HP ProCurve 9304M Security Manual page 28

Security Guide for ProCurve 9300/9400 Series Routing Switches
USING THE WEB MANAGEMENT INTERFACE
1. Log on to the device using a valid user name and password for read-write access. The System configuration
dialog is displayed.
2. Select the Management link from the System configuration panel to display the Management configuration
panel.
3. Click Disable next to SNMP.
4. Click the Apply button to save the change to the device's running-config file.
5. Select the Save link at the bottom of the dialog. Select Yes when prompted to save the configuration change
to the startup-config file on the device's flash memory.
Disabling an Interface's Access to Management Functions
Beginning In software release 07.7.00, you can protect the CPU from remote access to management functions
such as:
• Telnet
• SSH
• Web Management Interface
• S NMP
• T FTP
• R ADIUS
• T ACACS
• T ACACS+
To enable this feature, disable access to the Management IP address through the device's Content Addressable
Memory (CAM). The following shows an example configuration.
NOTE: This feature does not affect Layer 3 routing functions.
ProCurveRS(config)# int e 3/10
ProCurveRS(config-if-e1000-3/10)# ip address 10.10.10.1 255.255.255.0
ProCurveRS(config-if-e1000-3/10)# exit
ProCurveRS(config)# int e 3/11
ProCurveRS(config-if-e1000-3/11)# ip address 11.11.11.1 255.255.255.0
ProCurveRS(config-if-e1000-3/11)# management-ip-disable
ProCurveRS(config-if-e1000-3/11)# exit
ProCurveRS(config)# int e 3/12
ProCurveRS(config-if-e1000-3/12)# ip address 12.12.12.1 255.255.255.0
ProCurveRS(config-if-e1000-3/12)# management-ip-disable
ProCurveRS(config-if-e1000-3/12)# exit
ProCurveRS(config)# int e 3/13
ProCurveRS(config-if-e1000-3/13)# ip address 13.13.13.1 255.255.255.0
ProCurveRS(config-if-e1000-3/13)# management-ip-disable
ProCurveRS(config-if-e1000-3/13)# exit
Syntax: [no] ip address <ip-addr> <ip-mask>
where <ip-addr> and <ip-mask> are the destination IP address and subnet mask.
Syntax: [no] management-ip-disable
Use the no form of the command to re-enable access to the Management IP address.
2 - 12 June 2005