To Next Page

HP A5120 EI Switch Series

Security

Configuration Guide

Abstract

This document describes the software features for the HP A Series products and guides you through the

software configuration procedures. These configuration guides also provide configuration examples to

help you apply software features to different network scenarios.

This documentation is intended for network planners, field technical support and servicing engineers, and

network administrators working with the HP A Series products.

Part number: 5998-1800

Software version: Release 2208

Document version: 5W100-20110530

Default Chapter1
- Configuration Guide1
- Table of Contents3
AAA Configuration11
- AAA Overview11
- AAA Configuration Considerations and Task List24
- Configuring AAA Schemes26
- Configuring AAA Methods for ISP Domains46
- Tearing down User Connections Forcibly52
- Configuring a Network Device as a RADIUS Server52
- Displaying and Maintaining AAA54
- AAA Configuration Examples54
- Troubleshooting AAA71
  - Troubleshooting RADIUS71
  - Troubleshooting HWTACACS72
802.1X Fundamentals73
- 802.1X Architecture73
- Controlled/Uncontrolled Port and Pot Authorization Status73
- 802.1X-Related Protocols74
  - Packet Format74
  - EAP over RADIUS76
- Initiating 802.1X Authentication76
  - 802.1X Client as the Initiator76
  - Access Device as the Initiator76
- 802.1X Authentication Procedures77
802.1X Configuration81
- HP Implementation of 802.1X81
  - Access Control Methods81
  - Using 802.1X Authentication with Other Features81
- Configuring 802.1X84
- Displaying and Maintaining 802.1X94
- 802.1X Configuration Examples94
EAD Fast Deployment Configuration101
- EAD Fast Deployment Overview101
  - EAD Fast Deployment Implementation101
- Configuring EAD Fast Deployment101
  - Configuration Prerequisites101
  - Configuration Procedure101
- Displaying and Maintaining EAD Fast Deployment102
- EAD Fast Deployment Configuration Example103
- Troubleshooting EAD Fast Deployment105
  - Web Browser Users Cannot be Correctly Redirected105
MAC Authentication Configuration106
- MAC Authentication Overview106
- Using MAC Authentication with Other Features107
- MAC Authentication Configuration Task List108
- Basic Configuration for MAC Authentication108
  - Configuration Prerequisites108
  - Configuration Procedure108
- Specifying an Authentication Domain for MAC Authentication Users109
- Configuring a MAC Authentication Guest VLAN110
  - Configuration Prerequisites110
  - Configuration Procedure110
- Displaying and Maintaining MAC Authentication111
- MAC Authentication Configuration Examples111
Portal Configuration118
- Portal Overview118
- Portal Configuration Task List122
- Configuration Prerequisites123
  - Specifying the Local Portal Server for Layer 2 Portal Authentication124
- Configuring the Local Portal Server124
  - Customizing Authentication Pages124
  - Configuring the Local Portal Server127
- Enabling Layer 2 Portal Authentication128
- Controlling Access of Portal Users129
- Specifying the Auth-Fail VLAN for Portal Authentication132
- Specifying the Auto Redirection URL for Authenticated Portal Users132
- Configuring Portal Detection Functions133
- Logging off Portal Users133
- Displaying and Maintaining Portal133
- Portal Configuration Examples134
  - Configuring Layer 2 Portal Authentication134
  - Configuration Procedures135
- Troubleshooting Portal138
  - Inconsistent Keys on the Access Device and the Portal Server138
  - Incorrect Server Port Number on the Access Device138
Triple Authentication Configuration140
- Triple Authentication Overview140
  - Triple Authentication Mechanism140
  - Using Triple Authentication with Other Features141
- Configuring Triple Authentication141
- Triple Authentication Configuration Examples142
  - Triple Authentication Basic Function Configuration Example142
  - Triple Authentication Supporting VLAN Assignment and Auth-Fail VLAN Configuration Example145
Port Security Configuration150
- Port Security Overview150
- Port Security Configuration Task List153
- Enabling Port Security154
  - Configuration Prerequisites154
  - Configuration Procedure154
- Setting the Maximum Number of Secure MAC Addresses154
- Setting the Port Security Mode155
  - Configuration Prerequisites155
  - Configuration Procedure155
- Configuring Port Security Features156
- Configuring Secure MAC Addresses158
  - Configuration Prerequisites158
  - Configuration Procedure158
- Ignoring Authorization Information from the Server159
- Displaying and Maintaining Port Security159
- Port Security Configuration Examples160
- Troubleshooting Port Security169
User Profile Configuration171
- User Profile Overview171
- User Profile Configuration Task List171
- Creating a User Profile171
  - Configuration Prerequisites171
- Configuring a User Profile172
- Enabling a User Profile172
- Displaying and Maintaining User Profile173
Password Control Configuration174
- Password Control Overview174
- Password Control Configuration Task List176
- Configuring Password Control177
- Displaying and Maintaining Password Control180
- Password Control Configuration Example181
HABP Configuration184
- HABP Overview184
- Configuring HABP185
  - Configuring the HABP Server185
  - Configuring an HABP Client185
- Displaying and Maintaining HABP186
- HABP Configuration Example186
  - Network Requirements186
  - Configuration Procedure187
Public Key Configuration189
- Asymmetric Key Algorithm Overview189
- Configuring the Local Asymmetric Key Pair190
- Configuring a Peer Public Key191
- Displaying and Maintaining Public Keys192
- Public Key Configuration Examples192
  - Configuring a Peer Public Key Manually192
  - Importing a Peer Public Key from a Public Key File194
PKI Configuration197
- PKI Overview197
- PKI Configuration Task List199
- Configuring an Entity DN200
- Configuring a PKI Domain201
- Submitting a PKI Certificate Request202
  - Submitting a Certificate Request in Auto Mode203
  - Submitting a Certificate Request in Manual Mode203
- Retrieving a Certificate Manually204
- Configuring PKI Certificate Verification205
- Destroying a Local RSA Key Pair206
- Deleting a Certificate206
- Configuring an Access Control Policy207
- Displaying and Maintaining PKI207
- PKI Configuration Examples208
- Troubleshooting PKI216
SSH2.0 Configuration218
- SSH2.0 Overview218
  - Introduction to SSH2.0218
  - How Does SSH Work218
- Configuring the Device as an SSH Server220
- Configuring the Device as an SSH Client225
- Displaying and Maintaining SSH227
- SSH Server Configuration Examples228
  - When Switch Acts as Server for Password Authentication228
  - When Switch Acts as Server for Publickey Authentication230
- SSH Client Configuration Examples235
  - When Switch Acts as Client for Password Authentication235
  - When Switch Acts as Client for Publickey Authentication238
SFTP Configuration241
- SFTP Overview241
- Configuring the Device as an SFTP Server241
- Configuring the Device an SFTP Client242
- SFTP Client Configuration Example245
- SFTP Server Configuration Example248
SSL Configuration251
- SSL Overview251
  - SSL Security Mechanism251
  - SSL Protocol Stack252
- SSL Configuration Task List252
- Configuring an SSL Server Policy252
- Configuring an SSL Client Policy255
  - Configuration Prerequisites255
  - Configuration Procedure255
- Displaying and Maintaining SSL256
- Troubleshooting SSL256
  - SSL Handshake Failure256
TCP Attack Protection Configuration258
- TCP Attack Protection Overview258
- Enabling the SYN Cookie Feature258
- Displaying and Maintaining TCP Attack Protection258
IP Source Guard Configuration259
- IP Source Guard Overview259
  - Introduction to IP Source Guard259
  - IP Source Guard Binding259
- Configuring Ipv4 Source Guard Binding261
  - Configuring a Static Ipv4 Source Guard Binding Entry262
  - Configuring the Dynamic Ipv4 Source Guard Binding Function262
- Configuring Ipv6 Source Guard Binding263
  - Configuring a Static Ipv6 Source Guard Binding Entry263
  - Configuring the Dynamic Ipv6 Source Guard Binding Function264
- Displaying and Maintaining IP Source Guard265
- IP Source Guard Configuration Examples266
- Troubleshooting IP Source Guard274
  - Neither Static Binding Entries nor the Dynamic Binding Function Can be Configured274
ARP Attack Protection Configuration275
- ARP Attack Protection Overview275
- ARP Attack Protection Configuration Task List275
- Configuring ARP Defense against IP Packet Attacks276
- Configuring ARP Packet Rate Limit277
  - Introduction277
- Configuring Source MAC Address Based ARP Attack Detection278
- Configuring ARP Packet Source MAC Address Consistency Check279
  - Introduction279
  - Configuration Procedure279
- Configuring ARP Active Acknowledgement280
  - Introduction280
  - Configuration Procedure280
- Configuring ARP Detection280
- Configuring ARP Automatic Scanning and Fixed ARP288
  - Introduction288
  - Configuration Procedure288
- Configuring ARP Gateway Protection289
- Configuring ARP Filtering290
ND Attack Defense Configuration293
- Introduction to ND Attack Defense293
- Enabling Source MAC Consistency Check for ND Packets294
- Configuring the ND Detection Function294
- ND Detection Configuration Example296
Support and Other Resources298
- Contacting HP298
  - Subscription Service298
- Related Information298
  - Documents298
  - Websites298
- Conventions299
Index301

Brand	HP
Model	5120 EI Switch Series
Category	Switch
Language	English

HP 5120 EI Switch Series User Manual

Table of Contents

Questions and Answers:

HP 5120 EI Switch Series Specifications

Related product manuals