HP FlexNetwork 10500 Series Security Configuration Manual page 13

Enabling MACsec desire ································································································································ 494
Configuring a preshared key ·························································································································· 495
Configuring the MKA key server priority ········································································································ 495
Configuring MACsec protection parameters in interface view ······································································· 495
Configuring the MACsec confidentiality offset ························································································ 496
Configuring MACsec replay protection ··································································································· 496
Configuring the MACsec validation mode ······························································································ 496
Configuring MACsec protection parameters by MKA policy ·········································································· 497
Configuring an MKA policy ····················································································································· 497
Applying an MKA policy ························································································································· 498
Displaying and maintaining MACsec ············································································································· 498
Device-oriented MACsec configuration example ··························································································· 498
Network requirements ···························································································································· 498
Configuration procedure ························································································································· 499
Verifying the configuration ······················································································································ 500
Troubleshooting MACsec ······························································································································· 502
Configuring MFF ························································································· 503
Overview ························································································································································ 503
Basic concepts ······································································································································· 504
MFF operation modes ···························································································································· 504
MFF working mechanism ······················································································································· 505
Protocols and standards ························································································································ 505
Configuring MFF ············································································································································ 505
Enabling MFF ········································································································································· 505
Configuring a network port ····················································································································· 506
Enabling periodic gateway probe ··········································································································· 506
Specifying the IP addresses of servers ·································································································· 506
Displaying and maintaining MFF ···················································································································· 507
MFF configuration examples ·························································································································· 507
Auto-mode MFF configuration example in a tree network ····································································· 507
Auto-mode MFF configuration example in a ring network ······································································ 509
Manual-mode MFF configuration example in a tree network ································································· 511
Manual-mode MFF configuration example in a ring network ································································· 512
Configuring ND attack defense ··································································· 514
Overview ························································································································································ 514
Configuration restrictions and guidelines ······································································································· 514
Configuring source MAC consistency check for ND messages ····································································· 514
Configuring ND attack detection ···················································································································· 515
About ND attack detection ····················································································································· 515
Configuration guidelines ························································································································· 515
Configuration procedure ························································································································· 516
Displaying and maintaining ND attack detection ···························································································· 516
Configuring RA guard ···································································································································· 516
About RA guard ······································································································································ 516
Specifying the role of the attached device ····························································································· 517
Configuring an RA guard policy ············································································································· 517
Enabling the RA guard logging feature ·································································································· 518
Displaying and maintaining RA guard ············································································································ 518
RA guard configuration example ···················································································································· 518
Network requirements ···························································································································· 518
Configuration procedure ························································································································· 519
Verifying the configuration ······················································································································ 520
Configuring keychains ················································································· 521
Overview ························································································································································ 521
Configuration procedure ································································································································ 521
Displaying and maintaining keychain ············································································································· 522
Keychain configuration example ···················································································································· 522
Network requirements ···························································································································· 522
Configuration procedure ························································································································· 522
xi