HP E3800 Series Manuals

Manuals and User Guides for HP E3800 Series. We have 1 HP E3800 Series manual available for free PDF download: Access Security Manual

HP E3800 Series Access Security Manual (732 pages)

Switch Software

Brand: HP | Category: Switch | Size: 5.32 MB

Table of Contents
5
About Your Switch Manual Set

23
Product Documentation

23
- Electronic Publications
  23
Software Feature Index

24
Security Overview

31
- Introduction
  
  31
  - About this Guide
    31
  - For more Information
    31
- Access Security Features
  
  33
- Network Security Features
  
  37
- Getting Started with Access Security
  
  40
- Precedence of Security Options
  
  46
- HP Identity-Driven Manager (IDM)
  
  50
Configuring Username and Password Security

51
Virus Throttling (Connection-Rate Filtering)

87
Web and MAC Authentication

115
- Overview
  
  115
  - Web Authentication
    116
  - MAC Authentication
    116
  - Concurrent Web and MAC Authentication
    117
  - Authorized and Unauthorized Client Vlans
    117
  - RADIUS-Based Authentication
    118
  - Wireless Clients
    118
- How Web and MAC Authentication Operate
  
  119
  - Web-Based Authentication
    119
  - MAC-Based Authentication
    121
- Terminology
  
  123
- Operating Rules and Notes
  
  124
- Setup Procedure for Web/Mac Authentication
  
  126
- Configuring Web Authentication
  
  132
  - Overview
    132
  - Configuration Commands for Web Authentication
    133
  - Show Commands for Web Authentication
    140
- Customizing Web Authentication HTML Files (Optional)
  
  146
  - Implementing Customized Web-Auth Pages
    146
  - Operating Notes and Guidelines
    146
  - Customizing HTML Templates
    147
    
    Customizable HTML Templates
    148
- Configuring MAC Authentication on the Switch
  
  162
- Client Status
  
  185
TACACS+ Authentication

187
- Overview
  
  187
- Terminology Used in TACACS Applications
  
  188
- General System Requirements
  
  190
- General Authentication Setup Procedure
  
  190
- Configuring TACACS+ on the Switch
  
  193
- How Authentication Operates
  
  210
  - General Authentication Process Using a TACACS+ Server
    210
  - Local Authentication Process
    211
  - Using the Encryption Key
    212
    
    General Operation
    212
    
    Encryption Options in the Switch
    213
- Using TACACS+ Authentication
  
  214
- Messages Related to TACACS+ Operation
  
  215
  - Operating Notes
    216
  - Overview
    217
- Accounting Services
  
  218
  - Terminology
    219
- Terminology
  
  220
- Switch Operating Rules for RADIUS
  
  220
- General RADIUS Setup Procedure
  
  221
- Configuring the Switch for RADIUS Authentication
  
  222
- Cached Reauthentication
  
  242
  - Timing Considerations
    243
- Using SNMP to View and Configure
  
  246
- Switch Authentication Features
  
  246
  - Changing and Viewing the SNMP Access Configuration
    247
  - Local Authentication Process
    250
- Controlling Webagent Access
  
  251
- Commands Authorization
  
  252
  - Enabling Authorization
    253
  - Displaying Authorization Information
    254
    
    Example Configuration on Cisco Secure ACS for MS Windows
    256
    
    Example Configuration Using Freeradius
    259
- VLAN Assignment in an Authentication Session
  
  260
- Viewing RADIUS Statistics
  
  278
  - RADIUS Authentication Statistics
    280
  - RADIUS Accounting Statistics
    282
- Changing RADIUS-Server Access Order
  
  283
- Dynamic Removal of Authentication
  
  286
- Limits
  
  286
  - Displaying the Port-Access Information
    288
    
    Operating Notes
    289
    
    Overview
    291
- Overview
  
  292
  - Optional PCM and IDM Network Management Applications
    292
- RADIUS Server Configuration for Cos
  
  293
- P Priority) and Rate-Limiting
  
  293
- Overview
  
  336
- Prerequisite for Using SSH
  
  336
- Steps for Configuring and Using SSH
  
  337
- Public Key Formats
  
  337
- For Switch and Client Authentication
  
  337
  - General Operating Rules and Notes
    339
- General Operating Rules and Notes
  
  340
- Configuring the Switch for SSH Operation
  
  340
  - Enable (Manager) Password
    341
    
    Configuring Key Lengths
    344
  - Client Contact Behavior
    347
  - Configuring the Switch for SSH Authentication
    352
  - Use an SSH Client to Access the Switch
    356
- Further Information on SSH Client Public-Key Authentication
  
  357
- Messages Related to SSH Operation
  
  363
  - Overview
    365
- Overview
  
  366
9 Configuring Secure Socket Layer (SSL)

366
- Terminology
  
  366
- Prerequisite for Using SSL
  
  368
- General Operating Rules and Notes
  
  369
- General Operating Rules and Notes
  
  370
- Authentication
  
  370
- Configuring the Switch for SSL Operation
  
  370
  - With the CLI
    371
  - Comments on Certificate Fields
    372
  - Generate a Self-Signed Host Certificate with the Webagent
    374
  - Webagent
    375
  - Browser Contact Behavior
    377
    
    Using the CLI Interface to Enable SSL
    378
- Common Errors in SSL Setup
  
  380
  - Introduction
    381
  - Overview of Options for Applying Ipv4 Acls on the Switch
    383
  - Command Summary for Standard Ipv4 Acls
    385
  - Command Summary for Ipv4 Extended Acls
    386
  - Displaying Acls
    387
  - Terminology
    388
  - Overview
    393
    
    RACL Applications
    394
    
    VACL Applications
    396
    
    RADIUS-Assigned (Dynamic) Port ACL Applications
    397
  - Multiple Acls on an Interface
    399
  - Features Common to All ACL Applications
    402
  - General Steps for Planning and Configuring Acls
    403
- Ipv4 Static ACL Operation
  
  405
  - The Packet-Filtering Process
    406
- Planning an ACL Application
  
  409
- Configuring and Assigning an Ipv4 ACL
  
  420
- Configuring Standard Acls
  
  430
  - Configuring Named, Standard Acls
    432
  - Creating Numbered, Standard Acls
    435
- Configuring Extended Acls
  
  439
  - Configuring Named, Extended Acls
    441
  - Configuring Numbered, Extended Acls
    454
- Adding or Removing an ACL Assignment on an Interface
  
  461
  - Filtering Ipv4 Traffic Inbound on a VLAN
    462
  - Filtering Inbound Ipv4 Traffic Per Port
    463
- Deleting an ACL
  
  465
- Editing an Existing ACL
  
  466
  - Sequence Numbering in Acls
    467
    
    Inserting an ACE in an Existing ACL
    468
    
    Deleting an ACE from an Existing ACL
    470
    
    Resequencing the Aces in an ACL
    471
    
    Attaching a Remark to an ACE
    472
    
    Operating Notes for Remarks
    475
- Displaying ACL Configuration Data
  
  477
- Creating or Editing Acls Offline
  
  487
  - Example of Using the Offline Process
    488
  - Enable ACL "Deny" Logging
    492
- Enable ACL “Deny” Logging
  
  493
- General ACL Operating Notes
  
  508
  - Introduction
    511
- Introduction
  
  512
- DHCP Snooping
  
  512
  - Overview
    513
  - Enabling DHCP Snooping
    514
  - Enabling DHCP Snooping on VLANS
    516
  - Configuring Authorized Server Addresses
    517
  - Using DHCP Snooping with Option 82
    518
    
    Changing the Remote-ID from a MAC to an IP Address
    520
  - The DHCP Binding Database
    521
  - Operational Notes
    522
  - Log Messages
    523
- Dynamic ARP Protection
  
  525
- Dynamic IP Lockdown
  
  533
- Using the Instrumentation Monitor
  
  543
- Operating Notes
  
  544
  - Configuring Instrumentation Monitor
    545
    
    Examples
    546
  - Viewing the Current Instrumentation Monitor Configuration
    547
    
    Overview
    549
    
    Introduction
    550
- Filter Types and Operation
  
  551
  - Example
    552
  - Named Source-Port Filters
    553
    
    Operating Rules for Named Source-Port Filters
    554
    
    Viewing a Named Source-Port Filter
    556
  - Static Multicast Filters
    562
  - Protocol Filters
    563
- Configuring Traffic/Security Filters
  
  564
  - Configuring a Source-Port Traffic Filter
    565
    
    Example of Creating a Source-Port Filter
    566
  - Editing a Source-Port Filter
    567
  - Configuring a Multicast or Protocol Traffic Filter
    568
  - Filter Indexing
    569
  - Displaying Traffic/Security Filters
    570
  - Overview
    573
  - User Authentication Methods
    574
    
    X User-Based Access Control
    575
    
    Alternative to Using a RADIUS Server
    576
- Terminology
  
  580
- General 802.1X Authenticator Operation
  
  580
  - VLAN Membership Priority
    581
  - General Operating Rules and Notes
    583
- General Setup Procedure for 802.1X Access Control
  
  585
  - Overview: Configuring 802.1X Authentication on the Switch
    588
- Configuring Switch Ports as 802.1X Authenticators
  
  589
- X Open VLAN Mode
  
  604
- To Allow Only 802.1X-Authenticated Devices
  
  622
- Option for Authenticator Ports: Configure Port-Security
  
  622
  - Port-Security
    622
  - Configuring Switch Ports to Operate as Supplicants for 802.1X Connections to Other Switches
    623
- Supplicants for 802.1X Connections to Other Switches
  
  625
  - Supplicant Port Configuration
    625
- Displaying 802.1X Configuration, Statistics, and Counters
  
  627
  - Viewing 802.1X Open VLAN Mode Status
    636
  - Show Commands for Port-Access Supplicant
    640
- How RADIUS/802.1X Authentication Affects VLAN Operation
  
  641
  - VLAN Assignment on a Port
    642
  - Authentication Session
    644
  - In Authentication Sessions
    647
- Overview
  
  649
- Overview
  
  650
- Port Security
  
  650
  - Eavesdrop Prevention
    651
    
    Feature Interactions When Eavesdrop Prevention Is Disabled
    652
    
    MIB Support
    653
  - Trunk Group Exclusion
    654
  - Planning Port Security
    655
  - Port Security Command Options and Operation
    656
  - Configuring Port Security
    660
  - Retention of Static Addresses
    665
- MAC Lockdown
  
  671
  - Differences between MAC Lockdown and Port Security
    672
    
    MAC Lockdown Operating Notes
    674
  - Deploying MAC Lockdown
    675
- MAC Lockout
  
  679
- Port Security and MAC Lockout
  
  681
- Reading Intrusion Alerts and Resetting Alert Flags
  
  682
  - How the Intrusion Log Operates
    683
    
    And Resetting Alert Flags
    684
  - Using the Event Log to Find Intrusion Alerts
    686
    
    Operating Notes for Port Security
    687
    
    Overview
    689
- Options
  
  691
- Access Levels
  
  692
- Defining Authorized Management Stations
  
  692
  - Menu: Viewing and Configuring IP Authorized Managers
    693
  - CLI: Viewing and Configuring Authorized IP Managers
    694
    
    Configuring IP Authorized Managers for the Switch
    695
    
    Webagent: Configuring IP Authorized Managers
    697
- Webagent: Configuring IP Authorized Managers
  
  698
  - Web Proxy Servers
    698
- Building IP Masks
  
  699
  - Additional Examples for Authorizing Multiple Stations
    701
    
    Operating Notes
    702
    
    Overview
    703
- Terminology
  
  704
- Configuring Key Chain Management
  
  704
  - Assigning a Time-Independent Key to a Chain
    705
  - Assigning Time-Dependent Keys to a Chain
    707

HP Categories

Desktop

Laptop Server

Monitor

Switch

More HP Manuals

HP E3800 Series Manuals

HP E3800 Series Access Security Manual (732 pages)

Table of Contents

About Your Switch Manual Set

Product Documentation

Software Feature Index

Security Overview

Introduction

Access Security Features

Network Security Features

Getting Started with Access Security

Precedence of Security Options

HP Identity-Driven Manager (IDM)

Configuring Username and Password Security

Overview

Configuring Local Password Security

Saving Security Credentials in a Config File

Front-Panel Security

Password Recovery

Virus Throttling (Connection-Rate Filtering)

Overview of Connection-Rate Filtering

General Configuration Guidelines

Configuring Connection-Rate Filtering

Configuring and Applying Connection-Rate Acls

Web and MAC Authentication

Overview

How Web and MAC Authentication Operate

Terminology

Operating Rules and Notes

Setup Procedure for Web/Mac Authentication

Configuring Web Authentication

Customizing Web Authentication HTML Files (Optional)

Configuring MAC Authentication on the Switch

Client Status

TACACS+ Authentication

Overview

Terminology Used in TACACS Applications

General System Requirements

General Authentication Setup Procedure

Configuring TACACS+ on the Switch

How Authentication Operates

Using TACACS+ Authentication

Messages Related to TACACS+ Operation

Accounting Services

Terminology

Switch Operating Rules for RADIUS

General RADIUS Setup Procedure

Configuring the Switch for RADIUS Authentication

Cached Reauthentication

Using SNMP to View and Configure

Switch Authentication Features

Controlling Webagent Access

Commands Authorization

VLAN Assignment in an Authentication Session

Viewing RADIUS Statistics

Changing RADIUS-Server Access Order

Dynamic Removal of Authentication

Limits

Overview

RADIUS Server Configuration for Cos

P Priority) and Rate-Limiting

Overview

Prerequisite for Using SSH

Steps for Configuring and Using SSH

Public Key Formats

For Switch and Client Authentication

General Operating Rules and Notes

Configuring the Switch for SSH Operation

Further Information on SSH Client Public-Key Authentication

Messages Related to SSH Operation

Overview

9 Configuring Secure Socket Layer (SSL)

Terminology

Prerequisite for Using SSL

General Operating Rules and Notes

General Operating Rules and Notes

Authentication

Configuring the Switch for SSL Operation

Common Errors in SSL Setup

Ipv4 Static ACL Operation