HP ProCurve 9304M Security Manual page 25

ProCurveRS(config)# telnet login-retries 5
Syntax: [no] telnet login-retries <number>
You can specify from 0 – 5 attempts. The default is 4 attempts.
Restricting Remote Access to the Device to Specific VLAN IDs
You can restrict management access to an HP device to ports within a specific port-based VLAN. VLAN-based
access control applies to the following access methods:
• Telnet access
• Web management access
• SNMP access
• TFTP access
By default, access is allowed for all the methods listed above on all ports. Once you configure security for a given
access method based on VLAN ID, access to the device using that method is restricted to only the ports within the
specified VLAN.
VLAN-based access control works in conjunction with other access control methods. For example, suppose you
configure an ACL to permit Telnet access only to specific client IP addresses, and you also configure VLAN-based
access control for Telnet access. In this case, the only Telnet clients that can access the device are clients that
have one of the IP addresses permitted by the ACL and are connected to a port that is in a permitted VLAN.
Clients who have a permitted IP address but are connected to a port in a VLAN that is not permitted still cannot
access the device through Telnet.
Restricting Telnet Access to a Specific VLAN
To allow Telnet access only to clients in a specific VLAN, enter a command such as the following:
ProCurveRS(config)# telnet server enable vlan 10
The command in this example configures the device to allow Telnet management access only to clients connected
to ports within port-based VLAN 10. Clients connected to ports that are not in VLAN 10 are denied management
access.
Syntax: [no] telnet server enable vlan <vlan-id>
Restricting Web Management Access to a Specific VLAN
To allow Web management access only to clients in a specific VLAN, enter a command such as the following:
ProCurveRS(config)# web-management enable vlan 10
The command in this example configures the device to allow Web management access only to clients connected
to ports within port-based VLAN 10. Clients connected to ports that are not in VLAN 10 are denied management
access.
Syntax: [no] web-management enable vlan <vlan-id>
Restricting SNMP Access to a Specific VLAN
To allow SNMP access only to clients in a specific VLAN, enter a command such as the following:
ProCurveRS(config)# snmp-server enable vlan 40
The command in this example configures the device to allow SNMP access only to clients connected to ports
within port-based VLAN 40. Clients connected to ports that are not in VLAN 40 are denied access.
Syntax: [no] snmp-server enable vlan <vlan-id>
Restricting TFTP Access to a Specific VLAN
To allow TFTP access only to clients in a specific VLAN, enter a command such as the following:
ProCurveRS(config)# tftp client enable vlan 40
June 2005
Securing Access to Management Functions
2 - 9