HP 4100gl manual Max-start 1

Page 170

Configuring Port-Based Access Control (802.1x)

Configuring Switch Ports To Operate As Supplicants for 802.1x Connections to Other Switches

aaa port-access supplicant [ ethernet ] < port-list> (Syntax Continued) [ auth-timeout < 1 - 300 > ]

Sets the period of time the port waits to receive a challenge from the authenticator. If the request times out, the port sends another authentication request, up to the number of attempts specified by the max-startparameter. (Default: 30 seconds).

[ max-start < 1 .. 10 >]

Defines the maximum number of times the supplicant port requests authentication. See step 1 on page 6-34 for a description of how the port reacts to the authen­ ticator response. (Default: 3).

[ held-period < 0 .. 65535 > ]

Sets the time period the supplicant port waits after an active 802.1x session fails before trying to re- acquire the authenticator port. (Default: 60 seconds)

[ start-period < 1 .. 300 > ]

Sets the time period between Start packet retrans- mis­ sions. That is, after a supplicant sends a start packet, it waits duirng the start-periodfor a response. If no response comes during the start- period, the supplicant sends a new start packet. The max-start setting (above) specifies how many start attempts are allowed in the session. (Default: 30 seconds)

aaa port-access supplicant [ ethernet ] < port-list> [ initialize ]

On the specified ports, blocks inbound and outbound traffic and restarts the 802.1x authentication process. Affects only ports configured as 802.1x supplicants.

[ clear-statistics ]

Clears and restarts the 802.1x supplicant statistics counters.

6-36

Image 170
Contents Access security guide Hp procurve Series 4100gl switches Page HP Procurve Series 4100GL Switches Access Security GuidePublication Number Contents Controlling Web Browser Interface Access When Configuring the Switch for Radius AuthenticationControlling Web Browser Interface Access When Using Radius AuthenticationFurther Information on SSH Client Public-Key Authentication 802.1x Connections to Other Switches General Setup Procedure forConfiguring Switch Ports To Operate As Supplicants for Operating Rules for Authorized-ClientWeb Displaying and Configuring Port Security Features How RADIUS/802.1x Authentication Affects Vlan OperationPort Security Command Options and Operation Resetting Alert Flags Operating Notes for Port SecurityDefining Authorized Management Stations Page Getting Started Contents Getting Started Overview of Access Security FeaturesIntroduction Xiii Simulating Display Output Command Syntax ConventionsCommand Prompts Related Publications Screen SimulationsGetting Started Getting Documentation From the Web Click on technical supportSources for More Information Need Only a Quick Start? To Set Up and Install the Switch in Your NetworkRun Setup Main Menu of the Menu interface, selectPage Configuring Username and Password Security Overview Configuring Username and Password SecurityFeature Default Menu Level Actions PermittedPasswords are case-sensitive To set a new password Configuring Local Password SecurityMenu Setting Passwords Console PasswordsConfiguring Manager and Operator Passwords CLI Setting Passwords and UsernamesContinue Deletion of password protection? No Commands Used in This SectionClick on the Security tab Web Setting Passwords and UsernamesClick on Device Passwords EnterTACACS+ Authentication Using TACACS+ Authentication Messages Operating NotesTACACS+ Authentication Example of TACACS+ OperationTACACS+ Authentication Terminology Used in Tacacs Applications General System Requirements General Authentication Setup Procedure Always used as the secondary access control method Result in Operator read-only access. Thus, when configuringAdditional features that the application offers Determine the followingTelnet Command Configuring TACACS+ on the SwitchCLI Commands Described in this Section Before You BeginViewing the Switch’s Current Authentication Configuration This example shows the default authentication configurationConfiguring the Switch’s Authentication Methods Authentication for the access being configured is local AAA Authentication ParametersName Default Range Function Method/privilege path. Available only if the primary methodPrimary/Secondary Authentication Table Login Primary to Local authenticationHPswitchconfig# aaa authentication num-attempts Configuring the Switch’s TACACS+ Server Access TACACS+ serverSyntax tacacs-server host ip-addr key key-string Name Default Range NoneTimeout 1 None nullHPswitchconfig# no tacacs-server host To configure north01 as a per-server encryption keyChanges without executing write mem How Authentication OperatesGeneral Authentication Process Using a TACACS+ Server TACACS+ Authentication Local Authentication Process AuthenticationUsing the Encryption Key HPswitchconfig# tacacs-server key north40campus Operating Notes Tacacs-server configurationMessages Related to TACACS+ Operation CLI Message MeaningRized persons Radius Authentication and Accounting Controlling Web Browser Interface Access When Using RadiusPort-Access Radius Authentication and AccountingTerminology Switch Operating Rules for Radius General Radius Setup Procedure Preparation for Configuring Radius on the SwitchRadius Authentication Commands Configuring the Switch for Radius AuthenticationOutline of the Steps for Configuring Radius Authentication Radius server documentation Used on the specified Radius server. Default nullConfigure the global Radius parameters Server IP addressLocal none Example Configuration for Radius Authentication Authentication Process onConfigure the Switch To Access a Radius Server Configuring Radius Accounting instead of continuing hereRadius Authentication and Accounting Configure the Switch’s Global Radius Parameters Key global-key-stringTo an authentication request before counting the attempt as Local Authentication Process Listings of Global Radius Parameters Configured In FigureWord pair for the level you want to enter On page 3-5 before continuing here Configuring Radius AccountingRadius Accounting Commands Operating Rules for Radius Accounting Steps for Configuring Radius Accounting Configure the Switch To Access a Radius Server Radius Authentication and Accounting Example of Configuring Accounting Types Start-StopUpdate period Viewing Radius Statistics General Radius StatisticsTerm Definition PendingRequestsRadius Authentication Statistics 14. Listing the Accounting Configuration in the Switch Radius Accounting StatisticsChanging RADIUS-Server Access Order 17. Search Order for Accessing a Radius Server18. Example of New Radius Server Search Order Messages Related to Radius Operation Message MeaningPage Configuring Secure Shell SSH Configuring the Switch for SSH OperationClient Public Key Authentication Model Configuring Secure Shell SSHDES 56-bit Use a key to authenticate itself to the switch3DES 168-bit Prerequisite for Using SSH Public Key Formats SSH OptionsEnable Ssh enable tacacs Switch Primary SSH Authenticate Primary SwitchManager Ssh enable local Ssh enable radiusConfiguring Secure Shell SSH General Operating Rules and Notes Configuring the Switch for SSH Operation SSH-Related Commands in This SectionGenerating the Switch’s Public and Private Key Pair Example of Configuring Local PasswordsPair automatically disables SSH To the switch using the earlier pairCLI kill command Operation Providing the Switch’s Public Key to ClientsFor example, to generate and display a new key Example of a Public Key Generated by the Switch Inserted Bit Exponent Modulus Switch’s Public and Private Key Pair on To enable SSH on the switch Version of SSH to accept connections from. default 1-or-2 On the switch by appearing to be youConfiguring the Switch for SSH Authentication Option a Configuring SSH Access for Password-Only SSHU t i o n Configures Use an SSH Client To Access the Switch 14 shows how to check the results of the above commandsFurther Information on SSH Client Public-Key Authentication 15. Example of a Client Public Key Property Supported Comments Value AsciiShow crypto client-public-key babble fingerprint Deletes the client-public-key file from the switch Messages Related to SSH Operation 00000K Peer unreachableKey for the switch Assigning a Local Login Operator Comments on certificate fieldsServer Certificate authentication with User Password Configuring Secure Socket Layer SSL3DES 168-bit, 112 Effective RC4 40-bit, 128-bitPrerequisite for Using SSL General steps for configuring ssl include Client PreparationProvided with your browser General Operating Rules and Notes SSL-Related CLI Commands in This Section Configuring the Switch for SSL OperationAssigning a Local Login Operator and Enable ManagerPassword Security Tab Password Button Verified unequivocally Generating the Switch’s Server Host CertificateParticular switch/client session, and then discarded Earlier certificateCLI commands used to generate a Server Host Certificate CLIField Name Description Certificate Field DescriptionsFor example, to generate a key and a new host certificate Can resume SSL operation CLI Command to view host certificatesHost-cert command For example, to display the new server host certificateIii Select Self signed certificate in the type box Installed certificateSelect the Generate Certificate button New key then just select current from the listConfiguring Secure Socket Layer SSL Web browser Interface showing current SSL Host Certificate Configuring Secure Socket Layer SSL Certificate Request Certificate Request Reply T e Zeroize the switch’s host certificate or certificate key . Execute no web-management sslEnable SLL Port number Selection Common Errors in SSL setup Error During Possible CausePage Messages Related to 802.1x Operation -47 General Setup Procedure for Port-Based Access ControlGeneral Operating Rules and Notes -9 Refer to Radius Authentication and Accounting on Why Use Port-Based Access Control?General Features 802.1x on the Series 4100GL switches includes the followingConfiguring Port-Based Access Control Authenticating One Switch to Another .1x authentication also Authenticator Operation How 802.1x OperatesSwitch-Port Supplicant Operation Example of Supplicant OperationTerminology 802.1x standard General Operating Rules and Notes Configuring Port-Based Access Control General Setup Procedure for Port-Based Access Control Do These Steps Before You Configure 802.1x OperationOverview Configuring 802.1x Authentication on Switch Authenticators operate as expectedConfiguring Port-Based Access Control Configuring Switch Ports as Authenticators 802.1x Authentication CommandsEnable 802.1x Authentication on Selected Ports To activate 802.1x authentication on the switchTx-period 0 Clears authenticator statistics counters Eap-radius Configure the 802.1x Authentication MethodLocal Chap-radiusEnable 802.1x Authentication on the Switch Enter the Radius Host IP AddressesIntroduction 802.1x-Related Show Commands Radius server configuration802.1x Open Vlan Mode Use Models for 802.1x Open Vlan Modes Tagged Vlan as the Unauthorized-Client VlanPort as a static, tagged member of the VLAN, membership 802.1x Per-Port Configuration Port Response Condition Rule Multiple Authenticator Ports Using Setting Up and Configuring 802.1x Open Vlan Mode Before you configure the 802.1x Open Vlan mode on a portMised by an unauthorized client Vlan Operation Activate authentication on the switchPort-Security To Allow Only 802.1x Devices on HPswitchconfig# aaa authentication port-access eap-radius 802.1x Open Vlan Operating Notes Action none send-alarm send-disable Enables 802.1x authentication on the port 802.1x Authentication Commands 802.1x Supplicant Commands Authenticator at the same time Specified portsSyntax aaa port-access supplicant ethernet port-list Enter secret password Repeat secret passwordMax-start 1 Displaying 802.1x Configuration, Statistics, and Counters Show Commands for Port-Access AuthenticatorViewing 802.1x Open Vlan Mode Status Page Open Vlan Mode Status To the portConfiguring Port-Based Access Control Switch reboots Show Commands for Port-Access SupplicantSupplicant port detects a different authenticator device How RADIUS/802.1x Authentication Affects Vlan Operation Example of an Active Vlan Configuration Otherwise, port A2 is not listed Assignment Messages Related to 802.1x Operation 1x Operating MessagesPage Retention of Static Addresses Basic OperationBlocking Unauthorized Traffic -3 Trunk Group Exclusion -4 Configuring and Monitoring Port Security Basic OperationBlocking Unauthorized Traffic Trunk Group Exclusion SecurityPlanning Port Security Commands Port Security Command Options OperationPort Security Commands Used in This Section Acquires and maintains authorized addressesAddress address-limit integer Port Security ParametersMode Mac-address mac-addrClear- clear-intrusion-flag Retention of Static AddressesParameter Description Displaying Current Port Security Settings Using the CLI To Display Port Security SettingsConfiguring Port Security Configuring and Monitoring Port Security Example of Adding an Authorized Device to a Port Removing a Device From the Authorized List for a Port. This Command option removes unwanted devices MAC addresses fromDevice’s MAC address. For example Entry in the table onTo automatically become authorized Remove 0c0090-123456 from the Authorized Address listClick on Port Security Web Displaying and Configuring Port Security FeaturesReading Intrusion Alerts and Resetting Alert Flags How the Intrusion Log Operates Example of Multiple Intrusion Log Entries for the Same PortIt detects FlagsOperates as follows Intrusion flagType I Intrusion log to display the Intrusion Log 11. Example of the Intrusion Log DisplayList intrusion log content Intrusion Alert on port A1 14. Example of Port Status Screen After Alert Flags Reset Event Log lists port security intrusions asOperating Notes for Port Security Configuring and Monitoring Port Security Page Using Authorized IP Managers  Building IP MasksAuthorized IP Manager Features Using Authorized IP ManagersOptions Access LevelsYou can configure Defining Authorized Management Stations Overview of IP Mask OperationBuilding IP Masks on Menu Viewing and Configuring IP Authorized ManagersSwitch Configuration IP Authorized Managers From the console Main Menu, selectCLI Viewing and Configuring Authorized IP Managers Authorized IP Managers Commands Used in This SectionConfiguring IP Authorized Managers for the Switch IP MaskClick on Authorized Addresses Web Configuring IP Authorized ManagersAddress of the authorized manager you want to delete Authorized 227 125 Configuring One Station Per Authorized Manager IP EntryBuilding IP Masks Manager IPUsing Authorized IP Managers Any value from 0 to 125, or 127 can access the switchBuilding IP Masks IP Mask 255 249Authorized Additional Examples for Authorizing Multiple StationsResults Using Authorized IP Managers Page Index IndexSee port access control OpenSSH … 4-3,5-2 operating notes See SSH.­ proxy Web server … Quick start … SSL See RADIUS. … 3-4 troubleshoot … 2-15 troubleshooting Index Page 5990-3032
Related manuals
Manual 306 pages 15.53 Kb