Aruba 2530 Installation guide

ArubaOS-Switch Access Security Guide

for YA/YB.16.03

Part Number: 5200-2904b

Published: August 2017

Edition: 3

Notices

The information contained herein is subject to change without notice. The only warranties for Hewlett Packard

Enterprise products and services are set forth in the express warranty statements accompanying such products

and services. Nothing herein should be construed as constituting an additional warranty. Hewlett Packard

Enterprise shall not be liable for technical or editorial errors or omissions contained herein.

Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or

copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software

Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's

standard commercial license.

Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard Enterprise

has no control over and is not responsible for information outside the Hewlett Packard Enterprise website.

Acknowledgments

Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the United

States and other countries.

Microsoft® and Windows® are either registered trademarks or trademarks of Microsoft Corporation in the United

States and/or other countries.

Adobe® and Acrobat® are trademarks of Adobe Systems Incorporated.

Java® and Oracle® are registered trademarks of Oracle and/or its affiliates.

UNIX® is a registered trademark of The Open Group.

Chapter 1 About this document....................................................................15

Chapter 2 Security Overview.........................................................................16

Introduction.............................................................................................................................................. 16

About this guide............................................................................................................................ 16

For more information.....................................................................................................................16

Access security features.......................................................................................................................... 16

Network security features........................................................................................................................ 24

Getting started with access security........................................................................................................ 24

Physical security........................................................................................................................... 24

Using the Management Interface wizard.......................................................................................25

Configuring security settings using the CLI wizard.............................................................25

WebAgent: Management Interface wizard......................................................................... 27

SNMP security guidelines............................................................................................................. 27

General SNMP access to the switch.................................................................................. 27

SNMP access to the authentication configuration MIB...................................................... 27

HPE PCM+ Identity-Driven manager (IDM)............................................................................................. 28

Chapter 3 Configuring Username and Password Security........................ 29

Overview.................................................................................................................................................. 29

Configuring password security...................................................................................................... 29

Configuring local password security........................................................................................................ 30

Setting passwords (Menu)............................................................................................................ 30

Deleting password protection............................................................................................. 30

Recovering from a lost manager password........................................................................31

Setting passwords and usernames (CLI)...................................................................................... 31

Removing password protection.......................................................................................... 31

Setting passwords and usernames (WebAgent)...........................................................................32

Saving security credentials in a config file............................................................................................... 32

Benefits of saving security credentials.......................................................................................... 32

Enabling the storage and display of security credentials.............................................................. 32

Security settings that can be saved.............................................................................................. 33

Local manager and operator passwords.......................................................................................33

Front panel security................................................................................................................................. 34

When security is important............................................................................................................34

Front-panel button functions......................................................................................................... 34

Clear button........................................................................................................................35

Reset button....................................................................................................................... 35

Restoring the factory default configuration.........................................................................35

Configuring front panel security.................................................................................................... 36

Disabling the clear password function of the Clear button................................................. 37

Re-enabling the Clear button and setting or changing the ‘reset-on-clear’ operation........ 38

Changing the operation Reset+Clear combination.............................................................39

Password recovery.................................................................................................................................. 40

Disabling or re-enabling the password recovery process............................................................. 40

Password recovery process.......................................................................................................... 41

Contents

Contents 3

Chapter 4 Web and MAC Authentication......................................................43

Overview.................................................................................................................................................. 43

Web-based authentication.............................................................................................................43

MAC authentication.......................................................................................................................43

Concurrent web-based and MAC authentication.......................................................................... 44

Authorized and unauthorized client VLANs...................................................................................44

RADIUS-based authentication...................................................................................................... 44

Wireless clients............................................................................................................................. 45

How web-based and MAC authentication operate...................................................................................45

Web-based authentication.............................................................................................................45

Order of priority for assigning VLANs.................................................................................46

MAC-based authentication............................................................................................................47

Operating rules and notes........................................................................................................................47

Setup procedure for web-based/MAC authentication.............................................................................. 49

Configuring the RADIUS server to support MAC authentication...................................................50

Configuring the switch to access a RADIUS server...................................................................... 50

Radius service tracking................................................................................................................. 51

radius-server tracking.........................................................................................................51

radius-server tracking user-name.......................................................................................52

Configuring web-based authentication.....................................................................................................52

Overview....................................................................................................................................... 53

Configuration commands for web-based authentication............................................................... 53

Controlled direction............................................................................................................ 53

Disable web-based authentication..................................................................................... 54

Specifying the VLAN.......................................................................................................... 54

Maximum authenticated clients.......................................................................................... 54

Specifies base address...................................................................................................... 55

Specifies lease length........................................................................................................ 55

Allowing client moves between specified ports.................................................................. 55

Specifying the period..........................................................................................................55

Specifying the number of authentication attempts............................................................. 55

Specifying maximum retries............................................................................................... 56

Specifying the time period.................................................................................................. 56

Specifying the re-authentication period.............................................................................. 56

Specifying a forced reauthentication.................................................................................. 56

Specifying the URL.............................................................................................................56

Specifying the timeout........................................................................................................ 57

Enabling or disabling SSL login..........................................................................................57

Configuring MAC authentication.............................................................................................................. 57

Preparation for configuring MAC authentication........................................................................... 57

Configuration commands for MAC authentication.........................................................................57

Configuring a MAC-based address format......................................................................... 57

Configuring other MAC-based commands......................................................................... 58

Show status and configuration of web-based authentication........................................................ 60

Show status and configuration of MAC-based authentication.......................................................61

Client status.................................................................................................................................. 61

Chapter 5 Local MAC Authentication........................................................... 63

Overview.................................................................................................................................................. 63

Concepts....................................................................................................................................... 63

Possible scenarios for deployment.......................................................................................................... 63

Show commands..................................................................................................................................... 64

Configuration commands......................................................................................................................... 65

4ArubaOS-Switch Access Security Guide for YA/YB.16.03

Per-port attributes......................................................................................................................... 66

Configuration examples................................................................................................................ 66

Configuration example 1.................................................................................................... 66

Configuration example 2.................................................................................................... 66

Configuration using mac-groups........................................................................................ 68

Configuration without using mac-groups............................................................................ 68

Chapter 6 Port-based MAC authentication.................................................. 70

Overview.................................................................................................................................................. 70

Operating notes....................................................................................................................................... 70

aaa port-access use-lldp-data..................................................................................................................70

Chapter 7 TACACS+ Authentication.............................................................72

Overview.................................................................................................................................................. 72

General system requirements..................................................................................................................72

General authentication setup procedure..................................................................................................73

Configuring TACACS+ on the switch....................................................................................................... 74

show authentication...................................................................................................................... 75

Viewing the current TACACS+ server contact configuration.........................................................75

Configuring the switch authentication methods.............................................................................76

Using the privilege-mode option for login........................................................................... 76

Authentication parameters................................................................................................. 77

Configuring TACACS+ server....................................................................................................... 79

Configuring the TACACS+ server for single login......................................................................... 80

Configuring the switch TACACS+ server access.......................................................................... 83

TACACS+ authorization and accounting commands......................................................... 84

Device running a TACACS+ server application..................................................................89

Optional, global "encryption key"........................................................................................90

Specifying how long the switch waits for a TACACS+ server to respond to an

authentication request........................................................................................................ 91

Adding, removing, or changing the priority of a TACACS+ server..................................... 91

Configuring an encryption key............................................................................................92

How authentication operates................................................................................................................... 93

General authentication process using a TACACS+ server........................................................... 93

Local authentication process (TACACS+).....................................................................................94

Using the encryption key...............................................................................................................94

General operation...............................................................................................................94

Encryption options in the switch......................................................................................... 95

Controlling WebAgent access when using TACACS+ authentication......................................................95

Messages related to TACACS+ operation............................................................................................... 95

Operating notes....................................................................................................................................... 96

Chapter 8 RADIUS Authentication, Authorization, and Accounting......... 97

Overview.................................................................................................................................................. 97

Authentication Services.................................................................................................................97

Accounting services...................................................................................................................... 97

SNMP access to the switch's authentication configuration MIB....................................................97

Switch operating rules for RADIUS..........................................................................................................97

General RADIUS setup procedure...........................................................................................................98

Configuring the switch for RADIUS authentication.................................................................................. 99

Configuring authentication for the access methods that RADIUS protects...................................99

Enabling manager access privilege (optional)............................................................................ 102

Configuring the switch to access a RADIUS server.................................................................... 102

Contents 5

Configuring the switch global RADIUS parameters.................................................................... 104

Using SNMP to view and configure switch authentication features....................................................... 106

Viewing and changing the SNMP access configuration..............................................................107

Local authentication process (RADIUS)................................................................................................ 109

Controlling WebAgent access................................................................................................................109

Commands authorization....................................................................................................................... 109

Enabling authorization.................................................................................................................110

Viewing authorization information................................................................................................110

Configuring commands authorization on a RADIUS server.........................................................111

Using vendor specific attributes (VSAs)............................................................................111

Example configuration on Cisco secure ACS for MS Windows........................................112

Example configuration using FreeRADIUS.......................................................................114

Additional RADIUS attributes................................................................................................................. 115

MAC-based VLANs................................................................................................................................ 115

Accounting services............................................................................................................................... 116

Accounting service types.............................................................................................................116

Operating rules for RADIUS accounting......................................................................................116

Configuring RADIUS accounting................................................................................................. 117

Steps for configuring RADIUS accounting........................................................................117

Viewing RADIUS statistics..................................................................................................................... 121

General RADIUS statistics.......................................................................................................... 121

RADIUS authentication statistics................................................................................................ 123

RADIUS accounting statistics..................................................................................................... 124

Changing RADIUS-server access order................................................................................................ 125

Chapter 9 RADIUS Services Support on HPE Switches........................... 127

RADIUS client and server requirements................................................................................................ 127

Optional PCM and HPE PMC IDM network management applications................................................. 127

RADIUS server configuration for CoS (802.1p priority) and rate-limiting...............................................128

Applied rates for RADIUS-assigned rate limits........................................................................... 130

Per-port bandwidth override............................................................................................. 131

Viewing the currently active per-port CoS and rate-limiting configuration...................................132

Viewing CLI-configured rate-limiting and port priority for ports.........................................134

Configuring and using dynamic (RADIUS-assigned) access control lists..............................................135

Overview of RADIUS-assigned, dynamic ACLs..........................................................................135

Traffic applications............................................................................................................136

Contrasting RADIUS-assigned and static ACLs......................................................................... 137

How a RADIUS server applies a RADIUS-assigned ACL to a client on a switch port................ 138

Multiple clients sharing the same RADIUS-assigned ACL............................................... 139

Effect of multiple ACL application types on an interface.................................................. 139

General ACL features, planning, and configuration.................................................................... 139

The packet-filtering process........................................................................................................ 140

Operating rules for RADIUS-assigned ACLs.............................................................................. 140

Configuring an ACL in a RADIUS server.................................................................................... 140

Nas-filter-rule options....................................................................................................... 141

ACE syntax in RADIUS servers.................................................................................................. 144

Using the standard attribute in an IPv4 ACL (example)................................................... 147

Using HPE VSA 63 to assign IPv6 and IPv4 ACLs (example)......................................... 149

Using HPE VSA 61 to assign IPv4 ACLs (example)........................................................ 150

Configuration notes.......................................................................................................... 151

Configuring the switch to support RADIUS-assigned ACLs........................................................151

Displaying the current RADIUS-assigned ACL activity on the switch......................................... 152

Event Log messages...................................................................................................................156

Causes of client deauthentication immediately after authenticating........................................... 156

Monitoring shared resources.......................................................................................................156

6ArubaOS-Switch Access Security Guide for YA/YB.16.03

RADIUS filter-id......................................................................................................................................157

Forcing reauthentication..............................................................................................................157

show access-list radius ..................................................................................................158

show access-list (NAS rule) and (filter-id) ..........................................................................158

Log messages.............................................................................................................................159

Chapter 10 Password Complexity.............................................................. 160

Password complexity overview.............................................................................................................. 160

Password expiration periods..................................................................................................................160

Requirements.........................................................................................................................................160

Limitations..............................................................................................................................................161

Configuring Password Complexity......................................................................................................... 161

Viewing the password configuration............................................................................................161

Enable Password Complexity..................................................................................................... 162

Configure the Password Complexity parameters........................................................................162

Configure password minimum length..........................................................................................163

Configure password composition................................................................................................ 163

Configure password complexity checks...................................................................................... 164

password configuration commands....................................................................................................... 164

password configuration-control.............................................................................................................. 165

password configuration.......................................................................................................................... 166

password minimum-length..................................................................................................................... 167

password ...............................................................................................................................................167

aaa authentication local-user................................................................................................................. 168

password complexity..............................................................................................................................169

password composition........................................................................................................................... 169

show password-configuration................................................................................................................ 170

Troubleshooting..................................................................................................................................... 171

Unable to enable Password Complexity..................................................................................... 171

Unable to download the configuration file................................................................................... 171

Validation rules............................................................................................................................171

Display messages....................................................................................................................... 174

Chapter 11 Configuring Secure Shell (SSH).............................................. 176

Overview................................................................................................................................................ 176

Client public-key authentication (login/operator level) with user password authentication

(enable/manager level)............................................................................................................... 176

Switch SSH and user password authentication.......................................................................... 176

Prerequisite for using SSH.....................................................................................................................177

Public key formats..................................................................................................................................177

Steps for configuring and using SSH for switch and client authentication............................................. 177

General operating rules and notes.........................................................................................................178

Configuring the switch for SSH operation.............................................................................................. 178

Generating or erasing the switch public/private host key pair.....................................................179

crypto key generate................................................................................................ 180

show crypto host-public-key............................................................................... 180

zeroize.......................................................................................................................... 181

Displaying the public key.............................................................................................................181

Providing the switch public key to clients.................................................................................... 182

Enabling SSH on the switch and anticipating SSH client contact behavior................................ 183

ip ssh.............................................................................................................................184

Disabling SSH on the switch....................................................................................................... 185

Configuring the switch for SSH authentication............................................................................185

Option A: Configuring SSH access for password-only SSH authentication..................... 186

Contents 7

Option B: Configuring the switch for client Public-Key SSH authentication..................... 186

SSH client contact behavior............................................................................................. 188

Disable username prompt for management interface authentication in the Quick Base system...........189

Switch behavior with Telnet.........................................................................................................189

Switch behavior with SSH........................................................................................................... 191

Switch behavior with WebUI........................................................................................................192

SSH client public-key authentication notes............................................................................................193

Using client public-key authentication......................................................................................... 194

Creating a client public-key text file.............................................................................................194

Replacing or clearing the public-key file......................................................................................196

Enabling client public-key authentication.................................................................................... 197

Messages related to SSH operation...................................................................................................... 197

Logging messages...................................................................................................................... 198

Debug logging............................................................................................................................. 199

Chapter 12 Configuring Secure Socket Layer (SSL).................................200

Overview................................................................................................................................................ 200

Server certificate authentication with user password authentication...........................................200

Prerequisite for using SSL..................................................................................................................... 201

Steps for configuring and using SSL for switch and client authentication..............................................201

General operating rules and notes.........................................................................................................201

Configuring the switch for SSL operation...............................................................................................201

Assigning a local login (operator) and enabling (manager) password........................................ 201

Using the WebAgent to configure local passwords.......................................................... 201

Generating the switch's server host certificate............................................................................202

To generate or erase the switch's server certificate with the CLI..................................... 202

Comments on certificate fields......................................................................................... 203

Generate a self-signed host certificate with the WebAgent..............................................203

Generate a CA-Signed server host certificate with the WebAgent...................................204

Enabling SSL on the switch and anticipating SSL browser contact behavior............................. 205

SSL client contact behavior..............................................................................................205

Using the CLI interface to enable SSL............................................................................. 206

Using the WebAgent to enable SSL.................................................................................206

Common errors in SSL setup.................................................................................................................207

Chapter 13 IPv4 Access Control Lists (ACLs)...........................................208

Options for applying IPv4 ACLs on the switch....................................................................................... 208

Static ACLs................................................................................................................................. 208

Overview................................................................................................................................................ 209

Types of IPv4 ACLs.....................................................................................................................209

Standard ACL...................................................................................................................209

Extended ACL.................................................................................................................. 209

ACL applications......................................................................................................................... 209

VACL applications............................................................................................................ 209

Static port ACL and RADIUS-assigned ACL applications................................................ 210

Multiple ACLs on an interface..................................................................................................... 210

For a packet to be permitted, it must have a match with a "permit" ACE in all

applicable ACLs assigned to an interface.........................................................................211

Exception for connection-rate filtering.............................................................................. 211

Features common to all ACL applications...................................................................................211

General steps for planning and configuring ACLs.......................................................................211

IPv4 static ACL operation...................................................................................................................... 212

Introduction................................................................................................................................. 212

The packet-filtering process........................................................................................................ 213

8ArubaOS-Switch Access Security Guide for YA/YB.16.03

Sequential comparison and action................................................................................... 213

Implicit Deny.....................................................................................................................213

Planning an ACL application..................................................................................................................215

IPv4 traffic management and improved network performance....................................................215

Security....................................................................................................................................... 215

Guidelines for planning the structure of a static ACL.................................................................. 216

IPv4 ACL configuration and operating rules................................................................................216

How an ACE uses a mask to screen packets for matches......................................................... 217

What Is the difference between network (or subnet) masks and the masks used with

ACLs?...............................................................................................................................217

Rules for defining a match between a packet and an ACE.............................................. 218

Configuring and assigning an IPv4 ACL................................................................................................ 222

General steps for implementing ACLs........................................................................................ 222

Options for permit/deny policies..................................................................................................222

ACL configuration structure.........................................................................................................222

Standard ACL structure....................................................................................................223

Extended ACL configuration structure..............................................................................224

ACL configuration factors............................................................................................................226

The sequence of entries in an ACL is significant............................................................. 226

Allowing for the Implied Deny function............................................................................. 228

A configured ACL has no effect until you apply it to an interface..................................... 228

You can assign an ACL name or number to an interface even if the ACL does not

exist in the switch configuration........................................................................................228

Using the CLI to create an ACL.................................................................................................. 228

Inserting or adding an ACE to an ACL............................................................................. 228

Using CIDR notation to enter the IPv4 ACL mask............................................................229

Configuring standard ACLs....................................................................................................................230

Configuring named, standard ACLs............................................................................................ 230

Entering the IPv4 named ACL context............................................................................. 230

Configuring ACEs in a named, standard ACL.................................................................. 231

Creating numbered, standard ACLs.................................................................................232

Configuring extended ACLs................................................................................................................... 234

Configuring named, extended ACLs........................................................................................... 234

Configuring ACEs in named, extended ACLs............................................................................. 235

Including options for TCP and UDP traffic in extended ACLs..................................................... 237

Configuring numbered, extended ACLs...................................................................................... 238

Creating or adding to an extended, numbered ACL.........................................................238

Controlling TCP and UDP traffic flow............................................................................... 241

Adding or removing an ACL assignment on an interface.......................................................................241

Filtering IPv4 traffic inbound on a VLAN..................................................................................... 241

Filtering inbound IPv4 traffic per port.......................................................................................... 242

Deleting an ACL.....................................................................................................................................243

Editing an existing ACL..........................................................................................................................243

Using the CLI to edit ACLs..........................................................................................................244

General editing rules................................................................................................................... 244

Sequence numbering in ACLs.................................................................................................... 244

Inserting an ACE in an existing ACL................................................................................ 245

Deleting an ACE from an existing ACL............................................................................ 246

Resequencing the ACEs in an ACL................................................................................. 247

Attaching a remark to an ACE..........................................................................................248

Operating notes for remarks.............................................................................................250

Viewing ACL configuration data.............................................................................................................251

Viewing an ACL summary...........................................................................................................251

Viewing the content of all ACLs on the switch.............................................................................252

Viewing the VACL assignments for a VLAN................................................................................253

Viewing static port (and trunk) ACL assignments........................................................................254

Viewing specific ACL configuration details..................................................................................254

Contents 9

Viewing all ACLs and their assignments in the routing switch startup-config and running-

config files................................................................................................................................... 258

Creating or editing an ACL offline.......................................................................................................... 258

Enable ACL “deny” or “permit” logging.................................................................................................. 260

Requirements for using ACL logging.......................................................................................... 260

ACL logging operation.................................................................................................................260

Enabling ACL logging on the switch............................................................................................261

Configuring logging timer............................................................................................................ 261

Monitoring static ACL performance.............................................................................................261

IPv6 counter operation with multiple interface assignments............................................ 264

General ACL operating notes................................................................................................................ 265

Chapter 14 Configuring Advanced Threat Protection.............................. 267

Introduction............................................................................................................................................ 267

DHCP snooping..................................................................................................................................... 267

Enabling DHCP snooping........................................................................................................... 268

Enabling DHCP snooping on VLANs.......................................................................................... 269

Configuring DHCP snooping trusted ports.................................................................................. 270

For DHCPv4 servers........................................................................................................ 270

For DHCPv6 servers........................................................................................................ 270

Configuring authorized server addresses................................................................................... 271

Using DHCP snooping with option 82......................................................................................... 271

Changing the remote-id from a MAC to an IP address.................................................... 272

Disabling the MAC address check................................................................................... 272

DHCP binding database..............................................................................................................273

DHCPv4 snooping max-binding.................................................................................................. 274

Enabling debug logging...............................................................................................................275

DHCP operational notes............................................................................................................. 275

Log messages.............................................................................................................................276

IPv6 Network Defense........................................................................................................................... 277

DSNOOPv6 and DIPLDv6.......................................................................................................... 277

Configuring DHCPv6 snooping........................................................................................ 277

Configuring traps for DHCPv6 snooping.......................................................................... 279

Clearing DHCPv6 snooping statistics ..............................................................................279

Enabling debug logging for DHCPv6 snooping................................................................ 279

DHCPv6 show commands............................................................................................... 279

Dynamic ARP protection........................................................................................................................280

Enabling dynamic ARP protection...............................................................................................281

Configuring trusted ports.............................................................................................................281

Adding an IP-to-MAC binding to the DHCP database.................................................................282

Clearing the DHCP snooping binding table......................................................................283

Adding a static binding..................................................................................................... 283

Configuring additional validation checks on ARP packets.......................................................... 283

Verifying the configuration of dynamic ARP protection............................................................... 284

Displaying ARP packet statistics.................................................................................................284

Monitoring dynamic ARP protection............................................................................................285

Dynamic IP lockdown.............................................................................................................................285

Protection against IP source address spoofing...........................................................................285

Prerequisite: DHCP snooping..................................................................................................... 285

Filtering IP and MAC addresses per-port and per-VLAN............................................................ 286

Enabling Dynamic IP Lockdown..................................................................................................287

IPv4.................................................................................................................................. 287

IPv6.................................................................................................................................. 287

Operational notes........................................................................................................................288

Adding an IP-to-MAC binding to the DHCP binding database.................................................... 288

10 ArubaOS-Switch Access Security Guide for YA/YB.16.03

Potential issues with bindings.......................................................................................... 289

Adding a static binding..................................................................................................... 289

Verifying the dynamic IP lockdown configuration........................................................................ 290

For IPv4............................................................................................................................290

For IPv6............................................................................................................................291

Displaying the static configuration of IP-to-MAC bindings.......................................................... 291

For IPv4............................................................................................................................291

For IPv6............................................................................................................................291

Debugging dynamic IP lockdown................................................................................................ 291

Differences between switch platforms.........................................................................................292

Using the instrumentation monitor......................................................................................................... 293

Operating notes...........................................................................................................................295

Configuring instrumentation monitor........................................................................................... 295

Viewing the current instrumentation monitor configuration......................................................... 297

Chapter 15 Traffic/Security Filters and Monitors...................................... 298

Overview................................................................................................................................................ 298

Filter limits................................................................................................................................... 298

Using port trunks with filter..........................................................................................................298

Filter types and operation...................................................................................................................... 298

Source-port filters........................................................................................................................299

Operating rules for source-port filters...............................................................................299

Name source-port filters..............................................................................................................300

Operating rules for named source-port filters...................................................................300

Defining and configuring named source-port filters..........................................................301

Viewing a named source-port filter...................................................................................302

Using named source-port filters....................................................................................... 302

Configuring traffic/security filters............................................................................................................307

Configuring a source-port traffic filter.......................................................................................... 308

Configuring a filter on a port trunk.................................................................................... 308

Editing a source-port filter........................................................................................................... 309

Configuring a multicast filter........................................................................................................310

Filtering index.............................................................................................................................. 311

Displaying traffic/security filters................................................................................................... 311

Chapter 16 Configuring Port and User-Based Access Control (802.1X).313

Overview................................................................................................................................................ 313

Why use port or user-based access control?..............................................................................313

General features......................................................................................................................... 313

User authentication methods...................................................................................................... 313

802.1X user-based access control................................................................................... 313

802.1X port-based access control....................................................................................314

Authenticating users.........................................................................................................314

Providing a path for downloading 802.1X supplicant software.........................................314

Authenticating one switch to another............................................................................... 315

Accounting........................................................................................................................315

General 802.1X authenticator operation................................................................................................ 315

Example of the authentication process....................................................................................... 315

VLAN membership priority.......................................................................................................... 316

General operating rules and notes.........................................................................................................316

General setup procedure for 802.1X access control..............................................................................317

Overview: configuring 802.1X authentication on the switch........................................................318

Configuring switch ports as 802.1X authenticators................................................................................318

Enable 802.1X authentication on selected ports.........................................................................319

Contents 11

Enable the selected ports as authenticators and enable the (default) port-based

authentication................................................................................................................... 319

Specify user-based authentication or return to port-based authentication....................... 319

Reconfigure settings for port-access...........................................................................................320

Configure the 802.1X authentication method..............................................................................322

Enter the RADIUS host IP address(es).......................................................................................323

Enable 802.1X authentication on the switch............................................................................... 324

Reset authenticator operation (optional)..................................................................................... 324

Optional: Configure 802.1X Controlled Direction........................................................................ 324

Wake-on-LAN Traffic...................................................................................................................325

Unauthenticated VLAN access (guest VLAN access).................................................................325

Characteristics of mixed port access mode......................................................................325

Configuring mixed port access mode............................................................................... 326

Configuring RADIUS port speed VSA......................................................................................... 326

Configuring the port.....................................................................................................................326

Viewing the port operation mode.................................................................................................327

802.1X Open VLAN mode..................................................................................................................... 329

Introduction................................................................................................................................. 329

VLAN membership priorities....................................................................................................... 329

Use models for 802.1X Open VLAN modes................................................................................330

Operating rules for authorized and unauthorized-client VLANs.................................................. 333

Setting up and configuring 802.1X Open VLAN mode................................................................337

Configuring general 802.1X operation..............................................................................337

Configuring 802.1X Open VLAN mode............................................................................ 338

Inspecting 802.1X Open VLAN mode operation.............................................................. 339

802.1X Open VLAN operating notes...........................................................................................339

Option for authenticator ports: configure port-security to allow only 802.1X-authenticated devices......340

Port-Security............................................................................................................................... 341

Configure the port access type.........................................................................................341

Configuring switch ports to operate as supplicants for 802.1X connections to other switches..............342

Supplicant port configuration.......................................................................................................342

Enabling a switch port as a supplicant............................................................................. 343

Configuring a supplicant switch port.................................................................................343

Displaying 802.1X configuration, statistics, and counters......................................................................344

Show commands for port-access authenticator.......................................................................... 344

Viewing 802.1X Open VLAN mode status...................................................................................344

Show commands for port-access supplicant...............................................................................347

Note on supplicant statistics.............................................................................................348

How RADIUS/802.1X authentication affects VLAN operation............................................................... 348

VLAN assignment on a port........................................................................................................ 348

Operating notes...........................................................................................................................349

Example of untagged VLAN assignment in a RADIUS-based authentication session............... 350

Enabling the use of GVRP-learned dynamic VLANs in authentication sessions........................ 353

Chapter 17 Configuring and Monitoring Port Security............................. 354

Overview................................................................................................................................................ 354

Port security........................................................................................................................................... 354

Basic operation........................................................................................................................... 354

Eavesdrop Prevention.................................................................................................................355

Blocked unauthorized traffic........................................................................................................355

Trunk group exclusion.................................................................................................................356

Planning port security..................................................................................................................356

Port security command options and operation............................................................................357

Displaying port security settings.......................................................................................357

Configuring port security............................................................................................................. 359

12 ArubaOS-Switch Access Security Guide for YA/YB.16.03

Port security commands...................................................................................................359

Retention of static addresses......................................................................................................361

Learned addresses...........................................................................................................362

Assigned/authorized addresses....................................................................................... 362

Specifying authorized devices and intrusion responses...................................................362

Adding an authorized device to a port..............................................................................363

Removing a device from the “authorized” list for a port....................................................364

MAC Lockdown......................................................................................................................................365

How MAC Lockdown works........................................................................................................ 366

Differences between MAC Lockdown and port security..............................................................366

MAC Lockdown operating notes................................................................................................. 367

Limits................................................................................................................................ 367

Event Log messages........................................................................................................367

Limiting the frequency of log messages........................................................................... 367

Deploying MAC Lockdown.......................................................................................................... 367

Basic MAC Lockdown deployment...................................................................................368

Problems using MAC Lockdown in networks with multiple paths.....................................369

MAC Lockout......................................................................................................................................... 370

How MAC Lockout works............................................................................................................ 370

Port security and MAC Lockout............................................................................................................. 371

Denial of Service packet filtering............................................................................................................371

Reading intrusion alerts and resetting alert flags...................................................................................371

Notice of security violations.........................................................................................................371

How the intrusion log operates....................................................................................................372

Keeping the intrusion log current by resetting alert flags............................................................ 372

Checking for intrusions, listing intrusion alerts, and resetting alert flags (Menu)............. 373

Checking for intrusions, listing intrusion alerts, and resetting alert flags (CLI).................375

Using the Event Log to find intrusion alerts (CLI)........................................................................376

Operating notes for port security............................................................................................................377

Identifying the IP address of an intruder..................................................................................... 377

Proxy Web servers......................................................................................................................377

"Prior to" entries in the Intrusion Log...........................................................................................377

Alert flag status for entries forced off of the Intrusion Log...........................................................378

LACP not available on ports configured for port security............................................................ 378

Chapter 18 Using Authorized IP Managers................................................379

Introduction............................................................................................................................................ 379

Defining authorized management stations.............................................................................................379

Overview of IP mask operation................................................................................................... 380

Viewing and configuring IP Authorized managers (Menu).......................................................... 380

Editing or deleting an Authorized manager entry (Menu).................................................381

Viewing and configuring IP Authorized managers (CLI)..............................................................381

Listing the switch’s current IP Authorized manager(s)..................................................... 381

Configuring IP Authorized managers for the switch (CLI)................................................ 382

Configuring IP Authorized managers (WebAgent).................................................................................383

Web proxy servers...................................................................................................................... 384

How to eliminate the web proxy server....................................................................................... 384

Using a web proxy server to access the WebAgent....................................................................384

Building IP Masks.................................................................................................................................. 385

Configuring one station per Authorized manager IP entry.......................................................... 385

Configuring multiple stations per Authorized manager IP entry.................................................. 385

Operating notes..................................................................................................................................... 388

Chapter 19 Key Management System........................................................ 389

Contents 13

Overview................................................................................................................................................ 389

Configuring key chain management...................................................................................................... 389

Creating and deleting key chain entries...................................................................................... 389

Assigning a time-independent key to a chain..............................................................................390

Assigning time-dependent keys to a chain.......................................................................391

Chapter 20 Secure Mode............................................................................. 394

Configuring secure mode.......................................................................................................................394

Chapter 21 Conformance to Suite-B Cryptography requirements.......... 395

Configuration support.............................................................................................................................395

CRL configuration facts...............................................................................................................395

OCSP configuration facts............................................................................................................396

Configure CRL for revocation check .......................................................................................... 396

Configure OCSP for revocation check ....................................................................................... 397

Retrieve CRL ........................................................................................................................................ 397

Set TA profile to validate CRL and OCSP..............................................................................................398

Clear CRL ............................................................................................................................................. 398

Create a certificate signing request....................................................................................................... 398

Create and enroll a self-signed certificate..............................................................................................399

Configure or remove the minimum levels of security minLos for TLS....................................................400

Install authentication files ......................................................................................................................400

Remove authentication files...................................................................................................................401

Remove the client public keys from configuration..................................................................................402

Show details of TA profile ......................................................................................................................402

Chapter 22 Websites.................................................................................... 404

Chapter 23 Support and other resources.................................................. 405

Accessing Hewlett Packard Enterprise Support.................................................................................... 405

Accessing updates.................................................................................................................................405

Customer self repair...............................................................................................................................405

Remote support..................................................................................................................................... 406

Warranty information..............................................................................................................................406

Regulatory information...........................................................................................................................406

Documentation feedback....................................................................................................................... 407

14 ArubaOS-Switch Access Security Guide for YA/YB.16.03

This switch software guide is intended for network administrators and support personnel, and applies to the switch

models listed on this page unless otherwise noted. This guide does not provide information about upgrading or

replacing switch hardware.

Applicable Products

Aruba 2530 Switch Series (J9772A, J9773A, J9774A, J9775A, J9776A, J9777A, J9778A, J9779A, J9780A,

J9781A, J9782A, J9783A, J9853A, J9854A, J9855A, J9856A, JL070A)

Chapter 1

About this document

Chapter 1 About this document 15

Introduction

This chapter provides an overview of the security features included on your switch. For detailed information on

individual features, see the references provided.

Before you connect your switch to a network, Hewlett Packard Enterprise strongly recommends that you review

the section Getting started with access security on page 24. It outlines potential threats for unauthorized

switch and network access, and provides guidelines on how to prepare the switch for secure network operation.

About this guide

This access security guide describes how to configure security features on your switch.

For an introduction to the standard conventions used in this guide, see “Getting Started” in the basic

operation guide for your switch.

For more information

For IPv6-specific security settings and features, see the IPv6 configuration guide for your switch.

For information on which product manual to consult for a specific software feature, see the Software feature index

– extended.

For the latest version of all HPE switch documentation, including Release Notes covering recently added features

and other software topics, visit the Hewlett Packard Enterprise Networking website at http://www.hpe.com/

support/manuals.

Access security features

This section provides an overview of the switch’s access security features, authentication protocols, and methods.

For more in-depth information, see the references provided (all chapter and page references are to this access

security guide unless a different manual name is indicated).

The Management Interface wizard provides a convenient step-by-step method to prepare the switch

for secure network operation. See Using the Management Interface wizard on page 25 for

details.

Chapter 2

Security Overview

16 ArubaOS-Switch Access Security Guide for YA/YB.16.03

Table 1: Access security and switch authentication features

Feature Default setting Security guidelines More information and

configuration details

Manager password no password Configuring a local

manager password is a

fundamental step in

reducing the possibility of

unauthorized access

through the switch's

WebAgent and console

(CLI and Menu) interfaces.

The manager password

can easily be set by any

one of the following

methods:

• CLI: password

manager command, or

Management interface

wizard

• WebAgent: the

password options

under the Security tab,

or Management

interface wizard

• Menu interface:

Console passwords

option

• SNMP

Configuring local

password security on

page 30

Using the Management

Interface wizard on page

25

Using SNMP to view and

configure switch

authentication features

on page 106

Telnet and Web-browser

access (WebAgent) enabled The default remote

management protocols

enabled on the switch are

plain text protocols, which

transfer passwords in

open or plain text that is

easily captured.

To reduce the chances of

unauthorized users

capturing your passwords,

secure and encrypted

protocols such as SSH

and SSL (see below for

details) should be used for

remote access. This

enables you to employ

increased access security

while still retaining remote

client access.

Also, access security on

the switch is incomplete

Using the Management

Interface wizard on page

25

For more on Telnet and

the WebAgent, see

"Interface Access and

System Information" in the

management and

configuration guide.For

RADIUS accounting, see

RADIUS Authentication,

Authorization, and

Accounting on page 97

Table Continued

Chapter 2 Security Overview 17

Feature Default setting Security guidelines More information and

configuration details

without disabling Telnet

and the standard Web

browser access

(WebAgent). Among the

methods for blocking

unauthorized access

attempts using Telnet or

the WebAgent are the

following two CLI

commands:

•no telnet-server

: This command blocks

inbound Telnet access.

•no web-management

: This command

prevents use of the

WebAgent through http

(port 80) server

access.

If you choose not to

disable Telnet and the

WebAgent, you may want

to consider using RADIUS

accounting to maintain a

record of password-

protected access to the

switch.

Table Continued

18 ArubaOS-Switch Access Security Guide for YA/YB.16.03

Feature Default setting Security guidelines More information and

configuration details

SSH disabled SSH provides Telnet-like

functions through

encrypted, authenticated

transactions of the

following types:

• client public-key

authentication: uses

one or more public

keys (from clients) that

must be stored on the

switch. Only a client

with a private key that

matches a stored

public key can gain

access to the switch.

• switch SSH and user

password

authentication: this

option is a subset of

the client public-key

authentication, and is

used if the switch has

SSH enabled without a

login access configured

to authenticate the

client's key. In this

case, the switch

authenticates itself to

clients, and users on

SSH clients then

authenticate

themselves to the

switch by providing

passwords stored on a

RADIUS or TACACS+

server, or locally on the

switch.

• secure copy (SC) and

secure FTP (SFTP): By

opening a secure,

encrypted SSH

session, you can take

advantage of SC and

SFTP to provide a

secure alternative to

TFTP for transferring

sensitive switch

information. For more

on SC and SFTP, see

Using the Management

Interface wizard on page

25

Configuring Secure

Shell (SSH) on page 176

Table Continued

Chapter 2 Security Overview 19

Feature Default setting Security guidelines More information and

configuration details

the section titled "Using

Secure Copy and

SFTP" in the "File

Transfers" appendix of

the management and

configuration guide for

your switch.

SSL disabled Secure Socket Layer

(SSL) and Transport Layer

Security (TLS) provide

remote Web browser

access (WebAgent) to the

switch via authenticated

transactions and

encrypted paths between

the switch and

management station

clients capable of

SSL/TLS operation. The

authenticated type

includes server certificate

authentication with user

password authentication.

Using the Management

Interface wizard on page

25

Configuring Secure

Socket Layer (SSL) on

page 200

SNMP public, unrestricted In the default

configuration, the switch is

open to access by

management stations

running SNMP

management applications

capable of viewing and

changing the settings and

status data in the switch

MIB (Management

Information Base). Thus,

controlling SNMP access

to the switch and

preventing unauthorized

SNMP access should be a

key element of your

network security strategy.

SNMP security

guidelines on page 27

Using the Management

Interface wizard on page

25 management and

configuration guide, see

“Using SNMP Tools to

manage the switch”.

Table Continued

20 ArubaOS-Switch Access Security Guide for YA/YB.16.03

Page is loading ...

Aruba 2530 Installation guide

This manual is also suitable for

Aruba 2530 Installation guide

Related papers

Other documents