Manuals / Brands / Computer Equipment / Switch / IronPort Systems / Computer Equipment / Switch

IronPort Systems 4108GL - page 184

1 483

Download 483 pages, 5.98 Mb

9-30

Using Passwords and TACACS+ To Protect Against Una uthorized Access

TACACS+ Authentication for Central Control of Switch Access Security

Using Passwords and

TACACS+

Contents

Main Page Page Page Preface Use of This Guide and Other Procurve Switch Documentation Just Want a Quick Start? To Set Up and Install the Switch in Your Network Selecting a Management Interface Using the Menu Interface Using the Command Line Interface (CLI) Using the HP Web Browser Interface Switch Memory and Configuration Interface Access and System Information Configuring IP Addressing Time Protocols Using Passwords and TACACS+ To Protect Against Unauthorized Access Using Authorized IP Managers for Increased Management Security Optimizing Port Usage Through Traffic Control and Port Trunking Configuring for Network Management Applications HP Procurve Stack Management Port-Based Virtual LANs (VLANs) and GVRP Multimedia Traffic Control with IP Multicast (IGMP) Spanning Tree Protocol (STP) Monitoring and Analyzing Switch Operation Troubleshooting File Transfers MAC Address Management Daylight Savings Time on HP Procurve Switches Selecting a Management Interface Understanding Management Interfaces Advantages of Using the Menu Interface Advantages of Using the CLI CLI Usage Advantages of Using the HP Web Browser Interface Advantages of Using HP TopTools for Hubs & Switches Page Page Using the Menu Interface Page Starting and Ending a Menu Session Note How To Start a Menu Interface Session Note How To End a Menu Session and Exit from the Console: Page Main Menu Features Page Screen Structure and Navigation 2-10 Using the Menu Interface Table 2-1. How To Navigate in the Menu Interface Page Rebooting the Switch Note Menu Features List 2-15 Where To Go From Here Page Using the Command Line Interface (CLI) Accessing the CLI Using the CLI Note Privilege Levels at Logon Caution Privilege Level Operation Operator Privileges Operator Privileges Manager Privileges Manager Privileges Page How To Move Between Levels Listing Commands and Command Options Listing Commands Available at Any Privilege Level Page Command Option Displays ? Displaying CLI "Help" Page Configuration Commands and the Context Configuration Modes Page Page CLI Control and Editing Using the HP Web Browser Interface Note General Features Web Browser Interface Requirements Starting an HP Web Browser Interface Session with the Switch Using a Standalone Web Browser in a PC or UNIX Workstation Using HP TopTools for Hubs & Switches Note Tasks for Your First HP Web Browser Interface Session Viewing the First Time Install Window Creating Usernames and Passwords in the Browser Interface Page Note Using the Passwords Using the User Names If You Lose a Password Online Help for the HP Web Browser Interface Note Support/Mgmt URLs Feature Support URL Help and the Management Server URL Page Status Reporting Features The Overview Window The Port Utilization and Status Displays Port Utilization Page Port Status The Alert Log Sorting the Alert Log Entries 4-21 Alert Types Note Viewing Detail Views of Alert Log Entries The Status Bar Setting Fault Detection Policy Page Page Switch Memory and Configuration Overview of Configuration File Management Note Using the CLI To Implement Configuration Changes Page Note Using the Menu and Web Browser Interfaces To Implement Configuration Changes Using the Menu Interface To Implement Configuration Changes Note Using Save and Cancel in the Menu Interface Note Rebooting from the Menu Interface Page Using the Web Browser Interface To Implement Configuration Changes Note Using Primary and Secondary Flash Image Options Displaying the Current Flash Image Data Page OS Downloads Local OS Replacement and Removal Note Caution Caution--No Undo! Rebooting the Switch Page Page Page Interface Access and System Information Page Interface Access: Console/Serial Link, Web, and Inbound Telnet Note Menu: Modifying the Interface Access Interface Access and CLI: Modifying the Interface Access HP4108(config)# telnet-server HP4108(config)# no telnet-server HP4108(config)# no web-management HP4108(config)# web-management Note Page System Information Menu: Viewing and Configuring System Information Note CLI: Viewing and Configuring System Information Page Note Web: Configuring System Parameters Page Configuring IP Addressing Page IP Configuration Just Want a Quick Start? IP Addressing with Multiple VLANs Notes IP Addressing in a Stacking Environment Menu: Configuring IP Address, Gateway, and Time-To- Live (TTL) Note Page CLI: Configuring IP Address, Gateway, Time-To-Live (TTL), and Timep Note HP4108(config)# vlan 1 ip address 10.28.227.103/24 HP4108(config)# ip default-gateway 10.28.227.115 Web: Configuring IP Addressing How IP Addressing Affects Switch Operation DHCP/Bootp Operation Page Page Note Network Preparations for Configuring DHCP/Bootp Note Globally Assigned IP Network Addresses Time Protocols Notes TimeP Time Synchronization SNTP Time Synchronization Overview: Selecting a Time Synchronization Protocol or Turning Off Time Protocol Operation General Steps for Running a Time Protocol on the Switch: Disabling Time Synchronization SNTP: Viewing, Selecting, and Configuring 8-5 Table 8-1.SNTP Parameters Menu: Viewing and Configuring SNTP To View, Enable, and Modify SNTP Time Protocol: 1. From the Main Menu, select: Page Page CLI: Viewing and Configuring SNTP Page Page Page Page 8-13 Figure 8-11. Example of Disabling Time Synchronization by Disabling the SNTP Mode TimeP: Viewing, Selecting, and Configuring 8-14 Time Protocols Table 8-2.Timep Parameters Menu: Viewing and Configuring TimeP To View, Enable, and Modify the TimeP Protocol: 1. From the Main Menu, select: Page CLI: Viewing and Configuring TimeP Page Page Page SNTP Unicast Time Polling with Multiple SNTP Servers Address Prioritization Adding and Deleting SNTP Server Addresses Page Menu Interface Operation with Multiple SNTP Server Addresses Configured SNTP Messages in the Event Log Page Using Passwords and TACACS+ To Protect Against Unauthorized Access Page Configuring Username and Password Security Note Menu: Configuring Passwords CLI: Setting Manager and Operator Passwords Web: Configuring User-Names and Passwords TACACS+ Authentication for Central Control of Switch Access Security Notes Regarding Software Release G.01.xx Terminology Used in TACACS Applications: General System Requirements Notes General Authentication Setup Procedure Note on Privilege Levels Caution Configuring TACACS+ on the Switch Before You Begin Viewing the Switchs Current Authentication Configuration Viewing the Switchs Current TACACS+ Server Contact Configuration Configuring the Switchs Authentication Methods Caution Regarding the Use of Local for Login Primary Access Page Configuring the Switchs TACACS+ Server Access Note Note on Encryption Keys 9-21 Page Page How Authentication Operates General Authentication Process Using a TACACS+ Server Local Authentication Process Note Using the Encryption Key General Operation Note Encryption Options in the Switch Controlling Web Browser Interface Access When Using TACACS+ Authentication Messages Troubleshooting TACACS+ Operation Page Using Authorize IP Using Authorized IP Managers for Increased Management Security Page Page Using Authorized IP Managers Caution Access Levels Defining Authorized Management Stations Overview of IP Mask Operation Note Menu: Viewing and Configuring IP Authorized Managers CLI: Viewing and Configuring Authorized IP Managers Listing the Switchs Current Authorized IP Manager(s) Using Authorized IP Configuring IP Authorized Managers for the Switch Web: Configuring IP Authorized Managers Building IP Masks Configuring One Station Per Authorized Manager IP Entry Configuring Multiple Stations Per Authorized Manager IP Entry 10-12 Managers Using Authorized IP Table 10-3. Analysis of IP Mask for Multiple-Station Entries Figure 10-4. Example of How the Bitmap in the IP Mask Defines Authorized Manager Addresses Operating and Troubleshooting Notes Page Optimizing Port Usage Through Traffic Control and Port Trunking Viewing Port Status and Configuring Port Parameters Note On Connecting Transceivers to Fixed- Configuration Devices 11-3 Table 11-1. Status and Parameters for Each Port Type 11-4 and Trunking Ports: Traffic Control Menu: Viewing Port Status and Configuring Port Note CLI: Viewing Port Status and Configuring Port Page Page Web: Viewing Port Status and Configuring Port Port Trunking Note Caution Switch 4108GL Port Trunk Features and Operation LACP Note Trunk Configuration Methods 11-13 Table 11-4. Trunk Configuration Protocols Page 11-15 Menu: Viewing and Configuring a Static Trunk Group Important Page CLI: Viewing and Configuring a Static or Dynamic Port Trunk Group Using the CLI To View Port Trunks Page Page Using the CLI To Configure a Static or Dynamic Trunk Group Important HP4108(config)# trunk trk2 trunk c4-c6 Caution Page HP4108(config)# interface c4-c5 lacp active Web: Viewing Existing Port Trunk Groups Trunk Group Operation Using LACP Note Page 11-27 Default Port Operation LACP Notes and Restrictions Trunk Group Operation Using the Trunk Option Trunk Operation Using the FEC Option How the Switch Lists Trunk Data Outbound Traffic Distribution Across Trunked Links 11-31 Page Configuring for Network Management Applications SNMP Management Features Page Configuring for SNMP Access to the Switch Caution SNMP Communities Caution Menu: Viewing and Configuring SNMP Communities CLI: Viewing and Configuring Community Names Page manager unrestricted operator restricted Trap Receivers and Authentication Traps Note CLI: Configuring and Displaying Trap Receivers Page Note Using the CLI To Enable Authentication Traps Note Advanced Management: RMON CDP Introduction CDP Terminology General CDP Operation Outgoing Packets Incoming CDP Packets 12-16 the Switch Monitoring and Managing Figure 12-7. Example of Incomin g CDP Packet Results Page Configuring CDP on the Switch CLI: Viewing and Configuring CDP Viewing the Switchs Current CDP Configuration Viewing the Current Contents of the Switchs CDP Neighbors Tabl e Clearing (Resetting) the CDP Neighbors Table Configuring CDP Operation Page Effect of Spanning Tree (STP) On CDP Packet Transmission How the Switch Selects the IP Address To Include in Outbound CDP Packets CDP Neighbor Data and MIB Objects 12-26 the Switch Monitoring and Managing Table 12-2. CDP Neighbors Data Page Page HP Procurve Stack Management Page Page 13-4 HP Procurve Stack HP Procurve Stack Management Which Devices Support Stacking? Components of HP Procurve Stack Management General Stacking Operation Operating Rules for Stacking General Rules Specific Rules 13-9 Note Overview of Configuring and Bringing Up a Stack Page Page HP Procurve Stack Auto Join parameter set to Yes (the defaul t) Manager password not configured Using the Menu Interface To View Stack Status and Configure Stacking Using the Menu Interface To View and Configure a Commander Switch Page Using the Menu To Manage a Candidate Switch Page Using the Commander To Manage The Stack Page Page Page Page Note: Page Using the Commander To Access Member Switches for Configuration Changes and Monitoring Traffic Converting a Commander or Member to a Member of Another Stack Monitoring Stack Status Page Page Page 13-31 Using the CLI To View Stack Status and Configure Stacking 13-32 HP Procurve Stack Using the CLI To View Stack Status Page Using the CLI To Configure a Commander Switch Note Page Adding to a Stack or Moving Switches Between Stacks Page Page Page Page Using the CLI To Remove a Member from a Stack Note Page Using the CLI To Access Member Switches for Configuration Changes and Traffic Monitoring SNMP Community Operation in a Stack Using the CLI To Disable or Re-Enable Stacking Transmission Interval Stacking Operation with Multiple VLANs Configured Web: Viewing and Configuring Stacking 13-48 HP Procurve Stack Status Messages Stacking screens and listings display these status messages: Port-Based Virtual LANs (VLANs) and GVRP Page Page Port-Based Virtual LANs (Static VLANs) Note Page Page Overview of Using VLANs VLAN Support and the Default VLAN Which VLAN Is Primary? Note Per-Port Static VLAN Configuration Options Page General Steps for Using VLANs Notes on Using VLANs Menu: Configuring VLAN Parameters To Change VLAN Support Settings Note Adding or Editing VLAN Names Adding or Changing a VLAN Port Assignment Note CLI: Configuring VLAN Parameters Page Page Page Page Page Note Web: Viewing and Configuring VLAN Parameters VLAN Tagging Information Page Page Note Effect of VLANs on Other Switch Features Spanning Tree Protocol Operation with VLANs IP Interfaces VLAN MAC Addresses Port Trunks Port Monitoring VLAN Restrictions GVRP Note General Operation Note Per-Port Options for Handling GVRP Unknown VLANs Page Per-Port Options for Dynamic VLAN Advertising and Joining Note GVRP and VLAN Access Control Port-Leave From a Dynamic VLAN Planning for GVRP Operation Configuring GVRP On a Switch Menu: Viewing and Configuring GVRP Page CLI: Viewing and Configuring GVRP Page Page Web: Viewing and Configuring GVRP GVRP Operating Notes Page Page Multimedia Traffic Control with IP Multicast (IGMP) Page General Operation and Features Note IGMP Terms IGMP Operating Features Basic Operation Enhancements Notes CLI: Configuring and Displaying IGMP Page Note Page Web: Enabling or Disabling IGMP How IGMP Operates Operation With or Without IP Addressing Automatic Fast-Leave IGMP Forced Fast-Leave IGMP Configuration Options for Forced Fast-Leave Note on VLAN Numbers: Listing the Forced Fast-Leave Configuration Page Configuring Per-Port Forced Fast-Leave IGMP Using the Switch as Querier Querier Operation Note The Switch Excludes Well-Known or Reserved Multicast Addresses from IP Multicast Filtering Note: Number of IP Multicast Addresses Allowed Spanning Tree Protocol (STP) Page Note Caution Menu: Configuring STP CLI: Configuring STP Page Spanning Tree Protocol Caution Note Page Web: Enabling or Disabling STP How STP Operates STP Fast Mode Caution STP Operation with 802.1Q VLANs Page Page Monitoring and Analyzing Switch Operation Note 17-3 Status and Counters Data Note Menu Access To Status and Counters General System Information Menu Access Switch Management Address Information Menu Access Module Information Menu: Displaying Port Status Port Status Viewing Port and Trunk Group Statistics and Flow Control Status Note on Reset Menu Access to Port and Trunk Statistics CLI Access To Port and Trunk Group Statistics Web Browser Access To View Port and Trunk Group Statistics Viewing the Switchs MAC Address Tables Menu Access to the MAC Address Views and Searches Page CLI Access for MAC Address Views and Searches Note Spanning Tree Protocol (STP) Information Menu Access to STP Data CLI Access to STP Data Internet Group Management Protocol (IGMP) Status VLAN Information Page Web Browser Interface Status Information Port Monitoring Features Note Menu: Configuring Port Monitoring CLI: Configuring Port Monitoring Page Web: Configuring Port Monitoring Page Troubleshooting Note Troubleshooting Approaches Browser or Telnet Access Problems Page Unusual Network Activity General Problems Troubleshooting CDP Operation IGMP-Related Problems Problems Related to Spanning-Tree Protocol (STP) Caution Stacking-Related Problems TACACS-Related Problems Page TimeP, SNTP, or Gateway Problems VLAN-Related Problems Page Troubleshooting TACACS+ Operation Page Page Using the Event Log To Identify Problem Sources 18-17 Table 18-1. Event Log System Modules Figure 18-3. Example of an Event Log Display Menu: Entering and Navigating in the Event Log From the Main Menu, select Event Log. CLI: Diagnostic Tools Port Auto-Negotiation Ping and Link Tests Note Web: Executing Ping or Link Tests CLI: Ping or Link Tests Page Displaying the Configuration File CLI: Viewing the Configuration File Web: Viewing the Configuration File CLI Administrative and Troubleshooting Commands Note Restoring the Factory-Default Configuration Note CLI: Resetting to the Factory-Default Configuration Note Clear/Reset: Resetting to the Factory-Default Configuration Restoring a Flash Image Note Page Page Page A File Transfers Downloading an Operating System (OS) General OS Download Rules Note Using TFTP To Download an OS Image from a Server Note Menu: TFTP Download from a Server to Primary Flash Note CLI: TFTP Download from a Server to Primary or Secondary Flash Using Xmodem to Download an OS Image From a PC or UNIX Workstation Menu: Xmodem Download to Primary Flash CLI: Xmodem Download from a PC or Unix Workstation to Primary or Secondary Flash Switch-to-Switch Download Menu: Switch-to-Switch Download to Primary Flash CLI: Switch-To-Switch Downloads Using the HP TopTools for Hubs & Switches Utility Troubleshooting TFTP Downloads Note Transferring Switch Configurations Page Page Copying Diagnostic Data to a Remote Host, PC, or Unix Workstation Copying Command Output to a Destination Device Copying Event Log Output to a Destination Device Copying Crash Data Content to a Destination Device Copying Crash Log Data Content to a Destination Device B MAC Address Management Note Determining MAC Addresses Note Menu: Viewing the Switchs MAC Addresses Note CLI: Viewing the Port and VLAN MAC Addresses Note B-5 MAC Address Management Determining MAC Addresses Figure B-2. Example of Port MAC Address Assignments Page Daylight Savings Time on HP Procurve Switches C Daylight Savings Time on HP Procurve Switches Page Daylight Savings Time on HP Procurve Switches Page Index 1 Index Symbols Numerics A B D Index 3 E F G 4 Index H I J L Index 5 M N O P 6 Index Q Index 7 R S 8 Index T Index 9 U V 10 Index W Page Page *5969-2378* 5969-2378