Switch modules authenticate users when they are logging in to switch modules in Telnet mode
from an Ethernet port. Only authenticated users can configure and maintain switch modules.
Switch modules use hierarchical protection mode for commands, and define four command
levels in ascending order: visit level, monitoring level, configuration level, and management
level. Users are also classified into four levels accordingly. Users can use only commands at
levels the same as or lower than their own levels, effectively controlling user rights.
Switch modules support mapping between command levels and user levels to implement fine-
grained user level management.
Remote SSH Login
Switch modules support SSH. On networks without security assurance, SSH provides security
guarantees and authentication functions for user logins and defends against multiple attacks.
SNMP Encrypted Authentication
Switch modules support SNMPv3 encrypted authentication. When switch modules are
managed by the network management system (NMS) over SNMP, the encrypted
authentication mode of the User-based Security Model (USM) can be used to guarantee the
security of switch modules.
AAA
Switch modules support Authentication, Authorization and Accounting (AAA). With
hierarchical command protection and AAA, switch modules can authenticate and authorize
login users, and authenticate NMS users. The AAA mechanism enables switch modules to
prevent unauthorized user logins.
CPU Attack Defense
Switch modules can filter protocol packets and management packets that are sent to the CPU
based on the protocol ID, port number, or a combination of the port number and VLAN ID.
This protects CPU channels from denial-of-service (DoS) attacks and prevents congestion.
Service Security
VLAN Assignment
Switch modules support the division of a LAN into multiple VLANs. Devices in different
VLANs cannot communicate with each other directly. This function isolates broadcast
domains and improves information security.
MAC Address Learning Limit on Interfaces
On a specified interface of the switch module, the maximum number of MAC address entries
that this interface can learn can be configured. This prevents hackers from initiating source
MAC address attacks over this interface and protects MAC address entries of the entire switch
module from being used up.
Blackhole MAC Address Entry
Switch modules support blackhole MAC address entries. When receiving a packet, the switch
module compares the source or destination MAC address of this packet with blackhole MAC
address entries. If the source or destination MAC address of this packet is a blackhole MAC
address entry, the switch module discards this packet.
E9000 Server
User Guide
2 Overview
Issue 25 (2019-11-30)
Copyright © Huawei Technologies Co., Ltd.
36
