HP manual Access security guide Hp procurve Series 4100gl switches

Page 1

access security guide

hp procurve

series 4100gl switches

www.hp.com/go/hpprocurve

Page 1 Page 2
Image 1
Page 1 Page 2
Contents Access security guide Hp procurve Series 4100gl switches Page Access Security Guide HP Procurve Series 4100GL SwitchesPublication Number Contents Configuring the Switch for Radius Authentication Controlling Web Browser Interface Access WhenWhen Using Radius Authentication Controlling Web Browser Interface AccessFurther Information on SSH Client Public-Key Authentication Configuring Switch Ports To Operate As Supplicants for General Setup Procedure for802.1x Connections to Other Switches Operating Rules for Authorized-ClientPort Security Command Options and Operation How RADIUS/802.1x Authentication Affects Vlan OperationWeb Displaying and Configuring Port Security Features Resetting Alert Flags Operating Notes for Port SecurityDefining Authorized Management Stations Page Getting Started Contents Introduction Overview of Access Security FeaturesGetting Started Xiii Command Prompts Command Syntax ConventionsSimulating Display Output Screen Simulations Related PublicationsGetting Started Click on technical support Getting Documentation From the WebSources for More Information Run Setup To Set Up and Install the Switch in Your NetworkNeed Only a Quick Start? Main Menu of the Menu interface, selectPage Configuring Username and Password Security Feature Default Menu Configuring Username and Password SecurityOverview Level Actions PermittedPasswords are case-sensitive Menu Setting Passwords Configuring Local Password SecurityTo set a new password Console PasswordsContinue Deletion of password protection? No CLI Setting Passwords and UsernamesConfiguring Manager and Operator Passwords Commands Used in This SectionClick on Device Passwords Web Setting Passwords and UsernamesClick on the Security tab EnterUsing TACACS+ Authentication Messages Operating Notes TACACS+ AuthenticationExample of TACACS+ Operation TACACS+ AuthenticationTACACS+ Authentication Terminology Used in Tacacs Applications General System Requirements General Authentication Setup Procedure Additional features that the application offers Result in Operator read-only access. Thus, when configuringAlways used as the secondary access control method Determine the followingTelnet CLI Commands Described in this Section Configuring TACACS+ on the SwitchCommand Before You BeginThis example shows the default authentication configuration Viewing the Switch’s Current Authentication ConfigurationConfiguring the Switch’s Authentication Methods Name Default Range Function AAA Authentication ParametersAuthentication for the access being configured is local Method/privilege path. Available only if the primary methodLogin Primary to Local authentication Primary/Secondary Authentication TableHPswitchconfig# aaa authentication num-attempts TACACS+ server Configuring the Switch’s TACACS+ Server AccessSyntax tacacs-server host ip-addr key key-string None Name Default RangeNone null Timeout 1To configure north01 as a per-server encryption key HPswitchconfig# no tacacs-server hostGeneral Authentication Process Using a TACACS+ Server How Authentication OperatesChanges without executing write mem TACACS+ Authentication Authentication Local Authentication ProcessUsing the Encryption Key HPswitchconfig# tacacs-server key north40campus Messages Related to TACACS+ Operation Tacacs-server configurationOperating Notes CLI Message MeaningRized persons Controlling Web Browser Interface Access When Using Radius Radius Authentication and AccountingRadius Authentication and Accounting Port-AccessTerminology Switch Operating Rules for Radius Preparation for Configuring Radius on the Switch General Radius Setup ProcedureOutline of the Steps for Configuring Radius Authentication Configuring the Switch for Radius AuthenticationRadius Authentication Commands Configure the global Radius parameters Used on the specified Radius server. Default nullRadius server documentation Server IP addressLocal none Authentication Process on Example Configuration for Radius AuthenticationConfiguring Radius Accounting instead of continuing here Configure the Switch To Access a Radius ServerRadius Authentication and Accounting Key global-key-string Configure the Switch’s Global Radius ParametersTo an authentication request before counting the attempt as Listings of Global Radius Parameters Configured In Figure Local Authentication ProcessWord pair for the level you want to enter Radius Accounting Commands Configuring Radius AccountingOn page 3-5 before continuing here Operating Rules for Radius Accounting Steps for Configuring Radius Accounting Configure the Switch To Access a Radius Server Radius Authentication and Accounting Start-Stop Example of Configuring Accounting TypesUpdate period General Radius Statistics Viewing Radius StatisticsPendingRequests Term DefinitionRadius Authentication Statistics Radius Accounting Statistics 14. Listing the Accounting Configuration in the Switch17. Search Order for Accessing a Radius Server Changing RADIUS-Server Access Order18. Example of New Radius Server Search Order Message Meaning Messages Related to Radius OperationPage Configuring the Switch for SSH Operation Configuring Secure Shell SSHConfiguring Secure Shell SSH Client Public Key Authentication Model3DES 168-bit Use a key to authenticate itself to the switchDES 56-bit Prerequisite for Using SSH SSH Options Public Key FormatsManager Ssh enable local Switch Primary SSH Authenticate Primary SwitchEnable Ssh enable tacacs Ssh enable radiusConfiguring Secure Shell SSH General Operating Rules and Notes SSH-Related Commands in This Section Configuring the Switch for SSH OperationExample of Configuring Local Passwords Generating the Switch’s Public and Private Key PairCLI kill command To the switch using the earlier pairPair automatically disables SSH For example, to generate and display a new key Providing the Switch’s Public Key to ClientsOperation Example of a Public Key Generated by the Switch Inserted Bit Exponent Modulus Switch’s Public and Private Key Pair on To enable SSH on the switch On the switch by appearing to be you Version of SSH to accept connections from. default 1-or-2Option a Configuring SSH Access for Password-Only SSH Configuring the Switch for SSH AuthenticationU t i o n Configures 14 shows how to check the results of the above commands Use an SSH Client To Access the SwitchFurther Information on SSH Client Public-Key Authentication 15. Example of a Client Public Key Ascii Property Supported Comments ValueShow crypto client-public-key babble fingerprint Deletes the client-public-key file from the switch 00000K Peer unreachable Messages Related to SSH OperationKey for the switch Comments on certificate fields Assigning a Local Login OperatorConfiguring Secure Socket Layer SSL Server Certificate authentication with User PasswordRC4 40-bit, 128-bit 3DES 168-bit, 112 EffectiveGeneral steps for configuring ssl include Client Preparation Prerequisite for Using SSLProvided with your browser General Operating Rules and Notes Assigning a Local Login Operator and Enable ManagerPassword Configuring the Switch for SSL OperationSSL-Related CLI Commands in This Section Security Tab Password Button Particular switch/client session, and then discarded Generating the Switch’s Server Host CertificateVerified unequivocally Earlier certificateCLI CLI commands used to generate a Server Host CertificateFor example, to generate a key and a new host certificate Certificate Field DescriptionsField Name Description Host-cert command CLI Command to view host certificatesCan resume SSL operation For example, to display the new server host certificateSelect the Generate Certificate button Installed certificateIii Select Self signed certificate in the type box New key then just select current from the listConfiguring Secure Socket Layer SSL Web browser Interface showing current SSL Host Certificate Configuring Secure Socket Layer SSL Certificate Request Certificate Request Reply T e Execute no web-management ssl Zeroize the switch’s host certificate or certificate key .Enable SLL Port number Selection Error During Possible Cause Common Errors in SSL setupPage General Operating Rules and Notes -9 General Setup Procedure for Port-Based Access ControlMessages Related to 802.1x Operation -47 General Features Why Use Port-Based Access Control?Refer to Radius Authentication and Accounting on 802.1x on the Series 4100GL switches includes the followingConfiguring Port-Based Access Control Authenticating One Switch to Another .1x authentication also How 802.1x Operates Authenticator OperationExample of Supplicant Operation Switch-Port Supplicant OperationTerminology 802.1x standard General Operating Rules and Notes Configuring Port-Based Access Control Do These Steps Before You Configure 802.1x Operation General Setup Procedure for Port-Based Access ControlAuthenticators operate as expected Overview Configuring 802.1x Authentication on SwitchConfiguring Port-Based Access Control 802.1x Authentication Commands Configuring Switch Ports as AuthenticatorsTo activate 802.1x authentication on the switch Enable 802.1x Authentication on Selected PortsTx-period 0 Clears authenticator statistics counters Local Configure the 802.1x Authentication MethodEap-radius Chap-radiusEnter the Radius Host IP Addresses Enable 802.1x Authentication on the Switch802.1x Open Vlan Mode 802.1x-Related Show Commands Radius server configurationIntroduction Tagged Vlan as the Unauthorized-Client Vlan Use Models for 802.1x Open Vlan ModesPort as a static, tagged member of the VLAN, membership 802.1x Per-Port Configuration Port Response Condition Rule Multiple Authenticator Ports Using Before you configure the 802.1x Open Vlan mode on a port Setting Up and Configuring 802.1x Open Vlan ModeMised by an unauthorized client Port-Security To Allow Only 802.1x Devices on Activate authentication on the switchVlan Operation HPswitchconfig# aaa authentication port-access eap-radius 802.1x Open Vlan Operating Notes Action none send-alarm send-disable Enables 802.1x authentication on the port 802.1x Authentication Commands 802.1x Supplicant Commands Specified ports Authenticator at the same timeEnter secret password Repeat secret password Syntax aaa port-access supplicant ethernet port-listMax-start 1 Show Commands for Port-Access Authenticator Displaying 802.1x Configuration, Statistics, and CountersViewing 802.1x Open Vlan Mode Status Page To the port Open Vlan Mode StatusConfiguring Port-Based Access Control Supplicant port detects a different authenticator device Show Commands for Port-Access SupplicantSwitch reboots How RADIUS/802.1x Authentication Affects Vlan Operation Example of an Active Vlan Configuration Otherwise, port A2 is not listed Assignment 1x Operating Messages Messages Related to 802.1x OperationPage Blocking Unauthorized Traffic -3 Trunk Group Exclusion -4 Basic OperationRetention of Static Addresses Basic Operation Configuring and Monitoring Port SecurityBlocking Unauthorized Traffic Security Trunk Group ExclusionPlanning Port Security Port Security Commands Used in This Section Port Security Command Options OperationCommands Acquires and maintains authorized addressesMode Port Security ParametersAddress address-limit integer Mac-address mac-addrParameter Description Retention of Static AddressesClear- clear-intrusion-flag Using the CLI To Display Port Security Settings Displaying Current Port Security SettingsConfiguring Port Security Configuring and Monitoring Port Security Example of Adding an Authorized Device to a Port Device’s MAC address. For example Command option removes unwanted devices MAC addresses fromRemoving a Device From the Authorized List for a Port. This Entry in the table onRemove 0c0090-123456 from the Authorized Address list To automatically become authorizedReading Intrusion Alerts and Resetting Alert Flags Web Displaying and Configuring Port Security FeaturesClick on Port Security Example of Multiple Intrusion Log Entries for the Same Port How the Intrusion Log OperatesOperates as follows FlagsIt detects Intrusion flag11. Example of the Intrusion Log Display Type I Intrusion log to display the Intrusion LogList intrusion log content Intrusion Alert on port A1 Event Log lists port security intrusions as 14. Example of Port Status Screen After Alert Flags ResetOperating Notes for Port Security Configuring and Monitoring Port Security Page Building IP Masks Using Authorized IP Managers Using Authorized IP Managers Authorized IP Manager FeaturesYou can configure Access LevelsOptions Overview of IP Mask Operation Defining Authorized Management StationsSwitch Configuration IP Authorized Managers Menu Viewing and Configuring IP Authorized ManagersBuilding IP Masks on From the console Main Menu, selectAuthorized IP Managers Commands Used in This Section CLI Viewing and Configuring Authorized IP ManagersIP Mask Configuring IP Authorized Managers for the SwitchAddress of the authorized manager you want to delete Web Configuring IP Authorized ManagersClick on Authorized Addresses Building IP Masks Configuring One Station Per Authorized Manager IP EntryAuthorized 227 125 Manager IPUsing Authorized IP Managers Building IP Masks 125, or 127 can access the switchAny value from 0 to IP Mask 255 249Results Additional Examples for Authorizing Multiple StationsAuthorized Using Authorized IP Managers Page Index IndexSee port access control OpenSSH … 4-3,5-2 operating notes See SSH.­ proxy Web server … Quick start … SSL See RADIUS. … 3-4 troubleshoot … 2-15 troubleshooting Index Page 5990-3032
Related manuals
Manual 306 pages 15.53 Kb
Top Page Image Contents