GE T1000, Техническое руководство

Страница: 50 / 302

Chapter 4
– Functions
GE Reason Switches
50 REASON SWITCHES-TM-EN-3
3 Security
Security is an important matter that must be understood when designing a network.
Security is a common topic in power systems installations, and as Ethernet
technology is being widely used in automation systems, the importance of network
security has increased over the years. Equipment involved with automation tasks are
designed to be aware of network security.
When it comes to switches, management security and access to LAN security must
be evaluated. This section describes basic security configurations, related to
management access control and interfaces protocol available.
Managed switches allow to create and choose privilege levels for selected users,
define if authentication will be done remotely or locally at the switch, define an IP
range and VLAN allowed to access switch interfaces and to define protocols allowed
to access.
Reason Switches allow to create users and define privilege levels to them. Up to 15
privilege levels are allowed and to select which functions performed by the switch
will be at determined levels. By default configuration, three privilege levels are set:

Level 5: ready-only user (guest);

Level 10: read and write user (standard user);

Level 15: read, write and software management user (administrator).
The authentication method used to access the switch can be performed locally or
remotely, and the choice depends on network requirements. The equipment allows to
select an authentication type for each of the access protocols. Thus, it is possible to
select a different authentication method for console interface, telnet, SSH and HTTP
protocols.
If there is no remote authentication server available, the local authentication must be
used. This means that user database (username, password and privilege levels) will
be stored at the switch's internal memory, and can be accessed and managed when
setting the switch. In this case, the administrator must have access to the interfaces
available, e. g., Ethernet connection or USB interface connection.
When using remote authentication method, it is allowed to use RADIUS or
servers and the choice remains based on network requirements. Both methods
would need centralized equipment (the server) to store and manage the users, and
both methods will require setting the hostname and password (key) to connect the
accounts server.
The telnet protocol is supported by Reason Switches, and is enabled by default. SSH
protocol is also supported, and this protocol is disabled by default. If the Secure-Shell
protocol is required as means to access the equipment, it must be enabled at
equipment configurations.