HP 2650 (J4899A/B), 4100gl, 2626 (J4900A/B), 2600-PWR, 6108 manual Password Recovery Process

Page 43

Configuring Username and Password Security

Front-Panel Security

Figure 2-11. Example of the Steps for Disabling Password-Recovery

N o t e

N o t e

Password Recovery Process

If you have lost the switch’s manager username/password, but password- recovery is enabled, then you can use the Password Recovery Process to gain

management access to the switch with an alternate password supplied by ProCurve.

If you have disabled password-recovery, which locks out the ability to recover a manager username/password pair on the switch, then the only way to recover from a lost manager username/password pair is to use the Reset+Clear button combination described under “Restoring the Factory Default Configuration” on page 2-9. This can disrupt network operation and make it necessary to temporarily disconnect the switch from the network to prevent unauthorized access and other problems while it is being reconfigured.

To use the password-recoveryoption to recover a lost password:

1.Note the switch’s base MAC address. It is shown on the label located on the upper right front corner of the switch.

2.Contact your ProCurve Customer Care Center for further assistance. Using the switch’s MAC address, the ProCurve Customer Care Center will generate and provide a “one-time use” alternate password you can use with the to gain management access to the switch. Once you gain access, you can configure a new, known password.

The alternate password provided by the ProCurve Customer Care Center is valid only for a single login attempt.

You cannot use the same “one-time-use” password if you lose the password a second time. Because the password algorithm is randomized based upon your switch's MAC address, the password will change as soon as you use the “one-time-use” password provided to you by the ProCurve Customer Care Center.

2-17

Image 43
Contents Access Security Guide Page December Access Security GuidePublication Number Contents Configuring the Switch To Access a Radius Server Contents Overview Client Options General FeaturesTerminology Operating Rules and Notes Messages Related to TACACS+ Operation Operating Notes Viewing the Switch’s Current Authentication ConfigurationConfiguring the Switch’s TACACS+ Server Access General Authentication Process Using a TACACS+ ServerLocal Authentication Process Configuring Secure Shell SSHCommon Errors in SSL Setup Generate the Switch’s Server Host CertificateVii Viii Configuring and Monitoring Port SecurityAccess Levels ContentsOperating Notes for Port Security Web Configuring IP Authorized Managers Switch manual set includes the following About Your Switch Manual SetXii Feature IndexFeature Configuration Management GuideXiii Product Documentation FeatureTftp XivGetting Started ContentsGetting Started Overview of Access Security FeaturesAccess security features covered in this guide include IntroductionFabric than if you use only local passwords Management Access Security ProtectionManagement Access Security Protection General Switch Traffic Security GuidelinesCommand Syntax Statements Feature Descriptions by ModelConventions Screen Simulations Command PromptsPort Identity Examples Getting Help in the Menu Interface Sources for More InformationMain Menu of the Menu interface, select Run SetupNeed Only a Quick Start? IP AddressingInterpreting LED behavior To Set Up and Install the Switch in Your NetworkThis page is intentionally unused Configuring Username and Password Security Web browser interface OverviewT e U t i o n Console Passwords Configuring Local Password SecurityMenu Setting Passwords To set a new passwordContinue Deletion of password protection? No CLI Setting Passwords and UsernamesCommands Used in This Section Click on Device Passwords Web Setting Passwords and UsernamesClick on the Security tab Front-Panel Security When Security Is ImportantFront-Panel Button Functions ResetClearClear Button Restoring the Factory Default Configuration Reset ButtonPress and hold the Reset button ResetClear Self Test Configuring Front-Panel SecuritySyntax show front-panel-security Default Front-Panel Security Settings Either form of the command enables password-clear Example of Re-Enabling the Clear Button’s Default Operation Changing the Operation of the Reset+Clear CombinationManagement access to the switch Password RecoveryDisabling or Re-Enabling the Password Recovery Process Default configuration settingsNo front-panel-security password-recovery Steps for Disabling Password-Recovery11. Example of the Steps for Disabling Password-Recovery Password Recovery ProcessThis page is intentionally unused Overview Client Options General Features Overview Client Options Lock a particular device to a specific switch and portRadius server uses the device MAC address as the username General Features Authenticator Operation How Web and MAC Authentication OperateWeb-based Authentication Progress Message During Authentication MAC-based Authentication How Web and MAC Authentication Operate Terminology Management Operating Rules and NotesOperating Rules and Notes Do These Steps Before You Configure Web/MAC Authentication General Setup Procedure for Web/MAC AuthenticationGeneral Setup Procedure for Web/MAC Authentication Aabbcc-ddeeff Aa-bb-cc-dd-ee-ff Aabbccddeeff AddressesRadius Server Configuration Commands Configuring the Switch To Access a Radius ServerExample of Configuring a Switch To Access a Radius Server Overview Configuring Web AuthenticationCommand Configuration Level Configure the Switch for Web-Based AuthenticationSyntax no aaa port-access web-based e port-list Syntax aaa port-access web-based e port-list max-requests Default 30 seconds Configuring MAC Authentication on Switch Configure the Switch for MAC-Based Authentication Syntax Default 30seconds Command Show Status and Configuration Web-Based AuthenticationShow Status and Configuration of MAC-Based Authentication Syntax show port-access port-list mac-based clients Timed out-unauth vlan Show Client StatusThis page is intentionally unused TACACS+ Authentication Example of TACACS+ Operation TACACS+ AuthenticationTerminology Used in Tacacs Applications TACACS+ Authentication General System Requirements General Authentication Setup ProcedureDetermine the following Using the Encryption Key onTACACS+ Authentication Switch offers three command areas for TACACS+ operation Configuring TACACS+ on the SwitchBefore You Begin Viewing the Switch’s Current Authentication Configuration CLI Commands Described in this SectionThis example shows the default authentication configuration Example of the Switch’s TACACS+ Configuration Listing Configuring the Switch’s Authentication Methods Method/privilege path. Available only if the primary method AAA Authentication ParametersName Default Range Function Authentication for the access being configured is localLogin Primary to Local authentication Primary/Secondary Authentication TableProCurve config# aaa authentication num-attempts Switch or your TACACS+ server Configuring the Switch’s TACACS+ Server AccessSyntax tacacs-server host ip-addr key key-string Name Default Range Tacacs-server host ip-addr None Details on Configuring Tacacs Servers and KeysTimeout 1 Name Default Range Key key-string None nullTo configure north01 as a per-server encryption key ProCurveconfig# no tacacs-server hostGeneral Authentication Process Using a TACACS+ Server How Authentication OperatesChanges without executing write mem TACACS+ Authentication Authentication Local Authentication ProcessTerminal must initiate a new session before trying again Encryption Options in the Switch Using the Encryption KeyGeneral Operation ProCurveconfig# tacacs-server key north40campus CLI Message Meaning Tacacs-server configurationMessages Related to TACACS+ Operation Operating NotesTACACS+ Authentication Radius Authentication and Accounting Radius Authentication and Accounting Web Series 2600, 2600-PWR, and 2800 switches Port-AccessHost See Radius Server Switch Operating Rules for Radius Preparation for Configuring Radius on the Switch General Radius Setup ProcedureRadius Authentication Commands Configuring the Switch for Radius AuthenticationRadius server documentation Outline of the Steps for Configuring Radius AuthenticationRadius Authentication and Accounting Example Configuration for Radius Authentication Configuring Radius Accounting instead of continuing here Configure the Switch To Access a Radius ServerRadius Authentication and Accounting Configure the Switch’s Global Radius Parameters T e Radius Authentication and Accounting Listings of Global Radius Parameters Configured In Figure Local Authentication Process Radius Accounting Commands Configuring Radius AccountingThis section assumes you have already Access methodsConfigured one or more Radius servers to support the switch Under Port-Based Access ControlOperating Rules for Radius Accounting Steps for Configuring Radius AccountingConfigure the Switch To Access a Radius Server Key key-string Radius Authentication and Accounting Start-Stop Syntax no aaa accounting update periodic 1 General Radius Statistics Viewing Radius StatisticsTerm Definition Values for Show Radius Host Output FigureSyntax show authentication Radius Authentication StatisticsRadius Accounting Statistics 14. Listing the Accounting Configuration in the Switch17. Search Order for Accessing a Radius Server Changing RADIUS-Server Access Order18. Example of New Radius Server Search Order Message Meaning Messages Related to Radius OperationThis page is intentionally unused Configuring Secure Shell SSH Configuring Secure Shell SSH Client Public Key Authentication ModelUsing these algorithms unless otherwise noted Use a key to authenticate itself to the switchTerminology Public Key Formats Prerequisite for Using SSHSSH Options AuthenticationPrimary SSH Configuring Secure Shell SSH General Operating Rules and Notes Assign Local Login Operator and Enable Manager Password Configuring the Switch for SSH OperationSSH-Related Commands in This Section Example of Configuring Local Passwords Generate the Switch’s Public and Private Key PairCLI kill command To the switch using the earlier pairPair automatically disables SSH For example, to generate and display a new key Provide the Switch’s Public Key to ClientsOperation Example of a Public Key Generated by the Switch Inserted Bit Exponent e Modulus n Switch’s Public and Private Key Pair on To enable SSH on the switch 49, 80, 1506, Always 896 bitsU t i o n T e Configure the Switch for SSH AuthenticationOption B Configuring the Switch for Client Public-Key SSH Copies a public key file into the switch Use an SSH Client To Access the Switch Further Information on SSH Client Public-Key AuthenticationConfiguring Secure Shell SSH 14. Example of a Client Public Key Ascii Property Supported Comments ValueDeletes the client-public-key file from the switch U t i o n 00000K Peer unreachable Messages Related to SSH OperationGenerating new RSA host key. If Steps for Configuring and Using SSL for Switch Configuring Secure Socket Layer SSLConfiguring Secure Socket Layer SSL Server Certificate authentication with User PasswordRC4 40-bit, 128-bit 3DES 168-bit, 112 EffectiveOtherwise noted Configuring Secure Socket Layer SSL Prerequisite for Using SSL General Operating Rules and Notes SSL-Related CLI Commands in This Section Configuring the Switch for SSL OperationSecurity Tab Password Button Earlier certificate Generate the Switch’s Server Host CertificateParticular switch/client session, and then discarded Verified unequivocallyCLI To Generate or Erase the Switch’s Server Certificate withField Name Description Comments on Certificate FieldsCertificate Field Descriptions For example, to generate a key and a new host certificateFor example, to display the new server host certificate Can resume SSL operationConfiguring Secure Socket Layer SSL Configuring Secure Socket Layer SSL Web browser Interface showing current SSL Host Certificate Configuring Secure Socket Layer SSL Example of a Certificate Request and Reply T e Execute no web-management ssl Using the CLI interface to enable SSLUsing the web browser interface to enable SSL Zeroize the switch’s host certificate or certificate key.Enable SLL Port number Selection Error During Possible Cause Common Errors in SSL SetupThis page is intentionally unused Operating Rules for Authorized-Client Configuring Port-Based Access ControlConfiguring Port-Based Access Control Why Use Port-Based Access Control? Configuring Port-Based Access Control Example of an 802.1X Application How 802.1X Operates Example of Supplicant Operation Switch-Port Supplicant OperationAuthenticator at the same time 802.1X standard General Operating Rules and Notes Configuring Port-Based Access Control Do These Steps Before You Configure 802.1X Operation General Setup Procedure for Port-Based Access ControlAuthenticators operate as expected Overview Configuring 802.1X Authentication on SwitchConfiguring Port-Based Access Control Enable 802.1X Authentication on Selected Ports Configuring Switch Ports as 802.1X Authenticators802.1X Authentication Commands Quiet-period 0 Max-requests 1 Clears authenticator statistics counters Example of 802.1X Port-Access Authentication Configure the 802.1X Authentication MethodEnter the Radius Host IP Addresses Enable 802.1X Authentication on the Switch802.1X-Related Show Commands Radius server configuration 802.1X Open Vlan ModeIntroduction Membership in the Vlan Use Models for 802.1X Open Vlan Modes802.1X Open Vlan Mode 1X Open Vlan Mode Options802.1X Per-Port Configuration Port Response Condition Rule Multiple Authenticator Ports Using Before you configure the 802.1X Open Vlan mode on a port Setting Up and Configuring 802.1X Open Vlan ModeMised by an unauthorized client Port-Security To Allow Only 802.1X Devices on Activate authentication on the switchVlan Operation ProCurveconfig# aaa authentication port-access eap-radius 802.1X Open Vlan Operating Notes ProCurveconfig# aaa port-access authenticator e A10 Enables 802.1X authentication on the port 802.1X Authentication Commands 802.1X Supplicant Commands Default supplicant parameters or any previously configured Enter secret password Repeat secret password Syntax aaa port-access supplicant ethernet port-listMax-start 1 Show Commands for Port-Access Authenticator Displaying 802.1X Configuration Statistics, and CountersShow port-access authenticator Syntax Config e port-list Viewing 802.1X Open Vlan Mode Status Authenticator Open Vlan Mode Status802.1X authentication Access ControlCurrent Vlan ID Status Indicator MeaningNo Pvid The port is not an untagged member of any Vlan Supplicant port detects a different authenticator device Show Commands for Port-Access SupplicantSwitch reboots How RADIUS/802.1X Authentication Affects Vlan Operation Example of an Active Vlan Configuration Otherwise, port A2 is not listed Assignment 1X Operating Messages Messages Related to 802.1X OperationConfiguring and Monitoring Port Security Basic Operation Configuring and Monitoring Port SecurityCast traffic Blocking Unauthorized Traffic Switch C Physical Topology Logical Topology for Access to Switch aSwitch B Switch aPlanning Port Security Acquires and maintains authorized addresses Port Security Command Options OperationPort Security Commands Used in This Section Commands00f031-423fc1 4 b0-880a80 the authorized address 080090-1362f2Address-limit integer Clear-intrusion-flag Assigned/Authorized MAC Addresses Displaying Current Port Security SettingsRetention of Static MAC Addresses Learned MAC AddressesUsing the CLI To Display Port Security Settings Specifying Authorized Devices and Intrusion Responses Configuring Port SecurityAdding a MAC Address to an Existing Port List Example of Adding a Second Authorized Device to a Port Example of Adding an Authorized Device to a PortSee the MAC Address entry in the table on Device’s MAC address. For exampleRemove 0c0090-123456 from the Authorized Address list Address configuration. Refer to the Note onExample of Port A1 After Removing One MAC Address MAC LockdownConfiguring and Monitoring Port Security Differences Between MAC Lockdown and Port Security MAC Lockdown Operating Notes Deploying MAC Lockdown MAC Lockdown Deployed At the Network Edge Provides Security Address and stealing data Edge switchesInside the Core Network as well, not just on the edge External Network X e d U s e r s 11. Listing Locked Down Ports MAC LockoutConfiguring and Monitoring Port Security 12. Listing Locked Out Ports Port Security and MAC LockoutOperating Rules for IP Lockdown Using the IP Lockdown CommandIP lockdown command operates as follows IP LockdownClick on Port Security Web Displaying and Configuring Port Security FeaturesReading Intrusion Alerts and Resetting Alert Flags Log command displays the Event LogHow the Intrusion Log Operates It detects Resetting Alert FlagsFlags As follows15. Example of the Intrusion Log Display Type I Intrusion log to display the Intrusion LogConfiguring and Monitoring Port Security List intrusion log content 18. Example of Port Status Screen After Alert Flags Reset Event Log lists port security intrusions as Using the Event Log To Find Intrusion AlertsOperating Notes for Port Security Configuring and Monitoring Port Security Traffic/Security Filters ProCurve Series 2600/2600-PWR and 2800 Switches10-2 10-3 Filter for the Actions Shown in FigureOperating Rules for Source-Port Filters Using Source-Port Filters10-5 Configuring a Source-Port Filter10-6 ProCurveconfig# filter source-port trk1 drop trk2,10-1510-7 Viewing a Source-Port FilterSource Port Destination Action Ports 10-8 Filter Indexing10-9 Editing a Source-Port Filter10-10 Using Named Source-Port FiltersDefining and Configuring Named Source-Port Filters Operating Rules for Named Source-Port Filters10-11 Viewing a Named Source-Port Filter Sample Configuration for Named Source-Port Filters10-12 Applying Example Named Source-Port Filters Source Port 10-1410-15 10-16 10-17 10-18 Operating Notes 11-1 Using Authorized IP ManagersUsing Authorized IP Managers Authorized IP Manager FeaturesConfiguration Options Access LevelsYou can configure Overview of IP Mask Operation Defining Authorized Management Stations11-4 11-5 Menu Viewing and Configuring IP Authorized ManagersSwitch Configuration … IP Authorized Managers From the console Main Menu, selectListing the Switch’s Current Authorized IP Managers CLI Viewing and Configuring Authorized IP ManagersAuthorized IP Managers Commands Used in This Section 11-7 Configuring IP Authorized Managers for the SwitchIP Mask 11-8 Address of the authorized manager you want to deleteAnalysis of IP Mask for Single-Station Entries Web Configuring IP Authorized ManagersConfiguring One Station Per Authorized Manager IP Entry Building IP MasksAny value from 0 to 11-1011-11 Additional Examples for Authorizing Multiple StationsOperating Notes Index IndexSee RADIUS. message See SSH. proxy Web server … Quick start … Show accounting … 5-28 show authentication … See RADIUS. troubleshooting Vlan This page is intentionally unused December
Related manuals
Manual 88 pages 37.5 Kb Manual 228 pages 26.31 Kb