication radius-server retransmit < 1 - 5 > If a RADIUS server fails to respond to an authentica tion request, specifies how many retries to attempt before closing the session. Default: 3; Range: 1 - 5) Note Where the switch has multiple RADIUS servers configured to support authen...
Page 162 RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication Note: The Webui access task shown in this figure is available only on the switches covered in this guide. After two attempts failing due to username or password entry errors, the switch will terminate the session.
Page 163: Local Authentication Process
RADIUS Authentication and Accounting Local Authentication Process Local Authentication Process When the switch is configured to use RADIUS, it reverts to local authentication only if one of these two conditions exists: Local is the authentication option for the access method being used. ■...
Page 164: Controlling Web Browser Interface Access
RADIUS Authentication and Accounting Controlling Web Browser Interface Access Controlling Web Browser Interface Access To help prevent unauthorized access through the web browser interface, do one or more of the following: ■ Configure the switch to support RADIUS authentication for web browser interface access.
Page 165: Configuring Radius Accounting
RADIUS Authentication and Accounting Configuring RADIUS Accounting Configuring RADIUS Accounting RADIUS Accounting Commands Page [no] radius-server host < ip-address > 6-23 [acct-port < port-number >] 6-23 [key < key-string >] 6-23 [no] aaa accounting < exec | network | system > 6-27 <...
Page 166: Operating Rules For Radius Accounting
RADIUS Authentication and Accounting Configuring RADIUS Accounting Exec accounting: Provides records holding the information listed ■ below about login sessions (console, Telnet, and SSH) on the switch: • Acct-Session-Id • Acct-Delay-Time • NAS-IP-Address • Acct-Status-Type • Acct-Session-Time • NAS-Identifier • Acct-Terminate-Cause •...
Page 167: Steps For Configuring Radius Accounting
RADIUS Authentication and Accounting Configuring RADIUS Accounting Steps for Configuring RADIUS Accounting Configure the switch for accessing a RADIUS server. You can configure a list of up to three RADIUS servers (one primary, two backup). The switch operates on the assumption that a server can operate in both accounting and authentication mode.
Page 168 RADIUS Authentication and Accounting Configuring RADIUS Accounting changed, or you need to specify a non-default UDP destination port for accounting requests. Note that switch operation expects a RADIUS server to accommodate both authentication and accounting. Syntax: [no] radius-server host < ip-address > Adds a server to the RADIUS configuration or (with no) deletes a server from the configuration.
Page 169: Configure Accounting Types And The Controls For Sending Reports To The Radius Server
RADIUS Authentication and Accounting Configuring RADIUS Accounting For example, suppose you want to the switch to use the RADIUS server described below for both authentication and accounting purposes. IP address: 10.33.18.151 ■ ■ A non-default UDP port number of 1750 for accounting. For this example, assume that all other RADIUS authentication parameters for accessing this server are acceptable at their default settings, and that RADIUS is already configured as an authentication method for one or more...
Page 170 RADIUS Authentication and Accounting Configuring RADIUS Accounting Note that there is no time span associated with using the system option. It simply causes the switch to transmit whatever accounting data it cur rently has when one of the above events occurs. Network: Use Network if you want to collect accounting information ■...
Page 171: Optional) Configure Session Blocking And Interim Updating Options
RADIUS Authentication and Accounting Configuring RADIUS Accounting For example, to configure RADIUS accounting on the switch with start-stop for exec functions and stop-only for system functions: Configures exec and system accounting and controls. Summarizes the switch’s accounting configuration. Exec and System accounting are active.
Page 172 RADIUS Authentication and Accounting Configuring RADIUS Accounting To continue the example in figure 6-8, suppose that you wanted the switch to: Send updates every 10 minutes on in-progress accounting sessions. ■ ■ Block accounting for unknown users (no username). • Update Period •...
Page 173 RADIUS Authentication and Accounting Viewing RADIUS Statistics Viewing RADIUS Statistics General RADIUS Statistics Syntax: show radius [host < ip-addr >] Shows general RADIUS configuration, including the server IP addresses. Optional form shows data for a specific RADIUS host. To use show radius, the server’s IP address must be configured in the switch, which.
Page 174 RADIUS Authentication and Accounting Viewing RADIUS Statistics Figure 6-11. RADIUS Server Information From the Show Radius Host Command Term Definition Round Trip Time The time interval between the most recent Accounting-Response and the Accounting- Request that matched it from this RADIUS accounting server. PendingRequests...
Page 175: Viewing Radius Statistics
RADIUS Authentication and Accounting Viewing RADIUS Statistics RADIUS Authentication Statistics Syntax: show authentication Displays the primary and secondary authentication meth ods configured for the Console, Telnet, Port-Access (802.1X), and SSH methods of accessing the switch. Also displays the number of access attempts currently allowed in a session. show radius authentication Displays NAS identifier and data on the configured RADIUS server and the switch’s interactions with this server.
Page 176 RADIUS Authentication and Accounting Viewing RADIUS Statistics Figure 6-13. Example of RADIUS Authentication Information from a Specific Server RADIUS Accounting Statistics Syntax: show accounting Lists configured accounting interval, “Empty User” suppres sion status, accounting types, methods, and modes. show radius accounting Lists accounting statistics for the RADIUS server(s) config...
Page 177 RADIUS Authentication and Accounting Changing RADIUS-Server Access Order Figure 6-15. Example of RADIUS Accounting Information for a Specific Server Figure 6-16. Example Listing of Active RADIUS Accounting Sessions on the Switch Changing RADIUS-Server Access Order The switch tries to access RADIUS servers according to the order in which their IP addresses are listed by the show radius command.
Page 178 RADIUS Authentication and Accounting Changing RADIUS-Server Access Order RADIUS server IP addresses listed in the order in which the switch will try to access them. In this case, the server at IP address 1.1.1.1 is first. Note: If the switch successfully accesses the first server, it does not try to access any other servers in the list, even if the client is denied access by the first server.
Page 179 RADIUS Authentication and Accounting Changing RADIUS-Server Access Order Removes the “003” and “001” addresses from the RADIUS server list. Inserts the “003” address in the first position in the RADIUS server list, and inserts the “001” address in the last position in the list. Shows the new order in which the switch searches for a RADIUS server.
Page 180 RADIUS Authentication and Accounting Messages Related to RADIUS Operation Messages Related to RADIUS Operation Message Meaning Can’t reach RADIUS server < x.x.x.x >. A designated RADIUS server is not responding to an authentication request. Try pinging the server to determine whether it is accessible to the switch.
Page 181 Configuring Secure Shell (SSH) Contents Overview ........... . . 7-2 Terminology .
Page 182: Overview
Configuring Secure Shell (SSH) Overview Overview Feature Default Menu Generating a public/private key pair on the switch page 7-10 Using the switch’s public key page 7-12 Enabling SSH Disabled page 7-15 Enabling client public-key authentication Disabled pages 7-19, 7-22 Enabling user authentication Disabled page 7-18 The switches covered in this guide use Secure Shell version 2 (SSHv2) to...
Page 183: Terminology
Configuring Secure Shell (SSH) Terminology Note SSH in ProCurve switches is based on the OpenSSH software toolkit. For more information on OpenSSH, visit http://www.openssh.com . Switch SSH and User Password Authentication . This option is a subset of the client public-key authentication shown in figure 7-1. It occurs if the switch has SSH enabled but does not have login access (login public-key) configured to authenticate the client’s key.
Page 184 Configuring Secure Shell (SSH) Terminology PEM (Privacy Enhanced Mode): Refers to an ASCII-formatted ■ client public-key that has been encoded for portability and efficiency. SSHv2 client public-keys are typically stored in the PEM format. See figure 7-3 for an example of PEM-encoded ASCII keys. Private Key: An internally generated key used in the authentication ■...
Page 185: Prerequisite For Using Ssh
Configuring Secure Shell (SSH) Prerequisite for Using SSH Prerequisite for Using SSH Before using the switch as an SSH server, you must install a publicly or commercially available SSH client application on the computer(s) you use for management access to the switch. If you want client public-key authentication (page 7-2), then the client program must have the capability to generate or import keys.
Page 186: Steps For Configuring And Using Ssh
Configuring Secure Shell (SSH) Steps for Configuring and Using SSH for Switch and Client Authentication Steps for Configuring and Using SSH for Switch and Client Authentication For two-way authentication between the switch and an SSH client, you must use the login (Operator) level. Table 7-1.
Page 187 Configuring Secure Shell (SSH) Steps for Configuring and Using SSH for Switch and Client Authentication B. Switch Preparation 1. Assign a login (Operator) and enable (Manager) password on the switch (page 7-9). Generate a public/private key pair on the switch (page 7-10). You need to do this only once.
Page 188: General Operating Rules And Notes
Configuring Secure Shell (SSH) General Operating Rules and Notes General Operating Rules and Notes ■ Public keys generated on an SSH client must be exportable to the switch. The switch can only store 10 keys client key pairs. The switch’s own public/private key pair and the (optional) client ■...
Page 189: Assigning A Local Login (Operator) And
Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation Configuring the Switch for SSH Operation SSH-Related Commands in This Section Page show ip ssh 7-17 show crypto client-public-key [keylist-str] [< babble | 7-25 fingerprint >] show crypto host-public-key [< babble | fingerprint >] 7-14 show authentication 7-21...
Page 190: Generating The Switch's Public And Private Key Pair
Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation Figure 7-4. Example of Configuring Local Passwords 2. Generating the Switch’s Public and Private Key Pair You must generate a public and private host key pair on the switch. The switch uses this key pair, along with a dynamically generated session key pair to negotiate an encryption method and session with an SSH client trying to connect to the switch.
Page 191 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation Notes When you generate a host key pair on the switch, the switch places the key pair in flash memory (and not in the running-config file). Also, the switch maintains the key pair across reboots, including power cycles. You should consider this key pair to be “permanent”;...
Page 192: Providing The Switch's Public Key To Clients
Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation For example, to generate and display a new key: Host Public Key for the Switch Version 1 and Version 2 views of same host public key Figure 7-5. Example of Generating a Public/Private Host Key Pair for the Switch The 'show crypto host-public-key' displays it in two different formats because your client may store it in either of these formats after learning the key.
Page 193 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation distribution to clients is to use a direct, serial connection between the switch and a management device (laptop, PC, or UNIX workstation), as described below. The public key generated by the switch consists of three parts, separated by one blank space each: Bit Size Exponent <e>...
Page 194 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation 4. Add any data required by your SSH client application. For example Before saving the key to an SSH client’s "known hosts" file you may have to insert the switch’s IP address: Modulus <n>...
Page 195: Enabling Ssh On The Switch And Anticipating Ssh Client Contact Behavior
Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation Phonetic "Hash" of Switch’s Public Key Hexadecimal "Fingerprints" of the Same Switch Figure 7-9. Examples of Visual Phonetic and Hexadecimal Conversions of the Switch’s Public Key The two commands shown in figure 7-9 convert the displayed format of the switch’s (host) public key for easier visual comparison of the switch’s public key to a copy of the key in a client’s “known host”...
Page 196 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation SSH Client Contact Behavior. At the first contact between the switch and an SSH client, if the switch’s public key has not been copied into the client, then the client’s first connection to the switch will question the connection and, for security reasons, provide the option of accepting or refusing.
Page 197 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation [port < 1-65535 | default >] The TCP port number for SSH connections (default: 22). Important: See “Note on Port Number” on page 7-17. [timeout < 5 - 120 >] The SSH login timeout value (default: 120 seconds).
Page 198: Configuring The Switch For Ssh Authentication
Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation C a u t i o n Protect your private key file from access by anyone other than yourself. If someone can access your private key file, they can then penetrate SSH security on the switch by appearing to be you.
Page 199 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation Syntax: aaa authentication ssh login < local | tacacs | radius >[< local | none >] Configures a password method for the primary and second ary login (Operator) access. If you do not specify an optional secondary method, it defaults to none.
Page 200 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation C a u t i o n To allow SSH access only to clients having the correct public key, you must configure the secondary (password) method for login public-key to none. Otherwise a client without the correct public key can still gain entry by submitting a correct local login password.
Page 201: Use An Ssh Client To Access The Switch
Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation Figure 7-12 shows how to check the results of the above commands. Lists the current SSH authentication configuration. Shows the contents of the public key file downloaded with the copy tftp command in figure 7-11.
Page 202: Further Information On Ssh Client Public-Key Authentication
Configuring Secure Shell (SSH) Further Information on SSH Client Public-Key Authentication Further Information on SSH Client Public-Key Authentication The section titled “5. Configuring the Switch for SSH Authentication” on page 7-18 lists the steps for configuring SSH authentication on the switch. However, if you are new to SSH or need more details on client public-key authentication, this section may be helpful.
Page 203 Configuring Secure Shell (SSH) Further Information on SSH Client Public-Key Authentication 3. If there is not a match, and you have not configured the switch to accept a login password as a secondary authentication method, the switch denies SSH access to the client. If there is a match, the switch: Generates a random sequence of bytes.
Page 204 Configuring Secure Shell (SSH) Further Information on SSH Client Public-Key Authentication Notes Comments in public key files, such as smith@support.cairns.com in figure 7-13, may appear in a SSH client application’s generated public key. While such comments may help to distinguish one key from another, they do not pose any restriction on the use of a key by multiple clients and/or users.
Page 205 Configuring Secure Shell (SSH) Further Information on SSH Client Public-Key Authentication N o t e o n P u b l i c The actual content of a public key entry in a public key file is determined by K e ys the SSH client application generating the key.
Page 206 Configuring Secure Shell (SSH) Further Information on SSH Client Public-Key Authentication Syntax: clear crypto public-key Deletes the client-public-key file from the switch. Syntax: clear crypto public-key 3 Deletes the entry with an index of 3 from the client-public-key file on the switch. Enabling Client Public-Key Authentication.
Page 207: Messages Related To Ssh Operation
Configuring Secure Shell (SSH) Messages Related to SSH Operation Messages Related to SSH Operation Message Meaning File transfer did not occur. Indicates an error in 00000K Peer unreachable. communicating with the tftp server or not finding the file to download. Causes include such factors as: •...
Page 208 Configuring Secure Shell (SSH) Messages Related to SSH Operation Message Meaning After you execute the crypto key generate ssh [rsa] Generating new RSA host key. If the command, the switch displays this message while it cache is depleted, this could take up to is generating the key.
Page 209 Configuring Secure Socket Layer (SSL) Contents Overview ........... . . 8-2 Terminology .
Page 210: Overview
Configuring Secure Socket Layer (SSL) Overview Overview Feature Default Menu Generating a Self Signed Certificate on the switch page 8-9 page 8-13 Generating a Certificate Request on the switch page 8-15 Enabling SSL Disabled page 8-17 page 8-19 The switches covered in this guide use Secure Socket Layer Version 3 (SSLv3) and support for Transport Layer Security(TLSv1) to provide remote web access to the switches via encrypted paths between the switch and manage...
Page 211: Terminology
Configuring Secure Socket Layer (SSL) Terminology 1. Switch-to-Client SSL Cert. SSL Client ProCurve Browser Switch 2. User-to-Switch (login password and (SSL enable password authentication) Server) options: – Local – TACACS+ – RADIUS Figure 8-1. Switch/User Authentication SSL on the switches covered in this guide supports these data encryption methods: ■...
Page 212 Configuring Secure Socket Layer (SSL) Terminology Root Certificate: A trusted certificate used by certificate authorities to ■ sign certificates (CA-Signed Certificates) and used later on to verify that authenticity of those signed certificates. Trusted certificates are distrib uted as an integral part of most popular web clients. (see browser docu mentation for which root certificates are pre-installed).
Page 213: Prerequisite For Using Ssl
Configuring Secure Socket Layer (SSL) Prerequisite for Using SSL Prerequisite for Using SSL Before using the switch as an SSL server, you must install a publicly or commercially available SSL enabled web browser application on the com puter(s) you use for management access to the switch. Steps for Configuring and Using SSL for Switch and Client Authentication The general steps for configuring SSL include:...
Page 214: General Operating Rules And Notes
Configuring Secure Socket Layer (SSL) General Operating Rules and Notes General Operating Rules and Notes ■ Once you generate a certificate on the switch you should avoid re- generating the certificate without a compelling reason. Otherwise, you will have to re-introduce the switch’s certificate on all management stations (clients) you previously set up for SSL access to the switch.
Page 215: Configuring The Switch For Ssl Operation
Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Configuring the Switch for SSL Operation SSL-Related CLI Commands in This Section Page web-management ssl page 8-19 show config page 8-19 show crypto host-cert page 8-12 crypto key generate cert [rsa] <512 | 768 |1024> page 8-10 zeroize cert page 8-10...
Page 216 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Using the web browser interface To Configure Local Passwords. You can configure both the Operator and Manager password on one screen. To access the web browser interface, refer to the chapter titled “Using the ProCurve Web Browser Interface”...
Page 217: Generating The Switch's Server Host Certificate
Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation 2. Generating the Switch’s Server Host Certificate You must generate a server certificate on the switch before enabling SSL. The switch uses this server certificate, along with a dynamically generated session key pair to negotiate an encryption method and session with a browser trying to connect via SSL to the switch.
Page 218: To Generate Or Erase The Switch's Server Certificate
Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation To Generate or Erase the Switch’s Server Certificate with the CLI Because the host certificate is stored in flash instead of the running-config file, it is not necessary to use write me mory to save the certificate. Erasing the host certificate automatically disables SSL.
Page 219: Comments On Certificate Fields
Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Comments on certificate fields. There are a number arguments used in the generation of a server certificate. table 8-1, “Certificate Field Descriptions” describes these arguments. Table 8-1. Certificate Field Descriptions Field Name Description Valid Start Date...
Page 220 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation N o t e s “Zeroizing” the switch’s server host certificate or key automatically disables SSL (sets web-management ssl to No). Thus, if you zeroize the server host certificate or key and then generate a new key and server certificate, you must also re-enable SSL with the web-management ssl command before the switch can resume SSL operation.
Page 221: Generate A Self-Signed Host Certificate With The Web Browser
Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Generate a Self-Signed Host Certificate with the Web browser interface You can configure SSL from the web browser interface. For more information on how to access the web browser interface refer to the chapter titled “Using the ProCurve Web Browser Interface”...
Page 222 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation For example, to generate a new host certificate via the web browsers inter- face: Security Tab SSL button Create Certificate Button Certificate Type Box Key Size Selection Certificate Arguments Figure 8-5.
Page 223: Generate A Ca-Signed Server Host Certificate With The Web Browser Interface
Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Current SSL Host Certificate Figure 8-6. Web browser Interface showing current SSL Host Certificate Generate a CA-Signed server host certificate with the Web browser interface To install a CA-Signed server host certificate from the web browser interface. For more information on how to access the web browser interface, refer to the chapter titled “Using the ProCurve Web Browser Interface”...
Page 224 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation The installation of a CA-signed certificate involves interaction with other entities and consists of three phases. The first phase is the creation of the CA certificate request, which is then copied off from the switch for submission to the certificate authority.
Page 225: Enabling Ssl On The Switch And Anticipating Ssl Browser Contact Behavior
Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Certificate Request Certificate Request Reply -----BEGIN CERTIFICATE----- MIICZDCCAc2gAwIBAgIDMA0XMA0GCSqGSIb3DQEBBAUAMIGHMQswCQYDVQQGEwJa QTEiMCAGA1UECBMZRk9SIFRFU1RJTkcgUFVSUE9TRVMgT05MWTEdMBsGA1UEChMU VGhhd3RlIENlcnRpZmljYXRpb24xFzAVBgNVBAsTDlRFU1QgVEVTVCBURVNUMRww GgYDVQQDExNUaGF3dGUgVGVzdCBDQSBSb290MB4XDTAyMTEyMjIyNTIxN1oXDTAy MTIxMzIyNTIxN1owgYQxCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENh cGUxEjAQBgNVBAcTCUNhcGUgVG93bjEUMBIGA1UEChMLT3Bwb3J0dW5pdGkxGDAW BgNVBAsTD09ubGluZSBTZXJ2aWNlczEaMBgGA1UEAxMRd3d3LmZvcndhcmQuY28u emEwWjANBgkqhkiG9w0BAQEFAANJADBGAkEA0+aMcXgVruVixw/xuASfj6G4gvXe 0uqQ7wI7sgvnTwJy9HfdbV3Zto9fdA9ZIA6EqeWchkoMCYdle3Yrrj5RwwIBA6Ml MCMwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0B Figure 8-7. Request for Verified Host Certificate Web Browser Interface Screen 3. Enabling SSL on the Switch and Anticipating SSL Browser Contact Behavior he web-management ssl command enables SSL on the switch and modifies parameters the switch uses for transactions with clients.
Page 226 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation N o t e Before enabling SSL on the switch you must generate the switch’s host certificate and key. If you have not already done so, refer to “2. Generating the Switch’s Server Host Certificate”...
Page 227: Using The Cli Interface To Enable Ssl
Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Using the CLI interface to enable SSL Syntax: [no] web-management ssl Enables or disables SSL on the switch. [port < 1-65535 | default:443 >] The TCP port number for SSL connections (default: 443).
Page 228 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Enable SLL and port number Selection Figure 8-8. Using the web browser interface to enable SSL and select TCP port number N o t e o n P o r t ProCurve recommends using the default IP port number (443).
Page 229: Common Errors In Ssl Setup
Configuring Secure Socket Layer (SSL) Common Errors in SSL setup Common Errors in SSL setup Error During Possible Cause Generating host certificate on CLI You have not generated a certificate key. (Refer to “CLI commands used to generate a Server Host Certificate” on page 8-10.) Enabling SSL on the CLI or Web browser interface You have not generated a host...
Page 230 Configuring Secure Socket Layer (SSL) Common Errors in SSL setup — This page is intentionally unused. — 8-22...
Page 231 Traffic/Security Filters Contents Overview ........... . . 9-2 Introduction .
Page 232: Overview
Traffic/Security Filters Overview Overview Applicable Switch Models. As of October, 2005, Traffic/Security filters are available on these current ProCurve switch models: Switch Models Source-Port Protocol Multicast Filters Filters Filters Series 6400cl Series 5400zl Series 4200vl Series 3500yl Series 3400cl Series 2800 Series 2500 Switch 4000m and 8000m This chapter describes Traffic/Security filters on the switches covered in this...
Page 233: Filter Limits
Traffic/Security Filters Filter Types and Operation You can enhance in-band security and improve control over access to network resources by configuring static filters to forward (the default action) or drop unwanted traffic. That is, you can configure a traffic filter to either forward or drop all network traffic moving to outbound (destination) ports and trunks (if any) on the switch.
Page 234: Source-Port Filters
Traffic/Security Filters Filter Types and Operation Source-Port Filters This filter type enables the switch to forward or drop traffic from all end nodes on the indicated source-port to specific destination ports. Server Node “A” Port Port Switch 5400zl Configured for Node Source-Port “B”...
Page 235 Traffic/Security Filters Filter Types and Operation When you create a source port filter, all ports and port trunks (if any) ■ on the switch appear as destinations on the list for that filter, even if routing is disabled and separate VLANs and/or subnets exist. Where traffic would normally be allowed between ports and/or trunks, the switch automatically forwards traffic to the outbound ports and/or trunks you do not specifically configure to drop traffic.
Page 236: Named Source-Port Filters
Traffic/Security Filters Filter Types and Operation This list shows the filter created to block (drop) traffic from source port 5 (workstation "X") to destination port 7 (server "A"). Notice that the filter allows traffic to move from source port 5 to all other destination ports. Figure 9-3.
Page 237: Defining And Configuring Named Source-Port Filters
Traffic/Security Filters Filter Types and Operation A named source-port filter can only be deleted when it is not applied ■ to any ports. Defining and Configuring Named Source-Port Filters The named source-port filter command operates from the global configuration level. [no] filter source-port named-filter <filter-name>...
Page 238: Viewing A Named Source-Port Filter
Traffic/Security Filters Filter Types and Operation A named source-port filter must first be defined and configured before it can be applied. In the following example two named source-port filters are defined, web-only and accounting. ProCurve(config)# filter source-port named-filter web- only ProCurve(config)# filter source-port named-filter accounting By default, these two named source-port filters forward traffic to all ports and...
Page 239 Traffic/Security Filters Filter Types and Operation Using Named Source-Port Filters A company wants to manage traffic to the Internet and its accounting server on a 26-port switch. Their network is pictured in Figure 9-4. Switch port 1 connects to a router that provides connectivity to a WAN and the Internet. Switch port 7 connects to the accounting server.
Page 240 Traffic/Security Filters Filter Types and Operation ProCurve(config)# filter source-port named-filter web-only drop 2-26 ProCurve(config)# filter source-port named-filter accounting drop 1-6,8,9,12-26 ProCurve(config)# filter source-port named-filter no-incoming-web drop 7,10,11 Ports and port trunks using the ProCurve(config)# show filter source-port filter. When NOT USED is displayed the named source-port filter may be deleted.
Page 241 Traffic/Security Filters Filter Types and Operation ProCurve(config)# show filter Traffic/Security Filters Indicates the port number or port- ID X Filter Type | Value trunk name of the source port or trunk - -- ------------ + ------------------- assigned to the filter. Sourc e Port Sourc e Port An automatically assigned index...
Page 242 Traffic/Security Filters Filter Types and Operation ProCurve(config)# show filter 24 ProCurve(config)# show filter 4 Traffic /Security Filters Tr affic/Security Filters Filter Type : Source Port F ilter Type : Source Port Source Port : 10 S ource Port : 5 Dest Port Ty pe | Action...
Page 243 Traffic/Security Filters Filter Types and Operation ProCurve(config)# show filter 26 Tra ffic/Security Filters Fi lter Type : Source Port So urce Port : 1 De st Port Type ction -- ------- --------- + ------------------------ 10/100TX Forward 10/100TX Forward 10/100TX Forward 10/100TX Forward 10/100TX Forward...
Page 244 Traffic/Security Filters Filter Types and Operation The following revisions to the named source-port filter definitions maintain the desired network traffic management, as shown in the Action column of the show command. ProCurve(config)# filter source-port named-filter accounting forward 8,12,13 ProCurve(config)# filter source-port named-filter no-incoming-web drop 8,12,13 ProCurve(config)# ...
Page 245: Static Multicast Filters
Traffic/Security Filters Filter Types and Operation Static Multicast Filters This filter type enables the switch to forward or drop multicast traffic to a specific set of destination ports. This helps to preserve bandwidth by reducing multicast traffic on ports where it is unnecessary, and to isolate multicast traffic to enhance security.
Page 246: Protocol Filters
Traffic/Security Filters Filter Types and Operation N o t e s : Per-Port IP Multicast Filters. The static multicast filters described in this section filter traffic having a multicast address you specify. To filter all multicast traffic on a per-VLAN basis, refer to the section titled “Configuring and Displaying IGMP”...
Page 247: Configuring Traffic/Security Filters
Traffic/Security Filters Configuring Traffic/Security Filters Configuring Traffic/Security Filters Use this procedure to specify the type of filters to use on the switch and whether to forward or drop filtered packets for each filter you specify. Select the static filter type(s). 2. For inbound traffic matching the filter type, determine the filter action you want for each outbound (destination) port on the switch (forward or drop).
Page 248: Configuring A Source-Port Traffic Filter
Traffic/Security Filters Configuring Traffic/Security Filters Configuring a Source-Port Traffic Filter Syntax: [no] filter [source-port < port-number | trunk-name>] Specifies one inbound port or trunk. Traffic received inbound on this interface from other devices will be filtered. The no form of the command deletes the source- port filter for <...
Page 249: Example Of Creating A Source-Port Filter
Traffic/Security Filters Configuring Traffic/Security Filters Example of Creating a Source-Port Filter For example, assume that you want to create a source-port filter that drops all traffic received on port 5 with a destination of port trunk 1 (Trk1) and any port in the range of port 10 to port 15.
Page 250: Editing A Source-Port Filter
Traffic/Security Filters Configuring Traffic/Security Filters filter on port 5, then create a trunk with ports 5 and 6, and display the results, you would see the following: The *5* shows that port 5 is configured for filtering, but the filtering action has been suspended while the port is a member of a trunk.
Page 251: Configuring A Multicast Or Protocol Traffic Filter
Traffic/Security Filters Configuring Traffic/Security Filters Figure 9-7. Assigning Additional Destination Ports to an Existing Filter Configuring a Multicast or Protocol Traffic Filter Syntax: [no] filter [multicast < mac- address >] Specifies a multicast address. Inbound traffic received (on any port) with this multicast address will be filtered.
Page 252: Filter Indexing
Traffic/Security Filters Configuring Traffic/Security Filters For example, suppose you wanted to configure the filters in table 9-3 on a switch. (For more on source-port filters, refer to “Configuring a Source-Port Traffic Filter” on page 9-18.) Table 9-3. Filter Example Filter Type Filter Value Action Destination Ports...
Page 253: Displaying Traffic/Security Filters
Traffic/Security Filters Configuring Traffic/Security Filters Displaying Traffic/Security Filters This command displays a listing of all filters by index number and also enables you to use the index number to display the details of individual filters. Syntax: show filter Lists the filters configured in the switch, with corresponding filter index (IDX) numbers.
Page 254 Traffic/Security Filters Configuring Traffic/Security Filters Lists all filters configured in the switch. Filter Index Numbers Criteria for Individual (Automatically Assigned) Filters Uses the index number (IDX) for a specific filter to list the details for that filter only. Figure 9-9. Example of Displaying Filter Data 9-24...
Page 255 Configuring Port-Based and Client-Based Access Control (802.1X) Contents Overview ........... . 10-3 Why Use Port-Based or Client-Based Access Control? .
Page 256 Configuring Port-Based and Client-Based Access Control (802.1X) Contents 3. Configure the 802.1X Authentication Method ....10-21 4. Enter the RADIUS Host IP Address(es) ..... 10-22 5.
Page 257: Overview
Configuring Port-Based and Client-Based Access Control (802.1X) Overview Overview Feature Default Menu Configuring Switch Ports as 802.1X Authenticators Disabled page 10-16 Configuring 802.1X Open VLAN Mode Disabled page 10-24 Configuring Switch Ports to Operate as 802.1X Supplicants Disabled page 10-42 Displaying 802.1X Configuration, Statistics, and Counters page 10-46 How 802.1X Affects VLAN Operation...
Page 258: User Authentication Methods
Configuring Port-Based and Client-Based Access Control (802.1X) Overview • Port-Based access control option allowing authentication by a single client to open the port. This option does not force a client limit and, on a port opened by an authenticated client, allows unlimited client access without requiring further authentication.
Page 259: 802.1X Port-Based Access Control
Configuring Port-Based and Client-Based Access Control (802.1X) Overview the session total includes any sessions begun by the Web Authentication or MAC Authentication features covered in chapter 4.) For more information, refer to “Option For Authenticator Ports: Configure Port-Security To Allow Only 802.1X-Authenticated Devices”...
Page 260: Alternative To Using A Radius Server
Configuring Port-Based and Client-Based Access Control (802.1X) Terminology N o t e Port-Based 802.1X can operate concurrently with Web-Authentication or MAC-Authentication on the same port. However, this is not a commonly used application and is not generally recommended. For more information, refer to “Operating Notes”...
Page 261 Configuring Port-Based and Client-Based Access Control (802.1X) Terminology local authentication is used, in which case the switch performs this function using its own username and password for authenticating a supplicant). Authenticator: In ProCurve applications, a switch that requires a supplicant to provide the proper credentials before being allowed access to the network.
Page 262 Configuring Port-Based and Client-Based Access Control (802.1X) Terminology Supplicant: The entity that must provide the proper credentials to the switch before receiving access to the network. This is usually an end-user work- station, but it can be a switch, router, or another device seeking network services.
Page 263: General 802.1X Authenticator Operation
Configuring Port-Based and Client-Based Access Control (802.1X) General 802.1X Authenticator Operation General 802.1X Authenticator Operation This operation provides security on a point-to-point link between a client and the switch, where both devices are 802.1X-aware. (If you expect desirable clients that do not have the necessary 802.1X supplicant software, you can provide a path for downloading such software by using the 802.1X Open VLAN mode—refer to “802.1X Open VLAN Mode”...
Page 264: Vlan Membership Priority
Configuring Port-Based and Client-Based Access Control (802.1X) General 802.1X Authenticator Operation N o t e The switches covered in this guide can use either 802.1X port-based authen tication or 802.1X client-based authentication. For more information, refer to “User Authentication Methods” on page 10-4. VLAN Membership Priority Following client authentication, an 802.1X port resumes membership in any tagged VLANs for which it is already assigned in the switch configuration.
Page 265 Configuring Port-Based and Client-Based Access Control (802.1X) General 802.1X Authenticator Operation New Client Authenticated Another Assign New Client (Old) Client RADIUS- to RADIUS- Already Using Assigned Specified VLAN Port VLAN? Authorized Client VLAN Assign New Client Accept New Client VLAN Same As Old to Authorized VLAN Configured?
Page 266: General Operating Rules And Notes
Configuring Port-Based and Client-Based Access Control (802.1X) General Operating Rules and Notes General Operating Rules and Notes ■ In the client-based mode, when there is an authenticated client on a port, the following traffic movement is allowed: • Multicast and broadcast traffic is allowed on the port. •...
Page 267 Configuring Port-Based and Client-Based Access Control (802.1X) General Operating Rules and Notes If a port on switch “A” is configured as an 802.1X supplicant and is ■ connected to a port on another switch, “B”, that is not 802.1X-aware, access to switch “B” will occur without 802.1X security protection. ■...
Page 268: General Setup Procedure For 802.1X Access Control
1. Configure a local username and password on the switch for both the Operator (login) and Manager (enable) access levels. (While this may or may not be required for your 802.1X configuration, HP recommends that you use a local username and password pair at least until your other security measures are in place.)
Page 269: Overview: Configuring 802.1X Authentication On The Switch
Configuring Port-Based and Client-Based Access Control (802.1X) General Setup Procedure for 802.1X Access Control Overview: Configuring 802.1X Authentication on the Switch This section outlines the steps for configuring 802.1X on the switch. For detailed information on each step, refer to the following: “802.1X Client-Based Access Control”...
Page 270 Configuring Port-Based and Client-Based Access Control (802.1X) Configuring Switch Ports as 802.1X Authenticators N o t e If you want to implement the optional port security feature (step 7) on the switch, you should first ensure that the ports you have configured as 802.1X authenticators operate as expected.
Page 271: Enable 802.1X Authentication On Selected Ports
Configuring Port-Based and Client-Based Access Control (802.1X) Configuring Switch Ports as 802.1X Authenticators 1. Enable 802.1X Authentication on Selected Ports This task configures the individual ports you want to operate as 802.1X authenticators for point-to-point links to 802.1X-aware clients or switches, and consists of two steps: A.
Page 272: Specify Client-Based Or Return To Port-Based 802.1X Authentication
Configuring Port-Based and Client-Based Access Control (802.1X) Configuring Switch Ports as 802.1X Authenticators B. Specify Client-Based or Return to Port-Based 802.1X Authentication Client-Based 802.1X Authentication. Syntax: aaa port-access authenticator client-limit < port-list > < 1 - 32 > Used after executing aaa port-access authenticator < port-list > (above) to convert authentication from port-based to client...
Page 273: Example: Configuring Client-Based 802.1X Authentication
Configuring Port-Based and Client-Based Access Control (802.1X) Configuring Switch Ports as 802.1X Authenticators Example: Configuring Client-Based 802.1X Authentication This example enables ports A10-A12 to operate as authenticators, and then configures the ports for client-based authentication. ProCurve(config)# aaa port-access authenticator a10-A12 ProCurve(config)# aaa port-access authenticator a10-A12 client-limit 4 Figure 10-2.
Page 274 Configuring Port-Based and Client-Based Access Control (802.1X) Configuring Switch Ports as 802.1X Authenticators [quiet-period < 0 - 65535 >] Sets the period during which the port does not try to acquire a supplicant. The period begins after the last attempt authorized by the max-requests parameter fails (next page).
Page 275: Configure The 802.1X Authentication Method
Configuring Port-Based and Client-Based Access Control (802.1X) Configuring Switch Ports as 802.1X Authenticators [reauth-period < 0 - 9999999 >] Sets the period of time after which clients connected must be re-authenticated. When the timeout is set to 0 the reauthentication is disabled (Default: 0 second) [unauth-vid <...
Page 276: Enter The Radius Host Ip Address(Es)
Configuring Port-Based and Client-Based Access Control (802.1X) Configuring Switch Ports as 802.1X Authenticators eap-radius Use EAP-RADIUS authentication. (Refer to the documentation for your RADIUS server application.) chap-radius Use CHAP-RADIUS (MD-5) authentication. (Refer to the documentation for your RADIUS server appli cation.) For example, to enable the switch to perform 802.1X authentication using one or more EAP-capable RADIUS servers:...
Page 277: Enable 802.1X Authentication On The Switch
Configuring Port-Based and Client-Based Access Control (802.1X) Configuring Switch Ports as 802.1X Authenticators Syntax: radius-server key < global key-string > Specifies the global encryption key the switch uses for sessions with servers for which the switch does not have a server-specific key. This key is optional if all RADIUS server addresses configured in the switch include a server- specific encryption key.
Page 278: 802.1X Open Vlan Mode
Configuring Port-Based and Client-Based Access Control (802.1X) 802.1X Open VLAN Mode 802.1X Open VLAN Mode 802.1X Authentication Commands page 10-16 802.1X Supplicant Commands page 10-44 802.1X Open VLAN Mode Commands [no] aaa port-access authenticator < port-list > page 10-38 [auth-vid < vlan-id >] [unauth-vid <...
Page 279: Vlan Membership Priorities
Configuring Port-Based and Client-Based Access Control (802.1X) 802.1X Open VLAN Mode Note On ports configured to allow multiple sessions using 802.1X client-based access control, all clients must use the same untagged VLAN. On a given port where there are no currently active, authenticated clients, the first authenti cated client determines the untagged VLAN in which the port will operate for all subsequent, overlapping client sessions.
Page 280: Use Models For 802.1X Open Vlan Modes
Configuring Port-Based and Client-Based Access Control (802.1X) 802.1X Open VLAN Mode N o t e After client authentication, the port resumes membership in any tagged VLANs for which it is configured. If the port is a tagged member of a VLAN used for 1 or 2 listed above, then it also operates as an untagged member of that VLAN while the client is connected.
Page 281 Configuring Port-Based and Client-Based Access Control (802.1X) 802.1X Open VLAN Mode Table 10-2. 802.1X Open VLAN Mode Options 802.1X Per-Port Configuration Port Response No Open VLAN mode: The port automatically blocks a client that cannot initiate an authentication session. Open VLAN mode with both of the following configured: Unauthorized-Client VLAN •...
Page 282 Configuring Port-Based and Client-Based Access Control (802.1X) 802.1X Open VLAN Mode 802.1X Per-Port Configuration Port Response Authorized-Client VLAN • After client authentication, the port drops membership in the Unauthorized-Client VLAN and becomes an untagged member of this VLAN. Notes: If the client is running an 802.1X supplicant application when the authentication session begins, and is able to authenticate itself before the switch assigns the port to the Unauthorized-Client VLAN, then the port does not become a...
Page 283 Configuring Port-Based and Client-Based Access Control (802.1X) 802.1X Open VLAN Mode 802.1X Per-Port Configuration Port Response Open VLAN Mode with Only an Unauthorized-Client VLAN Configured: • When the port detects a client, it automatically becomes an untagged member of this VLAN. To limit security risks, the network services and access available on this VLAN should include only what a client needs to enable an authentication session.
Page 284 Configuring Port-Based and Client-Based Access Control (802.1X) 802.1X Open VLAN Mode 802.1X Per-Port Configuration Port Response Open VLAN Mode with Only an Authorized-Client VLAN Configured: • Port automatically blocks a client that cannot initiate an authentication session. • If the client successfully completes an authentication session, the port becomes an untagged member of this VLAN.
Page 285: Operating Rules For Authorized-Client And Unauthorized-Client Vlans
Configuring Port-Based and Client-Based Access Control (802.1X) 802.1X Open VLAN Mode Operating Rules for Authorized-Client and Unauthorized-Client VLANs Condition Rule Static VLANs used as Authorized- These must be configured on the switch before you configure an Client or Unauthorized-Client VLANs 802.1X authenticator port to use them. (Use the vlan < vlan-id > command or the VLAN Menu screen in the Menu interface.) VLAN Assignment Received from a If the RADIUS server specifies a VLAN for an authenticated supplicant...
Page 286 Configuring Port-Based and Client-Based Access Control (802.1X) 802.1X Open VLAN Mode Condition Rule Effect of Unauthorized-Client VLAN • When an unauthenticated client connects to a port that is already configured with a static, untagged VLAN, the switch temporarily session on untagged port VLAN moves the port to the Unauthorized-Client VLAN (also untagged).
Page 287 Configuring Port-Based and Client-Based Access Control (802.1X) 802.1X Open VLAN Mode Condition Rule Effect of RADIUS-assigned VLAN The port joins the RADIUS-assigned VLAN as an untagged member. This rule assumes no other authenticated clients are already using the port on a different VLAN.
Page 288 Configuring Port-Based and Client-Based Access Control (802.1X) 802.1X Open VLAN Mode Condition Rule Note: Limitation on Using an You can optionally enable switches to allow up to 32 clients per-port. Unauthorized-Client VLAN on an The Unauthorized-Client VLAN feature can operate on an 802.1X- 802.1X Port Configured to Allow configured port regardless of how many clients the port is configured Multiple-Client Access...
Page 289: Setting Up And Configuring 802.1X Open Vlan Mode
Configuring Port-Based and Client-Based Access Control (802.1X) 802.1X Open VLAN Mode Setting Up and Configuring 802.1X Open VLAN Mode Preparation. This section assumes use of both the Unauthorized-Client and Authorized-Client VLANs. Refer to Table 10-2 on page 10-27 for other options. Before you configure the 802.1X Open VLAN mode on a port: ■...
Page 290 Configuring Port-Based and Client-Based Access Control (802.1X) 802.1X Open VLAN Mode Note that as an alternative, you can configure the switch to use local password authentication instead of RADIUS authentication. However, this is less desirable because it means that all clients use the same passwords and have the same access privileges.
Page 291 Configuring Port-Based and Client-Based Access Control (802.1X) 802.1X Open VLAN Mode 3. If you selected either eap-radius or chap-radius for step 2, use the radius host command to configure up to three RADIUS server IP address(es) on the switch. Syntax: radius host < ip-address > Adds a server to the RADIUS configuration.
Page 292 Configuring Port-Based and Client-Based Access Control (802.1X) 802.1X Open VLAN Mode Configuring 802.1X Open VLAN Mode. Use these commands to actually configure Open VLAN mode. For a listing of the steps needed to prepare the switch for using Open VLAN mode, refer to “Preparation” on page 10-35. Syntax: aaa port-access authenticator <...
Page 293: 802.1X Open Vlan Operating Notes
Configuring Port-Based and Client-Based Access Control (802.1X) 802.1X Open VLAN Mode Inspecting 802.1X Open VLAN Mode Operation. For information and an example on viewing current Open VLAN mode operation, refer to “Viewing 802.1X Open VLAN Mode Status” on page 10-48. 802.1X Open VLAN Operating Notes ■...
Page 294: Option For Authenticator Ports: Configure Port-Security To Allow Only 802.1X-Authenticated Devices
Configuring Port-Based and Client-Based Access Control (802.1X) Option For Authenticator Ports: Configure Port-Security To Allow Only 802.1X-Authenticated Devices The first client to authenticate on a port configured to support multiple ■ clients will determine the port’s VLAN membership for any subsequent clients that authenticate while an active session is already in effect.
Page 295: Port-Security
Configuring Port-Based and Client-Based Access Control (802.1X) Option For Authenticator Ports: Configure Port-Security To Allow Only 802.1X-Authenticated Devices Port-Security N o t e If 802.1X port-access is configured on a given port, then port-security learn mode for that port must be set to either continuous (the default) or port-access. In addition to the above, to use port-security on an authenticator port (chapter 11), use the per-port client-limit option to control how many MAC addresses of 802.1X-authenticated devices the port is allowed to learn.
Page 296: Configuring Switch Ports To Operate As Supplicants For 802.1X Connections To Other Switches
Configuring Port-Based and Client-Based Access Control (802.1X) Configuring Switch Ports To Operate As Supplicants for 802.1X Connections to Other Switches Configuring Switch Ports To Operate As Supplicants for 802.1X Connections to Other Switches 802.1X Authentication Commands page 10-16 802.1X Supplicant Commands [no] aaa port-access <...
Page 297 Configuring Port-Based and Client-Based Access Control (802.1X) Configuring Switch Ports To Operate As Supplicants for 802.1X Connections to Other Switches • If, after the supplicant port sends the configured number of start packets, it does not receive a response, it assumes that switch “B” is not 802.1X-aware, and transitions to the authenticated state.
Page 298: Supplicant Port Configuration
Configuring Port-Based and Client-Based Access Control (802.1X) Configuring Switch Ports To Operate As Supplicants for 802.1X Connections to Other Switches Supplicant Port Configuration Enabling a Switch Port as a Supplicant. You can configure a switch port as a supplicant for a point-to-point link to an 802.1X-aware port on another switch.
Page 299 Configuring Port-Based and Client-Based Access Control (802.1X) Configuring Switch Ports To Operate As Supplicants for 802.1X Connections to Other Switches aaa port-access supplicant [ethernet] < port-list > (Syntax Continued) [secret] Enter secret: < password > Repeat secret: < password > Sets the secret password to be used by the port supplicant when an MD5 authentication request is received from an authenticator.
Page 300: Displaying 802.1X Configuration, Statistics, And Counters
Configuring Port-Based and Client-Based Access Control (802.1X) Displaying 802.1X Configuration, Statistics, and Counters Displaying 802.1X Configuration, Statistics, and Counters 802.1X Authentication Commands page 10-16 802.1X Supplicant Commands page 10-42 802.1X Open VLAN Mode Commands page 10-24 802.1X-Related Show Commands show port-access authenticator below show port-access supplicant page 10-52...
Page 301 Configuring Port-Based and Client-Based Access Control (802.1X) Displaying 802.1X Configuration, Statistics, and Counters show port-access authenticator (Syntax Continued) config [< port-list >] Shows: • Whether port-access authenticator is active • The 802.1X configuration of ports configured as 802.1X authenticators (For descriptions of these elements, refer to the syntax descriptions under “1.
Page 302: Viewing 802.1X Open Vlan Mode Status
Configuring Port-Based and Client-Based Access Control (802.1X) Displaying 802.1X Configuration, Statistics, and Counters Viewing 802.1X Open VLAN Mode Status You can examine the switch’s current VLAN status by using the show port- access authenticator vlan and show port-access authenticator < port-list > com mands as illustrated in figure 10-7.
Page 303 Configuring Port-Based and Client-Based Access Control (802.1X) Displaying 802.1X Configuration, Statistics, and Counters Thus, in the output shown in figure 10-7: When the Auth VLAN ID is configured and matches the Current VLAN ID, an ■ authenticated client is connected to the port. (This assumes the port is not a statically configured member of the VLAN you are using for Auth VLAN.) When the Unauth VLAN ID is configured and matches the Current VLAN ID,...
Page 304 Configuring Port-Based and Client-Based Access Control (802.1X) Displaying 802.1X Configuration, Statistics, and Counters Table 10-3. Output for Determining Open VLAN Mode Status (Figure 10-7, Lower) Status Indicator Meaning Status C losed: Either no client is connected or the connected client has not received authorization through 802.1X authentication.
Page 305 Configuring Port-Based and Client-Based Access Control (802.1X) Displaying 802.1X Configuration, Statistics, and Counters Syntax: show vlan < vlan-id > Displays the port status for the selected VLAN, including an indication of which port memberships have been temporarily overridden by Open VLAN mode. Note that ports B1 and B3 are not in the upper listing, but are included under “Overridden...
Page 306: Show Commands For Port-Access Supplicant
Configuring Port-Based and Client-Based Access Control (802.1X) Displaying 802.1X Configuration, Statistics, and Counters Show Commands for Port-Access Supplicant Syntax: show port-access supplicant [< port-list >] [statistics] show port-access supplicant [< port-list >] Shows the port-access supplicant configuration (excluding the secret parameter) for all ports or < port- list >...
Page 307: How Radius/802.1X Authentication Affects Vlan Operation
Configuring Port-Based and Client-Based Access Control (802.1X) How RADIUS/802.1X Authentication Affects VLAN Operation supplicant port to another without clearing the statistics data from the first port, the authenticator’s MAC address will appear in the supplicant statistics for both ports. How RADIUS/802.1X Authentication Affects VLAN Operation Static VLAN Requirement.
Page 308 Configuring Port-Based and Client-Based Access Control (802.1X) How RADIUS/802.1X Authentication Affects VLAN Operation For example, suppose that a RADIUS-authenticated, 802.1X-aware client on port A2 requires access to VLAN 22, but VLAN 22 is configured for no access on port A2, and VLAN 33 is configured as untagged on port A2: Scenario: An authorized 802.1X client requires access...
Page 309 Configuring Port-Based and Client-Based Access Control (802.1X) How RADIUS/802.1X Authentication Affects VLAN Operation This entry shows that port A2 is temporarily untagged on VLAN 22 for an 802.1X session. This is to accommodate an 802.1X client’s access, authenticated by a RADIUS server, where the server included an instruction to put the client’s access on VLAN 22.
Page 310 Configuring Port-Based and Client-Based Access Control (802.1X) How RADIUS/802.1X Authentication Affects VLAN Operation When the 802.1X client’s session on port A2 ends, the port discards the temporary untagged VLAN membership. At this time the static VLAN actually configured as untagged on the port again becomes available. Thus, when the RADIUS-authenticated 802.1X session on port A2 ends, VLAN 22 access on port A2 also ends, and the untagged VLAN 33 access on port A2 is restored.
Page 311: Operating Notes
Configuring Port-Based and Client-Based Access Control (802.1X) Operating Notes Operating Notes ■ Applying Web Authentication or MAC Authentication Concur rently with Port-Based 802.1X Authentication: While 802.1X port- based access control can operate concurrently with Web Authentication or MAC Authentication, port-based access control is subordinate to Web- Auth and MAC-Auth operation.
Page 312: Messages Related To 802.1X Operation
Configuring Port-Based and Client-Based Access Control (802.1X) Messages Related to 802.1X Operation Messages Related to 802.1X Operation Table 10-4. 802.1X Operating Messages Message Meaning < port-list > is not an authenticator. The ports in the port list have not been enabled as 802.1X Port authenticators.
Page 313 Configuring and Monitoring Port Security Contents Overview ........... . 11-3 Port Security .
Page 314 Configuring and Monitoring Port Security Contents Web: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags ......11-41 Operating Notes for Port Security .
Page 315 Configuring and Monitoring Port Security Overview Overview Feature Default Menu Displaying Current Port Security — page 11-8 page 11-34 Configuring Port Security disabled — page 11-12 page 11-34 Retention of Static Addresses — page 11-18 n/a MAC Lockdown disabled — page 11-23 MAC Lockout disabled...
Page 316: Port Security
Configuring and Monitoring Port Security Port Security Port Security Basic Operation Default Port Security Operation. The default port security setting for each port is off, or “continuous”. That is, any device can access a port without causing a security reaction. Intruder Protection.
Page 317: Eavesdrop Protection
Configuring and Monitoring Port Security Port Security • Static: Enables you to set a fixed limit on the number of MAC addresses authorized for the port and to specify some or all of the authorized addresses. (If you specify only some of the authorized addresses, the port learns the remaining authorized addresses from the traffic it receives from connected devices.) •...
Page 318: Trunk Group Exclusion
Configuring and Monitoring Port Security Port Security configuration to ports on which hubs, switches, or other devices are connected, and to maintain security while also maintaining network access to authorized users. For example: Physical Topology Logical Topology for Access to Switch A Switch A Switch A Port Security...
Page 319: Planning Port Security
Configuring and Monitoring Port Security Port Security Planning Port Security 1. Plan your port security configuration and monitoring according to the following: On which ports do you want port security? b. Which devices (MAC addresses) are authorized on each port? c. For each port, what security actions do you want? (The switch automatically blocks intruders detected on that port from transmit...
Page 320 Configuring and Monitoring Port Security Port Security Port Security Command Options and Operation Port Security Commands Used in This Section show port-security 11-9 show mac-address port-security 11-12 < port-list > 11-12 learn-mode 11-12 address-limit 11-15 mac-address 11-16 action 11-16 clear-intrusion-flag 11-17 no port-security 11-17...
Page 321 Configuring and Monitoring Port Security Port Security Displaying Port Security Settings. Syntax: show port-security show port-security <port number> show port-security [<port number>-<port number>]. . .[,<port number>] The CLI uses the same command to provide two types of port security listings: • All ports on the switch with their Learn Mode and (alarm) Action • Only the specified ports with their Learn Mode, Address...
Page 322 Configuring and Monitoring Port Security Port Security Figure 11-3. Example of the Port Security Configuration Display for a Single Port The next example shows the option for entering a range of ports, including a series of non-contiguous ports. Note that no spaces are allowed in the port number portion of the command string: ProCurve(config)# show port-security A1-A3,A6,A8 11-10...
Page 323 Configuring and Monitoring Port Security Port Security Listing Authorized and Detected MAC Addresses. Syntax: show mac-address [ port-list | mac-address | vlan < vid >] Without an optional parameter, show mac-address lists the authorized MAC addresses that the switch detects on all ports. mac-address: Lists the specified MAC address with the port on which it is detected as an authorized address.
Page 324: Configuring Port Security
Configuring and Monitoring Port Security Port Security Configuring Port Security Using the CLI, you can: ■ Configure port security and edit security settings. Add or delete devices from the list of authorized addresses for one or more ■ ports. Clear the Intrusion flag on specific ports ■...
Page 325 Configuring and Monitoring Port Security Port Security Syntax: port-security (Continued) learn-mode < continuous | static | port-access | configured | limited- continuous > (Continued) static: Enables you to use the mac-address parameter to specify the MAC addresses of the devices authorized for a port, and the address-limit parameter (explained below) to specify the number of MAC addresses authorized for the port.
Page 326 Configuring and Monitoring Port Security Port Security Syntax: port-security (Continued) learn-mode < continuous | static | port-access | configured | limited- continuous > (Continued) Caution: Using the static parameter with a device limit greater than the number of MAC addresses specified with mac-address can allow an un-wanted device to become “authorized”.
Page 327 Configuring and Monitoring Port Security Port Security Syntax: port-security (Continued) Addresses learned this way appear in the switch and port address tables and age out according to the MAC Age Interval in the System Information configuration screen of the Menu interface or the show system-information listing. You can set the MAC age out time using the CLI, SNMP, Web, or menu interfaces.
Page 328 Configuring and Monitoring Port Security Port Security Syntax: port-security (Continued) mac-address [<mac-addr>] [<mac-addr>] . . . [<mac-addr>] Available for learn-mode with the, static, configured, or limited-continuous option. Allows up to eight authorized devices (MAC addresses) per port, depending on the value specified in the address-limit parameter.
Page 329 Configuring and Monitoring Port Security Port Security Syntax: port-security (Continued) clear-intrusion-flag Clears the intrusion flag for a specific port. (See “Reading Intrusion Alerts and Resetting Alert Flags” on page 11-34.) no port-security <port-list> mac-address <mac-addr> [<mac-addr> <mac-addr>] Removes the specified learned MAC address(es) from the specified port.
Page 330: Retention Of Static Addresses
Configuring and Monitoring Port Security Port Security Retention of Static Addresses Static MAC addresses do not age-out. MAC addresses learned by using learn- mode continuous or learn-mode limited-continuous age out according to the currently configured MAC age time. (For information on the mac-age-time command, refer to the chapter titled “Interface Access and System Informa...
Page 331 Configuring and Monitoring Port Security Port Security Specifying Authorized Devices and Intrusion Responses. This example configures port A1 to automatically accept the first device (MAC address) it detects as the only authorized device for that port. (The default device limit is 1.) It also configures the port to send an alarm to a network management station and disable itself if an intruder is detected on the port.
Page 332 Configuring and Monitoring Port Security Port Security Adding an Authorized Device to a Port. To simply add a device (MAC address) to a port’s existing Authorized Addresses list, enter the port number with the mac-address parameter and the device’s MAC address. This assumes that Learn Mode is set to static and the Authorized Addresses list is not full (as determined by the current Address Limit value).
Page 333 Configuring and Monitoring Port Security Port Security (The message Inconsistent value appears if the new MAC address exceeds the current Address Limit or specifies a device that is already on the list. Note that if you change a port from static to continuous learn mode, the port retains in memory any authorized addresses it had while in static mode.
Page 334 Configuring and Monitoring Port Security Port Security Removing a Device From the “Authorized” List for a Port. This command option removes unwanted devices (MAC addresses) from the Authorized Addresses list. (An Authorized Address list is available for each port for which Learn Mode is currently set to “Static”. Refer to the command syntax listing under “Configuring Port Security”...
Page 335 Configuring and Monitoring Port Security MAC Lockdown The following command serves this purpose by removing 0c0090-123456 and reducing the Address Limit to 1: ProCurve(config)# port-security a1 address-limit 1 ProCurve(config)# no port-security a1 mac-address 0c0090- 123456 The above command sequence results in the following configuration for port Figure 11-9.
Page 336 Configuring and Monitoring Port Security MAC Lockdown You will need to enter a separate command for each MAC/VLAN pair you wish to lock down. If you do not specify a VLAN ID (VID) the switch inserts a VID of “1”. How It Works.
Page 337: Differences Between Mac Lockdown And Port Security
Configuring and Monitoring Port Security MAC Lockdown Other Useful Information. Once you lock down a MAC address/VLAN pair on one port that pair cannot be locked down on a different port. You cannot perform MAC Lockdown and 802.1X authentication on the same port or on the same MAC address.
Page 338: Mac Lockdown Operating Notes
Configuring and Monitoring Port Security MAC Lockdown MAC Lockdown Operating Notes Limits. There is a limit of 500 MAC Lockdowns that you can safely code per switch. To truly lock down a MAC address it would be necessary to use the MAC Lockdown command for every MAC Address and VLAN ID on every switch.
Page 339: Deploying Mac Lockdown
Configuring and Monitoring Port Security MAC Lockdown Deploying MAC Lockdown When you deploy MAC Lockdown you need to consider how you use it within your network topology to ensure security. In some cases where you are using techniques such as “meshing” or Spanning Tree Protocol (STP) to speed up network performance by providing multiple paths for devices, using MAC Lockdown either will not work or else it defeats the purpose of having multiple data paths.
Page 340 Configuring and Monitoring Port Security MAC Lockdown Internal Server “A” Core 5400zl Switch 5400zl Switch Network There is no need to lock MAC addresses on switches in the internal core network. 3500yl Switch 3500yl Switch Network Edge Lock Server “A” to these ports.
Page 341 Configuring and Monitoring Port Security MAC Lockdown The key points for this Model Topology are: • The Core Network is separated from the edge by the use of switches which have been “locked down” for security. • All switches connected to the edge (outside users) each have only one port they can use to connect to the Core Network and then to Server A.
Page 342 Configuring and Monitoring Port Security MAC Lockdown Internal Network PROBLEM: If this link fails, Server A traffic to Server A will not use the backup path via Switch 3 Switch 3 Switch 4 Server A is locked down to Switch 1, Uplink 2 Switch 2 Switch 1 External...
Page 343: Mac Lockout
Configuring and Monitoring Port Security MAC Lockout MAC Lockout MAC Lockout involves configuring a MAC address on all ports and VLANs for a switch so that any traffic to or from the “locked-out” MAC address will be dropped. This means that all data packets addressed to or from the given address are stopped by the switch.
Page 344 Configuring and Monitoring Port Security MAC Lockout MAC Lockout overrides MAC Lockdown, port security, and 802.1X authenti cation. You cannot use MAC Lockout to lock: • Broadcast or Multicast Addresses (Switches do not learn these) • Switch Agents (The switch’s own MAC Address) There are limits for the number of VLANs, Multicast Filters, and Lockout MACs that can be configured concurrently as all use MAC table entries.
Page 345: Port Security And Mac Lockout
Configuring and Monitoring Port Security MAC Lockout Port Security and MAC Lockout MAC Lockout is independent of port-security and in fact will override it. MAC Lockout is preferable to port-security to stop access from known devices because it can be configured for all ports on the switch with one command. It is possible to use MAC Lockout in conjunction with port-security.
Page 346: Web: Displaying And Configuring Port Security Features
Configuring and Monitoring Port Security Web: Displaying and Configuring Port Security Features Web: Displaying and Configuring Port Security Features Click on the Security tab. Click on [Port Security] 3. Select the settings you want and, if you are using the Static Learn Mode, add or edit the Authorized Addresses field.
Page 347: How The Intrusion Log Operates
Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags The switch enables notification of the intrusion through the following ■ means: • In the CLI: The show port-security intrusion-log command displays the – Intrusion Log The log command displays the Event Log –...
Page 348: Keeping The Intrusion Log Current By Resetting Alert Flags
Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags The log shows the most recent intrusion at the top of the listing. You cannot delete Intrusion Log entries (unless you reset the switch to its factory-default configuration). Instead, if the log is filled when the switch detects a new intrusion, the oldest entry is dropped off the listing and the newest entry appears at the top of the listing.
Page 349: Menu: Checking For Intrusions, Listing Intrusion Alerts, And Resetting Alert Flags
Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags Menu: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags The menu interface indicates per-port intrusions in the Port Status screen, and provides details and the reset function in the Intrusion Log screen. From the Main Menu select: 1.
Page 350: Cli: Checking For Intrusions, Listing Intrusion Alerts, And Resetting Alert Flags
Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags • Because the Port Status screen (figure 11-14 on page 11-37) does not indicate an intrusion for port A1, the alert flag for the intru sion on port A1 has already been reset. •...
Page 351 Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags clear intrusion-flags Clear intrusion flags on all ports. port-security [e] < port-number > clear-intrusion-flag Clear the intrusion flag on one or more specific ports. In the following example, executing show in terfaces brief lists the switch’s port status, which indicates an intrusion alert on port A1.
Page 352: Using The Event Log To Find Intrusion Alerts
Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags To clear the intrusion from port A1 and enable the switch to enter any subsequent intrusion for port A1 in the Intrusion Log, execute the port-security clear-intrusion-flag command. If you then re-display the port status screen, you will see that the Intrusion Alert entry for port A1 has changed to “No”.
Page 353 Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags Log Command Log Listing with with Security Violation “security” for Detected Search Log Listing with No Security Violation Detected Figure 11-19.Example of Log Listing With and Without Detected Security Violations From the Menu Interface: In the Main Menu, click on 4.
Page 354 Configuring and Monitoring Port Security Operating Notes for Port Security Operating Notes for Port Security Identifying the IP Address of an Intruder. The Intrusion Log lists detected intruders by MAC address. If you are using ProCurve Manager to manage your network, you can use the device properties page to link MAC addresses to their corresponding IP addresses.
Page 355 Configuring and Monitoring Port Security Operating Notes for Port Security ProCurve(config)# port-security e a17 learn-mode static address-limit 2 LACP has been disabled on secured port(s). ProCurve(config)# The switch will not allow you to configure LACP on a port on which port security is enabled.
Page 356 Configuring and Monitoring Port Security Operating Notes for Port Security 11-44...
Page 357 Using Authorized IP Managers Contents Overview ........... . 12-2 Options .
Page 358: Overview
Using Authorized IP Managers Overview Overview Authorized IP Manager Features Feature Default Menu Listing (Showing) Authorized page 12-5 page 12-6 page 12-9 Managers Configuring Authorized IP None page 12-5 page 12-6 page 12-9 Managers Building IP Masks page 12-9 page 12-9 page 12-9 Operating and Troubleshooting page 12-12 page 12-12 page 12-12...
Page 359: Access Levels
Using Authorized IP Managers Options Options You can configure: ■ Up to 10 authorized manager addresses, where each address applies to either a single management station or a group of stations Manager or Operator access privileges (for Telnet, SNMPv1, and ■...
Page 360: Defining Authorized Management Stations
Using Authorized IP Managers Defining Authorized Management Stations Defining Authorized Management Stations Authorizing Single Stations: The table entry authorizes a single man ■ agement station to have IP access to the switch. To use this method, just enter the IP address of an authorized management station in the Autho rized Manager IP column, and leave the IP Mask set to 255.255.255.255.
Page 361: Menu: Viewing And Configuring Ip Authorized Managers
Using Authorized IP Managers Defining Authorized Management Stations rized Manager IP address to authorize four IP addresses for management station access. The details on how to use IP masks are provided under “Building IP Masks” on page 12-9. N o t e The IP Mask is a method for recognizing whether a given IP address is authorized for management access to the switch.
Page 362: Cli: Viewing And Configuring Authorized Ip Managers
Using Authorized IP Managers Defining Authorized Management Stations 2. Enter an Authorized Manager IP address here. 3. Use the default mask to allow access by one management device, or edit the mask to allow access by a block of management devices. See “Building IP Masks”...
Page 363 Using Authorized IP Managers Defining Authorized Management Stations Figure 12-3.Example of the Show IP Authorized-Manager Display The above example shows an Authorized IP Manager List that allows stations to access the switch as shown below: IP Mask Authorized Station IP Address: Access Mode: 255.255.255.252 10.28.227.100 through 103...
Page 364 Using Authorized IP Managers Defining Authorized Management Stations If you omit the < mask bits > when adding a new authorized manager, the switch automatically uses 255.255.255.255. If you do not specify either Manager or Operator access, the switch assigns the Manager access. For example: Omitting a mask in the ip authorized-managers command results in a default mask of 255.255.255.255, which authorizes only the specified station.
Page 365: Web: Configuring Ip Authorized Managers
Using Authorized IP Managers Web: Configuring IP Authorized Managers Web: Configuring IP Authorized Managers In the web browser interface you can configure IP Authorized Managers as described below. To Add, Modify, or Delete an IP Authorized Manager address: Click on the Security tab. Click on [Authorized Addresses].
Page 366: Configuring Multiple Stations Per Authorized Manager Ip Entry
Using Authorized IP Managers Building IP Masks Configuring Multiple Stations Per Authorized Manager IP Entry The mask determines whether the IP address of a station on the network meets the criteria you specify. That is, for a given Authorized Manager entry, the switch applies the IP mask to the IP address you specify to determine a range of authorized IP addresses for management access.
Page 367 Using Authorized IP Managers Building IP Masks Figure 12-6. Analysis of IP Mask for Multiple-Station Entries Manager-Level or Operator-Level Device Access Octet Octet Octet Octet IP Mask The “255” in the first three octets of the mask specify that only the exact value in the octet of the corresponding IP address is allowed.
Page 368: Additional Examples For Authorizing Multiple Stations
Using Authorized IP Managers Operating Notes Additional Examples for Authorizing Multiple Stations Entries for Authorized Results Manager List IP Mask 255 255 0 This combination specifies an authorized IP address of 10.33.xxx.1. It could be applied, for example, to a subnetted network where each subnet is defined by the Authorized 248 1 third octet and includes a management station defined by the value of “1”...
Page 369 Using Authorized IP Managers Operating Notes • Even if you need proxy server access enabled in order to use other applications, you can still eliminate proxy service for web access to the switch. To do so, add the IP address or DNS name of the switch to the non-proxy, or “Exceptions”...
Page 370 Using Authorized IP Managers Operating Notes — This page is intentionally unused. — 12-14...
Page 371 Key Management System Contents Overview ........... . 13-2 Terminology .
Page 372: Overview
Key Management System Overview Overview The switches covered in this guide provide support for advanced routing capabilities. Security turns out to be extremely important as complex net- works and the internet grow and become a part of our daily life and business. This fact forces protocol developers to improve security mechanisms employed by their protocols, which in turn becomes an extra burden for system administrators who have to set up and maintain them.
Page 373: Configuring Key Chain Management
Key Management System Configuring Key Chain Management Configuring Key Chain Management KMS-Related CLI Commands in This Section Page show key-chain < chain_name > page 13-3 [ no ] key-chain chain_name page 13-3 [ no ] key-chain chain_name key Key_ID page 13-4 The Key Management System (KMS) has three configuration steps: Create a key chain entry.
Page 374: Assigning A Time-Independent Key To A Chain
Key Management System Configuring Key Chain Management Add new key chain Entry “Procurve1”. Display key chain entries. Figure 13-1. Adding a New Key Chain Entry After you add an entry, you can assign key(s) to it for use by a KMS-enabled protocol.
Page 375: Assigning Time-Dependent Keys To A Chain
Key Management System Configuring Key Chain Management Adds a new Time-Independent key to the “Procurve1” chain. Displays keys in the key chain entry. Figure 13-2. Example of Adding and Displaying a Time-Independent Key to a Key Chain Entry Assigning Time-Dependent Keys to a Chain A time-dependent key has Accept or Send time constraints.
Page 376 Key Management System Configuring Key Chain Management duration < mm/dd/yy [ yy ] hh:mm:ss | seconds > Specifies the time period during which the switch can use this key to authenticate inbound packets. Duration is either an end date and time or the number of seconds to allow after the start date and time (which is the accept-lifetime setting).
Page 377 Key Management System Configuring Key Chain Management Note Given transmission delays and the variations in the time value from switch to switch, it is advisable to include some flexibility in the Accept lifetime of the keys you configure. Otherwise, the switch may disregard some packets because either their key has expired while in transport or there are significant time variations between switches.
Page 378 Key Management System Configuring Key Chain Management The “Procurve1” key chain entry is a time-independent key and will not expire. “Procurve2” uses time-dependent keys, which result in this data: Expired = 1 Key 1 has expired because its lifetime ended at 8:10 on 01/18/03, the previous day.
Page 379 Index configuring method … 10-21 control all clients … 10-12 control command … 10-19 convert to port-based … 10-18 Numerics CoS override … 10-46, 10-48 3DES … 7-3, 8-3 counters … 10-46 802.1X access control delay move to unauthorized-client authenticate users … 10-5 VLAN …...
Page 380 suspended VLAN … 10-49 client not using … 10-29 unauthorized client … 10-26 configuring switch port … 10-44 use model … 10-26 enabling switch port … 10-44 VLAN, after authentication … 10-26, 10-32, identity option … 10-44 10-39 secret … 10-44 VLAN, tagged …...
Page 381 to delete password protection … 2-6 configuration aaa authentication … 5-8 filters … 9-2 aaa authenticaton port security … 11-7 web browser … 6-11 RADIUS aaa port-access See RADIUS. See Web or MAC Authentication. access levels, authorized IP managers … 12-3 See SSH.
Page 382 operation … 1-10, 3-5 filter type … 9-8 options … 3-5 idx … 9-8, 9-22 penalty period, throttling … 3-13 index … 9-8, 9-22 port setting change, effect … 3-8 operating rules … 9-4, 9-6 reboot after enable … 3-11 port-trunk operation …...
Page 383 terminology … 4-9 MAC Lockdown … 11-3 key chain MAC Lockout … 11-3 See KMS key chain. manager password … 2-3, 2-5, 2-6 key management system manager password recommended … 5-7 See KMS. MD5 KMS See RADIUS. accept key time … 13-5, 13-7 message assigning a time-dependent key …...
Page 384 port accounting, interim updating … 6-27 security configuration … 11-3 accounting, network … 6-25, 6-26 port access accounting, operating rules … 6-22 client limit … 10-18 accounting, server failure … 6-22 concurrent … 10-18 accounting, session-blocking … 6-27 MAC auth … 10-4 accounting, start-stop method …...
Page 385 authentication, web … 6-10 generating key pairs … 7-10 authentication, web browser … 6-11, 6-13 host key pair … 7-11 web browser security not supported … 6-7 key, babble … 7-11 RADIUS accounting key, fingerprint … 7-11 See RADIUS. keys, zeroing … 7-11 Radius Authentication key-size …...
Page 386 host key pair … 8-10 general operation … 5-2 key, babble … 8-12 IP address, server … 5-15 key, fingerprint … 8-12 local manager password requirement … 5-26 man-in-the-middle spoofing … 8-18 messages … 5-25 OpenSSL … 8-2 NAS … 5-3 operating notes …...
Page 387 802.1X … 10-53 802.1X, ID changes … 10-56 802.1X, suspend untagged VLAN … 10-49 connection-rate filtering … 3-21 not advertised for GVRP … 10-56 warranty … 1-ii Web auth port access … 10-4 Web Authentication authenticator operation … 4-5 blocked traffic … 4-4 CHAP defined …...
Page 388 10 – Index...
Page 390 Technical information in this document is subject to change without notice. © Copyright 2000, 2006. Hewlett-Packard Development Company, L.P. Reproduction, adaptation, or translation without prior written permission is prohibited except as allowed under the copyright laws. January 2006 Manual Part Number 5991-3828...

This manual is also suitable for:

Procurve 5400zl series Procurve 3500yl series Procurve 5406zl Procurve 5412zl Procurve 3500yl-24g-pwr intelligent edge Procurve 3500yl-48g-pwr intelligent edge ... Show all

HP ProCurve 6200yl Series Access Security Manual

Table of Contents

Configuring Username and Password Security/

Virus Throttling/

Web and Mac Authentication/

Tacacs+ Authentication/

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Quick Links

Chapters

Related Manuals for HP ProCurve 6200yl Series

Summary of Contents for HP ProCurve 6200yl Series