Name: HPE FlexFabric 5940 SERIES
Brand: HPE
Rating: 5 (1 reviews)

To Next Page

HPE FlexFabric 5940 Switch Series

Security Configuration Guide

Part number: 5200-1030a

Software version: Release 2508 and later verison

Document version: 6W101-20161101

Default Chapter3
- Table of Contents3
Configuring AAA14
- Overview14
- FIPS Compliance32
- AAA Configuration Considerations and Task List32
- Configuring AAA Schemes33
- Configuring AAA Methods for ISP Domains59
- Configuring the RADIUS Session-Control Feature66
- Configuring the RADIUS DAE Server Feature66
- Changing the DSCP Priority for RADIUS Packets67
- Configuring the RADIUS Attribute Translation Feature67
- Setting the Maximum Number of Concurrent Login Users69
- Configuring a NAS-ID Profile69
- Configuring the Device ID70
- Displaying and Maintaining AAA70
- AAA Configuration Examples70
- Troubleshooting RADIUS81
- Troubleshooting HWTACACS82
- Troubleshooting LDAP82
  - LDAP Authentication Failure82
802.1X Overview84
- 802.1X Architecture84
- Controlled/Uncontrolled Port and Port Authorization Status84
- 802.1X-Related Protocols85
  - Packet Formats85
  - EAP over RADIUS86
- 802.1X Authentication Initiation87
  - 802.1X Client as the Initiator87
  - Access Device as the Initiator87
- 802.1X Authentication Procedures88
Configuring 802.1X92
- Access Control Methods92
- 802.1X VLAN Manipulation92
  - Authorization VLAN92
  - Guest VLAN94
  - Auth-Fail VLAN95
  - Critical VLAN96
  - Critical Voice VLAN98
- Using 802.1X Authentication with Other Features99
  - ACL Assignment99
  - User Profile Assignment99
  - EAD Assistant99
  - Redirect URL Assignment100
- Configuration Prerequisites100
- 802.1X Configuration Task List100
- Enabling 802.1X101
- Enabling EAP Relay or EAP Termination101
- Setting the Port Authorization State102
- Specifying an Access Control Method102
- Setting the Maximum Number of Concurrent 802.1X Users on a Port103
- Setting the Maximum Number of Authentication Request Attempts103
- Setting the 802.1X Authentication Timeout Timers103
- Configuring Online User Handshake104
  - Configuration Guidelines104
  - Configuration Procedure104
- Configuring the Authentication Trigger Feature105
  - Configuration Guidelines105
  - Configuration Procedure105
- Specifying a Mandatory Authentication Domain on a Port105
- Setting the Quiet Timer106
- Configuring 802.1X Reauthentication106
  - Overview106
  - Configuration Restrictions and Guidelines107
  - Configuring 802.1X Periodic Reauthentication107
  - Configuring 802.1X Manual Reauthentication107
  - Enabling the Keep-Online Feature108
- Configuring an 802.1X Guest VLAN108
  - Configuration Guidelines108
  - Configuration Prerequisites109
  - Configuration Procedure109
- Enabling 802.1X Guest VLAN Assignment Delay109
- Configuring an 802.1X Auth-Fail VLAN110
  - Configuration Guidelines110
  - Configuration Prerequisites110
  - Configuration Procedure111
- Configuring an 802.1X Critical VLAN111
  - Configuration Guidelines111
  - Configuration Prerequisites111
- Enabling the 802.1X Critical Voice VLAN112
  - Configuration Restrictions and Guidelines112
  - Configuration Prerequisites112
  - Configuration Procedure112
- Specifying Supported Domain Name Delimiters112
- Enabling 802.1X User IP Freezing113
- Sending 802.1X Protocol Packets out of a Port Without VLAN Tags113
- Setting the Maximum Number of 802.1X Authentication Attempts for MAC Authenticated Users114
- Configuring the EAD Assistant Feature114
- Displaying and Maintaining 802.1X115
- 802.1X Authentication Configuration Examples115
  - Basic 802.1X Authentication Configuration Example115
  - Guest VLAN and Authorization VLAN Configuration Example117
  - 802.1X with ACL Assignment Configuration Example120
  - With EAD Assistant Configuration Example (with DHCP Relay Agent)121
  - With EAD Assistant Configuration Example (with DHCP Server)124
- Troubleshooting 802.1X126
  - EAD Assistant URL Redirection Failure126
Configuring MAC Authentication128
- Overview128
- Configuration Prerequisites132
- Configuration Task List132
- Enabling MAC Authentication132
- Specifying a MAC Authentication Domain133
- Configuring the User Account Format133
- Configuring MAC Authentication Timers134
- Setting the Maximum Number of Concurrent MAC Authentication Users on a Port134
- Enabling MAC Authentication Multi-VLAN Mode on a Port135
- Configuring MAC Authentication Delay135
- Enabling Parallel Processing of MAC Authentication and 802.1X Authentication136
  - Configuration Restrictions and Guidelines136
  - Configuration Procedure136
- Configuring a MAC Authentication Guest VLAN137
- Configuring a MAC Authentication Critical VLAN138
- Enabling the MAC Authentication Critical Voice VLAN138
  - Configuration Prerequisites138
  - Configuration Procedure139
- Configuring Periodic MAC Reauthentication139
- Enabling MAC Authentication Offline Detection140
- Displaying and Maintaining MAC Authentication141
- MAC Authentication Configuration Examples141
Configuring Portal Authentication149
- Overview149
  - Extended Portal Functions149
  - Portal System Components149
  - Portal System Using the Local Portal Web Server151
  - Interaction between Portal System Components151
  - Portal Authentication Modes152
  - Portal Support for EAP152
  - Portal Authentication Process153
  - Portal Packet Filtering Rules155
  - MAC-Based Quick Portal Authentication155
- Portal Configuration Task List156
- Configuration Prerequisites157
- Configuring a Portal Authentication Server157
- Configuring a Portal Web Server158
- Enabling Portal Authentication159
  - Configuration Restrictions and Guidelines159
  - Configuration Procedure160
- Specifying a Portal Web Server160
- Controlling Portal User Access161
  - Configuring a Portal-Free Rule161
  - Configuring an Authentication Source Subnet162
  - Configuring an Authentication Destination Subnet163
  - Setting the Maximum Number of Portal Users163
  - Specifying a Portal Authentication Domain164
  - Specifying a Preauthentication Domain165
  - Specifying a Preauthentication IP Address Pool for Portal Users165
  - Enabling Strict-Checking on Portal Authorization Information166
  - Enabling Portal Authentication Only for DHCP Users167
  - Enabling Outgoing Packets Filtering on a Portal-Enabled Interface167
- Configuring Portal Detection Features167
  - Configuring Online Detection of Portal Users167
  - Configuring Portal Authentication Server Detection168
  - Configuring Portal Web Server Detection169
  - Configuring Portal User Synchronization170
- Configuring the Portal Fail-Permit Feature171
- Configuring BAS-IP for Portal Packets Sent to the Portal Authentication Server171
- Enabling Portal Roaming172
- Specifying a Format for the NAS-Port-ID Attribute173
- Specifying the Device ID173
- Logging out Online Portal Users173
- Configuring Web Redirect174
- Applying a NAS-ID Profile to an Interface174
- Configuring the Local Portal Web Server Feature175
  - Customizing Authentication Pages175
  - Configuring a Local Portal Web Server177
- Enabling ARP or ND Entry Conversion for Portal Clients178
- Configuring MAC-Based Quick Portal Authentication178
  - Configuring a MAC Binding Server178
  - Specifying a MAC Binding Server on an Interface179
- Enabling Logging for User Logins and Logouts180
- Displaying and Maintaining Portal180
- Portal Configuration Examples181
  - Configuring Direct Portal Authentication181
  - Configuring Re-DHCP Portal Authentication189
  - Configuring Cross-Subnet Portal Authentication192
  - Configuring Extended Direct Portal Authentication196
  - Configuring Extended Re-DHCP Portal Authentication199
  - Configuring Extended Cross-Subnet Portal Authentication203
  - Configuring Portal Server Detection and Portal User Synchronization206
  - Configuring Direct Portal Authentication with a Preauthentication Domain214
  - Configuring Re-DHCP Portal Authentication with a Preauthentication Domain216
  - Configuring Direct Portal Authentication Using Local Portal Web Server218
- Troubleshooting Portal221
  - No Portal Authentication Page Is Pushed for Users221
  - Cannot Log out Portal Users on the Access Device222
  - Cannot Log out Portal Users on the RADIUS Server222
  - Users Logged out by the Access Device Still Exist on the Portal Authentication Server222
  - Re-DHCP Portal Authenticated Users Cannot Log in Successfully223
Configuring Port Security224
- Overview224
  - Port Security Features224
  - Port Security Modes224
- Configuration Task List227
- Enabling Port Security227
- Setting Port Security's Limit on the Number of Secure MAC Addresses on a Port228
- Setting the Port Security Mode229
- Configuring Port Security Features230
  - Configuring NTK230
  - Configuring Intrusion Protection231
- Configuring Secure MAC Addresses231
  - Configuration Prerequisites232
  - Configuration Procedure232
- Ignoring Authorization Information from the Server233
- Enabling MAC Move233
- Enabling the Authorization-Fail-Offline Feature234
- Applying a NAS-ID Profile to Port Security234
- Enabling SNMP Notifications for Port Security235
- Displaying and Maintaining Port Security235
- Port Security Configuration Examples235
- Troubleshooting Port Security244
  - Cannot Set the Port Security Mode244
  - Cannot Configure Secure MAC Addresses244
Configuring User Profiles246
- Overview246
- User Profile Configuration Task List246
- Configuration Restrictions and Guidelines246
- Configuring a User Profile246
- Displaying and Maintaining User Profiles247
- User Profile Configuration Example247
Configuring Password Control252
- Overview252
- FIPS Compliance255
- Password Control Configuration Task List255
- Enabling Password Control256
- Setting Global Password Control Parameters256
- Setting User Group Password Control Parameters257
- Setting Local User Password Control Parameters258
- Setting Super Password Control Parameters259
- Displaying and Maintaining Password Control259
- Password Control Configuration Example260
Configuring Keychains263
- Overview263
- Configuration Procedure263
- Displaying and Maintaining Keychain264
- Keychain Configuration Example264
Managing Public Keys269
- Overview269
- FIPS Compliance269
- Creating a Local Key Pair269
- Distributing a Local Host Public Key271
  - Exporting a Host Public Key271
  - Displaying a Host Public Key271
- Destroying a Local Key Pair272
- Configuring a Peer Host Public Key272
  - Importing a Peer Host Public Key from a Public Key File272
  - Entering a Peer Host Public Key273
- Displaying and Maintaining Public Keys273
- Examples of Public Key Management273
  - Example for Entering a Peer Host Public Key273
  - Example for Importing a Public Key from a Public Key File275
Configuring PKI278
- Overview278
- FIPS Compliance280
- PKI Configuration Task List280
- Configuring a PKI Entity281
- Configuring a PKI Domain281
- Requesting a Certificate283
- Aborting a Certificate Request285
- Obtaining Certificates285
- Verifying PKI Certificates287
  - Verifying Certificates with CRL Checking287
  - Verifying Certificates Without CRL Checking288
- Specifying the Storage Path for the Certificates and Crls288
- Exporting Certificates289
- Removing a Certificate289
- Configuring a Certificate-Based Access Control Policy290
- Displaying and Maintaining PKI291
- PKI Configuration Examples291
- Troubleshooting PKI Configuration307
Configuring Ipsec312
- Overview312
- FIPS Compliance316
- Ipsec Tunnel Establishment316
- Implementing ACL-Based Ipsec316
- Configuring Ipsec for Ipv6 Routing Protocols329
  - Configuration Task List329
  - Configuring a Manual Ipsec Profile330
- Configuring SNMP Notifications for Ipsec331
- Configuring Ipsec Fragmentation331
- Setting the Maximum Number of Ipsec Tunnels332
- Displaying and Maintaining Ipsec332
- Ipsec Configuration Examples333
  - Configuring a Manual Mode Ipsec Tunnel for Ipv4 Packets333
  - Configuring Ipsec for Ripng335
Configuring IKE339
- Overview339
- FIPS Compliance341
- IKE Configuration Prerequisites341
- IKE Configuration Task List341
- Configuring an IKE Profile342
- Configuring an IKE Proposal344
- Configuring an IKE Keychain345
- Configuring the Global Identity Information346
- Configuring the IKE Keepalive Feature346
- Configuring the IKE NAT Keepalive Feature347
- Configuring IKE DPD347
- Enabling Invalid SPI Recovery348
- Setting the Maximum Number of IKE Sas348
- Configuring SNMP Notifications for IKE349
- Displaying and Maintaining IKE349
- IKE Configuration Examples350
  - Configuring an IKE-Based Ipsec Tunnel for Ipv4 Packets350
  - Main Mode IKE with Pre-Shared Key Authentication Configuration Example352
- Troubleshooting IKE355
Configuring Ikev2360
- Overview360
- Ikev2 Configuration Task List361
- Configuring an Ikev2 Profile362
- Configuring an Ikev2 Policy365
- Configuring an Ikev2 Proposal365
- Configuring an Ikev2 Keychain367
- Configure Global Ikev2 Parameters368
- Displaying and Maintaining Ikev2369
- Troubleshooting Ikev2369
Configuring SSH371
- Overview371
- FIPS Compliance373
- Configuring the Device as an SSH Server374
- Configuring the Device as an Stelnet Client380
- Configuring the Device as an SFTP Client384
- Configuring the Device as an SCP Client389
- Specifying Algorithms for SSH2392
- Displaying and Maintaining SSH393
- Stelnet Configuration Examples394
- SFTP Configuration Examples411
- SCP Configuration Examples421
  - SCP Configuration Example with Password Authentication421
  - SCP Configuration Example Based on Suite B Algorithms422
- NETCONF over SSH Configuration Example with Password Authentication429
  - Network Requirements429
  - Verifying the Configuration431
Configuring SSL432
- Overview432
  - SSL Security Services432
  - SSL Protocol Stack432
- FIPS Compliance433
- SSL Configuration Task List433
- Configuring an SSL Server Policy433
- Configuring an SSL Client Policy435
- Displaying and Maintaining SSL437
Configuring Attack Detection and Prevention438
- Overview438
- Attacks that the Device Can Prevent438
- Attack Detection and Prevention Configuration Task List441
- Configuring an Attack Defense Policy442
- Configuring TCP Fragment Attack Prevention449
- Enabling the Login Delay450
- Displaying and Maintaining Attack Detection and Prevention450
- Attack Detection and Prevention Configuration Examples451
  - Attack Defense Policy Device Application Configuration Example451
Configuring TCP Attack Prevention455
- Overview455
- Configuring Naptha Attack Prevention455
Configuring IP Source Guard456
- Overview456
  - Static IPSG Bindings456
  - Dynamic IPSG Bindings457
- IPSG Configuration Task List457
- Configuring the Ipv4Sg Feature458
  - Enabling Ipv4Sg on an Interface458
  - Configuring a Static Ipv4Sg Binding458
- Configuring the Ipv6Sg Feature459
  - Enabling Ipv6Sg on an Interface459
  - Configuring a Static Ipv6Sg Binding460
- Displaying and Maintaining IPSG460
- IPSG Configuration Examples461
Configuring ARP Attack Protection468
- ARP Attack Protection Configuration Task List468
- Configuring Unresolvable IP Attack Protection468
- Configuring ARP Packet Rate Limit470
  - Configuration Guidelines471
  - Configuration Procedure471
- Configuring Source MAC-Based ARP Attack Detection471
- Configuring ARP Packet Source MAC Consistency Check474
- Configuring ARP Active Acknowledgement474
- Configuring Authorized ARP474
- Configuring ARP Attack Detection477
- Configuring ARP Scanning and Fixed ARP485
  - Configuration Restrictions and Guidelines485
  - Configuration Procedure485
- Configuring ARP Gateway Protection485
- Configuring ARP Filtering487
- Configuring ARP Sender IP Address Checking488
Configuring ND Attack Defense490
- Overview490
- ND Attack Defense Configuration Task List490
- Enabling Source MAC Consistency Check for ND Messages490
- Configuring ND Attack Detection491
- Configuring RA Guard494
Configuring Urpf499
- Overview499
- Enabling Urpf502
- Displaying and Maintaining Urpf502
- Global Urpf Configuration Example503
  - Network Requirements503
  - Configuration Procedure503
Configuring Crypto Engines504
- Overview504
- Displaying and Maintaining Crypto Engines504
Configuring FIPS505
- Overview505
- Configuration Restrictions and Guidelines505
- Configuring FIPS Mode506
- FIPS Self-Tests508
- Displaying and Maintaining FIPS510
- FIPS Configuration Examples510
Document Conventions and Icons515
- Conventions515
- Network Topology Icons516
Support and Other Resources517
- Accessing Hewlett Packard Enterprise Support517
- Accessing Updates517
Index520

HPE FlexFabric 5940 SERIES User Manual

Table of Contents

Other manuals for HPE FlexFabric 5940 SERIES

Questions and Answers:

HPE FlexFabric 5940 SERIES Specifications

Related product manuals

Brand	HPE
Model	FlexFabric 5940 SERIES
Category	Switch
Language	English