HPE FlexNetwork 10500 Series Security Configuration Manual page 12

Specifying the source IP address for SFTP packets ·············································································· 414
Establishing a connection to an SFTP server ························································································ 414
Deleting server public keys saved in the public key file on the SFTP client··········································· 416
Establishing a connection to an SFTP server based on Suite B ···························································· 417
Working with SFTP directories ··············································································································· 417
Working with SFTP files ························································································································· 418
Displaying help information ···················································································································· 418
Terminating the connection with the SFTP server ················································································· 418
Configuring the device as an SCP client ········································································································ 418
SCP client configuration task list ············································································································ 418
Generating local key pairs ······················································································································ 419
Establishing a connection to an SCP server ·························································································· 419
Deleting server public keys saved in the public key file on the SCP client ············································ 421
Establishing a connection to an SCP server based on Suite B······························································ 422
Specifying algorithms for SSH2 ····················································································································· 422
Specifying key exchange algorithms for SSH2 ······················································································ 422
Specifying public key algorithms for SSH2 ···························································································· 423
Specifying encryption algorithms for SSH2 ···························································································· 423
Specifying MAC algorithms for SSH2 ···································································································· 424
Displaying and maintaining SSH ···················································································································· 424
Stelnet configuration examples ······················································································································ 425
Password authentication enabled Stelnet server configuration example ··············································· 425
Publickey authentication enabled Stelnet server configuration example ··············································· 427
Password authentication enabled Stelnet client configuration example ················································ 433
Publickey authentication enabled Stelnet client configuration example ················································· 436
Stelnet configuration example based on 128-bit Suite B algorithms ······················································ 438
SFTP configuration examples ························································································································ 442
Password authentication enabled SFTP server configuration example ················································· 442
Publickey authentication enabled SFTP client configuration example ··················································· 445
SFTP configuration example based on 192-bit Suite B algorithms ························································ 448
SCP configuration examples ·························································································································· 452
SCP configuration example with password authentication ···································································· 452
SCP configuration example based on Suite B algorithms ······································································ 454
NETCONF over SSH configuration example with password authentication ·················································· 460
Network requirements ···························································································································· 460
Configuration procedure ························································································································· 461
Verifying the configuration ······················································································································ 462
Configuring SSL ························································································ 463
Overview ························································································································································ 463
SSL security services ····························································································································· 463
SSL protocol stack ································································································································· 463
FIPS compliance ············································································································································ 464
SSL configuration task list ······························································································································ 464
Configuring an SSL server policy ··················································································································· 464
Configuring an SSL client policy ···················································································································· 467
Displaying and maintaining SSL ···················································································································· 469
SSL server policy configuration example ······································································································· 469
Configuring attack detection and prevention ·············································· 472
Overview ························································································································································ 472
Attacks that the device can prevent ··············································································································· 472
Single-packet attacks ····························································································································· 472
Scanning attacks ···································································································································· 473
Flood attacks ·········································································································································· 474
TCP fragment attack ······························································································································ 475
Login DoS attack ···································································································································· 475
Login dictionary attack ··························································································································· 475
Blacklist feature ·············································································································································· 475
IP blacklist ·············································································································································· 475
User blacklist ·········································································································································· 476
Attack detection and prevention configuration task list ·················································································· 476
x