HP ProCurve 9304M Security Manual page 23

ProCurveRS(config)# web access-group 10 vlan 3
ProCurveRS(config)# snmp-server community private rw 10 vlan 3
In this example, a Layer 3 VLAN is configured as a remote-access management VLAN and a router interface. The
IP address specified for the router interface becomes the management IP address of the VLAN.
When you make changes to the ACL configuration and/or make changes to the management VLAN, you must
enter the following command after making the configuration changes:
ProCurveRS(config)# remote-management rebind
Syntax: remote-management rebind
The show cam l4 command displays the following information about the hardware filtering in this configuration:
ProCurveRS# show cam l4 3/1
Sl Index Src IP_Addr
3 40960 192.64.22.254/32
3 40962 192.168.12.254/32
3 40964 192.168.2.254/32
3 40966 10.10.11.254/32
3 40968
The IP address in standard ACL 10 is the source IP address of the filter entry, and the IP address of the router
interface is the destination IP address of the filter entry.
Restricting Remote Access to the Device to Specific IP Addresses
By default, an HP device does not control remote management access based on the IP address of the managing
device. You can restrict remote management access to a single IP address for the following access methods:
• Telnet access
• Web management access
• SNMP access
In addition, if you want to restrict all three access methods to the same IP address, you can do so using a single
command.
The following examples show the CLI commands for restricting remote access. You can specify only one IP
address with each command. However, you can enter each command ten times to specify up to ten IP addresses.
NOTE: You cannot restrict remote management access using the Web management interface.
Restricting Telnet Access to a Specific IP Address
To allow Telnet access to the HP device only to the host with IP address 209.157.22.39, enter the following
command:
ProCurveRS(config)# telnet-client 209.157.22.39
Syntax: [no] telnet-client <ip-addr>
Restricting SSH Access to a Specific IP Address
To allow SSH access to the HP device only to the host with IP address 209.157.22.39, enter the following
command:
ProCurveRS(config)# ip ssh client 209.157.22.39
Syntax: [no] ip ssh client <ip-addr>
June 2005
SPort Dest IP_Addr
Any 10.10.11.1/24
Any 10.10.11.1/24
Any 10.10.11.1/24
Any 10.10.11.1/24
Any Any 10.10.11.1/24
Securing Access to Management Functions
DPort Prot Age
23 TCP dis Use L2/L3
23 TCP dis Use L2/L3
23 TCP dis Use L2/L3
23 TCP dis Use L2/L3
23 TCP dis
Out Port
Discard
2 - 7