HPE Moonshot 45Gc Security Configuration Manual page 6

Displaying and maintaining portal ·················································································································· 145
Portal configuration examples ························································································································ 146
Configuring direct portal authentication ·································································································· 146
Configuring re-DHCP portal authentication ···························································································· 153
Configuring cross-subnet portal authentication ······················································································ 157
Configuring extended direct portal authentication ·················································································· 159
Configuring extended re-DHCP portal authentication ············································································ 162
Configuring extended cross-subnet portal authentication ······································································ 166
Configuring portal server detection and portal user synchronization ····················································· 169
Configuring cross-subnet portal authentication for MPLS L3VPNs························································ 177
Configuring direct portal authentication using local portal Web server ·················································· 179
Troubleshooting portal ··································································································································· 182
No portal authentication page is pushed for users ················································································· 182
Cannot log out portal users on the access device ················································································· 182
Cannot log out portal users on the RADIUS server ··············································································· 183
Users logged out by the access device still exist on the portal authentication server···························· 183
Re-DHCP portal authenticated users cannot log in successfully ··························································· 183
Configuring port security ············································································· 185
Overview ························································································································································ 185
Port security features ····························································································································· 185
Port security modes ······························································································································· 185
Configuration task list ····································································································································· 188
Enabling port security ···································································································································· 188
Setting port security's limit on the number of secure MAC addresses on a port ············································ 189
Setting the port security mode ······················································································································· 189
Configuring port security features ·················································································································· 190
Configuring NTK ····································································································································· 190
Configuring intrusion protection ············································································································· 191
Configuring secure MAC addresses ·············································································································· 191
Configuration prerequisites ···················································································································· 192
Configuration procedure ························································································································· 192
Ignoring authorization information from the server ························································································ 193
Enabling MAC move ······································································································································ 193
Applying NAS-ID profile to port security ········································································································· 194
Enabling the authorization-fail-offline feature ································································································· 194
Displaying and maintaining port security ······································································································· 195
Port security configuration examples ············································································································· 195
autoLearn configuration example ··········································································································· 195
userLoginWithOUI configuration example ······························································································ 197
macAddressElseUserLoginSecure configuration example ···································································· 200
Troubleshooting port security ························································································································· 203
Cannot set the port security mode ········································································································· 203
Cannot configure secure MAC addresses ····························································································· 204
Configuring password control ····································································· 205
Overview ························································································································································ 205
Password setting ···································································································································· 205
Password updating and expiration ········································································································· 206
User login control ··································································································································· 207
Password not displayed in any form ······································································································ 207
Logging ·················································································································································· 207
FIPS compliance ············································································································································ 208
Password control configuration task list ········································································································· 208
Enabling password control ····························································································································· 208
Setting global password control parameters ·································································································· 209
Setting user group password control parameters ·························································································· 210
Setting local user password control parameters ···························································································· 211
Setting super password control parameters ·································································································· 211
Displaying and maintaining password control ································································································ 212
Password control configuration example ······································································································· 212
Network requirements ···························································································································· 212
iv