HP 2520-24 Скачать руководство пользователя страница 73

Страница: 73 / 110

3-5

IPv6 Management Security Features

Authorized IP Managers for IPv6

Conversely, in a mask, a “0” binary bit means that either the “on” or “off” setting
of the corresponding IPv6 bit in an authorized address is valid and does not
have to match the setting of the same bit in the specified IPv6 address.

Figure 3-2 shows the binary expressions represented by individual hexadeci-
mal values in an

ipv6-mask

parameter.

Figure 3-2. Hexadecimal Mask Values and Binary Equivalents

Hexadecimal Value in an IPv6 Mask

Binary Equivalent

0000

0001

0010

0011

0100

0101

0110

0111

1000

1001

1010

1011

1100

1101

1110

1111

Содержание 2520-24

Страница 1: ...HP Switch Software HP 2520 8 PoE Switch HP 2520 24 PoE Switch Software version S 15 09 August 2012 IPv6 Configuration Guide ...

Страница 2: ......

Страница 3: ...HP Networking 2520 Switches IPv6 Configuration Guide August 2012 S 15 09 ...

Страница 4: ...ge without notice HEWLETT PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS MATERIAL INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE Hewlett Packard shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing performance or use of this material The only warra...

Страница 5: ...6 on a VLAN 1 12 Neighbor Discovery ND 1 12 Duplicate Address Detection DAD 1 14 DAD Operation 1 14 Configuring DAD 1 15 View the Current IPv6 Addressing Configuration 1 17 Router Access and Default Router Selection 1 23 Router Advertisements 1 23 Router Solicitations 1 24 Default IPv6 Router 1 24 Router Redirection 1 25 View IPv6 Gateway Route and Router Neighbors 1 25 Viewing Gateway and IPv6 Ro...

Страница 6: ...mmands Supported 2 21 IP Preserve for IPv6 2 24 3 IPv6 Management Security Features Authorized IP Managers for IPv6 3 1 Usage Notes 3 1 Configuring Authorized IP Managers for Switch Access 3 3 Using a Mask to Configure Authorized Management Stations 3 3 Displaying an Authorized IP Managers Configuration 3 10 Additional Examples of Authorized IPv6 Managers Configuration 3 10 Secure Shell SSH for IP...

Страница 7: ...mand 4 11 Configuring Debug Destinations 4 12 Configuring an IPv6 Syslog Server 4 12 For more information see Configuring Debug and Event Log Messaging on page 4 11 4 13 Logging Command 4 13 Displaying a Debug Syslog for Configuration 4 14 A IPv6 Terminology ...

Страница 8: ......

Страница 9: ...switch interfaces and introduces basic operations Management and Configuration Guide Describes how to configure manage and monitor basic switch operation Advanced Traffic Management Guide Explainshowtoconfiguretraffic management features such as VLANs MSTP QoS and Meshing Access Security Guide Explains how to configure access security fea tures and user authentication on the switch IPv6 Configurat...

Страница 10: ...vancedTraffic Management Access Security Guide Basic Operation Guide 802 1Q VLAN Tagging X 802 1p Priority X 802 1X Authentication X AAA Authentication X Authorized IP Managers X Auto MDIX Configuration X BOOTP X Config File X Console Access X Copy Command X Debug X DHCP Configuration X DHCP Bootp Operation X Diagnostic Tools X Downloading Software X Eavesdrop Protection X Event Log X Factory Defa...

Страница 11: ...X MAC Lockdown X MAC Lockout X MAC based Authentication X Monitoring and Analysis X Multicast Filtering X Network Management Applications LLDP SNMP X Passwords X Ping X Port Configuration X Port Security X Port Status X Port Trunking LACP X Port Based Access Control 802 1X X Feature Management and Configuration AdvancedTraffic Management Access Security Guide Basic Operation Guide ...

Страница 12: ...odem X Spanning Tree MSTP X SSH Secure Shell Encryption X SSL Secure Socket Layer X Stack Management Stacking X Syslog System Information X TACACS Authentication X Telnet Access X TFTP X Time Protocols TimeP SNTP X Troubleshooting X VLANs X Web based Authentication X Web UI X Feature Management and Configuration AdvancedTraffic Management Access Security Guide Basic Operation Guide ...

Страница 13: ...P and ND for IPv6 are enabled with default values when IPv6 is first enabled and can either be left in their default settings or reconfigured as needed For more information on ICMP refer to View the Current IPv6 Addressing Configura tion on page 1 17 For more on ND refer to Neighbor Discovery ND on page 1 12 Note The switch is capable of operating in dual stack mode where IPv4 and IPv6 run concurr...

Страница 14: ...ocal address A DHCPv6 server can provide other services such as the addresses of time servers For this reason you may want to enable DHCP even if you are using another method to configure IPv6 addressing on the VLAN 2 If IPv6 DHCP service is not enabled on the VLAN then either Enable IPv6 on the VLAN This automatically configures a link local address with an EUI 64 interface identifier Statically ...

Страница 15: ... tentative until verified as unique by Duplicate Address Detection Refer to Duplicate Address Detec tion DAD on page 1 14 Enabling IPv6 with an Automatically Configured Link Local Address This command enables automatic configuration of a link local address Syntax no ipv6 enable If IPv6 has not already been enabled on a VLAN by another IPv6commandoptiondescribedinthischapter thiscommand enables IPv...

Страница 16: ...nabling autoconfig or rebooting the switch with autoconfig enabled on a VLAN causes the switch to configure IPv6 addressing on the VLAN using router advertisements and an EUI 64 interface identifier page 1 12 A link local address always uses the prefix fe80 0 0 0 With IPv6 enabled the VLAN uses received router advertise ments to designate the default IPv6 router Refer to Default IPv6 Router on pag...

Страница 17: ...ot received on the VLAN after autoconfig is enabled a link local address will be present but no global unicast addresses will be autoconfigured Notes If a link local address is already configured on the VLAN a later autoconfigured global unicast address uses the same device identifier as the link local address Autoconfigured and DHCPv6 assigned global unicast addresses with the same prefix are mut...

Страница 18: ...enabled theVLANusesreceivedrouteradvertisementstodesignate thedefaultIPv6router Referto RouterAccessandDefaultRouterSelection on page 1 23 Enabling DHCPv6 Enabling the DHCPv6 option on a VLAN allows the switch to obtain a global unicast address and an NTP network time protocol server assignment for a Timep server If a DHCPv6 server is not needed to provide a global unicast address to a switch inte...

Страница 19: ...ot been reached If a DHCPv6 server responds with an IPv6 address assign ment this address is assigned to the VLAN The DHCPv6 assigned address will be dropped if it has the same subnet as another address already assigned to the VLAN by an earlier autoconfig command After verification of uniqueness by DAD an IPv6 address assigned to the VLAN by an DHCPv6 server is set to the preferred and valid life...

Страница 20: ...ed global unicast addresses are mutually exclusive on a given VLAN That is configuring DHCPv6 on a VLAN erases any static global unicast addresses previously configured on that VLAN and the reverse A statically configured link local address will not be affected by configuring DHCPv6 on the VLAN For the same subnet on the switch a DHCPv6 global unicast address assignment takes precedence over an au...

Страница 21: ...lowed per VLAN interface device identifier The low order 64 bits in 16 bit blocks comprise this value in a link local address xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx Where a static link local address is already configured a new autoconfigured global unicast addresses assignment uses the same device identifier as the link local address Notes An existing link local address is replaced and is not dep...

Страница 22: ...age 1 12 Refer also to Disabling IPv6 on a VLAN on page 1 12 Syntax no ipv6 address network prefix device id prefix length no ipv6 address network prefix prefix length eui 64 If IPv6 is not already enabled on a VLAN either of these command options do the following enable IPv6 on the VLAN configure a link local address using the EUI 64 format statically configure a global unicast address If IPv6 is...

Страница 23: ...er must be transmitting router advertisements on the VLAN If an autoconfigured global unicast address already exists for the same subnetasanew staticallyconfiguredglobalunicastaddress thestatically configured address is denied In the reverse case you can add an auto config command to the VLAN configuration but it will not be imple mented unless the static address is removed from the configuration ...

Страница 24: ...red on a VLAN IPv6 remains enabled on that VLAN In this case removing the only IPv6 enabling command fromtheconfigurationdisablesIPv6operationontheVLAN Thatis todisable IPv6 on a VLAN all of the following commands must be removed from the VLAN s configuration ipv6 enable ipv6 address dhcp full rapid commit ipv6 address autoconfig ipv6 address fe80 device identifier link local ipv6 address prefix d...

Страница 25: ...icitation message containing a solicited node multicast address that corre sponds to the IPv6 address of the destination device on the VLAN When the destination device receives the neighbor solicitation it responds with a neighbor advertisement message identifying its link layer address When the initiating device receives this advertisement the two devices are ready to exchange traffic on the VLAN...

Страница 26: ...ns DAD for this address by sending a neighbor solicitation to the All Nodes multicast address ff02 1 This operation discovers other devices on the VLAN and verifies whether the proposed unicast address assignment is unique on the VLAN During this time the address being checked for unique ness is held in a tentative state and cannot be used to receive traffic other than neighbor solicitations and n...

Страница 27: ...ling DAD bypasses checks for uniqueness on newly configured addresses If a reboot is performed while DAD is disabled the duplicate address check is not performed on any IPv6 addresses configured on the switch Default 3 enabled Range 0 600 0 disabled The no form of the command restores the default setting 3 Syntax ipv6 nd ns interval milliseconds Used on VLAN interfaces to reconfigure the neighbor ...

Страница 28: ...che of neighboring switches to be updated If a previously configured unicast address is changed a neighbor adver tisement is sent on the VLAN to notify other devices and also for duplicate address detection If DAD is disabled when an address is configured the address is assumed to be unique and is assigned to the interface Syntax ipv6 nd reachable time milliseconds Used on VLAN interfaces to confi...

Страница 29: ... not configured per VLAN ND DAD Indicates whether DAD is enabled the default or disabled Using ipv6 nd dad attempts 0 disables neighbor discovery Refer to Duplicate Address Detection DAD on page 1 14 DAD Attempts Indicates the number of neighbor solicitations the switch transmits per address for duplicate IPv6 address detection Implemented when a new address is configured or when an interface with...

Страница 30: ...Lists each IPv6 address and prefix length configured on the indicated VLAN Address Status Tentative DAD has not yet confirmed the address as unique and is not usable for sending and receiving traffic Preferred The address has been confirmed as unique by DAD and usable for sending and receiving traffic The Expiry time shown for this address by the show ipv6 vlan vid command output is the preferred ...

Страница 31: ...ateway 10 0 9 80 ND DAD Enabled DAD Attempts 3 Vlan Name DEFAULT_VLAN IPv6 Status Disabled Vlan Name VLAN10 IPv6 Status Enabled Address Address Origin IPv6 Address Prefix Length Status autoconfig 2620 0 a03 e102 127 64 preferred dhcp 2620 0 a03 e102 212 79ff fe88 a100 64 preferred manual fe80 127 64 preferred Syntax show ipv6 nd Displays the current IPv6 neighbor discovery settings on the configur...

Страница 32: ...VLAN and the expiration data Expiry for each address IPv6 Routing This setting is always Disabled Refer to Router Access and Default Router Selection on page 1 23 Default Gateway Lists the IPv4 default gateway if any configured on the switch This is a globally configured router gateway address and is not configured per VLAN ND DAD Shows whether Neighbor Discovery ND is enabled The default setting ...

Страница 33: ...ted VLAN indicates whether IPv6 is disabled the default or enabled Refer to Config uring IPv6 Addressing on page 1 3 IPv6 Address Prefix Length Lists each IPv6 address and prefix length configured on the indicated VLAN Expiry Lists the lifetime status of each IPv6 address listed for a VLAN Permanent The address will not time out and need renewal or replacement date time The date and time that the ...

Страница 34: ...erred Syntax show run In addition to the other elements of the current configuration this command lists the statically configured global unicast IPv6 addressing and the current IPv6 configuration per VLAN The listing may include one or more of the following depending on what other IPv6 options are configured on the VLAN Any stateless address autoconfiguration SLAAC commands in the configuration ar...

Страница 35: ...nk local addresses of IPv6 routers on the VLAN For devices other than routers the switch must use neighbor discovery to learn these addresses building a list of default reachable routers along with router lifetime and prefix lifetime data learning the prefixes and the valid and preferred lifetimes to use for stateless autoconfigured global unicast addresses This is required for autoconfiguration o...

Страница 36: ... unless a new IPv6 setting is configured IPv6 on the VLAN is disabled then re enabled or the VLAN itself is disconnected then recon nected Default IPv6 Router If IPv6 is enabled on a VLAN where there is at least one accessible IPv6 router theswitchselectsadefaultIPv6router Referto EnablingAutoconfiguration of a Global Unicast Address and a Default Router Identity on a VLAN on page 1 4 If the switc...

Страница 37: ...perVLAN Thisincludesinformationreceivedinrouter advertisements from IPv6 routers on VLANs enabled with IPv6 on the switch Viewing Gateway and IPv6 Route Information Syntax show ipv6 route ipv6 addr connected This command displays the routes in the switch s IPv6 routing table ipv6 addr Optional Limits the output to show the gateway to the specified IPv6 address connected Optional Limits the output ...

Страница 38: ...nfigured on the Switch Link Local Address Configured on the Switch Link Local Address Assigned to the Loopback Address Syntax show ipv6 routers vlan vid This command lists the switch s IPv6 router table entries for all VLANs configured on the switch or for a single VLAN This output provides information about the IPv6 routers from which routing advertisements RAs have been received on the switch vl...

Страница 39: ...time the address is available including the preferred lifetime and the additional time if any allowed for the address to exist in the deprecated state Refer to Address Lifetimes on page 1 28 Preferred Lifetime The length of time during which the address can be used freely as both a source and a destination address for traffic exchanges with other devices Refer to Address Lifetimes on page 1 28 On ...

Страница 40: ... as a destination for existing communication exchanges but is not used for new exchanges or as a source for traffic sent from the interface A new preferred address and its deprecated counterpart will both appear in the show ipv6 vlan vid output as long as the deprecated address is within its valid lifetime Valid Lifetime This is the total time the address is available and is equal to or greater th...

Страница 41: ... used as a replacement for a deprecated address can be acquired from a manual DHCPv6 or autoconfiguration source Address Source Lifetime Criteria Link Local Permanent Statically Configured Unicast Permanent Autoconfigured Global Finite Preferred and Valid Lifetimes DHCPv6 Configured Finite Preferred and Valid Lifetimes ...

Страница 42: ...1 30 IPv6 Addressing Configuration Address Lifetimes ...

Страница 43: ...or solicita tion has been received at the source verifying that traffic has been received at the destination The switch maintains an IPv6 neighbor cache that is populated as a result of communication with other devices on the same VLAN You can view and clear the contents of the neighbor cache using the commands described in this section Viewing the Neighbor Cache Neighbor discovery occurs when the...

Страница 44: ... only when VLAN is specified and indicates the length of time the entry has remained unused Port Identifies the switch port on which the entry was learned If this field is empty for a given address then the address is configured on the switch itself State A neighbor destination is reachable from a given source address if confirmation has been received at the source veri fying that traffic has been...

Страница 45: ...d In such cases the fastest way to restore optimum traffic movement on a VLAN may be to statically clear the neighbor table instead of waiting for the unwanted entries to time out HP Switch config show ipv6 neighbor IPv6 ND Cache Entries IPv6 Address MAC Address State Type Port 2001 db8 260 212 101 0013c4 dd14b0 STALE dynamic 1 2001 db8 260 214 1 15 001279 88a100 REACH local fe80 1 1 001279 88a100...

Страница 46: ...rom the neighbor cache Local IPv6 addresses that is IPv6 addresses configured on the VLAN interface for the switch on which the command is executed are not removed Removed addresses are listed in the command output HP Switch config clear ipv6 neighbors HP Switch config show ipv6 neighbors HP Switch show ipv6 neighbors IPv6 ND Cache Entries IPv6 Address MAC Address State Type Port fe80 213 c4ff fed...

Страница 47: ...same VLAN requires the link local address and and interface scope link local addr Specifies the link local IPv6 address of the destination device vlan vid Suffix specifying the interface on which the destination device is located No spaces are allowed in the suffix TelnetforGlobalUnicastAddressesrequiresaglobalunicast address for the destination Also the switch must be receiving router advertiseme...

Страница 48: ... switch for both IPv4 and IPv6 Command output includes the following Session The session number The switch allows one outbound session and up to five inbound sessions Privilege Manager or Operator From Console for outbound sessions or the source IP address of the inbound session To The destination of the outbound session if in use HP Switch show telnet Telnet Activity Session 1 Privilege Manager F...

Страница 49: ...or this param eter are oobm inbound Telnet access is enabled only on the out of band management port data inbound Telnet access is enabled only on the data ports both inbound Telnet access is enabled on both the out of band management port and on the data ports This is the default value Refer to Appendix I Network Out of Band Management in the Management and Configuration Guide for more informa ti...

Страница 50: ...peration Commands Affecting SNTP Function show sntp Display the current SNTP configuration timesync sntp timep Enable either SNTP or Timep as the time synchronization method on the switch without affecting the configuration of either no timesync Enable time synchronization Requires a timesync method to also be enabled The no version disable time synchronization without affecting the configuration ...

Страница 51: ...ority of the server ad dressing being configured When the SNTP mode is set to uni cast and more than one server is configured this value determines the order in which the configured servers will be accessed for a time value The switch polls multiple servers in order until a response is received or all servers on the list have been tried without success Up to three server addresses IPv6 and or IPv4...

Страница 52: ... by vlan followed immediately without spaces by the VLAN identifier Syntax show sntp Displays the current SNTP configuration including the following Time Sync Mode Indicates whether timesync is disabled or set to either SNTP or Timep Default timep SNTP Mode Indicates whether SNTP uses the broadcast or unicast method of contacting a time server The broadcast option does not require you to configure...

Страница 53: ...Switch config show sntp SNTP Configuration Time Sync Mode Sntp SNTP Mode Broadcast Poll Interval sec 720 719 Priority SNTP Server Address Protocol Version 1 2001 db8 215 60ff fe79 8980 7 2 10 255 5 24 3 This example illustrates the command output when both IPv6 and IPv4 server addresses are configured Commands Affecting Timep Function show timep Display the current timep configuration timesync snt...

Страница 54: ...his command at the global config level as shown below Switch config ip timep manual fe80 215 60ff fe7a adc0 vlan10 Syntax ip timep dhcp interval 1 9999 ip timep manual ipv6 addr ipv4 addr interval 1 9999 oobm Used at the global config level to configure a Timep server ad dress Note The switch allows one Timep server configuration timep dhcp Configures the switch to obtain the address of a Timep se...

Страница 55: ... management command can also be used to display Timep server information Syntax show timep Displays the current Timep configuration including the following Time Sync Mode Indicates whether timesync is disabled or set to either SNTP or Timep Default Disabled Timep Mode Indicates whether Timep is configured to use a DHCP server to acquire a Timep server address or to use a statically configured Time...

Страница 56: ...igure TFTP file transfers between the switch and a TFTP server or other host device on the network refer to the File Transfers appendix in the Management and Configuration Guide for your switch To upload and or download files to the switch using TFTP in an IPv6 network you must 1 Enable TFTP for IPv6 on the switch see Enabling TFTP for IPv6 on page 2 15 2 Enter a TFTP copy command with the IPv6 ad...

Страница 57: ...nd the Menu interface Download OS screen become unavailable The no tftp client server command does not affect auto TFTP operation For more information see Using Auto TFTP for IPv6 on page 2 19 Syntax no tftp client server listen oobm data both Enables TFTP for IPv4 and IPv6 client or server functionality so that the switch can Use TFTP client functionality to access IPv4 or IPv6 based TFTP servers...

Страница 58: ...or example fe80 123 vlan10 If this is a global unicast address use this IPv6 format ipv6 addr For example 2001 db8 123 target is one of the following values autorun cert file Copies an autorun trusted certificate to the switch autorun key file Copies an autorun key file to the switch command file Copies a file stored on a remote host and executes the ACL command script on the switch Depending on t...

Страница 59: ...tware image enter the reload or boot system flash command pub key file Copies a public key file to the switch startup config Copies a configuration file on a remote host to the startup configuration file on the switch oobm For switches that have a separate out of band manage ment port specifies that the transfer will be through the out of band management interface Default is transfer through the d...

Страница 60: ...cause of a system crash You can copy crash information from an individual slot or from the master crash file on the switch crash log slot id master Copies the contents of the crash log to the specified file path on a remote host The crash log contains processor specific operational data that is used to determine the cause of a system crash You can copy the contents of the crash log from an individ...

Страница 61: ...lash boot image set to primary flash the default enter the boot or the reload command or cycle the power to the switch To reset the boot image to primary flash use boot set default flash primary ipv6 addr If this is a link local address use this IPv6 address format fe80 device id vlan vid For example fe80 123 vlan10 If this is a global unicast address use this IPv6 format ipv6 addr For example 200...

Страница 62: ..._14_01 swi must be different from the version number currently in the primary flash image The current TFTP client status enabled or disabled does not affect auto TFTP operation Refer to Enabling TFTP for IPv6 on page 2 15 Completion of the auto TFTP process may require several minutes while the switch executes the TFTP transfer to primary flash and then reboots again The no form of the command dis...

Страница 63: ...ttings SNMP notifications including SNMP version 1 or SNMP version 2c traps SNMPv2c informs SNMPv3 notification process including traps Advanced RMON Remote Monitoring management E PCM or E PCM management applications Flow sampling using sFlow Standard MIBs such as the Bridge MIB RFC 1493 and the Ethernet MAU MIB RFC 1515 SNMP Configuration Commands Supported IPv6 addressing is supported in the fo...

Страница 64: ...re 2 9 Executed at the global config level to configure an SNMP trap receiver to receive SNMPv1 and SNMPv2c traps SNMPv2c informs and optionally event log messages snmp server listen oobm data both For switches with a separate out of band management port specifies whether the switch listens for SNMP traps on the out of band management interface the data interface or both Syntax snmpv3 targetaddres...

Страница 65: ...rver SNMP Communities Community Name MIB View Write Access public Manager Unrestricted marker Manager Unrestricted Trap Receivers Link Change Traps Enabled on Ports All All Traps Category Current Status SNMP Authentication Extended Password change Enabled Login failures Enabled Port Security Enabled Authorization Server Contact Enabled Address Community Events Type Retry Timeout 15 29 17 218 publi...

Страница 66: ...at you do not invoke IP Preserve by entering a command from the CLI Figure 2 10 Example of How to Enter IP Preserve in a Configuration File HP Switch config show snmpv3 targetaddress snmpTargetAddrTable rfc2573 Target Name IP Address Parameter 1 10 29 17 218 1 2 10 29 17 219 2 PP 217 10 29 17 217 marker_p PP 218 2620 0 260 211 217 a4ff feff 1f70 marker_p An IPv6 address is displayed on two lines J...

Страница 67: ...IP Preserve is suspended The IPv6 addressing specified in the downloaded configuration file is implemented when the switch copies the file and reboots If the downloaded file specifies DHCP Bootp as the source for the IPv6 address of VLAN 1 the switch uses the IPv6 address assigned by the DHCP Bootp server If the file specifies a dedicated IPv6 address and subnet mask for VLAN 1 and a Gateway IPv6 ...

Страница 68: ...lt gateway 2001 db8 0 7 5 snmp server community public Unrestricted vlan 1 name DEFAULT_VLAN untagged 1 10 13 24 1 24 ip address 2001 db8 214 c2ff fe4c e480 exit spanning tree Trk1 priority 4 password manager Because the switch s IPv6 address and default gateway were statically configured not assigned by a DHCP server when the switch boots up with the IP Preserve startup configurationfile seeFigur...

Страница 69: ...Telnet and other terminal emulation applications Web browser interface SNMP with a correct community name As with the configuration of IPv4 management stations the Authorized IP Managers for IPv6 feature allows you to specify the IPv6 based stations that can access the switch Usage Notes Up to ten authorized IPv4 and IPv6 manager addresses can be configured on a switch where each address applies t...

Страница 70: ...Pv1 or SNMPv2c session Access privilege for SSH SNMPv3 and web browser sessions areconfiguredthroughtheaccessapplication notthroughtheAuthorized IP Managers feature Manager privilege allows full access to all web browser and console interface screens for viewing configuration and all other operations available in these interfaces Operator privilege allows read only access from the web browser and ...

Страница 71: ...in a different manner Configuring Single Station Access To authorize only one IPv6 based station for access to the switch enter the IPv6 address of the station and set the mask to FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF Syntax no ipv6authorized managers ipv6 addr ipv6 mask access operator manager Configures one or more authorized IPv6 addresses to access the switch where ipv6 mask specifies the ma...

Страница 72: ... FFFF FFFF FFFF FFFF FFFF FFFF FFFF only a station having an IPv6 address of FE80 202 B3FF FE1E 8329 has management access to the switch Figure 3 1 Mask for Configuring a Single Authorized IPv6 Manager Station Configuring Multiple Station Access To authorize multiple stations to access the switch without having to re enter the ipv6 authorized managers command for each station carefully select the ...

Страница 73: ...s not have to match the setting of the same bit in the specified IPv6 address Figure 3 2 shows the binary expressions represented by individual hexadeci mal values in an ipv6 mask parameter Figure 3 2 Hexadecimal Mask Values and Binary Equivalents Hexadecimal Value in an IPv6 Mask Binary Equivalent 0 0000 1 0001 2 0010 3 0011 4 0100 5 0101 6 0110 7 0111 8 1000 9 1001 A 1010 B 1011 C 1100 D 1101 E ...

Страница 74: ...first corresponding 126 bits in an authorized IPv6 address to be the same as in the specified IPv6 address 2001 DB8 0000 0000 244 17FF FEB6 D37C However the last two bits are set 1st Block 2nd Block 3rd Block 4th Block 5th Block 6th Block 7th Block 8th Block Manager or Operator Level Access IPv6 Mask FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFC The F value in the first 124 bits of the mask specifies th...

Страница 75: ... equivalent of FFF8 that is used to specify valid subnet IDs in the IPv6 addresses of authorized stations is 1111 1111 1111 1000 The three off bits 1000 in the last part of the this block FFF8 of the mask allow for eight possible authorized IPv6 stations 2001 DB8 0000 0000 244 17FF FEB6 D37D 2001 DB8 0000 0001 244 17FF FEB6 D37D 2001 DB8 0000 0002 244 17FF FEB6 D37D 2001 DB8 0000 0003 244 17FF FEB...

Страница 76: ...ock 5th Block 6th Block 7th Block 8th Block Manager or Operator Level Access IPv6 Mask FFFF FFFF FFFF FFF8 FFFF FFFF FFFF FFFF Inthisexample theIPv6maskallowsup to four stations in different subnets to access the switch This authorized IP manager configuration is useful if only management stations are specified by the authorized IPv6 addresses Refer to Figure 3 4 for how the bitmap of the IPv6 mas...

Страница 77: ...he fourth block of the IPv6 address Conversely bits 0 2 are variable and in an authorized IPv6 address may be either on 1 or off 0 As a result assuming that the seventh and eighth bytes fourth hexadecimal block of an IPv6 address are used as the subnet ID only the following binary expressionsandhexadecimalsubnetIDsaresupportedinthisauthorizedIPv6 manager configuration Figure 3 8 Binary Equivalents...

Страница 78: ...ddress with the ipv6 authorized managers command you must also enter a VLAN ID in the format vlan vlan id HP Switch show ipv6 authorized managers IPv6 Authorized Managers Address 2001 db8 0 7 5 Mask ffff ffff ffff ffff ffff ffff ffff ffff Access Manager Address 2001 db8 a 1c e3 3 Mask ffff ffff ffff ffff ffff ffff ffff fffe Access Manager Address 2001 db8 214 c2ff fe4c e480 Mask ffff ffff ffff fff...

Страница 79: ...y two stations in the subnets defined by 0x0006 and 0x0007 in the fourth block of an authorized IPv6 address Switch config ipv6 authorized managers 2001 db8 0000 0007 231 17ff fec5 c967 ffff ffff ffff fffe ffff ffff ffff ffe0 access operator The following ipv6authorized managerscommand authorizes a single automat ically generated EUI 64 IPv6 address with manager level access privilege Switch confi...

Страница 80: ...F FFFF FFFF FFFF FFFF and manager the default values Note that it is not necessary to enter either of these parameters Switch config ipv6 authorized managers 2001 db8 a05b 17ff fec5 3f61 Deleting an Authorized IP Manager Entry Enter only the IPv6 address of the configured authorized IP manager station that you want to delete with the no form of the command for example Switch config no ipv6 authori...

Страница 81: ...he switch or on a RADIUS or TACACS server Secure Copy SCP and Secure FTP SFTP client applications You can use either one SCP session or one SFTP session at a given time to perform secure file transfers to and from the switch Configuring SSH for IPv6 By default SSH is automatically enabled for IPv4 and IPv6 connections on a switch You can use the ip ssh command options to reconfigure the default SS...

Страница 82: ...bles SSH on the switch to connect to an SCP or SFTP client application to transfer files to and from the switch over IPv4 or IPv6 Default Disabled Note Enabling filetransfer automatically disables TFTP client and TFTP server functionality For more information refer to Secure Copy and Secure FTP for IPv6 on page 3 17 mac MAC type Allows configuration of the set of MACs that can be selected Valid ty...

Страница 83: ...RSA or DSA public key The text string for the public key must be a single quoted token If the keystring contains double quotes it can be quoted with single quotes keystring The following restrictions for a keystring apply A keystring cannot contain both single and double quotes A keystring cannot have extra characters such as a blank space or a new line To improve readabil ity you can add a backla...

Страница 84: ...tch The listen parameter is available only on switches that have a separate out of band management port Values for this parameter are oobm inbound SSH access is enabled only on the out of band management port data inbound SSH access is enabled only on the data ports both inbound SSH access is enabled on both the out of band management port and on the data ports This is the default value Refer to A...

Страница 85: ...ssion allowing you to use a secure SSH tunnel to Transfer files and update Switch software images Distributenewsoftwareimageswithautomatedscriptsthatmakeiteasier to upgrade multiple switches simultaneously and securely HP Switch show ip ssh SSH Enabled Yes Secure Copy Enabled No TCP Port Number 22 Timeout sec 120 Host Key Type RSA Host Key Size 2048 Ciphers aes128 cbc 3des cbc aes192 cbc aes256 cb...

Страница 86: ...ransfer com mands and software utilities to use Notes Enabling SSH file transfer disables TFTP and Auto TFTP operation The switch supports one SFTP session or one SCP session at a time All files on the switch have read write permission However several SFTP commands such as create or remove are not supported and return an error message For more information on how to configure SCP or SFTP in an SSH ...

Страница 87: ...te Limiting ICMP rate limiting controls the rate at which ICMPv6 generates error and informational messages for features such as neighbor solicitations neighbor advertisements path MTU discovery PMTU duplicate address discovery DAD neighbor unreachability detection NUD router discovery neighbor discovery NDP ICMPv6 error message generation is enabled by default The rate of message generation can b...

Страница 88: ... 10 tokens are allowed in the token bucket If the token bucket is full a new token cannot be added until an existing token is used to enable sending an ICMP message You can increase or decrease both the frequency with which used tokens can be replaced and optionally the number of tokens allowed to exist error interval Specifies the time interval in milliseconds between successive token adds Increa...

Страница 89: ... device by sending IP packets ICMP Echo Requests To use a ping6 command with an IPv6 host name or fully qualified domain names refer to DNS Resolver for IPv6 on page 4 8 Youcanissuesingleormultiplepingtestswithvaryingrepetitionsandtimeout periods to wait for a ping reply Replies to each ping test are displayed on the console screen To stop a ping test before it finishes press Ctrl C For more infor...

Страница 90: ...v6 DNS server switch number Number of an IPv6 based switch that is a member of a switch stack IPv6 subnet Valid values 1 16 oobm For switches that have a separate out of band management OOBM port oobm specifies that the traffic originates from the out of band management port repetitions 1 10000 Number of times that IPv6 ping packets are sent to the destination IPv6 host Default 1 timeout 1 60 Numb...

Страница 91: ...peration before it finishes press Ctrl C For more information about how to configure and use a traceroute operation refer to the Troubleshooting appendix in the Management and Configura tion Guide HP Switch ping6 fe80 2 1 vlan10 fe80 0000 0000 0000 0000 0000 0002 0001 is alive time 975 ms Switch ping6 2001 db8 a 1c e3 3 repetitions 3 2001 0db8 0000 0000 000a 001c 00e3 0003 is alive iteration 1 tim...

Страница 92: ...local address where vlan vlan id specifies the VLAN ID number hostname Host name of an IPv6 host device configured on an IPv6 DNS server oobm For switches that have a separate out of band management OOBM port oobm specifies that the traffic originates from the out of band management port minttl Minimum number of hops allowed for each probe packet sent along the route Default 1 Range 1 255 If the m...

Страница 93: ...t 3 Range 1 5 source ipv6 addr vid The source IPv6 address or VLAN of the traceroute device or the VLAN ID on which the traceroute packet is being sent dstport 1 34000 Destination port srcport 1 34000 Source port HP Switch traceroute6 2001 db8 10 traceroute to 2001 db8 10 1 hop min 30 hops max 5 sec timeout 3 probes 1 2001 db8 a 1c e3 3 0 ms 0 ms 0 ms 2 2001 db8 0 7 5 7 ms 3 ms 0 ms 3 2001 db8 214...

Страница 94: ...ing in the current Management and Configuration Guide for your switch Syntax no ip dns server address priority 1 3 ip addr oobm Used at the global config level to configure the address and priority of a DNS server Allows for configuring up to three servers providing DNS service The servers must all be acces sible to the switch The command allows both IPv4 and IPv6 servers in any combination and an...

Страница 95: ... at the global config level to configure the domain suffix that is automatically appended to the host name entered with a command supporting DNS operation Configuring the domain suffix is optional if you plan to use fully qualified domain names in all cases instead of just entering host names You can configure up to three addresses for DNS servers in the same or different domains However you can c...

Страница 96: ...r to DNS Resolver in appendix C Troubleshooting in the current Management and Configuration Guide for your switch Viewing the Current Configuration Use the show ip dns command to view the current DNS server configuration Use the show run command to view both the current DNS server addresses and the current DNS domain name in the active configuration Operating Notes In software release S 15 XX DNS ...

Страница 97: ...overy events LLDP events Use the logging severity severity level system module system module command to select a subset of Event Log messages to send to an external device for debugging purposes according to Severity level System module Debug Command Syntax no debug ipv6 debug type Configures the types of IPv6 messages that are sent to Syslog servers or other configured debug destinations where de...

Страница 98: ... buffer in switch memory Use the logging syslog ipv6 addr command to configure the Syslog server at the specified IPv6 destination address Configuring an IPv6 Syslog Server Syslog for IPv6 is a client server logging tool that allows a client switch to send event notification messages to n IPv6 networked device operating with Syslog server software Messages sent to a Syslog server can be stored to ...

Страница 99: ... message types are configured they are also sent to the Syslog server no logging removes all currently configured Syslog logging destinations from the running configuration no logging syslog ipv4 address removes only the specified Syslog logging destination from the running configuration Note The no logging command does not delete the Syslog server addresses stored in the startup configuration To ...

Страница 100: ...ystem Module and Severity Levels on an IPv6 Syslog Server HP Switch config show debug Debug Logging Destination None Enabled debug types None are enabled HP Switch config logging fe80 215 60ff fe7a adc0 HP Switch config write memory HP Switch config show debug Debug Logging Destination Logging fe80 215 60ff fe7a adc0 Facility user Severity debug System module all pass Enabled debug types event Dis...

Страница 101: ...ess by using the CLI to manually enter a static address Referred to as Static Address Configuration in this guide See Static Address Configuration below MTU Maximum Transmission Unit The largest frame size allowed on a given path or device RA Router Advertisement Refer to Router Access and Default Router Selection on page 1 23 SLAAC Stateless Address Autoconfiguration Static Address A permanently ...

Страница 102: ...A 2 IPv6 Terminology ...

Страница 103: ...t of static address 1 11 autoconfigured unicast address DHCPv6 precedence 1 8 autorun TFTP download of key file 2 16 TFTP download of trusted certificate 2 16 auto TFTP disabled 2 19 downloading software images 2 19 for IPv6 2 19 B binary expressions of IPv6 address 3 5 3 9 C clear neighbor cache 2 1 2 3 command file TFTP download and running command script 2 16 command output TFTP upload on remot...

Страница 104: ...ng debug configuration 4 14 DNS configuration 4 8 domain name 4 9 view configuration 4 10 documentation feature matrix 6 latest versions 5 release notes 5 E EUI in IPv6 address autoconfiguration 1 5 1 11 used in IPv6 address autoconfiguration 1 3 event log compared to debug Syslog operation 4 10 debugging by severity level 4 11 debugging by system module 4 11 Event Log Message Reference Guide 5 TF...

Страница 105: ...tion 1 22 global unicast address autoconfiguration 1 5 global unicast address manual configuration 1 10 IP Preserve 2 24 link local address autoconfiguration 1 3 link local address manual configuration 1 9 link local suffix 2 5 2 9 2 12 neighbor cache clear 2 3 neighbor cache view 2 2 neighbor discovery 1 12 2 1 routing between different VLANs 1 23 selecting default router on a VLAN 1 24 SNMP supp...

Страница 106: ...eroute 4 6 with ping 4 4 outbound Telnet6 2 4 P ping6 4 3 preferred address 1 18 preferred lifetime 1 18 of global unicast address 1 5 1 7 1 9 use of IPv6 address as source or destination 1 28 priority public key file TFTP download 2 17 R router advertisements used in IPv6 1 23 routing DHCPv6 server asigned address 1 7 displaying IPv6 routing table 1 25 1 26 IPv6 global unicast address autoconfigu...

Страница 107: ...ery 1 13 SSH filetransfer 2 20 overview 3 12 SSHv2 restriction 3 16 version 1 3 16 startup config TFTP download 2 17 TFTP upload on remote device 2 18 static address configuration 1 9 effect of autoconfig 1 11 suffix link local address 2 5 2 9 2 12 Syslog compared to event log 4 10 configuring IPv6 server address 4 12 configuring IPv6 Syslog servers 4 12 displaying Syslog configuration 4 14 event ...

Страница 108: ...ported in IPv6 2 21 troubleshooting configuring Syslog servers 4 12 using CLI session 4 12 using Syslog servers 4 10 V valid lifetime of global unicast address 1 5 1 7 use of deprecated IPv6 address as source or destination 1 28 VLAN DHCPv6 server assigned address 1 7 displaying IPv6 configuration 1 20 1 22 displaying IPv6 routing table 1 26 global unicast address autoconfiguration 1 5 global unic...

Страница 109: ......

Страница 110: ...s subject to change without notice The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services Nothing herein should be construed as constituting an additional warranty HP will not be liable for technical or editorial errors or omissions contained herein August 2012 Manual Part Number 5998 3621 ...

Результаты поиска

Содержание 2520-24

Отзывы:

Похожие инструкции для 2520-24

Бренды по названию

Популярные бренды

HP 2520-24, Руководство по настройке

Результаты поиска

Содержание 2520-24

Отзывы:

Похожие инструкции для 2520-24

Бренды по названию

Популярные бренды