IBM Partner Pavilion BMD00082 specs

SmartConnect User’s Guide

Setting Allowable Source IP Address Ranges

To limit access to the switch, you can set a source IP address (or range) that will be allowed to connect to the switch IP interface through Telnet, SSH, or the BBI. This also helps to prevent spoofing or attacks on the switch’s TCP/IP stack.

When an IP packet reaches the switch, the source IP address is checked against the range of addresses defined by the management networks and masks (as defined in the /cfg/sys/access/mgmt menu).

If the source IP address of the host or hosts are within the defined ranges, they are allowed to attempt to log in. Any packet addressed to a switch IP interface with a source IP address out- side these ranges are discarded.

Configuring an IP Address Range for the Management Network

Configure the management network IP address and mask in the System Access Management Menu.

>>Main# /cfg/sys/access/mgmt/add

Enter Management Network Address: 192.192.192.0

Enter Management Network Mask: 255.255.255.128

In this example, the management network is set to 192.192.192.0 and management mask is set to 255.255.255.128. This defines the following range of allowed IP addresses: 192.192.192.1 to 192.192.192.127. The following source IP addresses are granted or not granted access to the switch:

A host with a source IP address of 192.192.192.21 falls within the defined range and would be allowed to access the switch.

A host with a source IP address of 192.192.192.192 falls outside the defined range and is not granted access. To make this source IP address valid, you would need to shift the host to an IP address within the valid range specified, or modify the management address to be 192.192.192.128. This would put the 192.192.192.192 host within the valid range allowed by the configured management network (192.192.192.128–255).

BMD00082, February 2009

Chapter 6: Configuring Switch Access 71

Image 73

IBM Partner Pavilion BMD00082 manual Setting Allowable Source IP Address Ranges

Contents

User’s Guide SmartConnect User’s Guide Contents Switch Virtualization Part 2 BBI Reference Boot Management Switch Statistics SmartConnect User’s Guide Who Should Use This User’s Guide Preface What You’ll Find in This User’s Guide Part 1 Basic Concepts and ConfigurationPart 2 BBI Reference Typographic Conventions How to Get HelpTypographic Conventions 10 „ Preface Part 1 Basic Concepts & Configuration 12 „ Part 1 Basic Concepts & Configuration VSE SmartConnect Software Overview VSE SmartConnect Software Operation 14 „ VSE SmartConnect Software Operation Configuring the Upstream Networking Device Configuring the Chassis Management SystemConfiguring the Chassis Processor Blades VSE SmartConnect Software Quick Start 16 „ VSE SmartConnect Software Operation Getting Started with the Browser- Based Interface Web Browser Set UpRequirements Starting the BBI ASmartConnect Login Prompt Bbbi Startup Screen Updating the Software Image Transferring the New Image to the SwitchLoading the New Software Image CBoot Management Window shown with Stacking enabled Selecting a Software Image to Run Uploading a Software Image from the Switch Active, backup, or factory Selecting a Configuration Block Resetting the Switch Switch Virtualization Port Groups Virtual Switch GroupsVirtual Machine Groups Link Aggregation VLANs Port AccessNetwork Segmentation Port-Based Vlan Tagging Defined VLANs Trunking ATrunking External Ports External Trunks Trunking Rules Switch Failover Built-In Fault ToleranceStatistical Load Distribution Link Aggregation Control Protocol Configuring Switch Failover Setting the Number of Links to Trigger Failover CTrunking Internal Ports Internal Trunks Igmp Snooping ServerMobility Configuring a Backup Server Port 1ServerMobility General Configuration Fields General Configuration Configuration Port Configuration2ServerMobility Port Configuration Fields Dhcp Server Configuration SmartConnect User’s Guide 42 „ Switch Virtualization Stacking Stacking Requirements BackupStack Membership Master Master and Backup Selection Master and Backup Behavior Stack Member Numbers Configuring a Stack Configure the Stack Trunk ports optional Configuring Each Switch # cfg/stack/mif Locating the Master Switch Internal Management IP Interface Additional Master ConfigurationViewing Stack Connections Binding Members to the Stack CStack Switch Configuration Window DStack IP Interfaces Configuration Window Configuring an External IP Address for the Stack EPort Status with Stacking Managing a Stack Additional Internal Port Settings for Stacking Stacking Internal Port SettingsStacking Port Numbers Stacking VLANs Stacking Boot Management buttons Stacking Boot ManagementUpgrading Stack Software Info/stack/pushstat Command Reference Menu Summary CLI Menus „ Statistics Menu „ Boot Options Menu Viewing Pending Changes Viewing, Applying, and Saving ChangesApplying Pending Changes # save Saving the Configuration Management Module Setup Configuring Switch Access Configuring the Default Gateway Factory Default vs. MM Assigned IP AddressesSwitch IP Addresses, Based on Switch-Module Bay Numbers ASwitch Configuration in the Management Module Window Configuring Management Module for Switch Access Cfg/sys/access/https/access e Connect to the Switch via SSH Using Telnet Access via Http Using the Browser-Based InterfaceAccess via Https Https//192.168.70.127 Securing Access to the Switch Configuring an IP Address Range for the Management Network Setting Allowable Source IP Address Ranges Configuring Radius Radius Authentication and AuthorizationUser Access Levels User Accounts 3SmartConnect-Proprietary Attributes for Radius User Name/Access User-Service-Type Value TACACS+ Authentication Features TACACS+ AuthenticationAuthorization Configuring TACACS+ Authentication Considerations for Configuring End User Accounts End User Access Control Logging in to an End-User Account Configuring End-User Access Control CSwitch Protected Mode Configuration Window Protected Mode Secure Shell and Secure Copy Enabling or Disabling SCP Apply and Save Configuring SSH/SCP Features Using SSH and SCP Client Commands Configuring the SCP Administrator PasswordTo Log In to the Switch To Upload the Configuration to the Switch To Download the Switch Configuration Using SCP SSH and SCP Encryption of Management Messages Apply and Save the Configuration Cfg/sys/sshd/skeygen Generating RSA Host and Server Keys for SSH Access SSH/SCP Integration with TACACS+ Authentication SSH/SCP Integration with Radius AuthenticationUsing SecurID with SSH SecurID Support Using SecurID with SCP 86 „ Configuring Switch Access Part 2 BBI Reference 88 „ Part 2 BBI Reference Understanding the Browser-Based Interface AMain VSE SmartConnect Software Screen SmartConnect BBI Screen 1Port Status Colors Port Status Area Bvse SmartConnect Software Menu Area Menu Area Configuration Buttons Configuration Window 94 „ Understanding the Browser-Based Interface Port Groups Virtual Switch Groups Link Aggregation Virtual Machine Groups Switch Management Ports Virtual Switch Groups MembershipAssigning Ports to VSGs Assigning Virtual Machines to VSGs Delete Virtual Switch Group Settings Virtual Switch Groups SettingsSwitch Failover Link Aggregation Control Protocol Reset to DefaultIgmp Snooping Bpdu Policy Add or remove ACLs or ACL sets for the specified VSG ports Virtual Switch Groups ACL QoS Switch Policies Internal Port Settings Fields Internal Port Settings 2External Port Settings Fields External Port Settings Management Port Settings Fields Management Port Settings Port Mirroring ACL Configuration Table Access Control ListsSearching for an Existing ACL „ or Adding a New ACL 4ACL Configuration Fields Access Control ListAdd or Edit ACLs Number, just as with sport above 5ACL Metering Configuration Fields ACL Metering Settings6ACL Remarking Configuration Fields ACL Remark Control 7ACL Sets Configuration Fields Access Control List Sets Ieee 8021p for MAC-Level QoS Quality of Service DiffServ Code Point QoS 8DSCP Configuration Fields 4FB2F3A86E3435548B0BD82DF2B7E949 9ServerMobility General Configuration Fields ServerMobility General Configuration 10ServerMobility Port Configuration Fields ServerMobility Port Configuration System Settings System Log Management Settings1SNMP Management Fields 2Management Fields 3General Configuration Fields General Settings 4Built-In User Administration Fields Local User AdministrationBuilt-In Users 5Local User Administration Fields User Configuration 6RADIUS Fields Remote User Administration 7TACACS+ Fields TACACS+ General Settings Time Services SettingsNTP Settings 8Time Services General Settings Fields Switch Protected Mode ErrDisable System Settings10ErrDisable Configuration Fields Bootstrap Protocol Settings Management Network Settings11Management Network Configuration Fields 12BOOTP Configuration Fields Switch SSH Settings SSH/Telnet SettingsSwitch Telnet Settings 13SSH Configuration Fields 15VM Group Configuration Fields Virtual Machine Group Settings Syslog Settings Stack Switch Configuration Stacking ConfigurationStack Switch Configuration Fields Stack IP Interfaces „ Stack Switch Configuration on „ Managing a Stack on 132 „ System Settings General Boot Settings Boot Management Figuration block Boot Management buttons 2Boot Schedule Fields Boot Schedule 136 „ Boot Management Switch Information Access Control List Sets Information Access Control List Information 2BOOTP Relay Information Fields Bootstrap Protocol Relay InformationARP Cache Information 1ARP Cache Information Fields 3FDB Information Fields Forwarding Database Information 4Virtual Switch Group Information Fields Virtual Switch Group Information Igmp Multicast Groups Igmp InformationIgmp Snooping Multicast Router Ports 5IGMP Multicast Groups information 8Default Gateway information Default GatewaysIP Information IP Interfaces 9Link Status information Link Status Information 10ServerMobility General information ServerMobility General Information Server Mobility Port information ServerMobility Port Information 12SNMPv3 information SNMPv3 Information VacmSecurityToGroup Table SNMPv3 information SnmpTargetParams Table Syslog Messages Trunk Groups Information Port Transceiver StatusTransceiver information Trunk Group information User Information User Access informationVirtual Machine Group Information VM Group information 152 „ Switch Information Access Control List Statistics Switch Statistics1ACL Statistics FDB Statistics Address Resolution Protocol StatisticsLayer 3 Statistics 2FDB Statistics 4ICMP Statistics Icmp Statistics 5TCP Statistics TCP Statistics 6UDP Statistics UDP Statistics 7IGMP Snooping Statistics Igmp Group Snooping Statistics Summary 8IP Statistics IP Statistics Dont Fragment flag was set MP-Specific Information MP Packet Statistics CPU Utilization9CPU Utilization 10MP Packet Statistics Network Time Protocol Statistics Switch Ports Statistics SummaryPort Statistics NTP Statistics Index Symbols TACACS+