HP Switch 6120 User manual

August 2009

ProCurve Series 6120 Switches

Access Security Guide

Hewlett-Packard Company

8000 Foothills Boulevard, m/s 5551

Roseville, California 95747-5551

www.procurve.com

L.P. The information contained herein is subject to change without

This document contains proprietary information, which is

protected by copyright. No part of this document may be

photocopied, reproduced, or translated into another lan- gauge

without the prior written consent of Hewlett-Packard.

Publication Number

5992-5525

August 2009

Applicable Products

HP ProCurve Switch 6120G/XG (498358-B21)

HP ProCurve Switch 6120XG (516733-B21)

Trademark Credits

Microsoft, Windows, and Microsoft Windows NT are U.S.

registered trademarks of Microsoft Corporation.

Software Credits and Notices

SSH on ProCurve switches is based on the OpenSSH soft- ware

toolkit. This product includes software developed by the

OpenSSH Project for use in the OpenSSH Toolkit. For more

information on OpenSSH, visit www.openssh.com.

SSL on ProCurve switches is based on the OpenSSL software

toolkit. This product includes software developed by the

OpenSSL Project for use in the OpenSSL Toolkit. For more

information on OpenSSL, visit

www.openssl.org.

This product includes cryptographic software written by Eric

Young (eay@cryptsoft.com). This product includes software

written by Tim Hudson (tjh@cryptsoft.com).

Portions of the software on ProCurve switches are based on the

lightweight TCP/IP (lwIP) software toolkit by Adam Dunkels,

and are covered by the following notices.

forms, with or without modification, are permitted provided that

the following conditions are met:

1. Redistributions of source code must retain the above copy-

right notice, this list of conditions and the following dis-

claimer.

2. Redistributions in binary form must reproduce the above

copyright notice, this list of conditions and the following

disclaimer in the documentation and/or other materials pro-

vided with the distribution.

3. The name of the author may not be used to endorse or

promote products derived from this software without specific

prior written permission.

THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND

ANY EXPRESS OR IMPLIED WARRANTIES, INCLU- DING, BUT

NOT LIMITED TO, THE IMPLIED WARRAN-TIES OF

MERCHANTABILITY AND FITNESS FOR A PAR-TICULAR

PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE

AUTHOR BE LIABLE FOR ANY DIRECT, IN-DIRECT,

INCIDENTAL, SPECIAL, EXEMPLARY, OR CON-SEQUENTIAL

DAMAGES (INCLUDING, BUT NOT LIM- ITED TO,

PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

LOSS OF USE, DATA, OR PROFITS; OR BUSI-NESS

INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,

OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,

EVEN IF ADVISED OF THE POSSI-BILITY OF SUCH DAMAGE.

This product includes software written by Adam Dunkels

([email protected]).

Disclaimer

The information contained in this document is subject to change

without notice.

HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF

ANY KIND WITH REGARD TO THIS MATERIAL, INCLUDING,

BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF

MERCHANTABILITY AND FITNESS FOR A PARTICULAR

PURPOSE. Hewlett-Packard shall not be liable for errors

contained herein or for incidental or consequential damages in

connection with the furnishing, performance, or use of this

material.

The only warranties for HP products and services are set forth

in the express warranty statements accompanying such

products and services. Nothing herein should be construed as

constituting an additional warranty. HP shall not be liable for

technical or editorial errors or omissions contained herein.

Hewlett-Packard assumes no responsibility for the use or

reliability of its software on equipment that is not furnished by

Hewlett-Packard.

Warranty

See the Customer Support/Warranty information at

http://www.hp.com/#Support.

A copy of the specific warranty terms applicable to your Hewlett-

Packard products and replacement parts can be obtained from

your HP Sales and Service Office or authorized dealer.

HP Contact Information

For the name of the nearest HP authorized reseller:

• See the Contact HP worldwide (in English) webpage

(http://welcome.hp.com/country/us/en/wwcontact.html).

For HP technical support:

• In the United States, for contact options see the Contact HP

United States webpage

(http://welcome.hp.com/country/us/en/contact_us.html).

To contact HP by phone:

• Call 1-800-HP-INVENT (1-800-474-6836). This service is

available 24 hours a day, 7 days a week. For continuous quality

improvement, calls may be recorded or monitored.

• If you have purchased a Care Pack (service upgrade), call

1-800-633-3600. For more information about Care Packs, refer

to the HP website (http://www.hp.com/hps).

• In other locations, see the Contact HP worldwide (in English)

webpage

(http://welcome.hp.com/country/us/en/wwcontact.html).

ii

iii

Contents

Product Documentation

About Your Switch Manual Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii

Printed Publications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii

Electronic Publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii

Software Feature Index. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xviii

1 Security Overview

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2

About This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2

For More Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2

Access Security Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3

Network Security Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7

Getting Started with Access Security . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-9

Physical Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-9

Quick Start: Using the Management Interface Wizard . . . . . . . . . . . . 1-10

CLI: Management Interface Wizard . . . . . . . . . . . . . . . . . . . . . . . . 1-10

Web: Management Interface Wizard . . . . . . . . . . . . . . . . . . . . . . . 1-12

SNMP Security Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-15

Precedence of Security Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-17

Precedence of Port-Based Security Options . . . . . . . . . . . . . . . . . . . . 1-17

Precedence of Client-Based Authentication:

Dynamic Configuration Arbiter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-17

Network Immunity Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-18

Arbitrating Client-Specific Attributes . . . . . . . . . . . . . . . . . . . . . . 1-19

ProCurve Identity-Driven Manager (IDM) . . . . . . . . . . . . . . . . . . . . . 1-21

iv

2 Configuring Username and Password Security

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3

Configuring Local Password Security . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-6

Menu: Setting Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-6

CLI: Setting Passwords and Usernames . . . . . . . . . . . . . . . . . . . . . . . . . 2-8

Web: Setting Passwords and Usernames . . . . . . . . . . . . . . . . . . . . . . . . 2-9

SNMP: Setting Passwords and Usernames . . . . . . . . . . . . . . . . . . . . . . 2-9

Saving Security Credentials in a Config File . . . . . . . . . . . . . . . . . . . 2-10

Benefits of Saving Security Credentials . . . . . . . . . . . . . . . . . . . . . . . . 2-10

Enabling the Storage and Display of Security Credentials . . . . . . . . 2-11

Security Settings that Can Be Saved . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-11

Local Manager and Operator Passwords . . . . . . . . . . . . . . . . . . . . . . . 2-12

Password Command Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-12

SNMP Security Credentials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-13

802.1X Port-Access Credentials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-14

TACACS+ Encryption Key Authentication . . . . . . . . . . . . . . . . . . . . . 2-15

RADIUS Shared-Secret Key Authentication . . . . . . . . . . . . . . . . . . . . 2-15

SSH Client Public-Key Authentication . . . . . . . . . . . . . . . . . . . . . . . . . 2-16

Operating Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-19

Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-21

Front-Panel Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-23

When Security Is Important . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-23

Front-Panel Button Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-24

Clear Button . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-25

Reset Button . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-25

Restoring the Factory Default Configuration . . . . . . . . . . . . . . . . 2-25

Configuring Front-Panel Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-27

Disabling the Clear Password Function of the Clear Button . . . 2-29

Re-Enabling the Clear Button and Setting or

Changing the “Reset-On-Clear” Operation . . . . . . . . . . . . . . . . . . 2-30

Changing the Operation of the Reset+Clear Combination . . . . . 2-31

Password Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-32

Disabling or Re-Enabling the Password Recovery Process . . . . . . . . 2-32

v

Password Recovery Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-34

3 Web and MAC Authentication

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3

Web Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3

MAC Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-4

Concurrent Web and MAC Authentication . . . . . . . . . . . . . . . . . . . . . . 3-4

Authorized and Unauthorized Client VLANs . . . . . . . . . . . . . . . . . . . . . 3-5

RADIUS-Based Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-6

Wireless Clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-6

How Web and MAC Authentication Operate . . . . . . . . . . . . . . . . . . . . 3-6

Web-based Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-7

MAC-based Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-9

Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-11

Operating Rules and Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-12

Setup Procedure for Web/MAC Authentication . . . . . . . . . . . . . . . . . 3-14

Before You Configure Web/MAC Authentication . . . . . . . . . . . . . . . . 3-14

Configuring the RADIUS Server To Support MAC Authentication . . 3-16

Configuring the Switch To Access a RADIUS Server . . . . . . . . . . . . . 3-17

Configuring Web Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-20

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-20

Configuration Commands for Web Authentication . . . . . . . . . . . . . . 3-21

Show Commands for Web Authentication . . . . . . . . . . . . . . . . . . . . . . 3-28

Customizing Web Authentication HTML Files (Optional) . . . . . . . 3-34

Implementing Customized Web-Auth Pages . . . . . . . . . . . . . . . . . . . . 3-34

Operating Notes and Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-34

Customizing HTML Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-35

Customizable HTML Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-36

Configuring MAC Authentication on the Switch . . . . . . . . . . . . . . . . 3-50

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-50

Configuration Commands for MAC Authentication . . . . . . . . . . . . . . 3-51

Show Commands for MAC-Based Authentication . . . . . . . . . . . . . . . 3-54

vi

Client Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-60

4 TACACS+ Authentication

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2

Terminology Used in TACACS Applications: . . . . . . . . . . . . . . . . . . . . 4-3

General System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-5

General Authentication Setup Procedure . . . . . . . . . . . . . . . . . . . . . . . 4-5

Configuring TACACS+ on the Switch . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-8

Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-8

CLI Commands Described in this Section . . . . . . . . . . . . . . . . . . . . . . . 4-9

Viewing the Switch’s Current Authentication Configuration . . . . . . . 4-9

Viewing the Switch’s Current TACACS+

Server Contact Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-10

Configuring the Switch’s Authentication Methods . . . . . . . . . . . . . . . 4-11

Using the Privilege-Mode Option for Login . . . . . . . . . . . . . . . . . 4-11

Authentication Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-12

Configuring the TACACS+ Server for Single Login . . . . . . . . . . . . . . 4-13

Configuring the Switch’s TACACS+ Server Access . . . . . . . . . . . . . . 4-18

How Authentication Operates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-24

General Authentication Process Using a TACACS+ Server . . . . . . . . 4-24

Local Authentication Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-26

Using the Encryption Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-27

General Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-27

Encryption Options in the Switch . . . . . . . . . . . . . . . . . . . . . . . . . 4-27

Controlling Web Browser Interface

Access When Using TACACS+ Authentication . . . . . . . . . . . . . . . . . . 4-28

Messages Related to TACACS+ Operation . . . . . . . . . . . . . . . . . . . . . 4-29

Operating Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-29

5 RADIUS Authentication, Authorization, and Accounting

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-3

vii

Authentication Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-3

Accounting Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-4

RADIUS-Administered CoS and Rate-Limiting . . . . . . . . . . . . . . . . . . . 5-4

RADIUIS-Administered Commands Authorization . . . . . . . . . . . . . . . . 5-4

SNMP Access to the Switch’s Authentication Configuration MIB . . . 5-4

Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-5

Switch Operating Rules for RADIUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-6

General RADIUS Setup Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-7

Configuring the Switch for RADIUS Authentication . . . . . . . . . . . . . 5-8

Outline of the Steps for Configuring RADIUS Authentication . . . . . . 5-9

1. Configure Authentication for the Access Methods

You Want RADIUS To Protect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-10

2. Enable the (Optional) Access Privilege Option . . . . . . . . . . . . . . . . 5-13

3. Configure the Switch To Access a RADIUS Server . . . . . . . . . . . . 5-14

4. Configure the Switch’s Global RADIUS Parameters . . . . . . . . . . . 5-17

Using SNMP To View and Configure

Switch Authentication Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-21

Changing and Viewing the SNMP Access Configuration . . . . . . . . . . 5-22

Local Authentication Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-24

Controlling Web Browser Interface Access . . . . . . . . . . . . . . . . . . . . 5-25

Commands Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-26

Enabling Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-27

Displaying Authorization Information . . . . . . . . . . . . . . . . . . . . . . . . . 5-28

Configuring Commands Authorization on a RADIUS Server . . . . . . 5-28

Using Vendor Specific Attributes (VSAs) . . . . . . . . . . . . . . . . . . . 5-28

Example Configuration on Cisco Secure ACS for MS Windows 5-30

Example Configuration Using FreeRADIUS . . . . . . . . . . . . . . . . . 5-32

VLAN Assignment in an Authentication Session . . . . . . . . . . . . . . . . 5-34

Tagged and Untagged VLAN Attributes . . . . . . . . . . . . . . . . . . . . . . . . 5-35

Additional RADIUS Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-36

Configuring RADIUS Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-37

Operating Rules for RADIUS Accounting . . . . . . . . . . . . . . . . . . . . . . 5-39

Steps for Configuring RADIUS Accounting . . . . . . . . . . . . . . . . . . . . . 5-39

1. Configure the Switch To Access a RADIUS Server . . . . . . . . . 5-40

viii

2. Configure Accounting Types and the Controls for

Sending Reports to the RADIUS Server . . . . . . . . . . . . . . . . . . . . 5-42

3. (Optional) Configure Session Blocking and

Interim Updating Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-44

Viewing RADIUS Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-46

General RADIUS Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-46

RADIUS Authentication Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-48

RADIUS Accounting Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-49

Changing RADIUS-Server Access Order . . . . . . . . . . . . . . . . . . . . . . . 5-50

Messages Related to RADIUS Operation . . . . . . . . . . . . . . . . . . . . . . . 5-53

6 Configuring Secure Shell (SSH)

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-1

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-2

Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-3

Prerequisite for Using SSH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-5

Public Key Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-5

Steps for Configuring and Using SSH

for Switch and Client Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-6

General Operating Rules and Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-8

Configuring the Switch for SSH Operation . . . . . . . . . . . . . . . . . . . . . . 6-9

1. Assigning a Local Login (Operator) and

Enable (Manager) Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-10

2. Generating the Switch’s Public and Private Key Pair . . . . . . . . . . 6-10

Configuring Key Lengths . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-13

3. Providing the Switch’s Public Key to Clients . . . . . . . . . . . . . . . . . . 6-13

4. Enabling SSH on the Switch and Anticipating SSH

Client Contact Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-15

5. Configuring the Switch for SSH Authentication . . . . . . . . . . . . . . . 6-20

6. Use an SSH Client To Access the Switch . . . . . . . . . . . . . . . . . . . . . 6-24

Further Information on SSH Client Public-Key Authentication . 6-24

Messages Related to SSH Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-30

Logging Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-31

Debug Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-32

ix

7 Configuring Secure Socket Layer (SSL)

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-1

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-2

Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-3

Prerequisite for Using SSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-5

Steps for Configuring and Using SSL for Switch and Client

Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-5

General Operating Rules and Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-6

Configuring the Switch for SSL Operation . . . . . . . . . . . . . . . . . . . . . . 7-7

1. Assigning a Local Login (Operator) and

Enabling (Manager) Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-7

2. Generating the Switch’s Server Host Certificate . . . . . . . . . . . . . . . . 7-8

To Generate or Erase the Switch’s Server Certificate

with the CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-9

Comments on Certificate Fields. . . . . . . . . . . . . . . . . . . . . . . . . . . 7-10

Generate a Self-Signed Host Certificate with the Web browser

interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-12

Generate a CA-Signed server host certificate with the

Web browser interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-15

3. Enabling SSL on the Switch and Anticipating SSL

Browser Contact Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-17

Using the CLI Interface to Enable SSL . . . . . . . . . . . . . . . . . . . . . 7-19

Using the Web Browser Interface to Enable SSL . . . . . . . . . . . . . 7-19

Common Errors in SSL setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-21

8 Configuring Advanced Threat Protection

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-1

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-3

DHCP Snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-4

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-4

Enabling DHCP Snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-5

Enabling DHCP Snooping on VLANS . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-7

Configuring DHCP Snooping Trusted Ports . . . . . . . . . . . . . . . . . . . . . 8-8

Configuring Authorized Server Addresses . . . . . . . . . . . . . . . . . . . . . . . 8-9

x

Using DHCP Snooping with Option 82 . . . . . . . . . . . . . . . . . . . . . . . . . . 8-9

Changing the Remote-id from a MAC to an IP Address . . . . . . . 8-11

Disabling the MAC Address Check . . . . . . . . . . . . . . . . . . . . . . . . 8-11

The DHCP Binding Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-12

Operational Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-13

Log Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-14

Dynamic ARP Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-16

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-16

Enabling Dynamic ARP Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-18

Configuring Trusted Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-18

Adding an IP-to-MAC Binding to the DHCP Database . . . . . . . . . . . . 8-20

Configuring Additional Validation Checks on ARP Packets . . . . . . . 8-21

Verifying the Configuration of Dynamic ARP Protection . . . . . . . . . 8-21

Displaying ARP Packet Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-22

Monitoring Dynamic ARP Protection . . . . . . . . . . . . . . . . . . . . . . . . . . 8-23

Dynamic IP Lockdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-23

Protection Against IP Source Address Spoofing . . . . . . . . . . . . . . . . . 8-24

Prerequisite: DHCP Snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-24

Filtering IP and MAC Addresses Per-Port and Per-VLAN . . . . . . . . . 8-25

Enabling Dynamic IP Lockdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-26

Operating Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-26

Adding an IP-to-MAC Binding to the DHCP Binding Database . . . . . 8-28

Potential Issues with Bindings . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-28

Adding a Static Binding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-29

Verifying the Dynamic IP Lockdown Configuration . . . . . . . . . . . . . . 8-29

Displaying the Static Configuration of IP-to-MAC Bindings . . . . . . . 8-30

Debugging Dynamic IP Lockdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-31

Using the Instrumentation Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-33

Operating Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-34

Configuring Instrumentation Monitor . . . . . . . . . . . . . . . . . . . . . . . . . 8-35

Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-36

Viewing the Current Instrumentation Monitor Configuration . . . . . . 8-37

xi

9 Traffic/Security Filters and Monitors

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-1

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-2

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-2

Filter Limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-2

Using Port Trunks with Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-2

Filter Types and Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-3

Source-Port Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-4

Operating Rules for Source-Port Filters . . . . . . . . . . . . . . . . . . . . . 9-4

Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-5

Named Source-Port Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-6

Operating Rules for Named Source-Port Filters . . . . . . . . . . . . . . 9-6

Defining and Configuring Named Source-Port Filters . . . . . . . . . 9-7

Viewing a Named Source-Port Filter . . . . . . . . . . . . . . . . . . . . . . . . 9-8

Using Named Source-Port Filters . . . . . . . . . . . . . . . . . . . . . . . . . . 9-9

Configuring Traffic/Security Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-15

Configuring a Source-Port Traffic Filter . . . . . . . . . . . . . . . . . . . . . . . 9-16

Example of Creating a Source-Port Filter . . . . . . . . . . . . . . . . . . . 9-17

Configuring a Filter on a Port Trunk . . . . . . . . . . . . . . . . . . . . . . . 9-17

Editing a Source-Port Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-18

Filter Indexing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-19

Displaying Traffic/Security Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-20

10 Configuring Port-Based and

User-Based Access Control (802.1X)

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-1

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-3

Why Use Port-Based or User-Based Access Control? . . . . . . . . . . . . 10-3

General Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-3

User Authentication Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-4

802.1X User-Based Access Control . . . . . . . . . . . . . . . . . . . . . . . . 10-4

802.1X Port-Based Access Control . . . . . . . . . . . . . . . . . . . . . . . . 10-5

Alternative To Using a RADIUS Server . . . . . . . . . . . . . . . . . . . . . 10-6

Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-6

xii

Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-6

General 802.1X Authenticator Operation . . . . . . . . . . . . . . . . . . . . . . 10-9

Example of the Authentication Process . . . . . . . . . . . . . . . . . . . . . . . . 10-9

VLAN Membership Priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-10

General Operating Rules and Notes . . . . . . . . . . . . . . . . . . . . . . . . . . 10-12

General Setup Procedure for 802.1X Access Control . . . . . . . . . . 10-14

Do These Steps Before You Configure 802.1X Operation . . . . . . . . 10-14

Overview: Configuring 802.1X Authentication on the Switch . . . . . 10-17

Configuring Switch Ports as 802.1X Authenticators . . . . . . . . . . . 10-18

1. Enable 802.1X Authentication on Selected Ports . . . . . . . . . . . . . 10-19

A. Enable the Selected Ports as Authenticators and Enable

the (Default) Port-Based Authentication . . . . . . . . . . . . . . . . . . 10-19

B. Specify User-Based Authentication or Return to Port-Based

Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-20

Example: Configuring User-Based 802.1X Authentication . . . . 10-21

Example: Configuring Port-Based 802.1X Authentication . . . . 10-21

2. Reconfigure Settings for Port-Access . . . . . . . . . . . . . . . . . . . . . . . 10-21

3. Configure the 802.1X Authentication Method . . . . . . . . . . . . . . . . 10-24

4. Enter the RADIUS Host IP Address(es) . . . . . . . . . . . . . . . . . . . . . 10-25

5. Enable 802.1X Authentication on the Switch . . . . . . . . . . . . . . . . 10-25

6. Optional: Reset Authenticator Operation . . . . . . . . . . . . . . . . . . . . 10-26

7. Optional: Configure 802.1X Controlled Directions . . . . . . . . . . . . 10-26

Wake-on-LAN Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-27

Operating Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-27

Example: Configuring 802.1X Controlled Directions . . . . . . . . 10-28

802.1X Open VLAN Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-29

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-29

VLAN Membership Priorities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-30

Use Models for 802.1X Open VLAN Modes . . . . . . . . . . . . . . . . . . . . 10-31

Operating Rules for Authorized-Client and

Unauthorized-Client VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-36

Setting Up and Configuring 802.1X Open VLAN Mode . . . . . . . . . . . 10-40

802.1X Open VLAN Operating Notes . . . . . . . . . . . . . . . . . . . . . . . . . 10-44

Option For Authenticator Ports: Configure Port-Security

To Allow Only 802.1X-Authenticated Devices . . . . . . . . . . . . . . . . . 10-45

xiii

Port-Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-46

Configuring Switch Ports To Operate As Supplicants for 802.1X

Connections to Other Switches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-47

Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-47

Supplicant Port Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-49

Displaying 802.1X Configuration, Statistics, and Counters . . . . 10-51

Show Commands for Port-Access Authenticator . . . . . . . . . . . . . . . 10-51

Viewing 802.1X Open VLAN Mode Status . . . . . . . . . . . . . . . . . . . . . 10-60

Show Commands for Port-Access Supplicant . . . . . . . . . . . . . . . . . . 10-64

How RADIUS/802.1X Authentication Affects VLAN Operation . 10-65

VLAN Assignment on a Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-66

Operating Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-66

Example of Untagged VLAN Assignment in a RADIUS-Based

Authentication Session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-68

Enabling the Use of GVRP-Learned Dynamic VLANs

in Authentication Sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-71

Messages Related to 802.1X Operation . . . . . . . . . . . . . . . . . . . . . . . 10-73

11 Configuring and Monitoring Port Security

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-1

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-3

Port Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-4

Basic Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-4

Eavesdrop Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-5

Blocking Unauthorized Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-5

Trunk Group Exclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-6

Planning Port Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-7

Port Security Command Options and Operation . . . . . . . . . . . . . . . . 11-8

Port Security Display Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-8

Configuring Port Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-12

Retention of Static Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-17

MAC Lockdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-22

Differences Between MAC Lockdown and Port Security . . . . . . . . 11-24

MAC Lockdown Operating Notes . . . . . . . . . . . . . . . . . . . . . . . . 11-25

xiv

Deploying MAC Lockdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-26

MAC Lockout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-26

Port Security and MAC Lockout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-29

Web: Displaying and Configuring Port Security Features . . . . . . 11-30

Reading Intrusion Alerts and Resetting Alert Flags . . . . . . . . . . . 11-30

Notice of Security Violations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-30

How the Intrusion Log Operates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-31

Keeping the Intrusion Log Current by Resetting Alert Flags . . . . . . 11-32

Menu: Checking for Intrusions, Listing Intrusion Alerts, and

Resetting Alert Flags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-33

CLI: Checking for Intrusions, Listing Intrusion Alerts,

and Resetting Alert Flags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-34

Using the Event Log To Find Intrusion Alerts . . . . . . . . . . . . . . . . . . 11-36

Web: Checking for Intrusions, Listing Intrusion

Alerts, and Resetting Alert Flags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-37

Operating Notes for Port Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-38

12 Using Authorized IP Managers

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-1

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-2

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-3

Access Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-3

Defining Authorized Management Stations . . . . . . . . . . . . . . . . . . . . 12-4

Overview of IP Mask Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-4

Menu: Viewing and Configuring IP Authorized Managers . . . . . . . . . 12-5

CLI: Viewing and Configuring Authorized IP Managers . . . . . . . . . . . 12-6

Listing the Switch’s Current Authorized IP Manager(s) . . . . . . . 12-6

Configuring IP Authorized Managers for the Switch . . . . . . . . . 12-7

Web: Configuring IP Authorized Managers . . . . . . . . . . . . . . . . . . . . . 12-9

Web Proxy Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-9

How to Eliminate the Web Proxy Server . . . . . . . . . . . . . . . . . . . 12-9

Using a Web Proxy Server to Access the Web Browser Interface . . .

12-10

Web-Based Help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-10

xv

Building IP Masks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-10

Configuring One Station Per Authorized Manager IP Entry . . . . . . 12-10

Configuring Multiple Stations Per Authorized Manager IP Entry . . 12-11

Additional Examples for Authorizing Multiple Stations . . . . . . . . . 12-13

Operating Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-13

xvi

xvii

Product Documentation

About Your Switch Manual Set

Note For the latest version of switch documentation, please visit any of the follow-

ing websites:

www.procurve.com/manuals

www.hp.com/go/bladesystem/documentation

h18004.www1.hp.com/products/blades/components/c-class-tech-installing.html

Printed Publications

The publication listed below is printed and shipped with your switch. The

latest version is also available in PDF format, as described in the Note at the

top of this page.

■ Quick Installation Card—Explains how to prepare for and perform the

physical installation and connect the switch to your network.

Electronic Publications

The latest version of each of the publications listed below is available in PDF

format on the ProCurve Web site, as described in the Note at the top of this

page.

■ Installation and Getting Started Guide—Describes how to install hard-

ware, and get started using the switch.

■ Management and Configuration Guide—Describes how to configure,

manage, and monitor basic switch operation.

■ Advanced Traffic Management Guide—Explains how to configure traffic

management features such as VLANs, MSTP, and QoS.

■ Multicast and Routing Guide—Explains how to configure IGMP fea-

tures.

■ Access Security Guide—Explains how to configure access security fea-

tures and user authentication on the switch.

■ IPv6 Configuration Guide—Describes the IPv6 protocol operations that

are supported on the switch.

■ Release Notes—Describe new features, fixes, and enhancements that

become available between revisions of the main product guide.

xviii

Software Feature Index

This feature index indicates which manual to consult for information on a

given software feature.

Note This Index does not cover IPv6 capable software features. For information on

IPv6 protocol operations and features (such as DHCPv6, DNS for IPv6, and

Ping6), refer to the IPv6 Configuration Guide.

Intelligent Edge Software Features. These features are automatically

included on all switches.

Intelligent Edge Software

Features

Manual

Management

and

Configuration

Advanced

Traffic

Management

Multicast and

Routing

Access

Security

Guide

802.1Q VLAN Tagging X

802.1X Multiple Authenticated Clients Per Port X

AAA Authentication X

Authorized IP Managers X

Authorized Manager List (Web, Telnet, TFTP) X

Auto MDIX Configuration X

BOOTP X

Config File X

Console Access X

Copy Command X

CoS (Class of Service) X

Debug X

DHCP Configuration X

DHCP/Bootp Operation X

Diagnostic Tools X

xix

Downloading Software X

Event Log X

Factory Default Settings X

Flow Control (802.3x) X

File Transfers X

Friendly Port Names X

GVRP X

Identity-Driven Management (IDM) X

IGMP X

Interface Access (Telnet, Console/Serial, Web) X

IP Addressing X

Jumbo Packets X

LACP X

LLDP X

LLDP-MED X

Loop Protection X

MAC Address Management X

MAC Lockdown X

MAC Lockout X

MAC-based Authentication X

Monitoring and Analysis X

Network Management Applications (SNMP) X

Passwords and Password Clear Protection X

ProCurve Manager (PCM) X

Ping X

Port Configuration X

Intelligent Edge Software

Features

Manual

Management

and

Configuration

Advanced

Traffic

Management

Multicast and

Routing

Access

Security

Guide

Page is loading ...

HP Switch 6120 User manual

This manual is also suitable for

HP Switch 6120 User manual

Related papers

Other documents