General Switch Traffic Security Guideline - HP ProCurve 6400cl Series Access Security Manual

Getting Started

General Switch Traffic Security Guideline

1-10
Port-Based Access Control (802.1X) (page 10-1): On point-to-point
■
connections, enables the switch to allow or deny traffic between a port
and an 802.1x-aware device (supplicant) attempting to access the switch.
Also enables the switch to operate as a supplicant for connections to other
802.1x-aware switches. Includes the option of allowing only the device
having the first MAC address detected by a port.
■ Port Security (page 11-1): Enables a switch port to maintain a unique
list of MAC addresses defining which specific devices are allowed to
access the network through that port. Also enables a port to detect,
prevent, and log access attempts by unauthorized devices.
MAC Lockdown (page 11-21): Permanently assigns a device MAC
■
address to a specific port on the switch to restrict a client device to a
specific port.
■ MAC Lockout (page 11-29): Causes the switch to drop traffic carrying
a specific MAC address as either a source or destination.
Authorized IP Managers (page 12-1): Allows access to the switch by
■
a networked device having an IP address previously configured in the
switch as "authorized".
■ Key Management System (page 13-1): Centralizes the mechanisms
used to configure and maintain security information for all routing proto­
cols.
HP recommends that you use local passwords together with the switch's other
security features to provide a more comprehensive security fabric than if you
use only local passwords.
General Switch Traffic Security
Guideline
Where the switch is running multiple security options, it implements network
traffic security based on the OSI (Open Systems Interconnection model)
precedence of the individual options, from the lowest to the highest. The
following list shows the order in which the switch implements configured
security features on traffic moving through a given port.
1. Disabled/Enabled physical port
2. MAC lockout (Applies to all ports on the switch.)
3. MAC lockdown