Home
Huawei
Network Router
AR1200-S
Huawei AR1200-S User Manual
4
of 1
of 1 rating
308 pages
Give review
Manual
Specs
To Next Page
To Next Page
To Previous Page
To Previous Page
Loading...
#
keychain huawei mode absolute
receive-tolerance 100
key-id 1
algorithm md5
key-string plain hello
send-time utc 14:40 2008-10-10 to 14:50 2008-10-10
receive-time utc 14:30 2008-10-10 to 14:50 2008-10-10
#
return
Huawei AR1200-S Series Enterprise Routers
Configuration Guide - Security
13 Keychain Configuration
Issue 02 (2012-03-30)
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
279
292
294
Table of Contents
About this Document
3
Intended Audience
3
Command Conventions
4
Interface Numbering Conventions
4
Table of Contents
6
1 AAA Configuration
15
AAA Overview
16
AAA Features Supported by the AR1200-S
16
Issue
16
Configuring Local Authentication and Authorization
19
Establishing the Configuration Task
20
Configuring a Local User
20
Configuring Authentication and Authorization Schemes
22
Configuring a Domain
23
Checking the Configuration
24
Configuring RADIUS AAA
25
Establishing the Configuration Task
25
Configuring AAA Schemes
26
Configuring a RADIUS Server Template
28
Configuring a Domain
30
Checking the Configuration
32
Configuring HWTACACS AAA
32
Establishing the Configuration Task
32
Configuring AAA Schemes
34
Configuring an HWTACACS Server Template
36
Configuring a Domain
39
Checking the Configuration
40
Maintaining AAA
41
Clearing the Statistics
41
Configuration Examples
42
Example for Configuring RADIUS Authentication, Authorization, and Accounting
42
Example for Configuring HWTACACS Authentication, Authorization, and Accounting
45
2 HTTPS Configuration
49
HTTPS Overview
50
HTTPS Features Supported by the AR1200-S
50
Configuring the AR1200-S as an HTTPS Server
50
Configuration Examples
52
Example for Configuring the Router as an HTTPS Server
52
3 Firewall Configuration
56
Firewall Overview
58
Firewall Features Supported by the AR1200-S
58
Port Mapping
60
Firewall Log
60
Attack Defense
61
Land Attack
62
Smurf Attack
62
Ping of Death Attack
63
Fraggle Attack
63
Configuring Zones
64
Establishing the Configuration Task
64
Creating a Zone
65
Adding an Interface to the Zone
65
Creating an Interzone
66
Enabling Firewall in the Interzone
66
Checking the Configuration
67
Configuring the Packet Filtering Firewall
67
Establishing the Configuration Task
67
Configuring ACL-Based Packet Filtering in an Interzone
68
Checking the Configuration
69
Configuring the Blacklist
69
Establishing the Configuration Task
69
Enabling the Blacklist Function
70
Adding IP Addresses to the Blacklist Manually
70
Configuring Blacklist and Whitelist Using the Configuration File
71
Checking the Configuration
72
Configuring the Whitelist
72
Establishing the Configuration Task
72
Adding Entries to the Whitelist Manually
73
Configuring Blacklist and Whitelist Using the Configuration File
74
Checking the Configuration
75
Configuring ASPF
75
Establishing the Configuration Task
75
Configuring ASPF Detection
76
Checking the Configuration
76
Configuring Port Mapping
77
Establishing the Configuration Task
77
Configuring Port Mapping
78
Checking the Configuration
78
Configuring the Aging Time of the Firewall Session Table
79
Establishing the Configuration Task
79
Checking the Configuration
80
Configuring the Attack Defense Function
81
Establishing the Configuration Task
81
Enabling the Attack Defense Function
81
Setting the Parameters for Flood Attack Defense
84
Configuring Large ICMP Packet Attack Defense
84
Setting Parameters for Scanning Attack Defense
85
Checking the Configuration
86
Configuring Traffic Statistics and Monitoring
86
Establishing the Configuration Task
87
Enabling Traffic Statistics and Monitoring
88
Setting the Session Thresholds
88
Checking the Configuration
90
Configuring the Log Function
90
Establishing the Configuration Task
91
Enabling the Log Function on the Firewall
91
Setting the Log Parameters
92
Checking the Configuration
93
Maintaining the Firewall
93
Displaying the Firewall Configuration
93
Clearing the Firewall Statistics
94
Configuration Examples
95
Example for Configuring the ACL-Based Packet Filtering Firewall
95
Example for Configuring ASPF and Port Mapping
97
Telnet Server
98
Example for Configuring the Blacklist
100
4 Traffic Suppression Configuration
104
Traffic Suppression Overview
105
Traffic Suppression Features Supported by the AR1200-S
105
Configuring Traffic Suppression
105
Establishing the Configuration Task
105
Configuring Traffic Suppression on an Interface
106
Checking the Configuration
107
Configuration Examples
107
Example for Setting the CIR Value for Traffic Suppression
107
Example for Setting the Rate Limit in Pps for Traffic Suppression
109
5 NAC Configuration
111
NAC Overview
112
NAC Features Supported by the AR1200-S
112
Mac Address Authentication
113
Configuring 802.1X Authentication
114
Establishing the Configuration Task
114
Enabling Global 802.1X Authentication
114
Enabling 802.1X Authentication on an Interface
115
Optional) Enabling MAC Address Bypass Authentication
115
Optional) Setting the 802.1X Authentication Mode
116
Optional) Setting the Access Method on an Interface
117
Optional) Configuring the Authorization Status of an Interface
118
Optional) Setting the Maximum Number of Concurrent Access Users on an Interface
119
Optional) Enabling 802.1X Authentication Triggered by DHCP Messages
120
Optional) Setting Values of Timers Used in 802.1X Authentication
120
Optional) Configuring the Quiet Timer Function
121
Optional) Configuring 802.1X Re-Authentication
122
Optional) Configuring a Guest VLAN for 802.1X Authentication
123
Optional) Configuring a Restrict VLAN for 802.1X Authentication
124
Optional) Enabling the Handshake Function
125
Optional) Setting the Maximum Number of Times the AR1200-S Sends Authentication Requests
125
Checking the Configuration
126
Configuring MAC Address Authentication
126
Establishing the Configuration Task
126
Enabling Global MAC Address Authentication
127
Enabling MAC Address Authentication on an Interface
127
Optional) Setting the Format of the User Name
128
Optional) Configuring a Domain for MAC Address Authentication
129
Optional) Setting Values for MAC Address Authentication Timers
129
Optional) Setting the Maximum Number of Users for MAC Address Authentication
130
Optional) Re-Authenticating a User with the Specified MAC Address
131
Checking the Configuration
131
Maintaining NAC
132
Clearing the Statistics on 802.1X Authentication
132
Clearing the Statistics on MAC Address Authentication
132
Configuration Examples
133
Example for Configuring 802.1X Authentication
133
Example for Configuring MAC Address Authentication
136
6 ARP Security Configuration
139
ARP Security Overview
140
ARP Security Supported by the AR1200-S
140
Configuring ARP Entry Limiting
142
Establishing the Configuration Task
142
Enabling Strict ARP Learning
143
Configuring Interface-Based ARP Entry Limiting
143
Checking the Configuration
144
Configuring ARP Anti-Attack
145
Establishing the Configuration Task
145
Configuring ARP Anti-Spoofing
146
Configuring the AR1200-S to Check Source MAC Address Consistency in ARP Packets
146
Configuring ARP Gateway Anti-Collision
147
Configuring the AR1200-S to Send Gratuitous ARP Packets
147
Checking the Configuration
149
Configuring ARP Suppression
150
Configuring Source IP Address-Based ARP Packet Suppression
151
Configuring Rate Limit of ARP Packets
152
Configuring Source IP Address-Based ARP Miss Packet Suppression
153
Configuring Rate Limiting of ARP Miss Packets
154
Setting the Aging Time of Fake ARP Entries
155
Optional) Setting the Rate Limit of Broadcasting ARP Packets on the VLANIF Interface of a Super VLAN
156
Maintaining ARP Security
157
Clearing the Statistics on Discarded ARP Packets
158
Networking Requirements
159
7 ICMP Security Configuration
164
ICMP Security Overview
165
Configuring the AR1200-S to Discard Specified ICMP Packets
167
Configuring the AR1200-S to Discard the ICMP Packets with Options
168
Checking the Configuration
169
Maintaining ICMP Security
170
Configuration Examples
171
Example for Optimizing System Performance by Discarding Certain ICMP Packets
173
8 IP Address Anti-Spoofing Configuration
176
IP Address Anti-Spoofing Overview
177
Configuring URPF
178
Configuration Examples
179
9 Local Attack Defense Configuration
182
Local Attack Defense Overview
183
Configuring Attack Source Tracing
184
Configuring CPU Attack Defense
186
Creating an Attack Defense Policy
187
Optional) Configuring a Blacklist
188
Optional) Setting the Priority of Protocol Packets
189
Optional) Configuring the Rate Limit for Packets after ALP Is Enabled
190
Applying the Attack Defense Policy
191
Maintaining the Attack Defense Policy
192
10 ACL Configuration
198
ACL Overview
199
Function Description
200
Configuring a Basic ACL
202
Optional) Creating a Time Range for a Basic ACL
203
Configuring a Basic ACL Rule
205
Applying a Basic ACL
206
Checking the Configuration
208
Establishing the Configuration Task
209
Optional) Creating a Time Range for an Advanced ACL
210
Creating an Advanced ACL
211
Configuring an Advanced ACL Rule
212
Applying an Advanced ACL
214
Checking the Configuration
215
Configuring a Layer 2 ACL
216
Optional) Creating a Time Range for a Layer 2 ACL
217
Creating a Layer 2 ACL
218
Configuring a Layer 2 ACL Rule
219
Applying a Layer 2 ACL
220
Checking the Configuration
221
Configuration Examples
222
Example for Using Advanced Acls to Configure the Firewall Function
224
Example for Using a Layer 2 ACL to Configure Traffic Classification
228
11 SSL Configuration
231
SSL Overview
232
Security Mechanisms
233
SSL Features Supported by the AR1200-S
234
Configuring a Client SSL Policy
236
Configuration Examples
238
Example for Configuring a Client SSL Policy
241
12 PKI Configuration
247
PKI Overview
248
PKI Features Supported by the AR1200-S
249
Configuring a PKI Entity
251
Configuring a PKI Entity Identifier
252
Checking the Configuration
253
Configuring a PKI Domain
254
Configuring a PKI Entity Name
255
Optional) Configuring CA Certificate Fingerprint
256
Optional) Configuring a Certificate Revocation Password
257
Optional) Configuring a Source IP Address for TCP Connection Setup
258
Configuring Certificate Enrollment
259
Configuring Automatic Certificate Enrollment and Update
260
Creating a Self-Signed Certificate or Local Certificate
261
Configuring the Certificate Check Mode
262
Checking Certificate Validity
263
Checking the Configuration
264
Exporting a Certificate
265
Example for Configuring PKI in Ipsec
268
13 Keychain Configuration
277
Introduction to Keychain
278
Configuring Basic Keychain Functions
279
Creating a Keychain
280
Configuring a Key-ID in a Keychain
281
Configuring Authentication Algorithm of a Key-ID
282
Configuring Send-Time of a Key-ID
283
Configuring Receive-Time of a Key-ID
285
Checking the Configuration
287
Configuring TCP Authentication Parameters
288
Configuring TCP Kind of a Keychain
289
Configuration Examples
291
Configuration File
292
14 Configuration of Attack Defense and Application Layer Association
294
Overview to Attack Defense and Application Layer Association
295
Attack Defense and Application Layer Association Supported by AR1200-S
296
Configuring Abnormal Packet Attack Defense
297
Enabling Defense against Abnormal Packet Attacks
298
Configuring Fragmented Packet Attack Defense
299
Checking the Configuration
300
Establishing the Configuration Task
301
Configuring Defense against UDP Flood Attacks
302
Checking the Configuration
303
Configuring Application Layer Association
304
Maintenance Attack Defense and Application Layer Association
305
4
Based on 1 rating
Ask a question
Give review
Questions and Answers:
Need help?
Do you have a question about the Huawei AR1200-S and is the answer not in the manual?
Ask a question
Huawei AR1200-S Specifications
General
Brand
Huawei
Model
AR1200-S
Category
Network Router
Language
English
Related product manuals
Huawei AR1200 Series
232 pages
Huawei AR120
141 pages
Huawei AR120 Series
12 pages
Huawei Vodafone AR1220
7 pages
Huawei AR150 series
42 pages
Huawei AR100 Series
12 pages
Huawei AR160 Series
12 pages
Huawei AR651W-X4
12 pages
Huawei AR550 Series
505 pages
Huawei AR200 series
42 pages
Huawei AR600 Series
12 pages
Huawei AR550-8FE-D-H
505 pages
To Next PageTo Next PageTo Previous PageTo Previous Page
Loading...
Need help?
General
