Connection-Rate Filtering Based On Virus-Throttling Technology; Identity-Driven Management (Idm) - HP ProCurve Series 3400cl Release Notes

keys.) KMS provides specific instances of routing protocols with one or more Send or Accept keys
that must be active at the time of a request.
Refer to the chapter titled "Key Management System" in the Access Security Guide for your switch
model.

Connection-Rate Filtering Based On Virus-Throttling Technology

While not specifically a tool for controlling network access, this feature does help to protect the
network from attack and is recommeded for use on the network edge. It is primarily focused on the
class of worm-like malicious code that tries to replicate itself by taking advantage of weaknesses in
network applications behind unsecured ports. In this case, the malicious code tries to create a large
number of outbound IP connections on a routed interface in a short time. Connection-Rate filtering
detects hosts that are generating routed traffic that exhibits this behavior, and causes the switch to
generate warning messages and (optionally) to either throttle routed traffic from the offending hosts
or drop all traffic from the offending hosts.
Refer to the chapter titled "Virus Throttling" in the Access Security Guide for your switch model.

Identity-Driven Management (IDM)

IDM is a plug-in to ProCurve Manager Plus (PCM+) and uses RADIUS-based technologies to create
a user-centric approach to network access management and network activity tracking and moni-
toring. IDM enables control of access security policy from a central management server, with policy
enforcement to the network edge, and protection against both external and internal threats.
Using IDM, a system administrator can configure automatic and dynamic security to operate at the
network edge when a user connects to the network. This operation enables the network to distinguish
among different users and what each is authorized to do. Guest access can also be configured without
compromising internal security. This means that users can be identified and either approved or denied
at the edge of the network instead of in the core.
Criteria for enforcing RADIUS-based security for IDM applications includes classifiers such as:
■ authorized user identity
authorized device identity (MAC address)
■
■ software running on the device
physical location in the network
■
■ time of day
Responses can be configured to support the networking requirements, user (SNMP) community,
service needs, and access security level for a given client and device.
For more information on IDM, visit the ProCurve web site at
Products and Solutions, then Identity Driven Management (under Network Management).
Enforcing Switch Security
Network Access Security
http://www.procurve.com and click on
19