MES1000, MES2000 Ethernet Switches
39
4.3.3
Security system configuration
This section describes configuration of the dynamic IP address assigning and configuration of the
secure device management based on the AAA mechanism (Authentication, Authorization, Accounting).
Authentication
—matching of the existing account in the security system.
Authorization (access level verification
)—matching of the existing account in the system
(passed authentication) and specific privileges.
Accounting
—user resource consumption monitoring.
4.3.3.1
Obtaining IP Address from DHCP Server
If you have a DHCP server in your network, you can obtain the IP address via DHCP protocol. The
device acts as DHCP client. You can obtain IP address from DHCP server using any interface—VLAN,
physical port, port group.
DHCP client is enabled on VLAN 1 interface by default.
IP address obtained via DHCP will not be saved into the device configuration.
Configuration example for obtaining dynamic IP address from DHCP server on VLAN 1 interface:
console>
enable
console#
configure
console(config)#
interface vlan
1
console(config-if)#
ip address dhcp
console(config-if)#
exit
console#
To ensure the correct IP address assigning for the interface, use the
show ip interface
command:
console#
show ip interface vlan 1
IP Address Type Directed Precedence Status
Broadcast
------------------- ----------- ---------- ---------- -----------
192.168.25.67/24 DHCP disable No Valid
4.3.3.2
Management Security and Password Configuration
To ensure the system security, the switch uses AAA mechanism (Authentication, Authorization,
Accounting), which manages user access rights, privilege levels and control methods. AAA mechanism is
able to use both local and remote user databases.
To ensure the management security, it is possible to encrypt the management data using SSH
protocol.
Device comes with pre-configured access password. Assigning access passwords is the responsibility
of the system administrator.
If you have lost access to the device, you can initiate the password recovery procedure. This
procedure allows to access the device management features once without the password from the local
terminal (console port). Password recovery may be initiated via the console port only.
You can set up device access passwords for the following access interfaces:
