Fips Compliance; Aaa Configuration Considerations And Task List - HPE FlexNetwork MSR Series Comware 5 Security Configuration Manual

No. Sub-attribute
62 User_HeartBeat
140 User_Group
141 Security_Level
201 Input-Interval-Octets
202 Output-Interval-Octets
203 Input-Interval-Packets
204 Output-Interval-Packets
205 Input-Interval-Gigawords
Output-Interval-Gigaword
206
s
207 Backup-NAS-IP
255 Product_ID

FIPS compliance

Table 4
shows the support of MSR routers for the FIPS mode that complies with NIST FIPS 140-2
requirements. Support for features, commands, and parameters might differ in FIPS mode and
non-FIPS mode. For more information about FIPS mode, see "Configuring FIPS."
Table 4 Hardware and FIPS mode compatibility matrix
Hardware
MSR900
MSR93X
MSR20-1X
MSR20
MSR30
MSR50
MSR1000

AAA configuration considerations and task list

To configure AAA on the NAS:
1. Configure the required AAA schemes.
Description
Hash value assigned after an 802.1X user passes authentication, which
is a 32-byte string. This attribute is stored in the user list on the NAS and
is used for verifying the handshake messages from the 802.1X user.
This attribute only exists in Access-Accept and Accounting-Request
packets.
User groups assigned after the SSL VPN user passes authentication. A
user might belong to more than one user group. In this case, the user
groups are delimited by semi-colons. This attribute is used for
cooperation with the SSL VPN device.
Security level assigned after the SSL VPN user passes security
authentication.
Number of bytes input within a real-time accounting interval.
Number of bytes output within a real-time accounting interval.
Number of packets input within an accounting interval, in the unit set on
the NAS.
Number of packets output within an accounting interval, in the unit set
on the NAS.
Amount of bytes input within an accounting interval, in units of 4G bytes.
Amount of bytes output within an accounting interval, in units of 4G
bytes.
Backup source IP address for sending RADIUS packets.
Product name.
FIPS mode compatibility
No
No
No
Yes
Yes (except the MSR30-16)
Yes
Yes
20