Using the Encryption Key | HP 4100gl instruction

TACACS+ Authentication

How Authentication Operates

	Using the Encryption Key
	General Operation
	When used, the encryption key (sometimes termed "key", "secret key", or
	"secret") helps to prevent unauthorized intruders on the network from reading
	username and password information in TACACS+ packets moving between
	the switch and a TACACS+ server. At the TACACS+ server, a key may include
	both of the following:
	■ Global key: A general key assignment in the TACACS+ server appli-
	cation that applies to all TACACS-aware devices for which an indi-
	vidual key has not been configured.
	■ Server-Specific key: A unique key assignment in the TACACS+
	server application that applies to a specific TACACS-aware device.

Note	Configure a key in the switch only if the TACACS+ server application has this
	exact same key configured for the switch. That is, if the key parameter in
	switch "X" does not exactly match the key setting for switch "X" in the
	TACACS+ server application, then communication between the switch and
	the TACACS+ server will fail.
	Thus, on the TACACS+ server side, you have a choice as to how to implement

	a key. On the switch side, it is necessary only to enter the key parameter so
	that it exactly matches its counterpart in the server. For information on how
	to configure a general or individual key in the TACACS+ server, refer to the
	documentation you received with the application.
	Encryption Options in the Switch
	When configured, the encryption key causes the switch to encrypt the
	TACACS+ packets it sends to the server. When left at "null", the TACACS+
	packets are sent in clear text. The encryption key (or just "key") you configure
	in the switch must be identical to the encryption key configured in the
	corresponding TACACS+ server. If the key is the same for all TACACS+
	servers the switch will use for authentication, then configure a global key in
	the switch. If the key is different for one or more of these servers, use "server-
	specific" keys in the switch. (If you configure both a global key and one or
	more per-server keys, the per-server keys will override the global key for the
	specified servers.)

2-23

Image 51

HP 4100gl manual Using the Encryption Key

Contents

Access security guide Hp procurve Series 4100gl switches Page Access Security Guide HP Procurve Series 4100GL Switches Publication Number Contents Configuring the Switch for Radius Authentication Controlling Web Browser Interface Access When When Using Radius Authentication Controlling Web Browser Interface Access Further Information on SSH Client Public-Key Authentication Operating Rules for Authorized-Client General Setup Procedure forConfiguring Switch Ports To Operate As Supplicants for 802.1x Connections to Other Switches Resetting Alert Flags Operating Notes for Port Security How RADIUS/802.1x Authentication Affects Vlan OperationPort Security Command Options and Operation Web Displaying and Configuring Port Security Features Defining Authorized Management Stations Page Getting Started Contents Overview of Access Security Features IntroductionGetting Started Xiii Command Syntax Conventions Command PromptsSimulating Display Output Screen Simulations Related Publications Getting Started Click on technical support Getting Documentation From the Web Sources for More Information Main Menu of the Menu interface, select To Set Up and Install the Switch in Your NetworkRun Setup Need Only a Quick Start?Page Configuring Username and Password Security Level Actions Permitted Configuring Username and Password SecurityFeature Default Menu Overview Passwords are case-sensitive Console Passwords Configuring Local Password SecurityMenu Setting Passwords To set a new password Commands Used in This Section CLI Setting Passwords and UsernamesContinue Deletion of password protection? No Configuring Manager and Operator Passwords Enter Web Setting Passwords and UsernamesClick on Device Passwords Click on the Security tab Using TACACS+ Authentication Messages Operating Notes TACACS+ Authentication Example of TACACS+ Operation TACACS+ Authentication TACACS+ Authentication Terminology Used in Tacacs Applications General System Requirements General Authentication Setup Procedure Determine the following Result in Operator read-only access. Thus, when configuringAdditional features that the application offers Always used as the secondary access control method Telnet Before You Begin Configuring TACACS+ on the SwitchCLI Commands Described in this Section Command This example shows the default authentication configuration Viewing the Switch’s Current Authentication Configuration Configuring the Switch’s Authentication Methods Method/privilege path. Available only if the primary method AAA Authentication ParametersName Default Range Function Authentication for the access being configured is local Login Primary to Local authentication Primary/Secondary Authentication Table HPswitchconfig# aaa authentication num-attempts TACACS+ server Configuring the Switch’s TACACS+ Server Access Syntax tacacs-server host ip-addr key key-string None Name Default Range None null Timeout 1 To configure north01 as a per-server encryption key HPswitchconfig# no tacacs-server host How Authentication Operates General Authentication Process Using a TACACS+ ServerChanges without executing write mem TACACS+ Authentication Authentication Local Authentication Process Using the Encryption Key HPswitchconfig# tacacs-server key north40campus CLI Message Meaning Tacacs-server configurationMessages Related to TACACS+ Operation Operating Notes Rized persons Controlling Web Browser Interface Access When Using Radius Radius Authentication and Accounting Radius Authentication and Accounting Port-Access Terminology Switch Operating Rules for Radius Preparation for Configuring Radius on the Switch General Radius Setup Procedure Configuring the Switch for Radius Authentication Outline of the Steps for Configuring Radius AuthenticationRadius Authentication Commands Server IP address Used on the specified Radius server. Default nullConfigure the global Radius parameters Radius server documentation Local none Authentication Process on Example Configuration for Radius Authentication Configuring Radius Accounting instead of continuing here Configure the Switch To Access a Radius Server Radius Authentication and Accounting Key global-key-string Configure the Switch’s Global Radius Parameters To an authentication request before counting the attempt as Listings of Global Radius Parameters Configured In Figure Local Authentication Process Word pair for the level you want to enter Configuring Radius Accounting Radius Accounting CommandsOn page 3-5 before continuing here Operating Rules for Radius Accounting Steps for Configuring Radius Accounting Configure the Switch To Access a Radius Server Radius Authentication and Accounting Start-Stop Example of Configuring Accounting Types Update period General Radius Statistics Viewing Radius Statistics PendingRequests Term Definition Radius Authentication Statistics Radius Accounting Statistics 14. Listing the Accounting Configuration in the Switch 17. Search Order for Accessing a Radius Server Changing RADIUS-Server Access Order 18. Example of New Radius Server Search Order Message Meaning Messages Related to Radius OperationPage Configuring the Switch for SSH Operation Configuring Secure Shell SSH Configuring Secure Shell SSH Client Public Key Authentication Model Use a key to authenticate itself to the switch 3DES 168-bitDES 56-bit Prerequisite for Using SSH SSH Options Public Key Formats Ssh enable radius Switch Primary SSH Authenticate Primary SwitchManager Ssh enable local Enable Ssh enable tacacs Configuring Secure Shell SSH General Operating Rules and Notes SSH-Related Commands in This Section Configuring the Switch for SSH Operation Example of Configuring Local Passwords Generating the Switch’s Public and Private Key Pair To the switch using the earlier pair CLI kill commandPair automatically disables SSH Providing the Switch’s Public Key to Clients For example, to generate and display a new keyOperation Example of a Public Key Generated by the Switch Inserted Bit Exponent Modulus Switch’s Public and Private Key Pair on To enable SSH on the switch On the switch by appearing to be you Version of SSH to accept connections from. default 1-or-2 Option a Configuring SSH Access for Password-Only SSH Configuring the Switch for SSH Authentication U t i o n Configures 14 shows how to check the results of the above commands Use an SSH Client To Access the Switch Further Information on SSH Client Public-Key Authentication 15. Example of a Client Public Key Ascii Property Supported Comments Value Show crypto client-public-key babble fingerprint Deletes the client-public-key file from the switch 00000K Peer unreachable Messages Related to SSH Operation Key for the switch Comments on certificate fields Assigning a Local Login Operator Configuring Secure Socket Layer SSL Server Certificate authentication with User Password RC4 40-bit, 128-bit 3DES 168-bit, 112 Effective General steps for configuring ssl include Client Preparation Prerequisite for Using SSL Provided with your browser General Operating Rules and Notes Configuring the Switch for SSL Operation Assigning a Local Login Operator and Enable ManagerPasswordSSL-Related CLI Commands in This Section Security Tab Password Button Earlier certificate Generating the Switch’s Server Host CertificateParticular switch/client session, and then discarded Verified unequivocally CLI CLI commands used to generate a Server Host Certificate Certificate Field Descriptions For example, to generate a key and a new host certificateField Name Description For example, to display the new server host certificate CLI Command to view host certificatesHost-cert command Can resume SSL operation New key then just select current from the list Installed certificateSelect the Generate Certificate button Iii Select Self signed certificate in the type box Configuring Secure Socket Layer SSL Web browser Interface showing current SSL Host Certificate Configuring Secure Socket Layer SSL Certificate Request Certificate Request Reply T e Execute no web-management ssl Zeroize the switch’s host certificate or certificate key . Enable SLL Port number Selection Error During Possible Cause Common Errors in SSL setupPage General Setup Procedure for Port-Based Access Control General Operating Rules and Notes -9Messages Related to 802.1x Operation -47 802.1x on the Series 4100GL switches includes the following Why Use Port-Based Access Control?General Features Refer to Radius Authentication and Accounting on Configuring Port-Based Access Control Authenticating One Switch to Another .1x authentication also How 802.1x Operates Authenticator Operation Example of Supplicant Operation Switch-Port Supplicant Operation Terminology 802.1x standard General Operating Rules and Notes Configuring Port-Based Access Control Do These Steps Before You Configure 802.1x Operation General Setup Procedure for Port-Based Access Control Authenticators operate as expected Overview Configuring 802.1x Authentication on Switch Configuring Port-Based Access Control 802.1x Authentication Commands Configuring Switch Ports as Authenticators To activate 802.1x authentication on the switch Enable 802.1x Authentication on Selected Ports Tx-period 0 Clears authenticator statistics counters Chap-radius Configure the 802.1x Authentication MethodLocal Eap-radius Enter the Radius Host IP Addresses Enable 802.1x Authentication on the Switch 802.1x-Related Show Commands Radius server configuration 802.1x Open Vlan ModeIntroduction Tagged Vlan as the Unauthorized-Client Vlan Use Models for 802.1x Open Vlan Modes Port as a static, tagged member of the VLAN, membership 802.1x Per-Port Configuration Port Response Condition Rule Multiple Authenticator Ports Using Before you configure the 802.1x Open Vlan mode on a port Setting Up and Configuring 802.1x Open Vlan Mode Mised by an unauthorized client Activate authentication on the switch Port-Security To Allow Only 802.1x Devices onVlan Operation HPswitchconfig# aaa authentication port-access eap-radius 802.1x Open Vlan Operating Notes Action none send-alarm send-disable Enables 802.1x authentication on the port 802.1x Authentication Commands 802.1x Supplicant Commands Specified ports Authenticator at the same time Enter secret password Repeat secret password Syntax aaa port-access supplicant ethernet port-list Max-start 1 Show Commands for Port-Access Authenticator Displaying 802.1x Configuration, Statistics, and Counters Viewing 802.1x Open Vlan Mode Status Page To the port Open Vlan Mode Status Configuring Port-Based Access Control Show Commands for Port-Access Supplicant Supplicant port detects a different authenticator deviceSwitch reboots How RADIUS/802.1x Authentication Affects Vlan Operation Example of an Active Vlan Configuration Otherwise, port A2 is not listed Assignment 1x Operating Messages Messages Related to 802.1x OperationPage Basic Operation Blocking Unauthorized Traffic -3 Trunk Group Exclusion -4Retention of Static Addresses Basic Operation Configuring and Monitoring Port Security Blocking Unauthorized Traffic Security Trunk Group Exclusion Planning Port Security Acquires and maintains authorized addresses Port Security Command Options OperationPort Security Commands Used in This Section Commands Mac-address mac-addr Port Security ParametersMode Address address-limit integer Retention of Static Addresses Parameter DescriptionClear- clear-intrusion-flag Using the CLI To Display Port Security Settings Displaying Current Port Security Settings Configuring Port Security Configuring and Monitoring Port Security Example of Adding an Authorized Device to a Port Entry in the table on Command option removes unwanted devices MAC addresses fromDevice’s MAC address. For example Removing a Device From the Authorized List for a Port. This Remove 0c0090-123456 from the Authorized Address list To automatically become authorized Web Displaying and Configuring Port Security Features Reading Intrusion Alerts and Resetting Alert FlagsClick on Port Security Example of Multiple Intrusion Log Entries for the Same Port How the Intrusion Log Operates Intrusion flag FlagsOperates as follows It detects 11. Example of the Intrusion Log Display Type I Intrusion log to display the Intrusion Log List intrusion log content Intrusion Alert on port A1 Event Log lists port security intrusions as 14. Example of Port Status Screen After Alert Flags Reset Operating Notes for Port Security Configuring and Monitoring Port Security Page Building IP Masks Using Authorized IP Managers Using Authorized IP Managers Authorized IP Manager Features Access Levels You can configureOptions Overview of IP Mask Operation Defining Authorized Management Stations From the console Main Menu, select Menu Viewing and Configuring IP Authorized ManagersSwitch Configuration IP Authorized Managers Building IP Masks on Authorized IP Managers Commands Used in This Section CLI Viewing and Configuring Authorized IP Managers IP Mask Configuring IP Authorized Managers for the Switch Web Configuring IP Authorized Managers Address of the authorized manager you want to deleteClick on Authorized Addresses Manager IP Configuring One Station Per Authorized Manager IP EntryBuilding IP Masks Authorized 227 125 Using Authorized IP Managers IP Mask 255 249 125, or 127 can access the switchBuilding IP Masks Any value from 0 to Additional Examples for Authorizing Multiple Stations ResultsAuthorized Using Authorized IP Managers Page Index Index See port access control OpenSSH … 4-3,5-2 operating notes See SSH. proxy Web server … Quick start … SSL See RADIUS. … 3-4 troubleshoot … 2-15 troubleshooting Index Page 5990-3032