Fips Compliance; Aaa Configuration Considerations And Task List - HP 5120 SI Series Security Configuration Manual

No. Sub-attribute
60 Ip_Host_Addr
61 User_Notify
62 User_HeartBeat
140 User_Group
141 Security_Level
201 Input-Interval-Octets
202 Output-Interval-Octets
203 Input-Interval-Packets
204 Output-Interval-Packets
205 Input-Interval-Gigawords
206 Output-Interval-Gigawords
207 Backup-NAS-IP
255 Product_ID

FIPS compliance

The device supports the FIPS mode that complies with NIST FIPS 140-2 requirements. Support for features,
commands, and parameters might differ in FIPS mode (see

AAA configuration considerations and task list

To configure AAA, you must complete these tasks on the NAS:
1. Configure the required AAA schemes:
Local authentication—Configure local users and the related attributes, including the usernames
and passwords of the users to be authenticated.
Remote authentication—Configure the required RADIUS and HWTACACS schemes, and
configure user attributes on the servers accordingly.
2. Configure AAA methods for the users' ISP domains:
Authentication method—No authentication (none), local authentication (local), or remote
authentication (scheme)
Description
IP address and MAC address of the user carried in authentication and
accounting requests, in the format A.B.C.D hh:hh:hh:hh:hh:hh. A space
is required between the IP address and the MAC address.
Information that needs to be sent from the server to the client
transparently
Hash value assigned after an 802.1X user passes authentication, which
is a 32-byte string. This attribute is stored in the user list on the device and
is used for verifying the handshake messages from the 802.1X user. This
attribute exists in only Access-Accept and Accounting-Request packets.
User groups assigned after the SSL VPN user passes authentication. A
user may belong to more than one user group. In this case, the user
groups are delimited by semi-colons. This attribute is used for
cooperation with the SSL VPN device.
Security level assigned after the SSL VPN user passes security
authentication
Bytes input within a real-time accounting interval
Bytes output within a real-time accounting interval
Packets input within an accounting interval, in the unit set on the device
Packets output within an accounting interval, in the unit set on the device
Result of bytes input within an accounting interval divided by 4G bytes
Result of bytes output within an accounting interval divided by 4G bytes
Backup source IP address for sending RADIUS packets
Product name
14
"Configuring FIPS") and non-FIPS mode.