HPE FlexFabric 5940 SERIES Скачать руководство пользователя страница 1

Страница: 1 / 571

HPE FlexFabric 5940 Switch Series

Security Configuration Guide

Part number: 5200-1030a
Software version: Release 2508 and later verison
Document version: 6W101-20161101

Содержание FlexFabric 5940 SERIES

Страница 1: ...HPE FlexFabric 5940 Switch Series Security Configuration Guide Part number 5200 1030a Software version Release 2508 and later verison Document version 6W101 20161101 ...

Страница 2: ...nd 12 212 Commercial Computer Software Computer Software Documentation and Technical Data for Commercial Items are licensed to the U S Government under vendor s standard commercial license Links to third party websites take you outside the Hewlett Packard Enterprise website Hewlett Packard Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise ...

Страница 3: ...DIUS attribute translation feature 54 Setting the maximum number of concurrent login users 56 Configuring a NAS ID profile 56 Configuring the device ID 57 Displaying and maintaining AAA 57 AAA configuration examples 57 AAA for SSH users by an HWTACACS server 57 Local authentication HWTACACS authorization and RADIUS accounting for SSH users 59 Authentication and authorization for SSH users by a RAD...

Страница 4: ...X reauthentication 93 Overview 93 Configuration restrictions and guidelines 94 Configuring 802 1X periodic reauthentication 94 Configuring 802 1X manual reauthentication 94 Enabling the keep online feature 95 Configuring an 802 1X guest VLAN 95 Configuration guidelines 95 Configuration prerequisites 96 Configuration procedure 96 Enabling 802 1X guest VLAN assignment delay 96 Configuring an 802 1X ...

Страница 5: ...C authentication guest VLAN 124 Configuring a MAC authentication critical VLAN 125 Enabling the MAC authentication critical voice VLAN 125 Configuration prerequisites 125 Configuration procedure 126 Configuring periodic MAC reauthentication 126 Overview 126 Configuration restrictions and guidelines 126 Configuration procedure 127 Enabling MAC authentication offline detection 127 Displaying and mai...

Страница 6: ...sed quick portal authentication 165 Configuring a MAC binding server 165 Specifying a MAC binding server on an interface 166 Enabling logging for user logins and logouts 167 Displaying and maintaining portal 167 Portal configuration examples 168 Configuring direct portal authentication 168 Configuring re DHCP portal authentication 176 Configuring cross subnet portal authentication 179 Configuring ...

Страница 7: ...xample 234 Network requirements 234 Configuration procedure 234 Verifying the configuration 237 Configuring password control 239 Overview 239 Password setting 239 Password updating and expiration 240 User login control 241 Password not displayed in any form 242 Logging 242 FIPS compliance 242 Password control configuration task list 242 Enabling password control 243 Setting global password control...

Страница 8: ...erifying certificates with CRL checking 274 Verifying certificates without CRL checking 275 Specifying the storage path for the certificates and CRLs 275 Exporting certificates 276 Removing a certificate 276 Configuring a certificate based access control policy 277 Displaying and maintaining PKI 278 PKI configuration examples 278 Requesting a certificate from an RSA Keon CA server 278 Requesting a...

Страница 9: ...dards 328 FIPS compliance 328 IKE configuration prerequisites 328 IKE configuration task list 328 Configuring an IKE profile 329 Configuring an IKE proposal 331 Configuring an IKE keychain 332 Configuring the global identity information 333 Configuring the IKE keepalive feature 333 Configuring the IKE NAT keepalive feature 334 Configuring IKE DPD 334 Enabling invalid SPI recovery 335 Setting the m...

Страница 10: ...tablishing a connection to an Stelnet server 368 Establishing a connection to an Stelnet server based on Suite B 370 Configuring the device as an SFTP client 371 SFTP client configuration task list 371 Generating local key pairs 371 Specifying the source IP address for SFTP packets 372 Establishing a connection to an SFTP server 372 Establishing a connection to an SFTP server based on Suite B 374 ...

Страница 11: ...ation task list 428 Configuring an attack defense policy 429 Creating an attack defense policy 429 Configuring a single packet attack defense policy 429 Configuring a scanning attack defense policy 430 Configuring a flood attack defense policy 431 Configuring attack detection exemption 435 Applying an attack defense policy to the device 435 Enabling log non aggregation for single packet attack eve...

Страница 12: ...3 Configuring ARP attack detection 464 Configuring user validity check 465 Configuring ARP packet validity check 466 Configuring ARP restricted forwarding 466 Enabling ARP attack detection logging 467 Displaying and maintaining ARP attack detection 467 User validity check configuration example 467 User validity check and ARP packet validity check configuration example 469 ARP restricted forwarding...

Страница 13: ... Configuring FIPS mode 493 Entering FIPS mode 493 Configuration changes in FIPS mode 494 Exiting FIPS mode 495 FIPS self tests 495 Power up self tests 496 Conditional self tests 496 Triggering self tests 497 Displaying and maintaining FIPS 497 FIPS configuration examples 497 Entering FIPS mode through automatic reboot 497 Entering FIPS mode through manual reboot 498 Exiting FIPS mode through autom...

Страница 14: ...gure 1 AAA network diagram To access networks or resources beyond the NAS a user sends its identity information to the NAS The NAS transparently passes the user information to AAA servers and waits for the authentication authorization and accounting result Based on the result the NAS determines whether to permit or deny the access request AAA has various implementations including RADIUS HWTACACS a...

Страница 15: ...ients 2 Performs user authentication authorization or accounting 3 Returns user access control information for example rejecting or accepting the user access request to the clients The RADIUS server can also act as the client of another RADIUS server to provide authentication proxy services The RADIUS server maintains the following databases Users Stores user information such as the usernames pass...

Страница 16: ...ct packet 4 The RADIUS client permits or denies the user according to the authentication result If the result permits the user the RADIUS client sends a start accounting request Accounting Request packet to the RADIUS server 5 The RADIUS server returns an acknowledgment Accounting Response packet and starts accounting 6 The user accesses the network resources 7 The host requests the RADIUS client ...

Страница 17: ...e From the server to the client The server sends a packet of this type to notify the client that it has received the Accounting Request and has successfully recorded the accounting information The Identifier field 1 byte long is used to match response packets with request packets and to detect duplicate request packets The request and response packets of the same exchange process for the same purp...

Страница 18: ...ramed MTU 56 59 unassigned 13 Framed Compression 60 CHAP Challenge 14 Login IP Host 61 NAS Port Type 15 Login Service 62 Port Limit 16 Login TCP Port 63 Login LAT Port 17 unassigned 64 Tunnel Type 18 Reply Message 65 Tunnel Medium Type 19 Callback Number 66 Tunnel Client Endpoint 20 Callback ID 67 Tunnel Server Endpoint 21 unassigned 68 Acct Tunnel Connection 22 Framed Route 69 Tunnel Password 23 ...

Страница 19: ...nctions As shown in Figure 5 a subattribute encapsulated in attribute 26 consists of the following parts Vendor ID ID of the vendor The most significant byte is 0 The other three bytes contains a code compliant to RFC 1700 Vendor Type Type of the subattribute Vendor Length Length of the subattribute Vendor Data Contents of the subattribute The device supports RADIUS subattributes with a vendor ID ...

Страница 20: ...ncrypts only the user password field in an authentication packet Protocol packets are complicated and authorization is independent of authentication Authentication and authorization can be deployed on different HWTACACS servers Protocol packets are simple and the authorization process is combined with the authentication process Supports authorization of configuration commands Access to commands de...

Страница 21: ...esponse to request the login password 8 Upon receipt of the response the HWTACACS client prompts the user for the login password 9 The user enters the password Host HWTACACS client HWTACACS server 1 The user tries to log in 2 Start authentication packet 3 Authentication response requesting the username 4 Request for username 5 The user enters the username 6 Continue authentication packet with the ...

Страница 22: ...not often change The protocol is used to store user information For example LDAP server software Active Directory Server is used in Microsoft Windows operating systems The software stores the user information and user group information for user login authentication and authorization LDAP directory service LDAP uses directories to maintain the organization information personnel information and reso...

Страница 23: ...e basic LDAP authentication process 1 A Telnet user initiates a connection request and sends the username and password to the LDAP client 2 After receiving the request the LDAP client establishes a TCP connection with the LDAP server 3 To obtain the right to search the LDAP client uses the administrator DN and password to send an administrator bind request to the LDAP server 4 The LDAP server proc...

Страница 24: ...e 8 Basic LDAP authorization process for a Telnet user The following shows the basic LDAP authorization process 1 A Telnet user initiates a connection request and sends the username and password to the device The device will act as the LDAP client during authorization 2 After receiving the request the device exchanges authentication packets with the authentication server for the user If LDAP authe...

Страница 25: ...or a user by username AAA manages users in the same ISP domain based on the users access types The device supports the following user access types LAN LAN users must pass 802 1X or MAC authentication to come online Login Login users include SSH Telnet FTP and terminal users who log in to the device Terminal users can access through a console port Portal Portal users must pass portal authentication...

Страница 26: ...uthorization can work only after RADIUS authentication is successful and the authorization information is included in the Access Accept packet HWTACACS authorization is separate from HWTACACS authentication and the authorization information is included in the authorization response after successful authentication You can configure backup methods to be used when the remote server is not available T...

Страница 27: ...e For more information about portal authentication see Configuring portal authentication Protocols and standards RFC 2865 Remote Authentication Dial In User Service RADIUS RFC 2866 RADIUS Accounting RFC 2867 RADIUS Accounting Modifications for Tunnel Protocol Support RFC 2868 RADIUS Attributes for Tunnel Protocol Support RFC 2869 RADIUS Extensions RFC 5176 Dynamic Authorization Extensions to Remot...

Страница 28: ...d by the server to communicate information for example the reason of the authentication failure 26 Vendor Specific Vendor specific proprietary attribute A packet can contain one or more proprietary attributes each of which can contain one or more subattributes 27 Session Timeout Maximum service duration for the user before termination of the session 28 Idle Timeout Maximum idle time permitted for ...

Страница 29: ...ibute 87 NAS Port Id String for describing the port of the NAS that is authenticating the user Proprietary RADIUS subattributes vendor ID 25506 Table 4 lists all RADIUS subattributes with a vendor ID of 25506 Support for these subattributes depends on the device model Table 4 RADIUS subattributes vendor ID 25506 No Subattribute Description 1 Input Peak Rate Peak rate in the direction from the user...

Страница 30: ...ter an 802 1X user passes authentication which is a 32 byte string This attribute is stored in the user list on the NAS and verifies the handshake packets from the 802 1X user This attribute only exists in Access Accept and Accounting Request packets 98 Multicast_Receive_Group IP address of the multicast group that the user s host joins as a receiver This subattribute can appear multiple times in ...

Страница 31: ... to shut down a port in the format of subscriber command disable host port 215 Accounting Level ITA traffic level in the range of 1 to 8 216 Ita Policy ITA policy name 230 Nas Port Interface through which the user is connected to the NAS 246 Auth_Detail_Result Accounting details The server sends Access Accept packets with subattribute 250 and this subattribute in the following situations 1 The sub...

Страница 32: ...ticated Remote authentication Configure the required RADIUS HWTACACS and LDAP schemes 2 Configure AAA methods for the users ISP domains Remote AAA methods need to use the configured RADIUS HWTACACS and LDAP schemes Figure 11 AAA configuration procedure To configure AAA perform the following tasks Tasks at a glance Required Perform a minimum one of the following tasks to configure local users or AA...

Страница 33: ...user database on the device A local user is uniquely identified by the combination of a username and a user type Local users are classified into the following types Device management user User who logs in to the device for device management Network access user User who accesses network resources through the device The following shows the configurable local user attributes Description Descriptive i...

Страница 34: ...e a password control attribute in system view user group view or local user view A password control attribute with a smaller effective range has a higher priority For more information about password management and global password configuration see Configuring password control Validity period Time period in which a network access user is considered valid for authentication Local user configuration ...

Страница 35: ...ed state state active block By default a local user is in active state and can request network services 7 Optional Set the upper limit of concurrent logins using the local user name access limit max user number By default the number of concurrent logins is not limited for the local user This command takes effect only when local accounting is configured for the local user It does not apply to FTP S...

Страница 36: ...configure validity periods only for network access users Configuring user group attributes User groups simplify local user configuration and management A user group contains a group of local users and has a set of local user attributes You can configure local user attributes for a user group to implement centralized user attributes management for the local users in the group Local user attributes ...

Страница 37: ... at fixed time periods of 10 minutes and automatically delete expired local users To configure the auto delete feature of local users Step Command Remarks 1 Enter system view system view N A 2 Enable the local user auto delete feature local user auto delete enable By default the feature is disabled Displaying and maintaining local users and local user groups Execute display commands in any view Ta...

Страница 38: ...nal Enabling SNMP notifications for RADIUS Configuring a test profile for RADIUS server status detection Use a test profile to detect whether a RADIUS authentication server is reachable at a detection interval To detect the RADIUS server status you must configure the RADIUS server to use this test profile in a RADIUS scheme With the test profile specified the device sends a detection packet to the...

Страница 39: ...quired specify only the primary server A RADIUS authentication server can function as the primary authentication server for one scheme and a secondary authentication server for another scheme at the same time When RADIUS server load sharing is enabled the device distributes the workload over all servers without considering the primary and secondary server roles The device checks the weight value a...

Страница 40: ...r connection teardown commands from an administrator However the device might fail to receive a response for a stop accounting request in a single transmission Enable the device to buffer RADIUS stop accounting requests that have not received responses from the accounting server The device will resend the requests until responses are received To limit the transmission times set a maximum number of...

Страница 41: ...N A 2 Enter RADIUS scheme view radius scheme radius scheme name N A 3 Specify a shared key for secure RADIUS communication key accounting authentication cipher simple string By default no shared key is specified for secure RADIUS communication The shared key configured on the device must be the same as the shared key configured on the RADIUS server Specifying an MPLS L3VPN instance for the scheme ...

Страница 42: ...ission mechanism to improve reliability A RADIUS request is retransmitted if the NAS does not receive a server response for the request within the response timeout timer For more information about the RADIUS server response timeout timer see Setting RADIUS timers You can set the maximum number for the NAS to retransmit a RADIUS request to the same server When the maximum number is reached the NAS ...

Страница 43: ...s disabled for the server regardless of whether a test profile has been specified for the server When the RADIUS server is set to active state server detection is enabled for the server on which an existing test profile is specified By default the device sets the status of all RADIUS servers to active However in some situations you must change the status of a server For example if a server fails y...

Страница 44: ...ing once the device sends a start accounting request to a server for a user it forwards all subsequent accounting requests of the user to the same server If the accounting server is unreachable the device returns an accounting failure message rather than searching for another active accounting server To enable the RADIUS server load sharing feature Step Command Remarks 1 Enter system view system v...

Страница 45: ...y IP address of the outbound interface is used Setting RADIUS timers The device uses the following types of timers to control communication with a RADIUS server Server response timeout timer response timeout Defines the RADIUS request retransmission interval The timer starts immediately after a RADIUS request is sent If the device does not receive a response from the RADIUS server before the timer...

Страница 46: ...device automatically sends an accounting on packet to the RADIUS server after the entire device reboots Upon receiving the accounting on packet the RADIUS server logs out all online users so they can log in again through the device Without this feature users cannot log in again after the reboot because the RADIUS server considers them to come online You can configure the interval for which the dev...

Страница 47: ...ue 0 for SSH FTP and terminal services An Access Accept packet received for a user must contain the matching attribute value Otherwise the user cannot log in to the device Use the loose check method only when the server does not issue Login Service attribute values 50 51 and 52 for SSH FTP and terminal users To configure the Login Service attribute check method for SSH FTP and terminal users Step ...

Страница 48: ...MP agent supports the following notifications generated by RADIUS RADIUS server unreachable notification The RADIUS server cannot be reached RADIUS generates this notification if it does not receive a response to an accounting or authentication request within the specified number of RADIUS request transmission attempts RADIUS server reachable notification The RADIUS server can be reached RADIUS ge...

Страница 49: ... HWTACACS accounting servers Required Specifying the shared keys for secure HWTACACS communication Optional Specifying an MPLS L3VPN instance for the scheme Optional Setting the username format and traffic statistics units Optional Specifying the source IP address for outgoing HWTACACS packets Optional Setting HWTACACS timers Creating an HWTACACS scheme Create an HWTACACS scheme before performing ...

Страница 50: ...ecify one primary authorization server and a maximum of 16 secondary authorization servers for an HWTACACS scheme When the primary server is not available the device searches for the secondary servers in the order they are configured The first secondary server in active state is used for communication If redundancy is not required specify only the primary server An HWTACACS server can function as ...

Страница 51: ...ber of attempts that can be made for transmitting individual HWTACACS stop accounting requests When the maximum attempts are made for a request the device discards the buffered request HWTACACS does not support accounting for FTP SFTP and SCP users To specify HWTACACS accounting servers for an HWTACACS scheme Step Command Remarks 1 Enter system view system view N A 2 Enter HWTACACS scheme view hwt...

Страница 52: ... instance specified for an HWTACACS scheme applies to all servers in that scheme If a VPN instance is also configured for an individual HWTACACS server the VPN instance specified for the HWTACACS scheme does not take effect on that server To specify a VPN instance for an HWTACACS scheme Step Command Remarks 1 Enter system view system view N A 2 Enter HWTACACS scheme view hwtacacs scheme hwtacacs s...

Страница 53: ...ACS packets is typically the IP address of an egress interface on the NAS However in some situations you must change the source IP address For example when VRRP is configured for stateful failover configure the virtual IP of the uplink VRRP group as the source address You can specify the source IP address for outgoing HWTACACS packets in HWTACACS scheme view or in system view The IP address specif...

Страница 54: ...of HWTACACS servers If the scheme includes one primary HWTACACS server and multiple secondary HWTACACS servers the device communicates with the HWTACACS servers based on the following rules When the primary server is in active state the device communicates with the primary server If the primary server fails the device performs the following operations Changes the server status to blocked Starts a ...

Страница 55: ...utes Displaying and maintaining HWTACACS Execute display commands in any view and reset commands in user view Task Command Display the configuration or server statistics of HWTACACS schemes display hwtacacs scheme hwtacacs scheme name statistics Display information about buffered HWTACACS stop accounting requests to which no responses have been received display stop accounting buffer hwtacacs sche...

Страница 56: ... address or an IPv6 address for an LDAP server The most recent configuration takes effect Specifying the LDAP version Specify the LDAP version on the NAS The device supports LDAPv2 and LDAPv3 The LDAP version specified on the device must be consistent with the version specified on the LDAP server To specify the LDAP version Step Command Remarks 1 Enter system view system view N A 2 Enter LDAP serv...

Страница 57: ...user attributes To authenticate a user an LDAP client must complete the following operations 1 Establish a connection to the LDAP server 2 Obtain the user DN from the LDAP server 3 Use the user DN and the user s password to bind with the LDAP server LDAP provides a DN search mechanism for obtaining the user DN According to the mechanism an LDAP client sends search requests to the server based on t...

Страница 58: ...ttributes obtained from an LDAP authorization server to device recognizable AAA attributes based on the mapping entries Because the device ignores unrecognized LDAP attributes configure the mapping entries to include important LDAP attributes that should not be ignored An LDAP attribute can be mapped only to one AAA attribute Different LDAP attributes can be mapped to the same AAA attribute To con...

Страница 59: ...map in an LDAP scheme To specify an LDAP attribute map for LDAP authorization Step Command Remarks 1 Enter system view system view N A 2 Enter LDAP scheme view ldap scheme ldap scheme name N A 3 Specify an LDAP attribute map attribute map map name By default no LDAP attribute map is specified Displaying and maintaining LDAP Execute display commands in any view Task Command Display the configuratio...

Страница 60: ... order 1 The authentication domain specified for the access module 2 The ISP domain in the username 3 The default ISP domain of the device If the chosen domain does not exist on the device the device searches for the ISP domain that accommodates users who are assigned to nonexistent domains If no such ISP domain is configured user authentication fails NOTE Support for the authentication domain con...

Страница 61: ... domain whose total traffic in the idle timeout period at the specified direction is less than the specified minimum traffic IPv4 address pool The device assigns IPv4 addresses from the pool to authenticated users in the domain Default authorization user profile When a user passes authentication it typically obtains an authorization user profile from the local or remote server If the user does not...

Страница 62: ...period or portal user online detection period Configuring authentication methods for an ISP domain Configuration prerequisites Before configuring authentication methods complete the following tasks 1 Determine the access type or service type to be configured With AAA you can configure an authentication method for each access type and service type 2 Determine whether to configure the default authen...

Страница 63: ... ldap scheme ldap scheme name local none local none none radius scheme radius scheme name local none By default the default authentication method is used for portal users The none keyword is not supported in FIPS mode 7 Specify the authentication method for obtaining a temporary user role authentication super hwtacacs scheme hwtacacs scheme name radius scheme radius scheme name By default the defa...

Страница 64: ...r login users authorization login hwtacacs scheme hwtacacs scheme name radius scheme radius scheme name local none local none none radius scheme radius scheme name hwtacacs scheme hwtacacs scheme name local none By default the default authorization method is used for login users The none keyword is not supported in FIPS mode 7 Specify the authorization method for portal users authorization portal ...

Страница 65: ...ecify the accounting method for login users accounting login hwtacacs scheme hwtacacs scheme name radius scheme radius scheme name local none local none none radius scheme radius scheme name hwtacacs scheme hwtacacs scheme name local none By default the default accounting method is used for login users The none keyword is not supported in FIPS mode 7 Specify the accounting method for portal users ...

Страница 66: ...n control client configuration takes effect only when the session control feature is enabled To configure the RADIUS session control feature Step Command Remarks 1 Enter system view system view N A 2 Enable the RADIUS session control feature radius session control enable By default the RADIUS session control feature is disabled 3 Specify a RADIUS session control client radius session control clien...

Страница 67: ...oS field determines the transmission priority of RADIUS packets A larger value represents a higher priority To change the DSCP priority for RADIUS packets Step Command Remarks 1 Enter system view system view N A 2 Change the DSCP priority for RADIUS packets radius ipv6 dscp dscp value By default the DSCP priority is 0 for RADIUS packets Configuring the RADIUS attribute translation feature The RADI...

Страница 68: ...d sent By default no RADIUS attribute conversion rules exist Repeat this command to add multiple RADIUS attribute conversion rules 6 Configure a RADIUS attribute rejection rule attribute reject attr name access accept access request accounting received sent By default no RADIUS attribute rejection rules exist Repeat this command to add multiple RADIUS attribute rejection rules To configure the RAD...

Страница 69: ...ts device name in the NAS Identifier attribute of all RADIUS requests A NAS ID profile enables you to send different NAS Identifier attribute strings in RADIUS requests from different VLANs The strings can be organization names service names or any user categorization criteria depending on the administrative requirements For example map the NAS ID companyA to all VLANs of company A The device will...

Страница 70: ... configuration of ISP domains display domain isp name AAA configuration examples AAA for SSH users by an HWTACACS server Network requirements As shown in Figure 12 configure the switch to meet the following requirements Use the HWTACACS server for SSH user authentication authorization and accounting Assign the default user role network operator to SSH users after they pass authentication Exclude d...

Страница 71: ...ain Switch hwtacacs hwtac quit Create an ISP domain named bbb and configure the domain to use the HWTACACS scheme for authentication authorization and accounting of login users Switch isp bbb authentication login hwtacacs scheme hwtac Switch isp bbb authorization login hwtacacs scheme hwtac Switch isp bbb accounting login hwtacacs scheme hwtac Switch isp bbb quit Create local RSA and DSA key pairs...

Страница 72: ...and RADIUS server Figure 13 Network diagram Configuration procedure 1 Configure the HWTACACS server Details not shown 2 Configure the RADIUS server Details not shown 3 Configure the switch Configure IP addresses for interfaces Details not shown Create local RSA and DSA key pairs Switch system view Switch public key local create rsa Switch public key local create dsa Enable the SSH service Switch s...

Страница 73: ... Switch isp bbb quit Enable the default user role feature to assign authenticated SSH users the default user role network operator Switch role default role enable Verifying the configuration Initiate an SSH connection to the switch and enter the username hello bbb and the correct password The user logs in to the switch Details not shown Verify that the user can use the commands permitted by the ne...

Страница 74: ... b Set the ports for authentication and accounting to 1812 and 1813 respectively c Select the service type Device Management Service d Select the access device type HP e Select the access device from the device list or manually add the access device with the IP address 10 1 1 2 f Leave the default settings for other parameters and click OK The IP address of the access device specified here must be...

Страница 75: ...User from the navigation tree Then click Add to configure a device management account as follows a Enter the account name hello bbb and specify the password b Select the service type SSH c Specify 10 1 1 0 to 10 1 1 255 as the IP address range of the hosts to be managed d Click OK NOTE The IP address range must contain the IP address of the switch ...

Страница 76: ...3 authentication mode scheme Switch line vty0 63 quit Enable the default user role feature to assign authenticated SSH users the default user role network operator Switch role default role enable Create a RADIUS scheme Switch radius scheme rad Specify the primary authentication server Switch radius rad primary authentication 10 1 1 1 1812 Set the shared key to expert in plaintext form for secure c...

Страница 77: ...7 an LDAP server is located at 10 1 1 1 24 and uses the domain name ldap com Configure the switch to meet the following requirements Use the LDAP server to authenticate SSH users Assign the default user role network operator to SSH users after they pass authentication On the LDAP server set the administrator password to admin 123456 add a user named aaa and set the user s password to ldap 123456 F...

Страница 78: ...xt Figure 18 Adding user aaa f In the dialog box enter the password ldap 123456 select options as needed and click Next Figure 19 Setting the user s password a Click OK Add user aaa to group Users a From the navigation tree click Users under the ldap com node b In the right pane right click the user aaa and select Properties ...

Страница 79: ...he Enter the object names to select field and click OK User aaa is added to group Users Figure 21 Adding user aaa to group Users Set the administrator password to admin 123456 a In the right pane right click the user Administrator and select Set Password b In the dialog box enter the administrator password Details not shown 2 Configure the switch ...

Страница 80: ...rs dc ldap dc com Specify the administrator password Switch ldap server ldap1 login password simple admin 123456 Configure the base DN for user search Switch ldap server ldap1 search base dn dc ldap dc com Switch ldap server ldap1 quit Create an LDAP scheme Switch ldap scheme ldap shm1 Specify the LDAP authentication server Switch ldap ldap shm1 authentication server ldap1 Switch ldap ldap shm1 qu...

Страница 81: ...S The user is configured on the RADIUS server The correct password is entered The same shared key is configured on both the RADIUS server and the NAS 2 If the problem persists contact Hewlett Packard Enterprise Support RADIUS packet delivery failure Symptom RADIUS packets cannot reach the RADIUS server Analysis Possible reasons include A communication failure exists between the NAS and the RADIUS ...

Страница 82: ...roblem 1 Verify the following items The accounting port number is correctly configured The accounting server IP address is correctly configured on the NAS 2 If the problem persists contact Hewlett Packard Enterprise Support Troubleshooting HWTACACS Similar to RADIUS troubleshooting See Troubleshooting RADIUS Troubleshooting LDAP LDAP authentication failure Symptom User authentication fails Analysi...

Страница 83: ...or the user authentication is correctly configured on the NAS The user is configured on the LDAP server The correct password is entered The administrator DN and the administrator password are correctly configured The user attributes for example the username attribute configured on the NAS are consistent with those configured on the LDAP server The user search base DN for authentication is specifie...

Страница 84: ...n the server returns the authentication results to the access device to make access decisions The authentication server is typically a RADIUS server In a small LAN you can use the access device as the authentication server Figure 22 802 1X architecture Controlled uncontrolled port and port authorization status 802 1X defines two logical ports for the network access port controlled port and uncontr...

Страница 85: ... over a LAN Between the access device and the authentication server 802 1X delivers authentication information by using one of the following methods Encapsulates EAP packets in RADIUS by using EAP over RADIUS EAPOR as described in EAP relay Extracts authentication information from the EAP packets and encapsulates the information in standard RADIUS packets as described in EAP termination Packet for...

Страница 86: ...tart The client sends an EAPOL Start message to initiate 802 1X authentication to the access device 0x02 EAPOL Logoff The client sends an EAPOL Logoff message to tell the access device that the client is logging off Length Data length in bytes or length of the Packet body If packet type is EAPOL Start or EAPOL Logoff this field is set to 0 and no Packet body field follows Packet body Content of th...

Страница 87: ...t and the authentication server does not support the multicast address you must use an 802 1X client that can send broadcast EAPOL Start packets For example you can use the HPE iNode 802 1X client Access device as the initiator The access device initiates authentication if a client cannot send EAPOL Start packets One example is the 802 1X client available with Windows XP The access device supports...

Страница 88: ... performs the following operations in EAP termination mode a Terminates the EAP packets received from the client b Encapsulates the client authentication information in standard RADIUS packets c Uses PAP or CHAP to authenticate to the RADIUS server Figure 29 EAP termination Comparing EAP relay and EAP termination Packet exchange method Benefits Limitations EAP relay Supports various EAP authentica...

Страница 89: ... the username in an EAP Response Identity packet to the access device 4 The access device relays the EAP Response Identity packet in a RADIUS Access Request packet to the authentication server 5 The authentication server uses the identity information in the RADIUS Access Request to search its user database If a matching entry is found the server uses a randomly generated EAPOL EAPOR 1 EAPOL Start ...

Страница 90: ... an EAP Success packet to the client b Sets the controlled port in authorized state The client can access the network 11 After the client comes online the access device periodically sends handshake requests to check whether the client is still online By default if two consecutive handshake attempts fail the device logs off the client 12 Upon receiving a handshake request the client returns a respo...

Страница 91: ...EAP termination mode the access device rather than the authentication server generates an MD5 challenge for password encryption The access device then sends the MD5 challenge together with the username and encrypted password in a standard RADIUS packet to the RADIUS server ...

Страница 92: ... an 802 1X user to authorized network resources Supported VLAN types and forms Which VLAN types and forms are supported depends on the authorization type Local VLAN authorization The authorization VLAN of an 802 1X user is specified in user view or user group view in the form of VLAN ID on the device The port through which the user accesses the device is assigned to the VLAN as an untagged member ...

Страница 93: ...does not have other online users the device selects the VLAN with the lowest ID from the group of VLANs If the port has other online users the device selects the VLAN by using the following process a The device selects the VLAN that has the fewest number of online users b If two VLANs have the same number of online 802 1X users the device selects the VLAN with the lower ID The device follows the r...

Страница 94: ... its own authorization VLAN IMPORTANT An 802 1X enabled access port can be assigned to an authorization VLAN only as an untagged member As a best practice always assign a hybrid port to a VLAN as an untagged member After the assignment do not reconfigure the port as a tagged member in the VLAN On a port with periodic online user reauthentication enabled the MAC based VLAN feature does not take eff...

Страница 95: ...cation The device creates a mapping between the MAC address of the user and the 802 1X guest VLAN The user can access only resources in the guest VLAN A user in the 802 1X guest VLAN fails 802 1X authentication If an 802 1X Auth Fail VLAN is available the device remaps the MAC address of the user to the Auth Fail VLAN The user can access only resources in the Auth Fail VLAN If no 802 1X Auth Fail ...

Страница 96: ...e device maps the MAC address of the user to the 802 1X Auth Fail VLAN The user can access only resources in the Auth Fail VLAN A user in the 802 1X Auth Fail VLAN fails 802 1X authentication because of any other reason except for unreachable servers The user is still in the Auth Fail VLAN A user in the 802 1X Auth Fail VLAN passes 802 1X authentication The device remaps the MAC address of the use...

Страница 97: ... the authentication server either the local access device or a RADIUS server does not authorize a VLAN the initial PVID of the port applies The user and all subsequent 802 1X users are assigned to this port VLAN After the user logs off the PVID remains unchanged A user in the 802 1X guest VLAN fails authentication because all the RADIUS servers are unreachable The device assigns the 802 1X critica...

Страница 98: ...device performs the following operations If MAC based access control is used the device removes 802 1X users from the critical VLAN The port sends a unicast EAP Request Identity to these users to trigger authentication If port based access control is used the device removes the port from the critical VLAN The port sends a multicast EAP Request Identity to all 802 1X users on the port to trigger au...

Страница 99: ...he following methods Modify the user profile configuration on the access device Specify another user profile for the user on the authentication server For more information about user profiles see Configuring user profiles EAD assistant Endpoint Admission Defense EAD is an integrated endpoint access control solution of Hewlett Packard Enterprise to improve the threat defensive capability of a netwo...

Страница 100: ...h the EAD assistant feature Configuration prerequisites Before you configure 802 1X complete the following tasks Configure an ISP domain and AAA scheme local or RADIUS authentication for 802 1X users If RADIUS authentication is used create user accounts on the RADIUS server If local authentication is used create local user accounts on the access device and set the service type to lan access 802 1X...

Страница 101: ... a port dot1x By default 802 1X is disabled on a port Enabling EAP relay or EAP termination When configuring EAP relay or EAP termination consider the following factors Support of the RADIUS server for EAP packets Authentication methods supported by the 802 1X client and the RADIUS server You can use both EAP termination and EAP relay in any of the following situations The client is using only MD5...

Страница 102: ...orce Places the port in the authorized state enabling users on the port to access the network without authentication unauthorized force Places the port in the unauthorized state denying any access requests from users on the port auto Places the port initially in unauthorized state to allow only EAPOL packets to pass After a user passes authentication sets the port in the authorized state to allow ...

Страница 103: ...eives no response To set the maximum number of authentication request attempts Step Command Remarks 1 Enter system view system view N A 2 Set the maximum number of attempts for sending an authentication request dot1x retry retries The default setting is 2 Setting the 802 1X authentication timeout timers The network device uses the following 802 1X authentication timeout timers Client timeout timer...

Страница 104: ...tion in the handshake packets from clients This feature can prevent 802 1X users that use illegal client software from bypassing iNode security check such as dual network interface cards NICs detection If a user fails the handshake security checking the device sets the user to the offline state Configuration guidelines When you configure online user handshake follow these restrictions and guidelin...

Страница 105: ...e clients attached to the port cannot send EAPOL Start packets to initiate 802 1X authentication Enable the unicast trigger on a port if only a few 802 1X clients are attached to the port and these clients cannot initiate authentication To avoid duplicate authentication packets do not enable both triggers on a port Configuration procedure To configure the authentication trigger feature on a port S...

Страница 106: ...quick authentication response set the quiet timer to a low value To set the quiet timer Step Command Remarks 1 Enter system view system view N A 2 Enable the quiet timer dot1x quiet period By default the timer is disabled 3 Optional Set the quiet timer dot1x timer quiet period quiet period value The default is 60 seconds Configuring 802 1X reauthentication Overview 802 1X reauthentication tracks t...

Страница 107: ...by using the dot1x timer reauth period command A change to the periodic reauthentication timer applies to online users only after the old timer expires The device selects a periodic reauthentication timer for 802 1X reauthentication in the following order a Server assigned reauthentication timer b Port specific reauthentication timer c Global reauthentication timer d Default reauthentication timer...

Страница 108: ...network you can use the keep online feature to prevent 802 1X users from coming online and going offline frequently Configuring an 802 1X guest VLAN Configuration guidelines When you configure an 802 1X guest VLAN follow these guidelines You can configure only one 802 1X guest VLAN on a port The 802 1X guest VLANs on different ports can be different Assign different IDs to the voice VLAN the port ...

Страница 109: ... view N A 2 Enter Ethernet interface view interface interface type interface number N A 3 Configure the 802 1X guest VLAN on the port dot1x guest vlan guest vlan id By default no 802 1X guest VLAN exists Enabling 802 1X guest VLAN assignment delay This feature delays assigning an 802 1X enabled port to the 802 1X guest VLAN when 802 1X authentication is triggered on the port This feature applies o...

Страница 110: ...ionship description Reference Super VLAN You cannot specify a VLAN as both a super VLAN and an 802 1X Auth Fail VLAN See Layer 2 LAN Switching Configuration Guide MAC authentication guest VLAN on a port that performs MAC based access control The 802 1X Auth Fail VLAN has a high priority See Configuring MAC authentication Port intrusion protection actions on a port that performs MAC based access co...

Страница 111: ...mes online and it can respond to the EAP Request Identity packet from the device for reauthentication Configuration guidelines When you configure an 802 1X critical VLAN follow these restrictions and guidelines Assign different IDs to the voice VLAN the PVID and the 802 1X critical VLAN on a port The assignment makes sure the port can correctly process VLAN tagged incoming traffic You can configur...

Страница 112: ...obally and on the port The device uses LLDP to identify voice users For information about LLDP see Layer 2 LAN Switching Configuration Guide Enable voice VLAN on the port For information about voice VLANs see Layer 2 LAN Switching Configuration Guide Configuration procedure To enable the 802 1X critical voice VLAN feature on a port Step Command Remarks 1 Enter system view system view N A 2 Enter E...

Страница 113: ...to the access device The device uses information such as user MAC addresses and IP addresses obtained through 802 1X to generate IPSG bindings to filter out IPv4 packets from unauthenticated 802 1X users For information about IP source guard see Configuring IP source guard This feature prevents any authenticated 802 1X users on a port from changing their IP addresses After you enable this feature ...

Страница 114: ...n a port Step Command Remarks 1 Enter system view system view N A 2 Enter Layer 2 Ethernet interface view interface interface type interface number N A 3 Set the maximum number of 802 1X authentication attempts for MAC authenticated users on the port dot1x after mac auth max attempt max attempts By default the number of 802 1X authentication attempts for MAC authenticated users is not limited on a...

Страница 115: ... number user mac mac address user name name string Clear 802 1X statistics reset dot1x statistics interface interface type interface number Remove users from the 802 1X guest VLAN on a port reset dot1x guest vlan interface interface type interface number mac address mac address 802 1X authentication configuration examples Basic 802 1X authentication configuration example Network requirements As sh...

Страница 116: ...ss Set the service type to lan access Device luser network localuser service type lan access Device luser network localuser quit 5 Configure a RADIUS scheme Create a RADIUS scheme named radius1 and enter RADIUS scheme view Device radius scheme radius1 Specify the IP addresses of the primary authentication and accounting RADIUS servers Device radius radius1 primary authentication 10 1 1 1 Device ra...

Страница 117: ...hod macbased Specify ISP domain bbb as the mandatory domain Device Ten GigabitEthernet1 0 1 dot1x mandatory domain bbb Device Ten GigabitEthernet1 0 1 quit Enable 802 1X globally Device dot1x Verifying the configuration Verify the 802 1X configuration on Ten GigabitEthernet 1 0 1 Device display dot1x interface ten gigabitethernet 1 0 1 Display the user connection information after an 802 1X user p...

Страница 118: ...3 Create VLANs and assign ports to the VLANs on the access device Device system view Device vlan 1 Device vlan1 port ten gigabitethernet 1 0 2 Device vlan1 quit Device vlan 10 Device vlan10 port ten gigabitethernet 1 0 1 Device vlan10 quit Device vlan 2 Device vlan2 port ten gigabitethernet 1 0 4 Device vlan2 quit Device vlan 5 Device vlan5 port ten gigabitethernet 1 0 3 Device vlan5 quit 4 Config...

Страница 119: ...cheme 2000 Device isp bbb accounting lan access radius scheme 2000 Device isp bbb quit 6 Configure 802 1X on the access device Enable 802 1X on Ten GigabitEthernet 1 0 2 Device interface ten gigabitethernet 1 0 2 Device Ten GigabitEthernet1 0 2 dot1x Implement port based access control on the port Device Ten GigabitEthernet1 0 2 dot1x port method portbased Set the port authorization mode to auto B...

Страница 120: ...is example for the users Details not shown 3 Assign an IP address to each interface as shown in Figure 34 Details not shown 4 Configure a RADIUS scheme Create RADIUS scheme 2000 and enter RADIUS scheme view Device system view Device radius scheme 2000 Specify the server at 10 1 1 1 as the primary authentication server and set the authentication port to 1812 Device radius 2000 primary authenticatio...

Страница 121: ...ice acl ipv4 adv 3000 rule 0 deny ip destination 10 0 0 1 0 time range ftp Device acl ipv4 adv 3000 quit 8 Configure 802 1X Enable 802 1X on Ten GigabitEthernet 1 0 1 Device interface ten gigabitethernet 1 0 1 Device Ten GigabitEthernet1 0 1 dot1x Device Ten GigabitEthernet1 0 1 quit Enable 802 1X globally Device dot1x Verifying the configuration Use the user account to pass authentication Details...

Страница 122: ...eb server for 802 1X client downloading Allow authenticated 802 1X users to access the network Figure 35 Network diagram Configuration procedure 1 Make sure the DHCP server the Web server and the authentication servers have been configured correctly Details not shown 2 Configure an IP address for each interface Details not shown 3 Configure DHCP relay Enable DHCP Device system view Device dhcp ena...

Страница 123: ... domain bbb Apply RADIUS scheme 2000 to the ISP domain for authentication authorization and accounting Device isp bbb authentication lan access radius scheme 2000 Device isp bbb authorization lan access radius scheme 2000 Device isp bbb accounting lan access radius scheme 2000 Device isp bbb quit 6 Configure 802 1X Configure the free IP Device dot1x ead assistant free ip 192 168 2 0 24 Configure t...

Страница 124: ... 36 The intranet 192 168 1 0 24 is attached to Ten GigabitEthernet 1 0 1 of the access device The hosts use DHCP to obtain IP addresses A Web server is deployed on the 192 168 2 0 24 subnet for users to download client software Deploy an EAD solution for the intranet to meet the following requirements Allow unauthenticated users and users that have failed 802 1X authentication to access 192 168 2 ...

Страница 125: ...rimary accounting server and set the accounting port to 1813 Device radius 2000 primary accounting 10 1 1 2 1813 Set the shared key to abc in plain text for secure communication between the authentication server and the device Device radius 2000 key authentication simple abc Set the shared key to abc in plain text for secure communication between the accounting server and the device Device radius ...

Страница 126: ...i seconds Minimum 0ms Maximum 0ms Average 0ms The output shows that you can access the free IP subnet before passing 802 1X authentication Verify that you are redirected to the Web server when you enter in your Web browser an IP address not on the free IP Details not shown Troubleshooting 802 1X EAD assistant URL redirection failure Symptom Unauthenticated users are not redirected to the specified...

Страница 127: ...s not provide Web services Solution To resolve the problem 1 Enter a dotted decimal IP address that is not in any free IP segments 2 Verify that the access device and the server are configured correctly 3 If the problem persists contact Hewlett Packard Enterprise Support ...

Страница 128: ...sed user account for each user The access device uses the source MAC addresses in packets as the usernames and passwords of users for MAC authentication This policy is suitable for an insecure environment One shared user account for all users You specify one username and password which are not necessarily a MAC address for all MAC authentication users on the access device This policy is suitable f...

Страница 129: ...thenticated user s authorization VLAN The authorization VLAN becomes the PVID All MAC authentication users on the port must be assigned the same authorization VLAN If a different authorization VLAN is assigned to a subsequent user the user cannot pass MAC authentication If the port is assigned to the authorization VLAN as a tagged member the PVID of the port does not change The device maps the MAC...

Страница 130: ... 12 VLAN manipulation Authentication status VLAN manipulation A user fails MAC authentication because all the RADIUS servers are unreachable The device maps the MAC address of the user to the MAC authentication critical VLAN The user is still in the MAC authentication critical VLAN if the user fails MAC reauthentication because all the RADIUS servers are unreachable If no MAC authentication critic...

Страница 131: ... the authentication server the device remaps the MAC address of the voice user to the PVID of the access port ACL assignment You can specify an authorization ACL in the user account for a MAC authentication user to control the user s access to network resources After the user passes MAC authentication the authentication server local or remote assigns the authorization ACL to the access port of the...

Страница 132: ...nts on the RADIUS server If you are using MAC based accounts make sure the username and password for each account are the same as the MAC address of each MAC authentication user 2 Make sure the port security feature is disabled For more information about port security see Configuring port security Configuration task list Tasks at a glance Required Enabling MAC authentication Optional Specifying a ...

Страница 133: ...rs Specify a global authentication domain in system view This domain setting applies to all ports enabled with MAC authentication Specify an authentication domain for an individual port in interface view MAC authentication chooses an authentication domain for users on a port in this order the port specific domain the global domain and the default domain For more information about authentication do...

Страница 134: ... wait before the device can perform MAC authentication for a user that has failed MAC authentication All packets from the MAC address are dropped during the quiet time This quiet mechanism prevents repeated authentication from affecting system performance Server timeout timer Sets the interval that the device waits for a response from a RADIUS server before the device regards the RADIUS server una...

Страница 135: ...marks 1 Enter system view system view N A 2 Enter interface view interface interface type interface number N A 3 Enable MAC authentication multi VLAN mode mac authentication host mode multi vlan By default this feature is disabled on a port When the port receives a packet sourced from an authenticated user in a VLAN not matching the existing MAC VLAN mapping the device logs off and reauthenticates...

Страница 136: ... a port follow these restrictions and guidelines Make sure the port meets the following requirements The port is configured with both 802 1X authentication and MAC authentication and performs MAC based access control for 802 1X authentication The port is enabled with the 802 1X unicast trigger For the port to perform MAC authentication before it is assigned to the 802 1X guest VLAN enable new MAC ...

Страница 137: ...n guest VLAN feature has higher priority When a user fails MAC authentication the user can access the resources in the guest VLAN The user s MAC address is not marked as a silent MAC address See Configuring MAC authentication timers Super VLAN You cannot specify a VLAN as both a super VLAN and a MAC authentication guest VLAN See Layer 2 LAN Switching Configuration Guide Port intrusion protection T...

Страница 138: ...LAN The user s MAC address is not marked as a silent MAC address See Configuring MAC authentication timers Super VLAN You cannot specify a VLAN as both a super VLAN and a MAC authentication critical VLAN See Layer 2 LAN Switching Configuration Guide Port intrusion protection The critical VLAN feature has higher priority than the block MAC action but lower priority than the shutdown port action of ...

Страница 139: ...ble for MAC reauthentication Configuration restrictions and guidelines When you configure periodic MAC reauthentication follow these restrictions and guidelines The server assigned RADIUS Session Timeout attribute 27 and Termination Action attribute 29 attributes together can affect the periodic MAC reauthentication feature To display the server assigned Session Timeout and Termination Action attr...

Страница 140: ...e By default periodic MAC reauthentication is disabled on a port 5 Optional Set the periodic reauthentication timer on the port mac authentication timer reauth period reauth period value By default no periodic reauthentication timer is set on a port The port uses the global periodic MAC reauthentication timer 6 Optional Enable the keep online feature for authenticated MAC authentication users on t...

Страница 141: ... type interface number mac address mac address Remove users from the MAC authentication critical voice VLAN on a port reset mac authentication critical voice vlan interface interface type interface number mac address mac address Remove users from the MAC authentication guest VLAN on a port reset mac authentication guest vlan interface interface type interface number mac address mac address MAC aut...

Страница 142: ...e Ten GigabitEthernet1 0 1 mac authentication Device Ten GigabitEthernet1 0 1 quit Specify ISP domain bbb as the MAC authentication domain Device mac authentication domain bbb Configure MAC authentication timers Device mac authentication timer offline detect 180 Device mac authentication timer quiet 180 Configure MAC authentication to use MAC based accounts Each MAC address is in the hexadecimal n...

Страница 143: ...sers 1 MAC address Auth state 00e0 fc12 3456 Authenticated The output shows that Host A has passed MAC authentication and has come online Host B failed MAC authentication and its MAC address is marked as a silent MAC address RADIUS based MAC authentication configuration example Network requirements As shown in Figure 38 the device uses RADIUS servers to perform authentication authorization and acc...

Страница 144: ...it Apply the RADIUS scheme to ISP domain bbb for authentication authorization and accounting Device domain bbb Device isp bbb authentication default radius scheme 2000 Device isp bbb authorization default radius scheme 2000 Device isp bbb accounting default radius scheme 2000 Device isp bbb quit Enable MAC authentication on Ten GigabitEthernet 1 0 1 Device interface ten gigabitethernet 1 0 1 Devic...

Страница 145: ...n domain Not configured Auth delay timer Disabled Periodic reauth Disabled Re auth server unreachable Logoff Guest VLAN Not configured Guest VLAN auth period 30 s Critical VLAN Not configured Critical voice VLAN Disabled Host mode Single VLAN Offline detection Enabled Authentication order Default Max online users 4294967295 Authentication attempts successful 1 failed 0 Current online users 1 MAC a...

Страница 146: ... accounting 10 1 1 2 1813 Device radius 2000 key authentication simple abc Device radius 2000 key accounting simple abc Device radius 2000 user name format without domain Device radius 2000 quit Apply the RADIUS scheme to an ISP domain for authentication authorization and accounting Device domain bbb Device isp bbb authentication default radius scheme 2000 Device isp bbb authorization default radi...

Страница 147: ...detect period 300 s Quiet period 60 s Server timeout 100 s Reauth period 3600 s Authentication domain bbb Online MAC auth users 1 Silent MAC users MAC address VLAN ID From port Port index Ten GigabitEthernet1 0 1 is link up MAC authentication Enabled Carry User IP Disabled Authentication domain Not configured Auth delay timer Disabled Periodic reauth Disabled Re auth server unreachable Logoff Gues...

Страница 148: ...est timed out Request timed out Request timed out Request timed out Ping statistics for 10 0 0 1 Packets Sent 4 Received 0 Lost 4 100 loss The output shows that ACL 3000 has been assigned to Ten GigabitEthernet 1 0 1 to deny access to the FTP server ...

Страница 149: ...ides ISPs with diversified management choices and extended functions For example the ISPs can place advertisements provide community services and publish information on the authentication page Supports multiple authentication modes For example re DHCP authentication implements a flexible address assignment scheme and saves public IP addresses Cross subnet authentication can authenticate users who ...

Страница 150: ...racts with the access device to authenticate users Portal Web server The portal Web server pushes the Web authentication page to authentication clients and forwards user authentication information username and password to the portal authentication server The access device also redirects HTTP requests from unauthenticated users to the portal Web server The portal Web server can be integrated with t...

Страница 151: ...L Portal page customization To perform local portal authentication you must customize a set of authentication pages that the device will push to users You can customize multiple sets of authentication pages compress each set of the pages to a zip file and upload the compressed files to the storage medium of the device On the device you must specify one of the files as the default authentication pa...

Страница 152: ...an that of re DHCP authentication Re DHCP authentication Before a user passes authentication DHCP allocates an IP address a private IP address to the user The user can access only the portal Web server and predefined authentication free websites After the user passes authentication DHCP reallocates an IP address a public IP address to the user The user then can access other network resources No pu...

Страница 153: ...n to support EAP authentication NOTE To use portal authentication that supports EAP the portal authentication server and client must be the HPE IMC portal server and the HPE iNode portal client Local portal authentication does not support EAP authentication Portal authentication process Direct authentication and cross subnet authentication share the same authentication process Re DHCP authenticati...

Страница 154: ...o the portal authentication server to notify authentication success or failure 7 The portal authentication server sends an authentication success or failure packet to the client 8 If the authentication is successful the portal authentication server sends an authentication reply acknowledgment packet to the access device If the client is an iNode client the authentication process includes step 9 an...

Страница 155: ... following categories of portal packet filtering rules First category The rule permits user packets that are destined for the portal Web server and packets that match the portal free rules to pass through Second category For an authenticated user with no ACL authorized the rule allows the user to access any destination network resources For an authenticated user with an ACL authorized the rule all...

Страница 156: ...hentication the access device removes the MAC trigger entry for the user NOTE For information about MAC binding server configuration see the user manual of the server Portal configuration task list Tasks at a glance Optional Configuring a portal authentication server Required Configuring a portal Web server Required Enabling portal authentication Required Specifying a portal Web server Optional Co...

Страница 157: ...rtal client access device and servers can reach each other To use the remote RADIUS server configure usernames and passwords on the RADIUS server and configure the RADIUS client on the access device For information about RADIUS client configuration see Configuring AAA To implement extended portal functions install and configure IMC EAD Make sure the ACLs configured on the access device correspond ...

Страница 158: ...supports multiple portal Web servers Perform this task to configure the following parameters for a portal Web server VPN instance of the portal Web server URL of the portal Web server Parameters carried in the URL when the device redirects the URL to users Portal Web server type which must be the same as the server type the device actually uses The captive pass feature With this feature enabled th...

Страница 159: ...ule for URL redirection if match original url url string redirect url url string url param encryption aes des key cipher simple string user agent string redirect url url string By default no URL redirection match rules exist Enabling portal authentication You must first enable portal authentication on an access interface before it can perform portal authentication for connected clients With portal...

Страница 160: ...on Step Command Remarks 1 Enter system view system view N A 2 Enter interface view interface interface type interface number The interface must be a Layer 3 interface 3 Enable portal authentication To enable IPv4 portal authentication portal enable method direct layer3 redhcp To enable IPv6 portal authentication portal ipv6 enable method direct layer3 Enable IPv4 portal authentication IPv6 portal ...

Страница 161: ...mask length mask any tcp tcp port number udp udp port number source ip ip address mask length mask any tcp tcp port number udp udp port number interface interface type interface number By default no IPv4 based portal free rule exists 3 Configure an IPv6 based portal free rule portal free rule rule number destination ipv6 ipv6 address prefix length any tcp tcp port number udp udp port number source...

Страница 162: ...subnet as any source IP address In re DHCP mode the access device regards the authentication source subnet on an interface as the subnet to which the private IP address of the interface belongs If both authentication source subnets and destination subnets are configured on an interface only the authentication destination subnets take effect You can configure multiple authentication source subnets ...

Страница 163: ...cation destination subnet Step Command Remarks 1 Enter system view system view N A 2 Enter interface view interface interface type interface number N A 3 Configure an IPv6 portal authentication destination subnet portal ipv6 free all except destination ipv6 network address prefix length By default no IPv6 portal authentication destination subnet is configured and users accessing any subnets must p...

Страница 164: ...f portal users This allows for flexible portal access control The device selects the authentication domain for a portal user in this order 1 ISP domain specified for the interface 2 ISP domain carried in the username 3 System default ISP domain For information about the default ISP domain see Configuring AAA You can specify an IPv4 portal authentication domain an IPv6 portal authentication domain ...

Страница 165: ...oes not exist the device might operate incorrectly You must delete a preauthentication domain by using the undo portal ipv6 pre auth domain command and reconfigure it in the following situations You create the ISP domain after specifying it as the preauthentication domain You delete the specified ISP domain and then re create it To specify a preauthentication domain Step Command Remarks 1 Enter sy...

Страница 166: ...nnot obtain the IP address and cannot perform portal authentication To specify an IP address pool before portal authentication Step Command Remarks 1 Enter system view system view N A 2 Enter interface view interface interface type interface number N A 3 Specify a preauthentication IP address pool for portal users portal ipv6 pre auth ip pool pool name By default no preauthentication IP address po...

Страница 167: ...nly By default both users with IP addresses obtained through DHCP and users with static IP addresses can pass authentication to get online Enabling outgoing packets filtering on a portal enabled interface When you enable this feature on a portal enabled interface the device permits the interface to send the following packets Packets whose destination IP addresses are IP addresses of authenticated ...

Страница 168: ...ection applies to all portal authentication modes To configure online detection of IPv4 portal users Step Command Remarks 1 Enter system view system view N A 2 Enter interface view interface interface type interface number N A 3 Configure online detection of IPv4 portal users portal user detect type arp icmp retry retries interval interval idle time By default this feature is disabled on the inter...

Страница 169: ...rface to have network access When the server recovers it resumes portal authentication on the interface For more information see Configuring the portal fail permit feature To configure portal authentication server detection Step Command Remarks 1 Enter system view system view N A 2 Enter portal authentication server view portal server server name N A 3 Configure portal authentication server detect...

Страница 170: ...eature This feature is implemented by sending and detecting portal synchronization packets as follows 1 The portal authentication server sends the online user information to the access device in a synchronization packet at the user heartbeat interval The user heartbeat interval is set on the portal authentication server 2 Upon receiving the synchronization packet the access device compares the use...

Страница 171: ...iew N A 2 Enter interface view interface interface type interface number N A 3 Enable portal fail permit for a portal authentication server portal ipv6 fail permit server server name By default portal fail permit is disabled for a portal authentication server 4 Enable portal fail permit for a portal Web server portal ipv6 apply web server server name fail permit By default portal fail permit is di...

Страница 172: ...ortal authentication server portal bas ipv6 ipv6 address By default The BAS IPv6 attribute of an IPv6 portal reply packet sent to the portal authentication server is the source IPv6 address of the packet The BAS IPv6 attribute of an IPv6 portal notification packet sent to the portal authentication server is the IPv6 address of the packet s output interface Enabling portal roaming Portal roaming ta...

Страница 173: ...server Make sure the configured device ID is different than any other access devices communicating with the same portal authentication server To specify the device ID Step Command Remarks 1 Enter system view system view N A 2 Specify the device ID portal device id device id By default a device is not configured with a device ID Logging out online portal users This feature deletes users that have p...

Страница 174: ...ce name in the NAS Identifier attribute of all RADIUS requests A NAS ID profile enables you to send different NAS Identifier attribute strings in RADIUS requests from different VLANs The strings can be organization names service names or any user categorization criteria depending on the administrative requirements For example map the NAS ID companyA to all VLANs of company A The device will send c...

Страница 175: ...ication page file as the default authentication page file for local portal authentication Customizing authentication pages Authentication pages are HTML files Local portal authentication requires the following authentication pages Logon page Logon success page Logon failure page Online page System busy page Logoff success page You must customize the authentication pages including the page elements...

Страница 176: ...ontain PtUser PtPwd and PtButton attributes A logoff Post request must contain the PtButton attribute 2 Authentication pages logon htm and logonFail htm must contain the logon Post request The following example shows part of the script in page logon htm form action logon cgi method post p User name input type text name PtUser style width 160px height 22px maxlength 64 p Password input type passwor...

Страница 177: ...Configure a PKI policy obtain the CA certificate and request a local certificate For more information see Configuring PKI Configure an SSL server policy and specify the PKI domain configured in the PKI policy For more information see Configuring SSL To configure a local portal Web server Step Command Remarks 1 Enter system view system view N A 2 Create a local portal Web server and enter its view ...

Страница 178: ...only on portal users who pass authentication after the feature is enabled or disabled To configure ARP or ND entry conversion for portal clients Step Command Remarks 1 Enter system view system view N A 2 Enable ARP or ND entry conversion for portal clients portal refresh arp nd enable By default ARP or ND entry conversion is enabled for portal clients 3 Disable ARP or ND entry conversion for porta...

Страница 179: ...number of query attempts is 3 and the query interval is 1 second 8 Optional Specify the type of the MAC binding server server type imc By default the type of a MAC binding server is IMC 9 Optional Specify the version of the portal protocol version version number By default the version of the portal protocol is 1 10 Optional Specify the timeout the device waits for portal authentication to complete...

Страница 180: ...rvers display portal mac trigger server all name server name Display portal rules display portal rule all dynamic static interface interface type interface number slot slot number Display portal configuration and portal running state information display portal interface interface type interface number Display portal authentication server information display portal server server name Display portal...

Страница 181: ...ng the authentication Figure 45 Network diagram Configuration prerequisites Configure IP addresses for the host switch and servers as shown in Figure 45 and make sure they can reach each other Configure the RADIUS server correctly to provide authentication and accounting functions Configuring the portal authentication server on IMC PLAT 3 20 In this example the portal server runs on IMC PLAT 3 20 ...

Страница 182: ...ice group This example uses the default group Ungrouped f Select the action Normal g Click OK Figure 47 Adding an IP address group 3 Add a portal device a Select Access Service Portal Service Management Device from the navigation tree to open the portal device configuration page b Click Add to open the page as shown in Figure 48 c Enter the device name NAS d Enter the IP address of the switch s in...

Страница 183: ...dding a portal device 4 Associate the portal device with the IP address group a As shown in Figure 49 click the icon in the Port Group Information Management column of device NAS to open the port group configuration page Figure 49 Device list b Click Add to open the page as shown in Figure 50 Figure 50 Port group configuration c Enter the port group name d Select the configured IP address group ...

Страница 184: ...ment Server from the navigation tree to open the portal server configuration page as shown in Figure 51 c Configure the portal server parameters as needed This example uses the default settings d Click OK Figure 51 Portal server configuration 2 Configure the IP address group a Select User Access Manager Portal Service Management IP Group from the navigation tree to open the portal IP address group...

Страница 185: ...e as that configured on the switch f Set whether to enable IP address reallocation This example uses direct portal authentication and therefore select No from the Reallocate IP list g Select whether to support sever heartbeat and user heartbeat functions In this example select No for both Support Server Heartbeat and Support User Heartbeat h Click OK Figure 53 Adding a portal device 4 Associate th...

Страница 186: ...he configurations Configuring the switch 1 Configure a RADIUS scheme Create a RADIUS scheme named rs1 and enter its view Switch system view Switch radius scheme rs1 Specify the primary authentication server and primary accounting server and configure the keys for communication with the servers Switch radius rs1 primary authentication 192 168 0 112 Switch radius rs1 primary accounting 192 168 0 112...

Страница 187: ...erver newpt quit Configure a portal Web server Switch portal web server newpt Switch portal websvr newpt url http 192 168 0 111 8080 portal Switch portal websvr newpt quit Enable direct portal authentication on VLAN interface 100 Switch interface vlan interface 100 Switch Vlan interface100 portal enable method direct Reference the portal Web server newpt on VLAN interface 100 Switch Vlan interface...

Страница 188: ...tion Layer3 source network IP address Prefix length Destination authenticate subnet IP address Prefix length A user can perform portal authentication by using the HPE iNode client or through a Web browser Before passing the authentication the user can access only the authentication page http 192 168 0 111 8080 portal All Web requests from the user will be redirected to the authentication page Afte...

Страница 189: ... configure a public address pool 20 20 20 0 24 and a private address pool 10 0 0 0 24 on the DHCP server Details not shown For re DHCP portal authentication The switch must be configured as a DHCP relay agent The portal enabled interface must be configured with a primary IP address a public IP address and a secondary IP address a private IP address For information about DHCP relay agent configurat...

Страница 190: ...cheme rs1 Switch isp dm1 quit Configure domain dm1 as the default ISP domain If a user enters the username without the ISP domain name at login the authentication and accounting methods of the default domain are used for the user Switch domain default enable dm1 3 Configure DHCP relay and authorized ARP Configure DHCP relay Switch dhcp enable Switch dhcp relay client information record Switch inte...

Страница 191: ...e Not configured Authorization Strict checking ACL Disabled User profile Disabled IPv4 Portal status Enabled Portal authentication method Redhcp Portal web server newpt Authentication domain Not configured Pre auth domain Not configured User dhcp only Disabled Pre auth IP pool Not configured Max Portal users Not configured Bas ip 20 20 20 1 User detection Not configured Action for server detection...

Страница 192: ...e 100 Total portal users 1 Username abc Portal server newpt State Online VPN instance N A MAC IP VLAN Interface 0015 e9a6 7cfe 20 20 20 2 100 Vlan interface100 Authorization information DHCP IP pool N A User profile N A Session group profile N A ACL N A CAR N A Configuring cross subnet portal authentication Network requirements As shown in Figure 57 Switch A supports portal authentication The host...

Страница 193: ...iew SwitchA radius scheme rs1 Specify the primary authentication server and primary accounting server and configure the keys for communication with the servers SwitchA radius rs1 primary authentication 192 168 0 112 SwitchA radius rs1 primary accounting 192 168 0 112 SwitchA radius rs1 key authentication simple radius SwitchA radius rs1 key accounting simple radius Exclude the ISP domain name from...

Страница 194: ...AN interface 4 SwitchA Vlan interface4 portal apply web server newpt Configure the BAS IP as 20 20 20 1 for portal packets sent from VLAN interface 4 to the portal authentication server SwitchA Vlan interface4 portal bas ip 20 20 20 1 SwitchA Vlan interface4 quit On Switch B configure a default route to subnet 192 168 0 0 24 specifying the next hop address as 20 20 20 1 Details not shown Verifying...

Страница 195: ... portal authentication by using the HPE iNode client or through a Web browser Before passing the authentication the user can access only the authentication page http 192 168 0 111 8080 portal All Web requests from the user will be redirected to the authentication page After passing the authentication the user can access other network resources After the user passes authentication use the following...

Страница 196: ...r correctly to provide authentication and accounting functions Configuration procedure Perform the following tasks on the switch 1 Configure a RADIUS scheme Create a RADIUS scheme named rs1 and enter its view Switch system view Switch radius scheme rs1 Specify the primary authentication server and primary accounting server and configure the keys for communication with the servers Switch radius rs1...

Страница 197: ...u specify ACL 3000 as the isolation ACL and ACL 3001 as the security ACL on the security policy server 4 Configure portal authentication Configure a portal authentication server Switch portal server newpt Switch portal server newpt ip 192 168 0 111 key simple portal Switch portal server newpt port 50100 Switch portal server newpt quit Configure a portal Web server Switch portal web server newpt Sw...

Страница 198: ...figured Authentication domain Not configured Pre auth domain Not configured User dhcp only Disabled Pre auth IP pool Not configured Max Portal users Not configured Bas ipv6 Not configured User detection Not configured Action for server detection Server type Server name Action Layer3 source network IP address Prefix length Destination authenticate subnet IP address Prefix length Before passing port...

Страница 199: ... the DHCP server A portal server acts as both a portal authentication server and a portal Web server A RADIUS server acts as the authentication accounting server Configure extended re DHCP portal authentication Before passing portal authentication the host is assigned a private IP address After passing portal identity authentication the host obtains a public IP address and accepts security check I...

Страница 200: ...ary accounting server and configure the keys for communication with the servers Switch radius rs1 primary authentication 192 168 0 113 Switch radius rs1 primary accounting 192 168 0 113 Switch radius rs1 key accounting simple radius Switch radius rs1 key authentication simple radius Switch radius rs1 user name format without domain Specify the security policy server Switch radius rs1 security poli...

Страница 201: ...tch portal server newpt ip 192 168 0 111 key simple portal Switch portal server newpt port 50100 Switch portal server newpt quit Configure a portal Web server Switch portal web server newpt Switch portal websvr newpt url http 192 168 0 111 8080 portal Switch portal websvr newpt quit Enable re DHCP portal authentication on VLAN interface 100 Switch interface vlan interface 100 Switch Vlan interface...

Страница 202: ...ed Bas ipv6 Not configured User detection Not configured Action for server detection Server type Server name Action Layer3 source network IP address Prefix length Destination authenticate subnet IP address Prefix length Before passing portal authentication a user that uses the HPE iNode client can access only the authentication page http 192 168 0 111 8080 portal All Web requests from the user wil...

Страница 203: ...r passing portal identity authentication the host accepts security check If the host fails the security check it can access only the subnet 192 168 0 0 24 After passing the security check the host can access other network resources Figure 60 Network diagram Configuration prerequisites and guidelines Configure IP addresses for the switch and servers as shown in Figure 60 and make sure the host swit...

Страница 204: ... portal radius scheme rs1 SwitchA isp dm1 quit Configure domain dm1 as the default ISP domain If a user enters the username without the ISP domain name at login the authentication and accounting methods of the default domain are used for the user SwitchA domain default enable dm1 3 Configure ACL 3000 as the isolation ACL and ACL 3001 as the security ACL SwitchA acl advanced 3000 SwitchA acl ipv4 a...

Страница 205: ...s taken effect SwitchA display portal interface vlan interface 4 Portal information of Vlan interface4 NAS ID profile Not configured Authorization Strict checking ACL Disabled User profile Disabled IPv4 Portal status Enabled Portal authentication method Layer3 Portal web server newpt Authentication domain Not configured Pre auth domain Not configured User dhcp only Disabled Pre auth IP pool Not co...

Страница 206: ... 4 Total portal users 1 Username abc Portal server newpt State Online VPN instance N A MAC IP VLAN Interface 0015 e9a6 7cfe 8 8 8 2 4 Vlan interface4 Authorization information DHCP IP pool N A User profile N A Session group profile N A ACL 3001 CAR N A Configuring portal server detection and portal user synchronization Network requirements As shown in Figure 61 the host is directly connected to th...

Страница 207: ...l authentication server detection so that the switch can detect the reachability of the portal authentication server by cooperating with the portal server heartbeat function Configure portal user synchronization so that the switch can synchronize portal user information with the portal authentication server by cooperating with the portal user heartbeat function Configuring the portal authenticatio...

Страница 208: ...e group This example uses the default group Ungrouped f Select the action Normal g Click OK Figure 63 Adding an IP address group 3 Add a portal device a Select Access Service Portal Service Management Device from the navigation tree to open the portal device configuration page b Click Add to open the page as shown in Figure 64 c Enter the device name NAS d Enter the IP address of the switch s inte...

Страница 209: ...dding a portal device 4 Associate the portal device with the IP address group a As shown in Figure 65 click the icon in the Port Group Information Management column of device NAS to open the port group configuration page Figure 65 Device list b Click Add to open the page as shown in Figure 66 Figure 66 Port group configuration c Enter the port group name d Select the configured IP address group ...

Страница 210: ... Server from the navigation tree to open the portal server configuration page as shown in Figure 67 c Configure the portal server heartbeat interval and user heartbeat interval d Use the default settings for other parameters e Click OK Figure 67 Portal authentication server configuration 2 Configure the IP address group a Select User Access Manager Portal Service Management IP Group from the navig...

Страница 211: ... as that configured on the switch f Set whether to enable IP address reallocation This example uses direct portal authentication and therefore select No from the Reallocate IP list g Select whether to support sever heartbeat and user heartbeat functions In this example select Yes for both Support Server Heartbeat and Support User Heartbeat h Click OK Figure 69 Adding a portal device 4 Associate th...

Страница 212: ...he configurations Configuring the switch 1 Configure a RADIUS scheme Create a RADIUS scheme named rs1 and enter its view Switch system view Switch radius scheme rs1 Specify the primary authentication server and primary accounting server and configure the keys for communication with the servers Switch radius rs1 primary authentication 192 168 0 112 Switch radius rs1 primary accounting 192 168 0 112...

Страница 213: ...es Switch portal server newpt server detect timeout 40 log NOTE The value of timeout must be greater than or equal to the portal server heartbeat interval Configure portal user synchronization with the portal authentication server and set the synchronization detection interval to 600 seconds Switch portal server newpt user sync timeout 600 Switch portal server newpt quit NOTE The value of timeout ...

Страница 214: ...ion with a preauthentication domain Network requirements As shown in Figure 72 the host is directly connected to the switch the access device The host is assigned a public IP address through DHCP A portal server acts as both a portal authentication server and a portal Web server A RADIUS server acts as the authentication accounting server Configure direct portal authentication so the host can acce...

Страница 215: ...t 3 Configure portal authentication Configure a portal authentication server Switch portal server newpt Switch portal server newpt ip 192 168 0 111 key simple portal Switch portal server newpt port 50100 Switch portal server newpt quit Configure a portal Web server Switch portal web server newpt Switch portal websvr newpt url http 192 168 0 111 8080 portal Switch portal websvr newpt quit Enable di...

Страница 216: ...ntication the host is assigned a private IP address and can access only the subnet 192 168 0 0 24 After passing the authentication the host gets a public IP address and can access other network resources Figure 73 Network diagram Configuration prerequisites and guidelines Configure IP addresses for the switch and servers as shown in Figure 73 and make sure the host switch and servers can reach eac...

Страница 217: ... in the domain Switch isp abc authorization attribute acl 3010 Switch isp abc quit Configure a rule to permit access to the subnet 192 168 0 0 24 Switch acl advanced 3010 Switch acl ipv4 adv 3010 rule 1 permit ip destination 192 168 0 0 24 Switch acl ipv4 adv 3010 quit Configure preauthentication domain abc on VLAN interface 100 Switch interface vlan interface 100 Switch Vlan interface100 portal p...

Страница 218: ...witch display portal user pre authenticate interface vlan interface 100 MAC IP VLAN Interface 0015 e9a6 7cfe 10 10 10 4 100 Vlan interface100 State Online VPN instance Authorization information DHCP IP pool N A User profile N A Session group profile N A ACL number 3010 Inbound CAR N A Outbound CAR N A Configuring direct portal authentication using local portal Web server Network requirements As sh...

Страница 219: ...gure an authentication domain Create an ISP domain named dm1 and enter its view Switch domain dm1 Configure AAA methods for the ISP domain Switch isp dm1 authentication portal radius scheme rs1 Switch isp dm1 authorization portal radius scheme rs1 Switch isp dm1 accounting portal radius scheme rs1 Switch isp dm1 quit Configure domain dm1 as the default ISP domain If a user enters the username with...

Страница 220: ...isabled IPv4 Portal status Enabled Portal authentication method Direct Portal web server newpt Authentication domain Not configured Pre auth domain Not configured User dhcp only Disabled Pre auth IP pool Not configured Max Portal users Not configured Bas ip Not configured User detection Not configured Action for server detection Server type Server name Action Layer3 source network IP address Mask ...

Страница 221: ...mation IP pool N A User profile N A Session group profile N A ACL N A CAR N A Troubleshooting portal No portal authentication page is pushed for users Symptom When a user is redirected to the IMC portal authentication server no portal authentication page or error message is prompted for the user The login page is blank Analysis The key configured on the portal access device and that configured on ...

Страница 222: ...er command to display the listening port of the portal authentication server configured on the access device 2 Use the portal server command in system view to change the listening port number to the actual listening port of the portal authentication server Cannot log out portal users on the RADIUS server Symptom The access device uses the HPE IMC server as the RADIUS server to perform identity aut...

Страница 223: ... private and public IP addresses However the authentication result for the user is failure Analysis When the access device detects that the client IP address is changed it sends an unsolicited portal packet to notify of the IP change to the portal authentication server The portal authentication server notifies of the authentication success only after it receives the IP change notification from bot...

Страница 224: ...y for scenarios that require only 802 1X authentication or MAC authentication For more information about 802 1X and MAC authentication see Configuring 802 1X and Configuring MAC authentication Port security features NTK The need to know NTK feature prevents traffic interception by checking the destination MAC address in the outbound frames The feature ensures that frames are sent only to the follo...

Страница 225: ...y is disabled on the port and access to the port is not restricted N A Controlling MAC address learning autoLearn NTK intrusion protection secure Performing 802 1X authentication userLogin N A userLoginSecure NTK intrusion protection userLoginSecureExt userLoginWithOUI Performing MAC authentication macAddressWithRadius NTK intrusion protection Performing a combination of MAC authentication and 802...

Страница 226: ...t based access control The port can service multiple 802 1X users Once an 802 1X user passes authentication on the port any subsequent 802 1X users can access the network through the port without authentication userLoginSecure A port in this mode performs 802 1X authentication and implements MAC based access control The port services only one user passing 802 1X authentication userLoginSecureExt T...

Страница 227: ...ion user and multiple MAC authentication users to log in In this mode the port performs MAC authentication upon receiving non 802 1X frames Upon receiving 802 1X frames the port performs MAC authentication and then if the authentication fails 802 1X authentication macAddressElseUserLoginSecureExt This mode is similar to the macAddressElseUserLoginSecure mode except that this mode supports multiple...

Страница 228: ...ng the number of concurrent users on the port For a port operating in a security mode except for autoLearn and secure the upper limit equals the smaller of the following values The limit of the secure MAC addresses that port security allows The limit of concurrent users allowed by the authentication mode in use Controlling the number of secure MAC addresses on the port in autoLearn mode The port s...

Страница 229: ...n cannot take effect Changing the port security mode of a port logs off the online users of the port Do not enable 802 1X authentication or MAC authentication on a port where port security is configured The device supports the URL attribute assigned by a RADIUS server in the following port security modes mac authentication mac else userlogin secure mac else userlogin secure ext userlogin secure us...

Страница 230: ...de command to restore the default port security mode Configuring port security features Configuring NTK The NTK feature checks the destination MAC addresses in outbound frames to make sure frames are forwarded only to authenticated devices The NTK feature supports the following modes ntkonly Forwards only unicast frames with authenticated destination MAC addresses ntk withbroadcasts Forwards only ...

Страница 231: ...rn to system view quit N A 5 Optional Set the silence timeout period during which a port remains disabled port security timer disableport time value By default the port silence timeout is 20 seconds NOTE On a port operating in either macAddressElseUserLoginSecure mode or macAddressElseUserLoginSecureExt mode intrusion protection is triggered only after both MAC authentication and 802 1X authentica...

Страница 232: ...resses are lost at reboot When the maximum number of secure MAC address entries is reached the port changes to secure mode In secure mode the port cannot add or learn any more secure MAC addresses The port allows only frames sourced from secure MAC addresses or MAC addresses configured by using the mac address dynamic or mac address static command to pass through Configuration prerequisites Before...

Страница 233: ...e a port to ignore authorization information from the server Step Command Remarks 1 Enter system view system view N A 2 Enter interface view interface interface type interface number N A 3 Ignore the authorization information received from the authentication server port security authorization ignore By default a port uses the authorization information received from the authentication server Enabli...

Страница 234: ...me in the NAS Identifier attribute of all RADIUS requests A NAS ID profile enables you to send different NAS Identifier attribute strings in RADIUS requests from different VLANs The strings can be organization names service names or any user categorization criteria depending on the administrative requirements For example map the NAS ID companyA to all VLANs of company A The device will send compan...

Страница 235: ... enable port security address learned dot1x failure dot1x logoff dot1x logon intrusion mac auth failure mac auth logoff mac auth logon By default SNMP notifications are disabled for port security Displaying and maintaining port security Execute display commands in any view Task Command Display the port security configuration operation information and statistics display port security interface inte...

Страница 236: ...t1 0 1 port security max mac count 64 Set the port security mode to autoLearn Device Ten GigabitEthernet1 0 1 port security port mode autolearn Configure the port to be silent for 30 seconds after the intrusion protection feature is triggered Device Ten GigabitEthernet1 0 1 port security intrusion mode disableport temporarily Device Ten GigabitEthernet1 0 1 quit Device port security timer disablep...

Страница 237: ... address security sticky 0002 0000 0015 vlan 1 port security mac address security sticky 0002 0000 0014 vlan 1 port security mac address security sticky 0002 0000 0013 vlan 1 port security mac address security sticky 0002 0000 0012 vlan 1 port security mac address security sticky 0002 0000 0011 vlan 1 Device Ten GigabitEthernet1 0 1 quit Verify that the port security mode changes to secure after t...

Страница 238: ...and sends usernames without domain names to the RADIUS server Configure Ten GigabitEthernet 1 0 1 to allow only one 802 1X user and a user that uses one of the specified OUI values to be authenticated Figure 76 Network diagram Configuration procedure The following configuration steps cover some AAA RADIUS configuration commands For more information about the commands see Security Command Reference...

Страница 239: ...ess 1234 0100 1111 Device port security oui index 2 mac address 1234 0200 1111 Device port security oui index 3 mac address 1234 0300 1111 Device port security oui index 4 mac address 1234 0400 1111 Device port security oui index 5 mac address 1234 0500 1111 Set the port security mode to userLoginWithOUI Device interface ten gigabitethernet 1 0 1 Device Ten GigabitEthernet1 0 1 port security port ...

Страница 240: ... Learned XGE1 0 1 Y macAddressElseUserLoginSecure configuration example Network requirements As shown in Figure 77 a client is connected to the device through Ten GigabitEthernet 1 0 1 The device authenticates the client by a RADIUS server in ISP domain sun If the authentication succeeds the client is authorized to access the Internet Configure Ten GigabitEthernet 1 0 1 of the device to meet the f...

Страница 241: ...evice dot1x authentication method chap Set port security s limit on the number of MAC addresses to 64 on the port Device interface ten gigabitethernet 1 0 1 Device Ten GigabitEthernet1 0 1 port security max mac count 64 Set the port security mode to macAddressElseUserLoginSecure Device Ten GigabitEthernet1 0 1 port security port mode mac else userlogin secure Specify ISP domain sun as the mandator...

Страница 242: ... authentication display MAC authentication information Verify that Ten GigabitEthernet 1 0 1 allows multiple MAC authentication users to be authenticated Device display mac authentication interface ten gigabitethernet 1 0 1 Global MAC authentication parameters MAC authentication Enabled User name format MAC address in uppercase XX XX XX XX XX XX Username mac Password Not configured Offline detect ...

Страница 243: ...al 802 1X parameters 802 1X authentication Enabled CHAP authentication Enabled Max tx period 30 s Handshake period 15 s Quiet timer Disabled Quiet period 60 s Supp timeout 30 s Server timeout 100 s Reauth period 3600 s Max auth requests 2 EAD assistant function Disabled EAD timeout 30 min Domain delimiter Online 802 1X wired users 1 Ten GigabitEthernet1 0 1 is link up 802 1X authentication Enabled...

Страница 244: ...ination MAC address multicast address or broadcast address are discarded Details not shown Troubleshooting port security Cannot set the port security mode Symptom Cannot set the port security mode for a port Analysis For a port operating in a port security mode other than noRestrictions you cannot change the port security mode by using the port security port mode command Solution To resolve the pr...

Страница 245: ... security mode to autoLearn Device Ten GigabitEthernet1 0 1 undo port security port mode Device Ten GigabitEthernet1 0 1 port security max mac count 64 Device Ten GigabitEthernet1 0 1 port security port mode autolearn Device Ten GigabitEthernet1 0 1 port security mac address security 1 1 2 vlan 1 2 If the problem persists contact Hewlett Packard Enterprise Support ...

Страница 246: ...d Configuring a user profile Configuration restrictions and guidelines When you configure user profiles follow these restrictions and guidelines Configure authentication parameters before you create a user profile The user profile supports working with the 802 1X and MAC authentication methods Specify a user profile for each user account In remote authentication specify a user profile on the authe...

Страница 247: ...y day even if User A passes 802 1X authentication User B has an upload speed of 2 Mbps after passing 802 1X authentication User C has a download speed of 4 Mbps after passing 802 1X authentication Figure 78 Network diagram Configuration procedure 1 Configure a QoS policy for User A Create a periodic time range from 8 30 to 12 00 every day Device system view Device time range for_usera 8 30 to 12 0...

Страница 248: ...0 kbps Device traffic behavior for_userb Device behavior for_userb car cir 2000 Device behavior for_userb quit Create a QoS policy named for_userb and associate traffic class class and traffic behavior for_userb in the QoS policy Device qos policy for_userb Device qospolicy for_userb classifier class behavior for_userb Device qospolicy for_userb quit 4 Create a user profile for User B and apply th...

Страница 249: ...b to use the LAN access service Device luser network userb service type lan access Specify user profile userb as the authorization user profile for user userb Device luser network userb authorization attribute user profile userb Device luser network userb quit Create a local user named userc Device local user userc class network New local user added Set the password to c12345 for user userc Device...

Страница 250: ... user profile information Device display user profile User Profile usera Inbound Policy for_usera slot 1 User Authentication type 802 1X Network attributes Interface Ten GigabitEthernet1 0 1 MAC address 6805 ca06 557b Service VLAN 1 User Profile userb Inbound Policy for_userb slot 1 User Authentication type 802 1X Network attributes Interface Ten GigabitEthernet1 0 1 MAC address 80c1 6ee0 2664 Ser...

Страница 251: ...238 ...

Страница 252: ...ser passwords If a user enters a password that is shorter than the minimum length the system rejects the password Password composition policy A password can be a combination of characters from the following types Uppercase letters A to Z Lowercase letters a to z Digits 0 to 9 Special characters in Table 19 Table 19 Special Characters Character name Symbol Character name Symbol Ampersand sign Apost...

Страница 253: ...e password is complexity incompliant the configuration will fail You can apply the following password complexity requirements A password cannot contain the username or the reverse of the username For example if the username is abc a password such as abc982 or 2cba is not complex enough A character or number cannot be included three or more times consecutively For example password a111 is not compl...

Страница 254: ... The four characters must be different from one another Otherwise the system will display an error message and the password will not be changed You can set the maximum number of history password records for the system to maintain for each user When the number of history password records exceeds your setting the most recent record overwrites the earliest one Current login passwords of device manage...

Страница 255: ...ds and parameters might differ in FIPS mode see Configuring FIPS and non FIPS mode Password control configuration task list The password control features can be configured in several different views and different views support different features The settings configured in different views or for different objects have the following application ranges Settings for super passwords apply only to super...

Страница 256: ...boot The inconsistency will cause the password expiration feature to malfunction For information about NTP see Network Management and Monitoring Configuration Guide To enable password control Step Command Remarks 1 Enter system view system view N A 2 Enable the global password control feature password control enable In non FIPS mode the global password control feature is disabled by default In FIP...

Страница 257: ...d complexity checking 7 Set the maximum number of history password records for each user password control history max record number The default setting is 4 8 Configure the login attempt limit password control login attempt login times exceed lock lock time time unlock By default the maximum number of login attempts is 3 and a user failing to log in after the specified number of attempts must wait...

Страница 258: ...the user group equals the global login attempt policy Setting local user password control parameters Step Command Remarks 1 Enter system view system view N A 2 Create a device management user and enter its view local user user name class manage By default no local users exist Local user password control applies to device management users instead of network access users For information about how to...

Страница 259: ... to the device For more information see Fundamentals Configuration Guide To set super password control parameters Step Command Remarks 1 Enter system view system view N A 2 Set the password expiration time for super passwords password control super aging aging time The default setting is 90 days 3 Configure the minimum length for super passwords password control super length length In non FIPS mod...

Страница 260: ...provide the correct password in two successive login attempts is permanently prohibited from logging in A user can log in five times within 60 days after the password expires A password expires after 30 days The minimum password update interval is 36 hours The maximum account idle time is 30 days A password cannot contain the username or the reverse of the username No character appears consecutive...

Страница 261: ...ition type number 4 type length 4 Set the minimum super password length to 24 characters Sysname password control super length 24 Specify that a super password must contain a minimum of four character types and a minimum of five characters for each type Sysname password control super composition type number 4 type length 5 Configure a super password used for switching to user role network operator...

Страница 262: ...omplexity Enabled username checking Enabled repeated characters checking Display the password control configuration for super passwords Sysname display password control super Super password control configurations Password aging Enabled 90 days Password length Enabled 24 characters Password composition Enabled 4 types 5 characters per type Display the password control configuration for local user t...

Страница 263: ... to authenticate packets to a peer set non overlapping sending lifetimes for the keys in the keychain The keys used by the local device and the peer device must have the same authentication algorithm and key string To configure a keychain Step Command Remarks 1 Enter system view system view N A 2 Create a keychain and enter keychain view keychain keychain name mode absolute By default no keychains...

Страница 264: ...he receiving lifetime in UTC mode for the key accept lifetime utc start time start date duration duration value infinite to end time end date By default the receiving lifetime is not configured for a key 11 Optional Specify the key as the default send key default send key By default no key in a keychain is specified as the default send key Displaying and maintaining keychain Execute display comman...

Страница 265: ... SwitchA keychain abc key 2 key string plain pwd123 SwitchA keychain abc key 2 send lifetime utc 11 00 00 2015 02 06 to 12 00 00 2015 02 06 SwitchA keychain abc key 2 accept lifetime utc 11 00 00 2015 02 06 to 12 00 00 2015 02 06 SwitchA keychain abc key 2 quit SwitchA keychain abc quit Configure VLAN interface 100 to use keychain abc for authentication SwitchA interface vlan interface 100 SwitchA...

Страница 266: ...vlan interface 100 SwitchB Vlan interface100 ospf authentication mode keychain abc SwitchB Vlan interface100 quit Verifying the configuration 1 When the system time is within the lifetime from 10 00 00 to 11 00 00 on the day 2015 02 06 verify the status of the keys in keychain abc Display keychain information on Switch A The output shows that key 1 is the valid key SwitchA display keychain Keychai...

Страница 267: ...ept lifetime 10 00 00 2015 02 06 to 11 00 00 2015 02 06 Accept status Active Key ID 2 Key string c 3 t4qHAw1hpZYN0JKIEpXPcMFMVT81u0hiOw Algorithm hmac md5 Send lifetime 11 00 00 2015 02 06 to 12 00 00 2015 02 06 Send status Inactive Accept lifetime 11 00 00 2015 02 06 to 12 00 00 2015 02 06 Accept status Inactive 2 When the system time is within the lifetime from 11 00 00 to 12 00 00 on the day 20...

Страница 268: ...e output shows that key 2 becomes the valid key SwitchB display keychain Keychain name abc Mode absolute Accept tolerance 0 TCP kind value 254 TCP algorithm value HMAC MD5 5 MD5 3 Default send key ID None Active send key ID 1 Active accept key IDs 1 Key ID 1 Key string c 3 G Shnh6heXWprlSQy XDmftHa2JZJBSgg Algorithm md5 Send lifetime 10 00 00 2015 02 06 to 11 00 00 2015 02 06 Send status Inactive ...

Страница 269: ... Encryption and decryption Any public key receiver can use the public key to encrypt information but only the private key owner can decrypt the information Digital signature The key owner uses the private key to digitally sign information to be sent The receiver decrypts the information with the sender s public key to verify information authenticity RSA DSA and ECDSA can all perform digital signat...

Страница 270: ...tically saved and can survive system reboots Table 21 A comparison of different types of asymmetric key algorithms Type Generated key pairs Modulus key length RSA In non FIPS mode One host key pair if you specify a key pair name One server key pair and one host key pair if you do not specify a key pair name Both key pairs use their default names In FIPS mode One host key pair NOTE Only SSH 1 5 use...

Страница 271: ...When you export a host public key follow these restrictions and guidelines If you specify a file name in the command the command exports the key to the specified file If you do not specify a file name the command exports the key to the monitor screen You must manually save the exported key to a file To export a local host public key Step Command 1 Enter system view system view 2 Export a local hos...

Страница 272: ...re of the peer device you must configure the peer device s public key on the local device You can configure the peer host public key by using the following methods Import the peer host public key from a public key file recommended Manually enter type or copy the peer host public key Importing a peer host public key from a public key file Before you perform this task make sure you have exported the...

Страница 273: ...ter public key view public key peer keyname By default no peer host public keys exist 3 Type or copy the key N A You can use spaces and carriage returns but the system does not save them 4 Return to system view peer public key end When you exit public key view the system automatically saves the peer host public key Displaying and maintaining public keys Execute display commands in any view Task Co...

Страница 274: ...7347B 8D41B58F8143512880139EC9111BFD31EB84B6B7C7A1470027AC8F04A827B30C2CAF79242E 45FDFF51A9C7E917DB818D54CB7AEF538AB261557524A7441D288EC54A5D31EFAE4F681257 6D7796490AF87A8C78F4A7E31F0793D8BA06FB95D54EBB9F94EB1F2D561BF66EA27DFD4788 CB47440AF6BB25ACA50203010001 Key name serverkey default Key type RSA Time when key pair created 16 48 31 2011 05 12 Key code 307C300D06092A864886F70D0101010500036B003068...

Страница 275: ...A DeviceB display public key peer name devicea Key name devicea Key type RSA Key modulus 1024 Key code 30819F300D06092A864886F70D010101050003818D0030818902818100DA3B90F59237347B 8D41B58F8143512880139EC9111BFD31EB84B6B7C7A1470027AC8F04A827B30C2CAF79242E 45FDFF51A9C7E917DB818D54CB7AEF538AB261557524A7441D288EC54A5D31EFAE4F681257 6D7796490AF87A8C78F4A7E31F0793D8BA06FB95D54EBB9F94EB1F2D561BF66EA27DFD47...

Страница 276: ...5D54EBB9F94EB1F2D561BF66EA27DFD4788 CB47440AF6BB25ACA50203010001 Key name serverkey default Key type RSA Time when key pair created 16 48 31 2011 05 12 Key code 307C300D06092A864886F70D0101010500036B003068026100C9451A80F7F0A9BA1A90C7BC 1C02522D194A2B19F19A75D9EF02219068BD7FD90FCC2AF3634EEB9FA060478DD0A1A49ACE E1362A4371549ECD85BA04DEE4D6BB8BE53B6AED7F1401EE88733CA3C4CED391BAE633028A AC41C80A15953F...

Страница 277: ...rt the host public key from the key file devicea pub DeviceB system view DeviceB public key peer devicea import sshkey devicea pub Verifying the configuration Verify that the peer host public key configured on Device B is the same as the key displayed on Device A DeviceB display public key peer name devicea Key name devicea Key type RSA Key modulus 1024 Key code 30819F300D06092A864886F70D010101050...

Страница 278: ...ith the international standards of ITU T X 509 of which X 509 v3 is the most commonly used This chapter covers the following types of certificates CA certificate Certificate of a CA Multiple CAs in a PKI system form a CA tree with the root CA at the top The root CA generates a self signed certificate and each lower level CA holds a CA certificate issued by the CA immediately above it The chain of ...

Страница 279: ...e with the CA or RA CA Certification authority that grants and manages certificates A CA issues certificates defines the certificate validity periods and revokes certificates by publishing CRLs RA Registration authority which offloads the CA by processing certificate enrollment requests The RA accepts certificate requests verifies user identity and determines whether to ask the CA to issue certifi...

Страница 280: ...can address the email requirements for confidentiality integrity authentication and non repudiation A common secure email protocol is Secure Multipurpose Internet Mail Extensions S MIME which is based on PKI and allows for transfer of encrypted mails with signature Web security PKI can be used in the SSL handshake phase to verify the identities of the communicating parties by digital certificates ...

Страница 281: ...entity and enter its view pki entity entity name By default no PKI entities exist To create multiple PKI entities repeat this step 3 Set a common name for the entity common name common name sting By default the common name is not set 4 Set the country code of the entity country country code string By default the country code is not set 5 Set the locality of the entity locality locality name By def...

Страница 282: ...y entity name By default no entity is specified 5 Specify the type of certificate request reception authority certificate request from ca ra By default no authority type is specified 6 Specify the certificate request URL certificate request url url string vpn instance vpn instance name By default the certificate request URL is not specified 7 Optional Set the SCEP polling interval and maximum numb...

Страница 283: ... packets source ip ip address interface interface type interface number Specify the source IPv6 address for the PKI protocol packets source ipv6 ipv6 address interface interface type interface number This task is required if the CA policy requires that the CA server accept certificate requests from a specific IP address or subnet By default the source IP address of PKI protocol packets is the IP a...

Страница 284: ...r RSA If DSA or ECDSA is used a PKI domain can have only one local certificate If RSA is used a PKI domain can have one local certificate for signature and one local certificate for encryption Configuring automatic certificate request IMPORTANT The device does not support automatic certificate rollover To avoid service interruptions you must manually submit a certificate renewal request before the...

Страница 285: ...in domain name password password pkcs10 filename filename This command is not saved in the configuration file This command triggers the PKI entity to automatically generate a key pair if the key pair specified in the PKI domain does not exist The name algorithm and length of the key pair are configured in the PKI domain Aborting a certificate request Before the CA issues a certificate you can abor...

Страница 286: ...u must provide the challenge password Contact the CA administrator to obtain the password If a CA certificate already exists locally you cannot obtain it again in online mode If you want to obtain a new one use the pki delete certificate command to remove the existing CA certificate and local certificates first If local or peer certificates already exist you can obtain new local or peer certificat...

Страница 287: ...til the root CA certificate is reached 5 Verifies that each CA certificate in the certificate chain is issued by the named parent CA starting from the root CA Verifying certificates with CRL checking CRL checking checks whether a certificate is in the CRL If it is the certificate has been revoked and its home entity is not trusted To use CRL checking a CRL must be obtained from a CRL repository Th...

Страница 288: ...is command is not saved in the configuration file Specifying the storage path for the certificates and CRLs CAUTION If you change the storage path save the configuration before you reboot or shut down the device to avoid loss of the certificates or the CRLs The device has a default storage path for certificates and CRLs You can change the storage path and specify different paths for the certificat...

Страница 289: ...on the terminal When you export a local certificate with RSA key pairs to a file the certificate file name might be different from the file name specified in the command The actual certificate file name depends on the purpose of the key pair contained in the certificate For more information see Security Command Reference Removing a certificate You can remove the CA certificate local certificate or...

Страница 290: ...r does not match any statements in the policy the certificate is regarded invalid If a statement is associated with a non existing attribute group or the attribute group does not have attribute rules the certificate matches the statement If the certificate based access control policy referenced by a security application for example HTTPS does not exist all certificates in the application pass the ...

Страница 291: ...as the CA server If you use Windows server or OpenCA you must install the SCEP add on for Windows server or enable SCEP for OpenCA In either case when you configure a PKI domain you must use the certificate request from ra command to specify the RA to accept certificate requests If you use RSA Keon the SCEP add on is not required When you configure a PKI domain you must use the certificate request...

Страница 292: ...le uses myca Device pki domain torsa ca identifier myca Configure the URL of the CA server The URL format is http host port Issuing Jurisdiction ID where Issuing Jurisdiction ID is a hexadecimal string generated on the CA server Device pki domain torsa certificate request url http 1 1 2 22 446 80f6214aa8865301d07929ae481c7ceed99f95bd Configure the device to send certificate requests to ca Device p...

Страница 293: ...domain torsa local Certificate Data Version 3 0x2 Serial Number 15 79 75 ec d2 33 af 5e 46 35 83 bc bd 6e e3 b8 Signature Algorithm sha1WithRSAEncryption Issuer CN myca Validity Not Before Jan 6 03 10 58 2013 GMT Not After Jan 6 03 10 58 2014 GMT Subject CN Device Subject Public Key Info Public Key Algorithm rsaEncryption Public Key 1024 bit Modulus 00 ab 45 64 a8 6c 10 70 3b b9 46 34 8d eb 1a a1 ...

Страница 294: ...example set the CA name to myca 2 Install the SCEP add on By default Windows Server 2003 does not support SCEP You must install the SCEP add on on the server for a PKI entity to register and obtain a certificate from the server After the SCEP add on installation is complete you will see a URL Specify this URL as the certificate request URL on the device 3 Modify the certificate service attributes ...

Страница 295: ...st url http 4 4 4 1 8080 certsrv mscep mscep dll Configure the device to send certificate requests to ra Device pki domain winserver certificate request from ra Set the PKI entity name to aaa Device pki domain winserver certificate request entity aaa Configure a general purpose RSA key pair named abc with a length of 1024 bits Device pki domain winserver public key rsa general name abc length 1024...

Страница 296: ...3f 5d 5b 36 9e 53 dc 3a bc 0d 11 fb d6 7d 4f 94 3c c1 90 4a 50 ce db 54 e0 b3 27 a9 6a 8e 97 fb 20 c7 44 70 8f f0 b9 ca 5b 94 f0 56 a5 2b 87 ac 80 c5 cc 04 07 65 02 39 fc db 61 f7 07 c6 65 4c e4 5c 57 30 35 b4 2e ed 9c ca 0b c1 5e 8d 2e 91 89 2f 11 e3 1e 12 8a f8 dd f8 a7 2a 94 58 d9 c7 f8 1a 78 bd f5 42 51 3b 31 5d ac 3e c3 af fa 33 2c fc c2 ed b9 ee 60 83 b3 d3 e5 8e e5 02 cf b0 c8 f0 3a a4 b7 a...

Страница 297: ...a 70 f2 fa 73 ab c1 3e 4d 12 fb 99 31 51 ab c2 84 c0 2f e5 f6 a7 c3 20 3c 9a b0 ce 5a bc 0f d9 34 56 bc 1e 6f ee 11 3f 7c b2 52 f9 45 77 52 fb 46 8a ca b7 9d 02 0d 4e c3 19 8f 81 46 4e 03 1f 58 03 bf 53 c6 c4 85 95 fb 32 70 e6 1b f3 e4 10 ed 7f 93 27 90 6b 30 e7 81 36 bb e2 ec f2 dd 2b bb b9 03 1c 54 0a 00 3f 14 88 de b8 92 63 1e f5 b3 c2 cf 0a d5 f4 80 47 6f fa 7e 2d e3 a7 38 46 f6 9e c7 57 9d 7f...

Страница 298: ...nCA server Device pki domain openca certificate request url http 192 168 222 218 cgi bin pki scep Configure the device to send certificate requests to the RA Device pki domain openca certificate request from ra Specify PKI entity aaa for certificate request Device pki domain openca certificate request entity aaa Configure a general purpose RSA key pair named abc with a length of 1024 bits Device p...

Страница 299: ...ublic Key Info Public Key Algorithm rsaEncryption Public Key 1024 bit Modulus 00 b8 7a 9a b8 59 eb fc 70 3e bf 19 54 0c 7e c3 90 a5 d3 fd ee ff c6 28 c6 32 fb 04 6e 9c d6 5a 4f aa bb 50 c4 10 5c eb 97 1d a7 9e 7d 53 d5 31 ff 99 ab b6 41 f7 6d 71 61 58 97 84 37 98 c7 7c 79 02 ac a6 85 f3 21 4d 3c 8e 63 8d f8 71 7d 28 a1 15 23 99 ed f9 a1 c3 be 74 0d f7 64 cf 0a dd 39 49 d7 3f 25 35 18 f4 1c 59 46 2...

Страница 300: ... 40 44 f3 ab e4 5a a0 06 8f af 22 a9 05 74 43 b6 e4 96 a5 d4 52 32 c2 a8 53 37 58 c7 2f 75 cf 3e 8e ed 46 c9 5a 24 b1 f5 51 1d 0f 5a 07 e6 15 7a 02 31 05 8c 03 72 52 7c ff 28 37 1e 7e 14 97 80 0b 4e b9 51 2d 50 98 f2 e4 5a 60 be 25 06 f6 ea 7c aa df 7b 8d 59 79 57 8f d4 3e 4f 51 c1 34 e6 c1 1e 71 b5 0d 85 86 a5 ed 63 1e 08 7f d2 50 ac a0 a3 9e 88 48 10 0b 4a 7d ed c1 03 9f 87 97 a3 5e 7d 75 1d ac ...

Страница 301: ...ttribute group mygroup1 Device pki cert attribute group mygroup1 attribute 1 subject name dn ctn aabbcc Device pki cert attribute group mygroup1 attribute 2 issuer name ip equ 10 0 0 1 Device pki cert attribute group mygroup1 quit Create a certificate attribute group named mygroup2 and add two attribute rules The first rule defines that the FQDN in the alternative subject name does not contain the...

Страница 302: ...rtificate import and export configuration example Network requirements As shown in Figure 88 Device B will replace Device A in the network PKI domain exportdomain on Device A has two local certificates containing the private key and one CA certificate To make sure the certificates are still valid after Device B replaces Device A copy the certificates on Device A to Device B as follows 1 Export the...

Страница 303: ...4 70 F5 17 17 20 2B 9E AC 20 F3 99 89 Key Attributes No Attributes BEGIN ENCRYPTED PRIVATE KEY MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIZtjSjfslJCoCAggA END ENCRYPTED PRIVATE KEY Display the local certificate file pkilocal pem encryption DeviceA more pkicachain pem encr Bag Attributes friendlyName localKeyID D5 DF 29 28 C8 B9 D9 49 6C B5 44 4B C2 BC 66 75 FE D6 6C C8 subject C CN O OpenCA L...

Страница 304: ...ocal pem signature Please input the password Import the local certificate file pkilocal pem encryption in PEM format to the PKI domain The certificate file contains a key pair DeviceB pki import domain importdomain pem local filename pkilocal pem encryption Please input the password Display the imported local certificate information on Device B DeviceB display pki certificate domain importdomain l...

Страница 305: ...titan 2560 1 3 6 1 5 5 7 48 12 URI http titan 830 X509v3 CRL Distribution Points Full Name URI http 192 168 40 130 pki pub crl cacrl crl Signature Algorithm sha256WithRSAEncryption 18 e7 39 9a ad 84 64 7b a3 85 62 49 e5 c9 12 56 a6 d2 46 91 53 8e 84 ba 4a 0a 6f 28 b9 43 bc e7 b0 ca 9e d4 1f d2 6f 48 c4 b9 ba c5 69 4d 90 f3 15 c4 4e 4b 1e ef 2b 1b 2d cb 47 1e 60 a9 0f 81 dc f2 65 6b 5f 7a e2 36 29 ...

Страница 306: ...f3 10 e9 ec 81 00 28 60 a9 02 bb 35 8b bf 85 75 6f 24 ab 26 de 47 6c ba 1d ee 0d 35 75 58 10 e5 e8 55 d1 43 ae 85 f8 ff 75 81 03 8c 2e 00 d1 e9 a4 5b 18 39 Exponent 65537 0x10001 X509v3 extensions X509v3 Basic Constraints CA FALSE Netscape Cert Type SSL Server X509v3 Key Usage Key Encipherment Data Encipherment Netscape Comment VPN Server of OpenCA Labs X509v3 Subject Key Identifier CC 96 03 2F FC...

Страница 307: ...72 57 72 5e 78 d6 97 ef b8 d8 6d 0c 05 28 ea 81 3a 06 a0 2e c3 79 05 cd c3 To display detailed information about the CA certificate use the display pki certificate domain command Troubleshooting PKI configuration This section provides troubleshooting information for common problems with PKI Failed to obtain the CA certificate Symptom The CA certificate cannot be obtained Analysis The network conne...

Страница 308: ...evice is not synchronized with the CA server Solution 1 Check for and fix any network connection problems 2 Obtain or import the CA certificate 3 Configure the correct LDAP server 4 Specify the key pair used for certificate request in the PKI domain or remove the existing key pair and submit a certificate request again 5 Check the registration policy on the CR or RA and make sure the attributes of...

Страница 309: ...ress that the CA server can accept For the correct settings contact the CA administrator 9 Synchronize the system time of the device with the CA server 10 If the problem persists contact Hewlett Packard Enterprise Support Failed to obtain CRLs Symptom CRLs cannot be obtained Analysis The network connection is down for example because the network cable is damaged or the connectors have bad contact ...

Страница 310: ...tain one The specified format does not match the actual format of the file to be imported Solution 1 Use undo crl check enable to disable CRL checking 2 Make sure the format of the imported file is correct 3 If the problem persists contact Hewlett Packard Enterprise Support Failed to import a local certificate Symptom A local certificate cannot be imported Analysis The PKI domain has no CA certifi...

Страница 311: ...e PKI domain The storage space of the device is full Solution 1 If the PKI domain does not have local certificates obtain or request local certificates first 2 Use mkdir to create the required path 3 Specify a correct export path 4 Configure the correct key pair in the PKI domain 5 Clear up the storage space of the device 6 If the problem persists contact Hewlett Packard Enterprise Support Failed ...

Страница 312: ...plicate packets IPsec delivers the following benefits Reduced key negotiation overhead and simplified maintenance by supporting the IKE protocol IKE provides automatic key negotiation and automatic IPsec security association SA setup and maintenance Good compatibility You can apply IPsec to all IP based application systems and services without modifying them Encryption on a per packet rather than ...

Страница 313: ...The security protocols protect the entire IP packet The entire IP packet is used to calculate the security protocol headers The calculated security protocol headers and the encrypted data only for ESP encapsulation are encapsulated in a new IP packet In this mode the encapsulated packet has two IP headers The inner IP header is the original IP header The outer IP header is added by the network dev...

Страница 314: ...ough IKE negotiations in medium and large scale dynamic networks A manually configured SA never ages out An IKE created SA has a lifetime which comes in two types Time based lifetime Defines how long the SA can be valid after it is created Traffic based lifetime Defines the maximum traffic that the SA can process If both lifetime timers are configured for an SA the SA becomes invalid when either o...

Страница 315: ...e an ACL to define the data flows to be protected specify the ACL in an IPsec policy and then apply the IPsec policy to an interface When packets sent by the interface match a permit rule of the ACL the packets are protected by the outbound IPsec SA and encapsulated with IPsec When the interface receives an IPsec packet destined for the local device it searches for the inbound IPsec SA according t...

Страница 316: ...y Make sure traffic of these protocols is not denied on the interfaces with IKE or IPsec configured IPsec tunnels can be established in different methods Choose a correct method to establish IPsec tunnels according to your network conditions ACL based IPsec tunnel Protects packets identified by an ACL To establish an ACL based IPsec tunnel configure an IPsec policy specify an ACL in the policy and...

Страница 317: ...Optional Enabling ACL checking for de encapsulated packets Optional Configuring IPsec anti replay Optional Configuring IPsec anti replay redundancy Optional Binding a source interface to an IPsec policy Optional Enabling QoS pre classify Optional Enabling logging of IPsec packets Optional Configuring the DF bit of IPsec packets Optional Configuring SNMP notifications for IPsec Optional Configuring...

Страница 318: ...ts will be sent out as normal packets If they match a permit statement at the receiving end they will be dropped by IPsec Mirror image ACLs To make sure SAs can be set up and the traffic protected by IPsec can be processed correctly between two IPsec peers create mirror image ACLs on the IPsec peers ACL for MPLS L3VPN IPsec protection To use IPsec to protect the data of an MPLS L3VPN you must spec...

Страница 319: ...ier has a higher priority The aes ctr 128 aes ctr 192 aes ctr 256 camellia cbc 128 camellia cbc 192 camellia cbc 256 gmac 128 gmac 192 gmac 256 gcm 128 gcm 192 and gcm 256 encryption algorithms and the aes xcbc mac authentication algorithm are available only for IKEv2 5 Specify the mode in which the security protocol encapsulates IP packets encapsulation mode transport tunnel By default the securi...

Страница 320: ...tbound SA The same is true of the local outbound SA and remote inbound SA The keys for the local and remote inbound and outbound SAs must be in the same format For example if the local inbound SA uses a key in characters the local outbound SA and remote inbound and outbound SAs must use keys in characters Configuration procedure To configure a manual IPsec policy Step Command Remarks 1 Enter syste...

Страница 321: ...the IPsec SA Configure keys correctly for the security protocol AH ESP or both you have specified in the IPsec transform set used by the IPsec policy If you configure a key in both the character and the hexadecimal formats only the most recent configuration takes effect If you configure a key in character format for ESP the device automatically generates an authentication key and an encryption key...

Страница 322: ...no IPsec policies exist 3 Optional Configure a description for the IPsec policy description text By default no description is configured 4 Specify an ACL for the IPsec policy security acl ipv6 acl number name acl name aggregation per host By default no ACL is specified for an IPsec policy You can specify only one ACL for an IPsec policy 5 Specify IPsec transform sets for the IPsec policy transform...

Страница 323: ...olicy template Except the IPsec transform sets and the IKE profile all other parameters are optional A device using an IPsec policy that is configured by using an IPsec policy template cannot initiate an SA negotiation but it can respond to a negotiation request The parameters not defined in the template are determined by the initiator For example in an IPsec policy template the ACL is optional If...

Страница 324: ...ified by this command must be the same as the IP address used as the local IKE identity 9 Optional Specify the remote IP address of the IPsec tunnel remote address ipv6 host name ipv4 address ipv6 ipv6 address By default the remote IP address of the IPsec tunnel is not specified 10 Optional Configure the IPsec SA lifetime sa duration time based seconds traffic based kilobytes By default the global...

Страница 325: ...iew interface interface type interface number N A 3 Apply an IPsec policy to the interface ipsec apply policy ipv6 policy policy name By default no IPsec policy is applied to an interface On an interface you can apply a maximum of two IPsec policies one IPv4 IPsec policy and one IPv6 IPsec policy An IKE based IPsec policy can be applied to multiple interfaces As a best practice apply an IKE based ...

Страница 326: ...c anti replay make sure you understand the impact of the operation on network security Set the anti replay window size as small as possible to reduce the impact on system performance IPsec anti replay requires that packets on the same interface be processed on the same slot To perform IPsec anti replay on a multichassis IRF fabric for a global interface use the service command in interface view to...

Страница 327: ...ke some time to renegotiate SAs resulting in service interruption To solve these problems bind a source interface to an IPsec policy and apply the policy to both interfaces This enables the two physical interfaces to use the same source interface to negotiate IPsec SAs As long as the source interface is up the negotiated IPsec SAs will not be removed and will keep working regardless of link failov...

Страница 328: ... A 2 Enter IPsec policy view or IPsec policy template view To enter IPsec policy view ipsec policy ipv6 policy policy name seq number isakmp manual To enter IPsec policy template view ipsec policy template ipv6 policy template template name seq number N A 3 Enable QoS pre classify qos pre classify By default QoS pre classify is disabled Enabling logging of IPsec packets Perform this task to enable...

Страница 329: ...Psec packet size To configure the DF bit of IPsec packets on an interface Step Command Remarks 1 Enter system view system view N A 2 Enter interface view interface interface type interface number N A 3 Configure the DF bit of IPsec packets on the interface ipsec df bit clear copy set By default the interface uses the global DF bit setting To configure the DF bit of IPsec packets globally Step Comm...

Страница 330: ...le Step Command Remarks 1 Enter system view system view N A 2 Create a manual IPsec profile and enter its view ipsec profile profile name manual By default no IPsec profile exists The manual keyword is not needed if you enter the view of an existing IPsec profile 3 Optional Configure a description for the IPsec profile description text By default no description is configured 4 Specify an IPsec tra...

Страница 331: ... globally snmp agent trap enable ipsec global By default SNMP notifications for IPsec are disabled 3 Enable SNMP notifications for the specified failure or event types snmp agent trap enable ipsec auth failure decrypt failure encrypt failure invalid sa failure no sa failure policy add policy attach policy delete policy detach tunnel start tunnel stop By default SNMP notifications for all failure a...

Страница 332: ... Execute display commands in any view and reset commands in user view Task Command Display IPsec policy information display ipsec ipv6 policy policy policy name seq number Display IPsec policy template information display ipsec ipv6 policy template policy template template name seq number Display IPsec profile information display ipsec profile profile name Display IPsec transform set information d...

Страница 333: ...chA acl ipv4 adv 3101 rule 0 permit ip source 2 2 2 1 0 destination 2 2 3 1 0 SwitchA acl ipv4 adv 3101 quit Create an IPsec transform set named tran1 SwitchA ipsec transform set tran1 Specify the encapsulation mode as tunnel SwitchA ipsec transform set tran1 encapsulation mode tunnel Specify the security protocol as ESP RouterA ipsec transform set tran1 protocol esp Specify the ESP encryption and...

Страница 334: ...tion mode as tunnel SwitchB ipsec transform set tran1 encapsulation mode tunnel Specify the security protocol as ESP SwitchB ipsec transform set tran1 protocol esp Specify the ESP encryption and authentication algorithms SwitchB ipsec transform set tran1 esp encryption algorithm aes cbc 192 SwitchB ipsec transform set tran1 esp authentication algorithm sha1 SwitchB ipsec transform set tran1 quit C...

Страница 335: ...Path MTU 1443 Tunnel local address 2 2 2 1 remote address 2 2 3 1 Flow as defined in ACL 3101 Inbound ESP SA SPI 54321 0x0000d431 Transform set ESP ENCRYPT AES CBC 192 ESP AUTH SHA1 No duration limit for this SA Outbound ESP SA SPI 12345 0x00003039 Transform set ESP ENCRYPT AES CBC 192 ESP AUTH SHA1 No duration limit for this SA Configuring IPsec for RIPng Network requirements As shown in Figure 9...

Страница 336: ...00 quit Create and configure the IPsec transform set named tran1 SwitchA ipsec transform set tran1 SwitchA ipsec transform set tran1 encapsulation mode transport SwitchA ipsec transform set tran1 protocol esp SwitchA ipsec transform set tran1 esp encryption algorithm aes cbc 128 SwitchA ipsec transform set tran1 esp authentication algorithm sha1 SwitchA ipsec transform set tran1 quit Create and co...

Страница 337: ...chB ipsec profile profile001 quit Apply the IPsec profile to RIPng process 1 SwitchB ripng 1 SwitchB ripng 1 enable ipsec profile profile001 SwitchB ripng 1 quit 3 Configure Switch C Configure IPv6 addresses for interfaces Details not shown Configure basic RIPng SwitchC system view SwitchC ripng 1 SwitchC ripng 1 quit SwitchC interface vlan interface 200 SwitchC Vlan interface200 ripng 1 enable Sw...

Страница 338: ...IPng process 1 SwitchA display ripng 1 RIPng process 1 Preference 100 Checkzero Enabled Default Cost 0 Maximum number of balanced paths 8 Update time 30 sec s Timeout time 180 sec s Suppress time 120 sec s Garbage Collect time 120 sec s Number of periodic updates sent 186 Number of trigger updates sent 1 IPsec profile name profile001 Use the display ipsec sa command to display the established IPse...

Страница 339: ...otiates SAs when the sequence number in the AH or ESP header overflows making sure IPsec can provide the anti replay service by using the sequence number As shown in Figure 94 IKE negotiates SAs for IPsec and transfers the SAs to IPsec and IPsec uses the SAs to protect IP packets Figure 94 Relationship between IKE and IPsec IKE negotiation process IKE negotiates keys and SAs for IPsec in two phase...

Страница 340: ...ion key distribution and IPsec SA establishment on insecure networks Identity authentication The IKE identity authentication mechanism is used to authenticate the identity of the communicating peers The device supports the following identity authentication methods Pre shared key authentication Two communicating peers use the pre configured shared key for identity authentication RSA signature authe...

Страница 341: ... FIPS and non FIPS mode IKE configuration prerequisites Determine the following parameters prior to IKE configuration The algorithms to be used during IKE negotiation including the identity authentication method encryption algorithm authentication algorithm and DH group Different algorithms provide different levels of protection A stronger algorithm provides more resistance to decryption but uses ...

Страница 342: ...gure the local ID the ID that the device uses to identify itself to the peer during IKE negotiation For digital signature authentication the device can use an ID of any type If the local ID is an IP address that is different from the IP address in the local certificate the device uses the FQDN the device name configured by using the sysname command instead For pre shared key authentication the dev...

Страница 343: ...ture authentication certificate domain domain name Configure at least one command as required By default no IKE keychain or PKI domain is specified for an IKE profile 5 Specify the IKE negotiation mode for phase 1 In non FIPS mode exchange mode aggressive main In FIPS mode exchange mode main By default the main mode is used during IKE negotiation phase 1 6 Specify IKE proposals for the IKE profile...

Страница 344: ...ls specified in the IKE profile to the peer An IKE proposal specified earlier for the IKE profile has a higher priority If the initiator is using an IPsec policy with no IKE profile the initiator sends all its IKE proposals to the peer An IKE proposal with a smaller number has a higher priority The peer searches its own IKE proposals for a match The search starts from the IKE proposal with the hig...

Страница 345: ...on Follow these guidelines when you configure an IKE keychain 1 Two peers must be configured with the same pre shared key to pass pre shared key authentication 2 You can specify the local address configured in IPsec policy or IPsec policy template view using the local address command for the IKE keychain to be applied If no local address is configured specify the IP address of the interface that u...

Страница 346: ...tication is used you cannot set the DN as the identity To configure the global identity information Step Command Remarks 1 Enter system view system view N A 2 Configure the global identity to be used by the local end ike identity address ipv4 address ipv6 ipv6 address dn fqdn fqdn name user fqdn user fqdn name By default the IP address of the interface to which the IPsec policy or IPsec policy tem...

Страница 347: ...tting data to the intended end To prevent NAT sessions from being aged configure the NAT keepalive feature on the IKE gateway behind the NAT device to send NAT keepalive packets to its peer periodically to keep the NAT session alive To configure the IKE NAT keepalive feature Step Command Remarks 1 Enter system view system view N A 2 Set the IKE NAT keepalive interval ike nat keepalive seconds The ...

Страница 348: ... find an SA an invalid SPI is encountered The peer drops the data packet and tries to send an SPI invalid notification to the data originator This notification is sent by using the IKE SA Because no IKE SA is available the notification is not sent The originating peer continues sending the data by using the IPsec SA that has the invalid SPI and the receiving peer keeps dropping the traffic The inv...

Страница 349: ...generate and output SNMP notifications for a specific IKE failure or event type perform the following tasks 1 Enable SNMP notifications for IKE globally 2 Enable SNMP notifications for the failure or event type To configure SNMP notifications for IKE Step Command Remarks 1 Enter system view system view N A 2 Enable SNMP notifications for IKE globally snmp agent trap enable ike global By default SN...

Страница 350: ...gure Switch A Configure an IP address for VLAN interface 1 SwitchA system view SwitchA interface vlan interface 1 SwitchA Vlan interface1 ip address 2 2 2 1 255 255 255 0 SwitchA Vlan interface1 quit Configure an IPv4 advanced ACL to identify the data flows between Switch A and Switch B SwitchA acl advanced 3101 SwitchA acl ipv4 adv 3101 rule 0 permit ip source 2 2 2 1 0 destination 2 2 3 1 0 Swit...

Страница 351: ...1 SwitchA ipsec policy isakmp map1 10 remote address 2 2 3 1 Specify IKE profile profile1 SwitchA ipsec policy isakmp map1 10 ike profile profile1 SwitchA ipsec policy isakmp map1 10 quit Apply IPsec policy map1 to VLAN interface 1 SwitchA interface vlan interface 1 SwitchA Vlan interface1 ipsec apply policy map1 2 Configure Switch B Configure an IP address for VLAN interface 1 SwitchB system view...

Страница 352: ...m set tran1 Specify the local and remote IP addresses of the IPsec tunnel as 2 2 3 1 and 2 2 2 1 SwitchB ipsec policy isakmp use1 10 local address 2 2 3 1 SwitchB ipsec policy isakmp use1 10 remote address 2 2 2 1 Specify IKE profile profile1 SwitchB ipsec policy isakmp use1 10 ike profile profile1 SwitchB ipsec policy isakmp use1 10 quit Apply IPsec policy use1 to VLAN interface 1 SwitchB interfa...

Страница 353: ...witchA ipsec transform set tran1 esp encryption algorithm aes cbc 192 SwitchA ipsec transform set tran1 esp authentication algorithm sha1 SwitchA ipsec transform set tran1 quit Create an IKE keychain named keychain1 SwitchA ike keychain keychain1 Specify 12345zxcvb ZXCVB in plain text as the pre shared key to be used with the remote peer at 2 2 2 2 SwitchA ike keychain keychain1 pre shared key add...

Страница 354: ... the packet encapsulation mode to tunnel SwitchB ipsec transform set tran1 encapsulation mode tunnel Use the ESP protocol for the IPsec transform set SwitchB ipsec transform set tran1 protocol esp Specify the encryption and authentication algorithms SwitchB ipsec transform set tran1 esp encryption algorithm aes cbc 192 SwitchB ipsec transform set tran1 esp authentication algorithm sha1 SwitchB ips...

Страница 355: ...tch A and Switch B to trigger IKE negotiation After IPsec SAs are successfully negotiated by IKE the traffic between the two switches is IPsec protected Troubleshooting IKE IKE negotiation failed because no matching IKE proposals were found Symptom 1 The IKE SA is in Unknown state Sysname display ike sa Connection ID Remote Flag DOI 1 192 168 222 5 Unknown IPSEC Flags RD READY RL REPLACED FD FADIN...

Страница 356: ...the matched IKE profile is not using the matched IKE keychain Failed to find keychain keychain1 in profile profile1 Solution Verify that the matched IKE proposal IKE proposal 1 in this debugging message example is specified for the IKE profile IKE profile 1 in the example Verify that the matched IKE keychain IKE keychain 1 in this debugging message example is specified for the IKE profile IKE prof...

Страница 357: ...ATION Analysis Certain IPsec policy settings of the responder are incorrect Verify the settings as follows 1 Use the display ike sa verbose command to verify that matching IKE profiles were found in IKE negotiation phase 1 If no matching IKE profiles were found and the IPsec policy is using an IKE profile the IPsec SA negotiation fails Verify that matching IKE profiles were found in IKE negotiatio...

Страница 358: ...es a flow from one network segment to another but the responder s ACL defines a flow from one host to another host IPsec proposal matching will fail On the initiator Sysname display acl 3000 Advanced IPv4 ACL 3000 1 rule ACL s step is 5 rule 0 permit ip source 192 168 222 0 0 0 0 255 destination 192 168 222 0 0 0 0 255 On the responder Sysname display acl 3000 Advanced IPv4 ACL 3000 1 rule ACL s s...

Страница 359: ...move the specified IKE profile from the IPsec policy Modify the specified IKE profile to match the IKE profile of the initiator 2 If the flow range defined by the responder s ACL is smaller than that defined by the initiator s ACL modify the responder s ACL so the ACL defines a flow range equal to or greater than that of the initiator s ACL For example Sysname display acl 3000 Advanced IPv4 ACL 30...

Страница 360: ...changes during the initial exchange process IKE_SA_INIT and IKE_AUTH each with two messages IKE_SA_INIT exchange Negotiates IKE SA parameters and exchanges keys IKE_AUTH exchange Authenticates the identity of the peer and establishes IPsec SAs After the four message initial exchanges IKEv2 sets up one IKE SA and one pair of IPsec SAs For IKEv1 to set up one IKE SA and one pair of IPsec SAs it must...

Страница 361: ...ders the initiator valid and proceeds with the negotiation If the carried cookie is incorrect the responder terminates the negotiation The cookie challenging mechanism automatically stops working when the number of half open IKE SAs drops below the threshold IKEv2 SA rekeying For security purposes both IKE SAs and IPsec SAs have a lifetime and must be rekeyed when the lifetime expires An IKEv1 SA ...

Страница 362: ...ie challenging feature takes effect only on IKEv2 responders Configuring an IKEv2 profile An IKEv2 profile is intended to provide a set of parameters for IKEv2 negotiation To configure an IKEv2 profile perform the following tasks 1 Specify the local and remote identity authentication methods The local and remote identity authentication methods must both be specified and they can be different You c...

Страница 363: ...kets after it de encapsulates them If you specify an inside VPN instance the device looks for a route in the specified VPN instance to forward the packets If you do not specify an inside VPN instance the internal and external networks are in the same VPN instance The device looks for a route in this VPN instance to forward the packets 11 Configure the NAT keepalive interval Configure this task whe...

Страница 364: ... address interface type interface number ipv4 address ipv6 ipv6 address By default an IKEv2 profile can be applied to any local interface or IP address 9 Optional Specify a priority for the IKEv2 profile priority priority By default the priority of an IKEv2 profile is 100 10 Optional Specify a VPN instance for the IKEv2 profile match vrf name vrf name any By default an IKEv2 profile belongs to the...

Страница 365: ...view ikev2 policy policy name By default an IKEv2 policy named default exists 3 Specify the local interface or address used for IKEv2 policy matching match local address interface type interface number ipv4 address ipv6 ipv6 address By default no local interface or address is used for IKEv2 policy matching and the policy matches any local interface or address 4 Specify a VPN instance for IKEv2 pol...

Страница 366: ...n FIPS mode encryption 3des cbc aes cbc 128 aes cbc 192 aes cbc 256 aes ctr 128 aes ctr 192 aes ctr 256 camellia cbc 128 camellia cbc 192 camellia cbc 256 des cbc In FIPS mode encryption aes cbc 128 aes cbc 192 aes cbc 256 aes ctr 128 aes ctr 192 aes ctr 256 By default an IKEv2 proposal does not have any encryption algorithms 4 Specify the integrity protection algorithms In non FIPS mode integrity...

Страница 367: ...tem view N A 2 Create an IKEv2 keychain and enter IKEv2 keychain view ikev2 keychain keychain name By default no IKEv2 keychains exist 3 Create an IKEv2 peer and enter IKEv2 peer view peer name By default no IKEv2 peers exist 4 Configure the information for identifying the IKEv2 peer To configure a host name for the peer hostname host name To configure a host IP address or address range for the pe...

Страница 368: ...nterval exceeds the DPD interval it sends a DPD message to the peer to detect its liveliness If the device has no data to send it never sends DPD messages If you configure IKEv2 DPD in both IKEv2 profile view and system view the IKEv2 DPD settings in IKEv2 profile view apply If you do not configure IKEv2 DPD in IKEv2 profile view the IKEv2 DPD settings in system view apply To configure global IKEv...

Страница 369: ... tunnel id Display IKEv2 statistics display ikev2 statistics Delete IKEv2 SAs and the child SAs negotiated through the IKEv2 SAs reset ikev2 sa local remote ipv4 address ipv6 ipv6 address vpn instance vpn instance name tunnel tunnel id fast Clear IKEv2 statistics reset ikev2 statistics Troubleshooting IKEv2 IKEv2 negotiation failed because no matching IKEv2 proposals were found Symptom The IKEv2 S...

Страница 370: ...nd IKEv2 proposals are correctly configured on both ends The two ends cannot establish an IPsec tunnel or cannot communicate through the established IPsec tunnel Analysis The IKEv2 SA or IPsec SAs on either end are lost The reason might be that the network is unstable and the device reboots Solution 1 Use the display ikev2 sa command to examine whether an IKEv2 SA exists on both ends If the IKEv2 ...

Страница 371: ... allowing a user to log in to the device for file upload and download The device can also act as an SCP client enabling a user to log in from the device to a remote device for secure file transfer NETCONF over SSH Based on SSH2 it enables users to securely log in to the device through SSH and perform NETCONF operations on the device through the NETCONF over SSH connections The device can act only ...

Страница 372: ...cute commands of more than 2000 bytes save the commands in a configuration file upload the file to the server through SFTP and use it to restart the server SSH authentication methods This section describes authentication methods that are supported by the device when it acts as an SSH server Password authentication The SSH server authenticates a client through the AAA mechanism The password authent...

Страница 373: ...t public key configuration see Managing public keys Password publickey authentication The server requires SSH2 clients to pass both password authentication and publickey authentication However an SSH1 client only needs to pass either authentication Any authentication The server requires clients to pass password authentication or publickey authentication SSH support for Suite B Suite B contains a s...

Страница 374: ...ny Optional if the authentication method is password Optional Configuring the SSH management parameters N A Optional Specifying a PKI domain for the SSH server N A Generating local key pairs The DSA ECDSA or RSA key pairs on the SSH server are required for generating the session keys and session ID in the key exchange stage They can also be used by a client to authenticate the server When a client...

Страница 375: ... create ecdsa secp384r1 command generates only one ECDSA host key pair Configuration procedure To generate local key pairs on the SSH server Step Command Remarks 1 Enter system view system view N A 2 Generate local key pairs public key local create dsa ecdsa secp256r1 secp384r1 rsa By default no local key pairs exist on the server Enabling the Stelnet server After you enable the Stelnet server on ...

Страница 376: ...Enter system view system view N A 2 Enable NETCONF over SSH netconf ssh server enable By default NETCONF over SSH is disabled For more information about NETCONF over SSH commands see Network Management and Monitoring Command Reference Configuring the user lines for SSH login Depending on the SSH application an SSH client can be an Stelnet client SFTP client SCP client or NETCONF over SSH client On...

Страница 377: ... best practice Entering a client s host public key Before you enter the client s host public key you must use the display public key local public command on the client to obtain the client s host public key To enter a client s host public key Step Command Remarks 1 Enter system view system view N A 2 Enter public key view public key peer keyname N A 3 Configure a client s host public key Enter the...

Страница 378: ...directory depends on the authentication method If the authentication method is password the working directory is authorized by AAA If the authentication method is publickey or password publickey the working folder is specified by the authorization attribute command in the associated local user view For an SSH user the user role also depends on the authentication method If the authentication method...

Страница 379: ...al for updating the RSA server key pair ssh server rekey interval interval By default the RSA server key pair is not updated This command takes effect only on SSH1 users This command is not available in FIPS mode 4 Set the SSH user authentication timeout timer ssh server authentication timeout time out value The default setting is 60 seconds If a user does not finish the authentication when the ti...

Страница 380: ...t affect online SSH users Specifying a PKI domain for the SSH server The PKI domain specified for the SSH server has the following functions The SSH server uses the PKI domain to send its certificate to the client in the key exchange stage The SSH server uses the PKI domain to authenticate the client s certificate if no PKI domain is specified for the client authentication by using the ssh user co...

Страница 381: ...rposes Ensuring the communication between the Stelnet client and the Stelnet server Improving the manageability of Stelnet clients in authentication service To specify the source IP address for SSH packets Step Command Remarks 1 Enter system view system view N A 2 Specify the source address for SSH packets Specify the source IPv4 address for SSH packets ssh client source interface interface type i...

Страница 382: ...3des cbc aes128 cbc aes128 ctr aes128 gcm aes192 ctr aes256 cbc aes256 ctr aes256 gcm des cbc prefer stoc hmac md5 md5 96 sha1 sha1 96 sha2 256 sha2 512 dscp dscp value escape character public key keyname server pki domain domain name source interface interface type interface number ip ip address In FIPS mode ssh2 server port number vpn instance vpn instance name identity key ecdsa sha2 nistp256 e...

Страница 383: ...istp384 rsa x509v3 ecdsa sha2 nistp384 x509v3 ecdsa sha2 nistp256 pki domain domain name prefer compress zlib prefer ctos cipher aes128 cbc aes128 ctr aes128 gcm aes192 ctr aes256 cbc aes256 ctr aes256 gcm prefer ctos hmac sha1 sha1 96 sha2 256 sha2 512 prefer kex dh group14 sha1 ecdh sha2 nistp256 ecdh sha2 nistp384 prefer stoc cipher aes128 cbc aes128 ctr aes128 gcm aes192 ctr aes256 cbc aes256 ...

Страница 384: ...P directories N A Optional Working with SFTP files N A Optional Displaying help information N A Optional Terminating the connection with the SFTP server N A Generating local key pairs Generate local key pairs on the SFTP client when the SFTP server uses the authentication method publickey password publickey or any Configuration restrictions and guidelines When you generate local key pairs on an SF...

Страница 385: ...ishing a connection to an SFTP server When you try to access an SFTP server the device must use the server s host public key to authenticate the server If the server s host public key is not configured on the device the device will notify you to confirm whether to continue with the access If you choose to continue the device accesses the server and downloads the server s host public key If you cho...

Страница 386: ...6 sha2 256 sha2 512 public key keyname server pki domain domain name source interface interface type interface number ip ip address To establish a connection to an IPv6 SFTP server Task Command Remarks Establish a connection to an IPv6 SFTP server In non FIPS mode sftp ipv6 server port number vpn instance vpn instance name i interface type interface number identity key dsa ecdsa sha2 nistp256 ecds...

Страница 387: ...To establish a connection to an SFTP server based on Suite B Task Command Remarks Establish a connection to an SFTP server based on Suite B Establish a connection to an IPv4 SFTP server based on Suite B sftp server port number vpn instance vpn instance name suite b 128 bit 192 bit pki domain domain name server pki domain domain name prefer compress zlib dscp dscp value source interface interface t...

Страница 388: ...Download a file from the SFTP server and save it locally get remote file local file Available in SFTP client view Upload a local file to the SFTP server put local file remote file Available in SFTP client view Display files under a directory dir a l remote path ls a l remote path Available in SFTP client view The dir command has the same function as the ls command Delete one or more directories fr...

Страница 389: ... pairs The key modulus length must be less than 2048 bits when you generate a DSA key pair Configuration procedure To generate local key pairs on the SCP client Step Command Remarks 1 Enter system view system view N A 2 Generate local key pairs public key local create dsa ecdsa secp256r1 secp384r1 rsa By default no local key pairs exist on an SCP client Establishing a connection to an SCP server W...

Страница 390: ... get source file name destination file name identity key ecdsa sha2 nistp256 ecdsa sha2 nistp384 rsa x509v3 ecdsa sha2 nistp384 x509v3 ecdsa sha2 nistp256 pki domain domain name prefer compress zlib prefer ctos cipher aes128 cbc aes128 ctr aes128 gcm aes192 ctr aes256 cbc aes256 ctr aes256 gcm prefer ctos hmac sha1 sha1 96 sha2 256 sha2 512 prefer kex dh group14 sha1 ecdh sha2 nistp256 ecdh sha2 n...

Страница 391: ...mac sha1 sha1 96 sha2 256 sha2 512 prefer kex dh group14 sha1 ecdh sha2 nistp256 ecdh sha2 nistp384 prefer stoc cipher aes128 cbc aes128 ctr aes128 gcm aes192 ctr aes256 cbc aes256 ctr aes256 gcm prefer stoc hmac sha1 sha1 96 sha2 256 sha2 512 public key keyname server pki domain domain name source interface interface type interface number ipv6 ipv6 address Establishing a connection to an SCP serv...

Страница 392: ...ct SSH1 sessions Specifying key exchange algorithms for SSH2 Step Command Remarks 1 Enter system view system view N A 2 Specify key exchange algorithms for SSH2 In non FIPS mode ssh2 algorithm key exchange dh group exchange sha1 dh group1 sha1 dh group14 sha1 ecdh sha2 nistp256 ecdh sha2 nistp384 In FIPS mode ssh2 algorithm key exchange dh group14 sha1 ecdh sha2 nistp256 ecdh sha2 nistp384 By defa...

Страница 393: ... encryption algorithms aes128 ctr aes192 ctr aes256 ctr aes128 gcm aes256 gcm aes128 cbc 3des cbc aes256 cbc and des cbc in descending order of priority for algorithm negotiation Specifying MAC algorithms for SSH2 Step Command Remarks 1 Enter system view system view N A 2 Specify MAC algorithms for SSH2 In non FIPS mode ssh2 algorithm mac md5 md5 96 sha1 sha1 96 sha2 256 sha2 512 In FIPS mode ssh2...

Страница 394: ... RSA key pairs are supported Do not generate a DSA key pair on the Stelnet server Password authentication enabled Stelnet server configuration example Network requirements As shown in Figure 99 The switch acts as the Stelnet server and uses password authentication The username and password of the client are saved on the switch Establish an Stelnet connection between the host and the switch so you ...

Страница 395: ...tion mode scheme Switch line vty0 63 quit Create a local device management user named client001 Switch local user client001 class manage Set the password to aabbcc in plain text for local user client001 Switch luser manage client001 password simple aabbcc Authorize local user client001 to use the SSH service Switch luser manage client001 service type ssh Assign the network admin user role to local...

Страница 396: ...ample and password aabbcc in this example you can enter the CLI of the server Publickey authentication enabled Stelnet server configuration example Network requirements As shown in Figure 101 the switch acts as the Stelnet server and it uses publickey authentication and the RSA public key algorithm Establish an Stelnet connection between the host and the switch so you can log in to the switch to c...

Страница 397: ...example uses an Stelnet client that runs PuTTY version 0 58 The configuration procedure is as follows 1 Generate RSA key pairs on the Stelnet client a Run PuTTYGen exe on the client select SSH 2 RSA and click Generate Figure 102 Generating a key pair on the client a Continue moving the mouse during the key generating process but do not place the mouse over the green progress bar shown in Figure 10...

Страница 398: ...ting process a After the key pair is generated click Save public key to save the public key A file saving window appears Figure 104 Saving a key pair on the client d Enter a file name key pub in this example and click Save ...

Страница 399: ...enerate a DSA key pair Switch public key local create dsa The range of public key modulus is 512 2048 If the key modulus is greater than 512 it will take a few minutes Press CTRL C to abort Input the modulus length default 1024 Generating Keys Create the key pair successfully Generate an ECDSA key pair Switch public key local create ecdsa secp256r1 Generating Keys Create the key pair successfully ...

Страница 400: ... user client002 to use the SSH service Switch luser manage client002 service type ssh Assign the network admin user role to local user client002 Switch luser manage client002 authorization attribute user role network admin Switch luser manage client002 quit 3 Specify the private key file and establish a connection to the Stelnet server a Launch PuTTY exe on the Stelnet client to enter the interfac...

Страница 401: ...lect Connection SSH Auth from the navigation tree The window shown in Figure 107 appears f Click Browse to bring up the file selection window navigate to the private key file private ppk in this example and click OK Figure 107 Specifying the private key file ...

Страница 402: ...you can log in to Switch B to configure and manage Switch B Figure 108 Network diagram Configuration procedure 1 Configure the Stelnet server Generate RSA key pairs SwitchB system view SwitchB public key local create rsa The range of public key modulus is 512 2048 If the key modulus is greater than 512 it will take a few minutes Press CTRL C to abort Input the modulus length default 1024 Generatin...

Страница 403: ...SSH user named client001 Specify the service type as stelnet and the authentication method as password for the user SwitchB ssh user client001 service type stelnet authentication type password 2 Establish a connection to the Stelnet server Assign an IP address to VLAN interface 2 SwitchA system view SwitchA interface vlan interface 2 SwitchA Vlan interface2 ip address 192 168 1 56 255 255 255 0 Sw...

Страница 404: ...866991113B2D SwitchA pkey public key key1 485348 SwitchA pkey public key key1 peer public key end SwitchA quit Establish an SSH connection to the server and specify the host public key of the server SwitchA ssh2 192 168 1 40 public key key1 Username client001 Press CTRL C to abort Connecting to 192 168 1 40 port 22 client001 192 168 1 40 s password Enter a character and a dot to abort Copyright c ...

Страница 405: ...can log in to Switch B to configure and manage Switch B Figure 109 Network diagram Configuration procedure In the server configuration the client s host public key is required Generate a DSA key pair on the client before configuring the Stelnet server 1 Configure the Stelnet client Assign an IP address to VLAN interface 2 SwitchA system view SwitchA interface vlan interface 2 SwitchA Vlan interfac...

Страница 406: ... Create the key pair successfully Generate an ECDSA key pair SwitchB public key local create ecdsa secp256r1 Generating Keys Create the key pair successfully Enable the Stelnet server SwitchB ssh server enable Assign an IP address to VLAN interface 2 The Stelnet client uses this address as the destination address for SSH connection SwitchB interface vlan interface 2 SwitchB Vlan interface2 ip addr...

Страница 407: ...nd a dot to abort Copyright c 2010 2016 Hewlett Packard Enterprise Development LP Without the owner s prior written consent no decompiling or reverse engineering shall be allowed SwitchB Select Yes to access the server and download the server s host public key At the next connection attempt the client authenticates the server by using the saved server s host public key on the client Stelnet config...

Страница 408: ...r ecdsa256 p12 to PKI domain server256 SwitchA pki import domain server256 p12 local filename ssh server ecdsa256 p12 The system is going to save the key pair You must specify a key pair name which is a case insensitive string of 1 to 64 characters Valid characters include a to z A to Z 0 to 9 and hyphens Please enter the key pair name default name server256 Display information about local certifi...

Страница 409: ...a256 p12 to PKI domain client256 SwitchA pki import domain client256 p12 local filename ssh client ecdsa256 p12 The system is going to save the key pair You must specify a key pair name which is a case insensitive string of 1 to 64 characters Valid characters include a to z A to Z 0 to 9 and hyphens Please enter the key pair name default name client256 Display information about local certificates ...

Страница 410: ... the client s certificate file ssh client ecdsa256 p12 to the Stelnet server through FTP or TFTP Details not shown Create a PKI domain named client256 for verifying the client s certificate and import the file of the client s certificate to this domain Details not shown Create a PKI domain named server256 for the server s certificate and import the file of the server s certificate to this domain D...

Страница 411: ...2 192 168 1 40 suite b 128 bit pki domain client256 server pki domain server256 Username client001 Press CTRL C to abort Connecting to 192 168 1 40 port 22 Enter a character and a dot to abort Copyright c 2010 2016 Hewlett Packard Enterprise Development LP Without the owner s prior written consent no decompiling or reverse engineering shall be allowed SwitchB SFTP configuration examples Unless oth...

Страница 412: ...er than 512 it will take a few minutes Press CTRL C to abort Input the modulus length default 1024 Generating Keys Create the key pair successfully Generate an ECDSA key pair Switch public key local create ecdsa secp256r1 Generating Keys Create the key pair successfully Enable the SFTP server Switch sftp server enable Assign an IP address to VLAN interface 2 The client uses this address as the des...

Страница 413: ...assword and service type as sftp for the user Switch ssh user client002 service type sftp authentication type password 2 Establish a connection between the SFTP client and the SFTP server The device supports different types of SFTP client software This example uses an SFTP client that runs PSFTP of PuTTy version 0 58 NOTE PSFTP supports only password authentication To establish a connection to the...

Страница 414: ...face vlan interface 2 SwitchA Vlan interface2 ip address 192 168 0 2 255 255 255 0 SwitchA Vlan interface2 quit Generate RSA key pairs SwitchA public key local create rsa The range of public key size is 512 2048 If the key modulus is greater than 512 it will take a few minutes Press CTRL C to abort Input the modulus length default 1024 Generating Keys Create the key pair successfully Export the ho...

Страница 415: ... peer public key from the public key file pubkey and name it switchkey SwitchB public key peer switchkey import sshkey pubkey Create an SSH user named client001 Specify the service type as sftp and the authentication method as publickey for the user Assign the public key switchkey to the user SwitchB ssh user client001 service type sftp authentication type publickey assign publickey switchkey Crea...

Страница 416: ... verify the result sftp mkdir new1 sftp dir l rwxrwxrwx 1 noone nogroup 1759 Aug 23 06 52 config cfg rwxrwxrwx 1 noone nogroup 225 Aug 24 08 01 pubkey2 rwxrwxrwx 1 noone nogroup 283 Aug 24 07 39 pubkey drwxrwxrwx 1 noone nogroup 0 Sep 01 06 22 new rwxrwxrwx 1 noone nogroup 225 Sep 01 06 55 pub drwxrwxrwx 1 noone nogroup 0 Sep 02 06 30 new1 Change the name of directory new1 to new2 and verify the r...

Страница 417: ...erver s certificate Details not shown You must first configure the certificates of the server and the client because they are required for identity authentication between the two parties In this example the server s certificate file is ssh server ecdsa384 p12 and the client s certificate file is ssh client ecdsa384 p12 2 Configure the SFTP client NOTE You can modify the pkix version of the client ...

Страница 418: ...4 3a 7c 5d b7 be d1 e6 9e f0 ce 95 39 ca fd a0 86 cd 54 ab 49 60 10 be 67 9f 90 3a 18 e2 7d d9 5f 72 27 09 e7 bf 7e 64 0a 59 bb b3 7d ae 88 14 94 45 b9 34 d2 f3 93 e1 ba b4 50 15 eb e5 45 24 31 10 c7 07 01 f9 dc a5 6f 81 ASN1 OID secp384r1 NIST CURVE P 384 X509v3 extensions X509v3 Basic Constraints CA FALSE Netscape Comment OpenSSL Generated Certificate X509v3 Subject Key Identifier 10 16 64 2C DA...

Страница 419: ...ter Aug 19 10 10 59 2016 GMT Subject C CN ST BBB O AAA OU Software CN ssh client Subject Public Key Info Public Key Algorithm id ecPublicKey Public Key 384 bit pub 04 85 7c 8b f4 7a 36 bf 74 f6 7c 72 f9 08 69 d0 b9 ac 89 98 17 c9 fc 89 94 43 da 9a a6 89 41 d3 72 24 9b 9a 29 a8 d1 ba b4 e5 77 ba fc df ae c6 dd 46 72 ab bc d1 7f 18 7d 54 88 f6 b4 06 54 7e e7 4d 49 b4 07 dc 30 54 4b b6 5b 01 10 51 6b...

Страница 420: ... an IP address to VLAN interface 2 SwitchB interface vlan interface 2 SwitchB Vlan interface2 ip address 192 168 0 1 255 255 255 0 SwitchB Vlan interface2 quit Set the authentication mode to AAA for user lines SwitchB line vty 0 15 SwitchB line vty0 15 authentication mode scheme SwitchB line vty0 15 quit Create a local device management user named client001 Authorize the user to use the SSH servic...

Страница 421: ...tablish an SCP connection between Switch A and Switch B so you can log in to Switch B to transfer files Figure 115 Network diagram Configuration procedure 1 Configure the SCP server Generate RSA key pairs SwitchB system view SwitchB public key local create rsa The range of public key modulus is 512 2048 If the key modulus is greater than 512 it will take a few minutes Press CTRL C to abort Input t...

Страница 422: ...er role network admin SwitchB luser manage client001 quit Create an SSH user named client001 Specify the service type as scp and the authentication method as password for the user SwitchB ssh user client001 service type scp authentication type password 2 Configure an IP address for VLAN interface 2 on the SCP client SwitchA system view SwitchA interface vlan interface 2 SwitchA Vlan interface2 ip ...

Страница 423: ...ient ecdsa256 p12 and ssh client ecdsa384 p12 to the SCP client through FTP or TFTP Details not shown Create a PKI domain named server256 for verifying the server s certificate ecdsa256 and enter its view SwitchA system view SwitchA pki domain server256 Disable CRL checking SwitchA pki domain server256 undo crl check enable SwitchA pki domain server256 quit Import local certificate file ssh server...

Страница 424: ...04 1c 61 78 f6 6b 7e f9 f9 42 8d 7c a7 bb 47 7c 2a 85 67 0d 81 12 0b 02 98 bc 06 1f c1 3c 9b c2 1b 4c 44 38 5a 14 b2 48 63 02 2b Create a PKI domain named client256 for the client s certificate ecdsa256 and enter its view SwitchA pki domain client256 Disable CRL checking SwitchA pki domain client256 undo crl check enable SwitchA pki domain client256 quit Import local certificate file ssh client ec...

Страница 425: ...d 5a 2e dc 1d b3 8a bf ce ee 71 4e 8f d9 93 7f a3 48 a1 5c 17 cb 22 fa 8f b3 e5 76 89 06 9f 96 47 dc 34 87 02 31 00 e3 af 2a 8f d6 8d 1f 3a 2b ae 2f 97 b3 52 63 b6 18 67 70 2c 93 2a 41 c0 e7 fa 93 20 09 4d f4 bf d0 11 66 0f 48 56 01 1e c3 be 37 4e 49 19 cf c6 Create a PKI domain named server384 for verifying the server s certificate ecdsa384 and enter its view SwitchA pki domain server384 Disable ...

Страница 426: ...enSSL Generated Certificate X509v3 Subject Key Identifier 10 16 64 2C DA C1 D1 29 CD C0 74 40 A9 70 BD 62 8A BB F4 D5 X509v3 Authority Key Identifier keyid 5A BE 85 49 16 E5 EB 33 80 25 EB D8 91 50 B4 E6 3E 4F B8 22 Signature Algorithm ecdsa with SHA384 30 65 02 31 00 80 50 7a 4f c5 cd 6a c3 57 13 7f e9 da c1 72 7f 45 30 17 c2 a7 d3 ec 73 3d 5f 4d e3 96 f6 a3 33 fb e4 b9 ff 47 f1 af 9d e3 03 d2 24...

Страница 427: ...a6 89 41 d3 72 24 9b 9a 29 a8 d1 ba b4 e5 77 ba fc df ae c6 dd 46 72 ab bc d1 7f 18 7d 54 88 f6 b4 06 54 7e e7 4d 49 b4 07 dc 30 54 4b b6 5b 01 10 51 6b 0c 6d a3 b1 4b c9 d9 6c d6 be 13 91 70 31 2a 92 00 76 ASN1 OID secp384r1 NIST CURVE P 384 X509v3 extensions X509v3 Basic Constraints CA FALSE Netscape Comment OpenSSL Generated Certificate X509v3 Subject Key Identifier BD 5F 8E 4F 7B FE 74 03 5A D...

Страница 428: ...ce 2 SwitchB interface vlan interface 2 SwitchB Vlan interface2 ip address 192 168 0 1 255 255 255 0 SwitchB Vlan interface2 quit Set the authentication mode to AAA for user lines SwitchB line vty 0 15 SwitchB line vty0 15 authentication mode scheme SwitchB line vty0 15 quit Create a local device management user named client001 Authorize the user to use the SSH service and assign the network admin...

Страница 429: ...ablish an SCP connection to the SCP server at 192 168 0 1 based on the 192 bit Suite B algorithms SwitchA scp 192 168 0 1 get src cfg suite b 192 bit pki domain client384 server pki domain server384 Username client002 Press CTRL C to abort Connecting to 192 168 0 1 port 22 src cfg 100 4814 4 7KB s 00 00 SwitchA NETCONF over SSH configuration example with password authentication Unless otherwise no...

Страница 430: ...l take a few minutes Press CTRL C to abort Input the modulus length default 1024 Generating Keys Create the key pair successfully Generate an ECDSA key pair Switch public key local create ecdsa secp256r1 Generating Keys Create the key pair successfully Enable NETCONF over SSH Switch netconf ssh server enable Configure an IP address for VLAN interface 2 The client uses this address as the destinati...

Страница 431: ...ce type ssh Assign the network admin user role to local user client001 Switch luser manage client001 authorization attribute user role network admin Switch luser manage client001 quit Create an SSH user named client001 Specify the service type as NETCONF and the authentication method as password for the user Switch ssh user client001 service type netconf authentication type password Verifying the ...

Страница 432: ...message authentication code MAC to verify message integrity It uses a MAC algorithm and a key to transform a message of any length to a fixed length message Any change to the original message will result in a change to the calculated fixed length message As shown in Figure 118 the message integrity verification process is as follows a The sender uses a MAC algorithm and a key to calculate a MAC va...

Страница 433: ... FIPS 140 2 requirements Support for features commands and parameters might differ in FIPS mode see Configuring FIPS and non FIPS mode SSL configuration task list Tasks at a glance Remarks Configuring an SSL server policy Perform this configuration task on the SSL server Configuring an SSL client policy Perform this configuration task on the SSL client Configuring an SSL server policy An SSL serve...

Страница 434: ...no PKI domain is specified for an SSL server policy If SSL server authentication is required you must specify a PKI domain and request a local certificate for the SSL server in the domain For information about configuring a PKI domain see Configuring PKI 6 Specify the cipher suites that the SSL server policy supports In non FIPS mode ciphersuite dhe_rsa_aes_128_cbc_sh a dhe_rsa_aes_128_cbc_sha 256...

Страница 435: ...lient verify enable optional By default SSL client authentication is disabled The SSL server does not perform digital certificate based authentication on SSL clients When authenticating a client by using the digital certificate the SSL server verifies the certificate chain presented by the client It also verifies that the certificates in the certificate chain except the root CA certificate are not...

Страница 436: ...a256 dhe_rsa_aes_256_cbc_sh a dhe_rsa_aes_256_cbc_sh a256 ecdhe_ecdsa_aes_128_c bc_sha256 ecdhe_ecdsa_aes_128_g cm_sha256 ecdhe_ecdsa_aes_256_c bc_sha384 ecdhe_ecdsa_aes_256_g cm_sha384 ecdhe_rsa_aes_128_cbc_ sha256 ecdhe_rsa_aes_128_gcm _sha256 ecdhe_rsa_aes_256_cbc_ sha384 ecdhe_rsa_aes_256_gcm _sha384 exp_rsa_des_cbc_sha exp_rsa_rc2_md5 exp_rsa_rc4_md5 rsa_3des_ede_cbc_sha rsa_aes_128_cbc_sha r...

Страница 437: ... default an SSL client policy uses TLS 1 0 To ensure security do not specify SSL 3 0 for an SSL client policy 7 Enable the SSL client to authenticate servers through digital certificates server verify enable By default SSL server authentication is enabled Displaying and maintaining SSL Execute display commands in any view Task Command Display cryptographic library version information display crypt...

Страница 438: ...attack Description ICMP redirect An attacker sends ICMP redirect messages to modify the victim s routing table The victim cannot forward packets correctly ICMP destination unreachable An attacker sends ICMP destination unreachable messages to cut off the connections between the victim and its destinations ICMP type A receiver responds to an ICMP packet according to its type An attacker sends forge...

Страница 439: ...ns Windows system The malicious packets contain an illegal Urgent Pointer which causes the victim s operating system to crash UDP bomb An attacker sends a malformed UDP packet The length value in the IP header is larger than the IP header length plus the length value in the UDP header When the target system processes the packet a buffer overflow can occur which causes a system crash UDP Snork An a...

Страница 440: ...his causes the server to be busy searching for SYN packets and the server is unable to process packets for normal services FIN flood attack FIN packets are used to shut down TCP connections A FIN flood attacker sends a large number of forged FIN packets to a server The victim might shut down correct connections or be unable to provide services because it is busy searching for matching connections ...

Страница 441: ...eceiving host reassembles the fragments a TCP fragment attack occurs To prevent TCP fragment attacks enable TCP fragment attack prevention to drop attack TCP fragments Login dictionary attack The login dictionary attack is an automated process to attempt to log in by trying all possible passwords from a pre arranged list of values the dictionary Multiple login attempts can occur in a short period ...

Страница 442: ... a single packet attack defense policy Step Command Remarks 1 Enter system view system view N A 2 Enter attack defense policy view attack defense policy policy name N A 3 Configure signature detection for single packet attacks signature detect fraggle fragment impossible land large icmp large icmpv6 smurf snork tcp all flags tcp fin only tcp invalid flags tcp null flag tcp syn fin tiny fragment tr...

Страница 443: ...ow medium action drop logging none The default action is logging for single packet attacks of the informational and low levels The default actions are logging and drop for single packet attacks of the medium and high levels 6 Optional Enable signature detection for single packet attacks of a specific level signature level high info low medium detect By default signature detection is disabled for a...

Страница 444: ... The default setting is 1000 5 Specify global actions against SYN flood attacks syn flood action drop logging By default no global action is specified for SYN flood attacks 6 Configure IP address specific SYN flood attack detection syn flood detect ip ipv4 address ipv6 ipv6 address vpn instance vpn instance name threshold threshold value action drop logging none By default IP address specific SYN ...

Страница 445: ...onfigured Configuring a FIN flood attack defense policy Step Command Remarks 1 Enter system view system view N A 2 Enter attack defense policy view attack defense policy policy name N A 3 Enable global FIN flood attack detection fin flood detect non specific By default global FIN flood attack detection is disabled 4 Set the global trigger threshold for FIN flood attack prevention fin flood thresho...

Страница 446: ...fy global actions against ICMP flood attacks icmp flood action drop logging By default no global action is specified for ICMP flood attacks 6 Configure IP address specific ICMP flood attack detection icmp flood detect ip ip address vpn instance vpn instance name threshold threshold value action drop logging none By default IP address specific ICMP flood attack detection is not configured Configuri...

Страница 447: ...ttack defense policy policy name N A 3 Enable global DNS flood attack detection dns flood detect non specific By default global DNS flood attack detection is disabled 4 Set the global trigger threshold for DNS flood attack prevention dns flood threshold threshold value The default setting is 1000 5 Optional Specify the global ports to be protected against DNS flood attacks dns flood port port list...

Страница 448: ...dentify packets from trusted servers The exemption feature reduces the false alarm rate and improves packet processing efficiency For example the attack defense policy identifies multicast packets with the same source addresses and different destination addresses as scanning attack packets for example OSPF or PIM packets You can configure an ACL to exempt such packets from attack detection If an A...

Страница 449: ...o which the victim IP address belongs As a best practice do not disable log aggregation A large number of logs will consume the display resources of the console To enable log non aggregation for single packet attack events Step Command Remarks 1 Enter system view system view N A 2 Enable log non aggregation for single packet attack events attack defense signature log non aggregate By default log n...

Страница 450: ...ing attackers display attack defense scan attacker ipv6 local slot slot number count Display information about IPv4 scanning attack victims display attack defense scan victim ip local slot slot number count Display information about IPv6 scanning attack victims display attack defense scan victim ipv6 local slot slot number count Display flood attack detection and prevention statistics for an IPv4 ...

Страница 451: ...ion Configure the device to output logs if it detects such attacks To prevent the SYN flood attacks that aim at the external interface of the switch enable IP address specific SYN flood attack detection for 192 168 2 1 24 When the device receives 5000 or more SYN packets sent to the protected IP address per second it outputs logs and drops the packets To prevent the SYN flood attacks that aim at t...

Страница 452: ...evention action Switch attack defense policy a1 syn flood detect non specific Switch attack defense policy a1 syn flood threshold 2000 Switch attack defense policy a1 syn flood action logging Switch attack defense policy a1 quit Apply the attack defense policy to the device Switch attack defense local apply policy a1 Verifying the configuration Verify that attack defense policy a1 is correctly con...

Страница 453: ...d Disabled info L ICMP parameter problem Disabled info L ICMP timestamp request Disabled info L ICMP timestamp reply Disabled info L ICMP information request Disabled info L ICMP information reply Disabled info L ICMP address mask request Disabled info L ICMP address mask reply Disabled info L ICMPv6 echo request Disabled info L ICMPv6 echo reply Disabled info L ICMPv6 group membership query Disab...

Страница 454: ...lood attack packets that are destined for the protected IP address the device outputs logs and drops the attack packets If the device receives TCP SYN flood attack packets that are destined for the device but not to the protected IP address the device outputs logs Display the attack detection and prevention statistics Switch display attack defense statistics local Attack policy name a1 Slot 1 Scan...

Страница 455: ... If the number of TCP connections in a state exceeds the limit the device will accelerate the aging of the TCP connections in that state to mitigate the Naptha attack To configure Naptha attack prevention Step Command Remarks 1 Enter system view system view N A 2 Enable Naptha attack prevention tcp anti naptha enable By default Naptha attack prevention is disabled 3 Optional Set the maximum number...

Страница 456: ... Generated based on information from other modules For more information about dynamic bindings see Dynamic IPSG bindings As shown in Figure 121 IPSG forwards only the packets that match an IPSG binding Figure 121 IPSG application Static IPSG bindings Static IPSG bindings are configured manually They are suitable for scenarios where few hosts exist on a LAN and their IP addresses are manually confi...

Страница 457: ... IPSG allows only packets from the DHCP clients to pass through Dynamic IPv4SG Dynamic bindings generated based on different source modules are for different usages Interface types Source modules Binding usage Layer 2 Ethernet port DHCP snooping 802 1X ARP snooping Packet filtering Layer 3 Ethernet interface VLAN interface DHCP relay agent Packet filtering DHCP server For cooperation with modules ...

Страница 458: ...nooping 802 1X DHCP snooping DHCP relay agent or DHCP server operates correctly on the network To enable the IPv4SG feature on an interface Step Command Remarks 1 Enter system view system view N A 2 Enter interface view interface interface type interface number The following interface types are supported Layer 2 Ethernet port Layer 3 Ethernet interface Layer 3 Ethernet subinterface Layer 3 aggrega...

Страница 459: ...tack detection feature the vlan vlan id option must be specified and ARP attack detection must be enabled for the specified VLAN You can configure the same static IPv4SG binding on different interfaces Configuring the IPv6SG feature You cannot configure the IPv6SG feature on a service loopback interface If IPv6SG is enabled on an interface you cannot assign the interface to a service loopback grou...

Страница 460: ...a global static IPv6SG binding Step Command Remarks 1 Enter system view system view N A 2 Configure a global static IPv6SG binding ipv6 source binding ip address ipv6 address mac address mac address No global static IPv6SG bindings exist Configuring a static IPv6SG binding on an interface Step Command Remarks 1 Enter system view system view N A 2 Enter interface view interface interface type inter...

Страница 461: ...ly IP packets from Host C to pass Ten GigabitEthernet 1 0 1 of Device A allows only IP packets from Host A to pass All interfaces of Device B allow IP packets from Host A to pass Ten GigabitEthernet 1 0 1 of Device B allows IP packets from Host B to pass Figure 122 Network diagram Configuration procedure 1 Configure Device A Configure IP addresses for the interfaces Details not shown Enable IPv4SG...

Страница 462: ...g for Host B DeviceB interface ten gigabitethernet 1 0 1 DeviceB Ten GigabitEthernet1 0 1 ip source binding mac address 0001 0203 0407 DeviceB Ten GigabitEthernet1 0 1 quit Verifying the configuration Verify that the static IPv4SG bindings are configured successfully on Device A DeviceA display ip source binding static Total entries found 2 IP Address MAC Address Interface VLAN Type 192 168 0 1 00...

Страница 463: ...P address and MAC address for dynamic IPSG Device interface ten gigabitethernet 1 0 1 Device Ten GigabitEthernet1 0 1 ip verify source ip address mac address Enable recording of client information in DHCP snooping entries on Ten GigabitEthernet 1 0 1 Device Ten GigabitEthernet1 0 1 dhcp snooping binding record Device Ten GigabitEthernet1 0 1 quit Verifying the configuration Verify that a dynamic I...

Страница 464: ...e VLAN interface 100 to operate in DHCP relay mode Switch interface vlan interface 100 Switch Vlan interface100 dhcp select relay Specify the IP address of the DHCP server Switch Vlan interface100 dhcp relay server address 10 1 1 1 Switch Vlan interface100 quit Verifying the configuration Verify that a dynamic IPv4SG binding is generated based on a DHCP relay entry Switch display ip source binding...

Страница 465: ...ins an IP address from the DHCPv6 server Perform the following tasks Enable DHCPv6 snooping on the device to make sure the DHCPv6 client obtains an IPv6 address from the authorized DHCPv6 server To generate a DHCPv6 snooping entry for the DHCPv6 client enable recording of client information in DHCPv6 snooping entries Enable dynamic IPv6SG on Ten GigabitEthernet 1 0 1 to filter incoming packets by ...

Страница 466: ...e 127 DHCPv6 relay agent is enabled on the switch The clients obtain IPv6 addresses from the DHCPv6 server through the DHCPv6 relay agent Enable dynamic IPv6SG on VLAN interface 3 to filter incoming packets by using the IPv6SG bindings generated based on DHCPv6 relay entries Figure 127 Network diagram Configuration procedure 1 Configure the DHCPv6 relay agent Create VLAN 2 and VLAN 3 assign interf...

Страница 467: ...ce 3 Switch Vlan interface3 ipv6 verify source ip address mac address Switch Vlan interface3 quit Verifying the configuration Verify that a dynamic IPv6SG binding is generated based on a DHCPv6 relay entry Switch display ipv6 source binding dhcpv6 relay Total entries found 1 IP Address MAC Address Interface VLAN Type 1 2 0001 0203 0406 Vlan3 3 DHCPv6 relay ...

Страница 468: ...istency check configured on gateways Configuring ARP active acknowledgement configured on gateways Configuring authorized ARP configured on gateways Configuring ARP attack detection configured on access devices Configuring ARP scanning and fixed ARP configured on gateways Configuring ARP gateway protection configured on access devices Configuring ARP filtering configured on access devices Configur...

Страница 469: ...in 5 seconds arp source suppression limit limit value By default the maximum number is 10 Configuring ARP blackhole routing Step Command Remarks 1 Enter system view system view N A 2 Enable ARP blackhole routing arp resolving route enable By default ARP blackhole routing is enabled 3 Optional Set the number of ARP blackhole route probes for each unresolved IP address arp resolving route probe coun...

Страница 470: ... Device arp source suppression enable Configure the device to process a maximum of 100 unresolvable packets per source IP address within 5 seconds Device arp source suppression limit 100 If the attack packets have different source addresses configure ARP blackhole routing Enable ARP blackhole routing Device arp resolving route enable Configuring ARP packet rate limit The ARP packet rate limit feat...

Страница 471: ...center see Network Management and Monitoring Configuration Guide To configure ARP packet rate limit Step Command Remarks 1 Enter system view system view N A 2 Optional Enable notification sending for ARP packet rate limit snmp agent trap enable arp rate limit By default notification sending for ARP packet rate limit is disabled 3 Optional Enable logging for ARP packet rate limit arp rate limit log...

Страница 472: ...rp source mac filter monitor By default this feature is disabled When you change the handling method from monitor to filter the configuration takes effect immediately When you change the handling method from filter to monitor the device continues filtering packets that match existing attack entries 3 Set the threshold arp source mac threshold threshold value The default threshold is 30 4 Set the a...

Страница 473: ...re the gateway in the following steps 1 Enable source MAC based ARP attack detection and specify the handling method as filter 2 Set the threshold 3 Set the lifetime for ARP attack entries 4 Exclude the MAC address of the server from this detection Configuration procedure Enable source MAC based ARP attack detection and specify the handling method as filter Device system view Device arp source mac...

Страница 474: ...y sends an ARP reply but does not create an ARP entry Upon receiving an ARP reply the gateway determines whether it has resolved the sender IP address If yes the gateway performs active acknowledgement When the ARP reply is verified as valid the gateway creates an ARP entry If no the gateway discards the packet For ARP active acknowledgement to take effect in strict mode make sure ARP blackhole ro...

Страница 475: ...rized ARP on Ten GigabitEthernet 1 0 1 of Device A a DHCP server to ensure user validity Figure 130 Network diagram Configuration procedure 1 Configure Device A Specify the IP address for Ten GigabitEthernet 1 0 1 DeviceA system view DeviceA interface ten gigabitethernet 1 0 1 DeviceA Ten GigabitEthernet1 0 1 ip address 10 1 1 1 24 DeviceA Ten GigabitEthernet1 0 1 quit Configure DHCP DeviceA dhcp ...

Страница 476: ...e communication fails Thus user validity is ensured Configuration example on a DHCP relay agent Network requirements As shown in Figure 131 configure authorized ARP on Ten GigabitEthernet 1 0 2 of Device B a DHCP relay agent to ensure user validity Figure 131 Network diagram Configuration procedure 1 Configure Device A Specify the IP address for Ten GigabitEthernet 1 0 1 DeviceA system view Device...

Страница 477: ...C Ten GigabitEthernet1 0 2 ip address dhcp alloc DeviceC Ten GigabitEthernet1 0 2 quit Verifying the configuration Display authorized ARP information on Device B DeviceB display arp all Type S Static D Dynamic O Openflow R Rule M Multiport I Invalid IP Address MAC Address VID Interface Link ID Aging Type 10 10 1 2 0012 3f86 e94c N A XGE1 0 2 16 D The output shows that Device A assigned the IP addr...

Страница 478: ...curity entry The 802 1X client must be enabled to upload its IP address to the device For more information see Configuring 802 1X Configuration guidelines When you configure user validity check follow these guidelines Make sure one or more of the following items are configured for user validity check User validity check rules Static IP source guard bindings DHCP snooping 802 1X If none of the item...

Страница 479: ...marks 1 Enter system view system view N A 2 Enter VLAN view vlan vlan id N A 3 Enable ARP attack detection arp detection enable By default ARP attack detection is disabled 4 Return to system view quit N A 5 Enable ARP packet validity check and specify the objects to be checked arp detection validate dst mac ip src mac By default ARP packet validity check is disabled 6 Enter Layer 2 Ethernet interf...

Страница 480: ...dropped ARP packets To enable ARP attack detection logging Step Command Remarks 1 Enter system view system view N A 2 Enable ARP attack detection logging arp detection log enable By default ARP attack detection logging is disabled Displaying and maintaining ARP attack detection Execute display commands in any view and reset commands in user view Task Command Display the VLANs enabled with ARP atta...

Страница 481: ... DeviceB Ten GigabitEthernet1 0 1 dot1x DeviceB Ten GigabitEthernet1 0 1 quit DeviceB interface ten gigabitethernet 1 0 2 DeviceB Ten GigabitEthernet1 0 2 dot1x DeviceB Ten GigabitEthernet1 0 2 quit Add a local user test DeviceB local user test DeviceB luser test service type lan access DeviceB luser test password simple test DeviceB luser test quit Enable ARP attack detection for VLAN 10 to check...

Страница 482: ... to VLAN 10 and specify the IP address of VLAN interface 10 on Device A Details not shown 2 Configure the DHCP server on Device A and configure DHCP address pool 0 DeviceA system view DeviceA dhcp enable DeviceA dhcp server ip pool 0 DeviceA dhcp pool 0 network 10 1 1 0 mask 255 255 255 0 3 Configure Host A DHCP client and Host B Details not shown 4 Configure Device B Enable DHCP snooping DeviceB ...

Страница 483: ...address 0001 0203 0607 vlan 10 DeviceB Ten GigabitEthernet1 0 2 quit Enable ARP packet validity check by checking the MAC addresses and IP addresses of ARP packets DeviceB arp detection validate dst mac ip src mac After the configurations are completed Device B first checks the validity of ARP packets received on Ten GigabitEthernet 1 0 1 and Ten GigabitEthernet 1 0 2 If the ARP packets are confir...

Страница 484: ...ard entry on interface Ten GigabitEthernet 1 0 2 DeviceB interface ten gigabitethernet 1 0 2 DeviceB Ten GigabitEthernet1 0 2 ip source binding ip address 10 1 1 6 mac address 0001 0203 0607 vlan 10 DeviceB Ten GigabitEthernet1 0 2 quit Enable ARP packet validity check by checking the MAC addresses and IP addresses of ARP packets DeviceB arp detection validate dst mac ip src mac Configure port iso...

Страница 485: ... you configure ARP scanning and fixed ARP IP addresses in existing ARP entries are not scanned ARP scanning will take some time To stop an ongoing scan press Ctrl C Dynamic ARP entries are created based on ARP replies received before the scan is terminated The arp fixup command is a one time operation You can use this command again to convert the dynamic ARP entries learned later to static Due to ...

Страница 486: ...th ARP attack detection ARP snooping and ARP fast reply ARP gateway protection applies first Configuration procedure To configure ARP gateway protection Step Command Remarks 1 Enter system view system view N A 2 Enter Layer 2 Ethernet interface and Layer 2 aggregate interface view interface interface type interface number N A 3 Enable ARP gateway protection for the specified gateway arp filter sou...

Страница 487: ...lines Follow these guidelines when you configure ARP filtering You can configure a maximum of eight permitted entries on an interface Do not configure both the arp filter source and arp filter binding commands on an interface If ARP filtering works with ARP attack detection ARP snooping and ARP fast reply ARP filtering applies first Configuration procedure To configure ARP filtering Step Command R...

Страница 488: ...ket in a VLAN before ARP learning If the sender IP address is within the allowed IP address range the gateway continues ARP learning If the sender IP address is out of the range the gateway determines the ARP packet as an attack packet and discards it When you configure the ARP sender IP address checking feature in a VLAN follow these restrictions and guidelines If the VLAN is a sub VLAN and is as...

Страница 489: ...er VLAN view vlan vlan id N A 3 Enable the ARP sender IP address checking feature and specify the IP address range arp sender ip range start ip address end ip address By default the ARP sender IP address checking feature is disabled ...

Страница 490: ...rce MAC consistency check ND messages in which the Ethernet frame header and the source link layer address option of the ND message contain different source MAC addresses ND attack detection ND messages in which the mapping between the source IPv6 address and the source MAC address is invalid RA guard RA messages incompliant with the RA guard policy or identified to be sent from hosts ND attack de...

Страница 491: ... devices ND attack detection defines the following types of interfaces ND trusted interface The device directly forwards ND messages or data packets received by ND trusted interfaces It does not perform user validity check ND untrusted interface The device discards RA and redirect messages received by ND untrusted interfaces For other types of ND messages received by the ND untrusted interfaces th...

Страница 492: ...bled 4 Return to system view quit N A 5 Enter Layer 2 Ethernet or aggregate interface view interface interface type interface number N A 6 Optional Configure the interface as ND trusted interface ipv6 nd detection trust By default all interfaces are ND untrusted interfaces Displaying and maintaining ND attack detection Execute display commands in any view and reset commands in user view Task Comma...

Страница 493: ...abitEthernet1 0 3 quit Assign IPv6 address 10 1 64 to VLAN interface 10 DeviceA interface vlan interface 10 DeviceA Vlan interface10 ipv6 address 10 1 64 DeviceA Vlan interface10 quit 2 Configure Device B Create VLAN 10 DeviceB system view DeviceB vlan 10 DeviceB vlan10 quit Configure Ten GigabitEthernet 1 0 1 Ten GigabitEthernet 1 0 2 and Ten GigabitEthernet 1 0 3 to trunk VLAN 10 DeviceB interfa...

Страница 494: ...Ten GigabitEthernet 1 0 2 based on the ND snooping entries Configuring RA guard About RA guard RA guard allows Layer 2 access devices to analyze and block unwanted and forged RA messages Upon receiving an RA message the device makes the forwarding or dropping decision based on the role of the attached device or the RA guard policy 1 If the role of the device attached to the port is router the devi...

Страница 495: ...ult no router preference match criterion exists 6 Optional Specify an M flag match criterion if match autoconfig managed address flag off on By default no M flag match criterion exists 7 Optional Specify an O flag match criterion if match autoconfig other flag off on By default no O flag match criterion exists 8 Optional Specify a maximum or minimum hop limit match criterion if match hop limit max...

Страница 496: ...d statistics interface interface type interface number Clear RA guard statistics reset ipv6 nd raguard statistics interface interface type interface number RA guard configuration example Network requirements As shown in Figure 138 Ten GigabitEthernet 1 0 1 Ten GigabitEthernet 1 0 2 and Ten GigabitEthernet 1 0 3 of Device B are in VLAN 10 Configure RA guard on Device B to filter forged and unwanted...

Страница 497: ...1 port access vlan 10 DeviceB Ten GigabitEthernet1 0 1 quit DeviceB interface ten gigabitethernet 1 0 2 DeviceB Ten GigabitEthernet1 0 2 port link type access DeviceB Ten GigabitEthernet1 0 2 port access vlan 10 DeviceB Ten GigabitEthernet1 0 2 quit Configure Ten GigabitEthernet 1 0 3 to trunk VLAN 10 DeviceB interface ten gigabitethernet 1 0 3 DeviceB Ten GigabitEthernet1 0 3 port link type trunk...

Страница 498: ...hat the device drops RA messages received on Ten GigabitEthernet 1 0 1 Details not shown Verify that the device forwards RA messages received on Ten GigabitEthernet 1 0 3 to other ports in VLAN 10 Details not shown ...

Страница 499: ...esses or attack multiple servers simultaneously to block connections or even break down the network uRPF can prevent these source address spoofing attacks It checks whether an interface that receives a packet is the output interface of the FIB entry that matches the source address of the packet If not uRPF considers it a spoofing attack and discards the packet uRPF check modes uRPF supports strict...

Страница 500: ...r packets 2 uRPF checks whether the source address matches a FIB entry Checks the received packet Broadcast source address All zero source address Matching FIB entry found Broadcast destination address Default route found Loose uRPF Allows the packet to pass Discards the packet Yes Yes Yes Yes No Yes Yes No No Receiving interface matches the output interface of the default route No No No No Loose ...

Страница 501: ... If no uRPF proceeds to step 9 5 uRPF checks whether the source IP address matches an ARP entry If yes uRPF proceeds to step 8 If no uRPF proceeds to step 9 6 uRPF checks whether the FIB table has a default route If yes uRPF proceeds to step 7 If no uRPF proceeds to step 9 7 uRPF checks whether the check mode is loose If yes uRPF proceeds to step 8 If no uRPF checks whether the output interface of...

Страница 502: ...fter you enable the uRPF feature on the switch the routing table size might decrease by half If the number of routes exceeds half the routing table size of the switch the uRPF feature cannot be enabled to avoid loss of routes and packets To enable uRPF globally Step Command Remarks 1 Enter system view system view N A 2 Enable uRPF globally ip urpf loose strict By default uRPF is disabled Displayin...

Страница 503: ...cts to an ISP switch Switch B To prevent source address spoofing attacks perform the following tasks Enable strict uRPF check on Switch A Enable strict uRPF check on Switch B Figure 142 Network diagram Configuration procedure 1 Enable strict uRPF check on Switch A SwitchA system view SwitchA ip urpf strict 2 Enable strict uRPF check on Switch B SwitchB system view SwitchB ip urpf strict ...

Страница 504: ...ules They are always enabled You cannot enable or disable software crypto engines The switch only supports a software crypto engine in the current software version Crypto engines provide encryption decryption services for service modules for example the IPsec module When a service module requires data encryption decryption it sends the desired data to a crypto engine After the crypto engine comple...

Страница 505: ...y with the password control policies such as password length complexity and aging policy When the aging timer for a password expires the system prompts you to change the password If you adjust the system time after the device enters FIPS mode the login password might expire before the next login because the original system time is typically much earlier than the actual time If you choose the autom...

Страница 506: ... automatic reboot and manual reboot Automatic reboot To use automatic reboot to enter FIPS mode 1 Enable FIPS mode 2 Select the automatic reboot method The system automatically performs the following tasks a Create a default FIPS configuration file named fips startup cfg b Specify the default file as the startup configuration file c Prompt you to configure the username and password for next login ...

Страница 507: ...rver and client are disabled The HTTP server is disabled SNMPv1 and SNMPv2c are disabled Only SNMPv3 is available The SSL server supports TLS1 0 TLS1 1 and TLS1 2 The SSH server does not support SSHv1 clients and DSA key pairs The generated RSA and DSA key pairs must have a modulus length of 2048 bits When the device acts as a server to authenticate a client through the public key the key pair for...

Страница 508: ...u can modify the default mode as needed The default authentication mode is password for VTY lines The default authentication mode is none for console ports After you disable FIPS mode follow these restrictions and guidelines before you manually reboot the device If you are logged in to the device through Telnet perform the following tasks without exiting the current user line Set the authenticatio...

Страница 509: ... string and then uses the private key to decrypt the encrypted text If the decryption result is the same as the original plain text string the test succeeds The power up self test examines the cryptographic algorithms listed in Table 26 Table 26 Power up self test list Type Operations KAT Tests the following algorithms SHA1 SHA224 SHA256 SHA384 and SHA512 HMAC SHA1 HMAC SHA224 HMAC SHA256 HMAC SHA...

Страница 510: ...splay the FIPS mode state display fips status FIPS configuration examples Entering FIPS mode through automatic reboot Network requirements Use the automatic reboot method to enter FIPS mode and use a console port to log in to the device in FIPS mode Configuration procedure If you want to save the current configuration execute the save command before you enable FIPS mode Enable FIPS mode and choose...

Страница 511: ...d new password confirm Updating user information Please wait Sysname Display the FIPS mode state Sysname display fips status FIPS mode is enabled Display the default configuration file Sysname more fips startup cfg password control enable local user root class manage service type terminal authorization attribute user role network admin fips mode enable return Sysname Entering FIPS mode through man...

Страница 512: ...n will be written to the device Are you sure Y N y Please input the file name cfg flash startup cfg To leave the existing filename unchanged press the enter key flash startup cfg exists overwrite Y N y Validating file Please wait Saved the current configuration to mainboard device successfully Sysname quit Delete the startup configuration file in binary format Sysname delete flash startup mdb Dele...

Страница 513: ...r has logged in to the device in FIPS mode through SSH with a username of test and a password of 12345zxcvb ZXCVB Use the manual reboot method to exit FIPS mode Configuration procedure Disable FIPS mode Sysname undo fips mode enable FIPS mode change requires a device reboot Continue Y N y The system will create a new startup configuration file for non FIPS mode and then reboot automatically Contin...

Страница 514: ...te flash startup mdb Delete flash startup mdb Y N y Deleting file flash startup mdb Done Reboot the device Sysname reboot Verifying the configuration After the device reboots enter a username of test and a password of 12345zxcvb ZXCVB to enter non FIPS mode Press ENTER to get started login test Password Last successfully login time Sysname Display the FIPS mode state Sysname display fips status FI...

Страница 515: ...ast one x y Asterisk marked square brackets enclose optional syntax choices separated by vertical bars from which you select one choice multiple choices or none 1 n The argument or keyword and argument combination before the ampersand sign can be entered 1 to n times A line that starts with a pound sign is comments GUI conventions Convention Description Boldface Window names button names field nam...

Страница 516: ... Represents an access controller a unified wired WLAN module or the access controller engine on a unified wired WLAN switch Represents an access point Represents a wireless terminator unit Represents a wireless terminator Represents a mesh access point Represents omnidirectional signals Represents directional signals Represents a security product such as a firewall UTM multiservice security gatewa...

Страница 517: ...s provide a mechanism for accessing software updates through the product interface Review your product documentation to identify the recommended software update method To download product updates go to either of the following Hewlett Packard Enterprise Support Center Get connected with updates page www hpe com support e updates Software Depot website www hpe com support softwaredepot To view and u...

Страница 518: ...r self repair CSR programs allow you to repair your product If a CSR part needs to be replaced it will be shipped directly to you so that you can install it at your convenience Some parts do not qualify for CSR Your Hewlett Packard Enterprise authorized service provider will determine whether a repair can be accomplished by CSR For more information about CSR contact your local service provider or ...

Страница 519: ...number edition and publication date located on the front cover of the document For online help content include the product name product version help edition and publication date located on the legal notices page ...

Страница 520: ...EAP relay termination authentication 75 EAP termination enable 88 EAP termination mode authentication 77 EAP Message attribute 73 EAPOL packet format 73 enable 88 feature cooperation 86 guest VLAN 81 guest VLAN assignment delay 96 guest VLAN configuration 95 104 keep online 95 MAC authentication delay 122 MAC based access control 79 maintain 102 mandatory port authentication domain 92 manual reaut...

Страница 521: ...attribute translation 54 RADIUS attributes 14 RADIUS authentication server 26 RADIUS DAE server 53 RADIUS display 35 RADIUS implementation 2 RADIUS maintain 35 RADIUS packet DSCP priority 54 RADIUS request transmission attempts max 29 RADIUS scheme 24 RADIUS scheme creation 26 RADIUS scheme VPN instance 28 RADIUS server SSH user authentication authorization 60 RADIUS server status 29 RADIUS sessio...

Страница 522: ...ol 51 299 alert protocol SSL 419 algorithm IPsec authentication 301 IPsec encryption 3DES 301 IPsec encryption AES 301 IPsec encryption DES 301 IPsec IKE DH algorithm 328 keychain configuration 250 251 SSH negotiation 359 SSH2 379 SSH2 encryption 380 SSH2 key exchange 379 SSH2 MAC 380 SSH2 public key 379 anti replay IPsec anti replay redundancy 313 IPsec configuration 313 any authentication SSH 35...

Страница 523: ... configuration RST flood attack 432 defense policy configuration scanning attack 430 defense policy configuration single packet attack 429 defense policy configuration SYN flood attack 431 defense policy configuration SYN ACK flood attack 432 defense policy configuration UDP flood attack 434 defense policy creation 429 detection exemption configuration 435 device preventable attacks 425 display 43...

Страница 524: ...n 327 IPsec IKE RSA signature authentication 327 IPsec RIPng configuration 322 IPsec tunnel for IPv4 packets IKE based 337 IPsec tunnel for IPv4 packets manual 320 keychain configuration 250 251 MAC authentication 115 119 128 MAC authentication local 128 MAC authentication RADIUS based 130 MAC authentication VLAN assignment 116 MAC local authentication method 115 MAC RADIUS authentication method 1...

Страница 525: ...hole ARP attack protection blackhole routing unresolvable IP attack 456 C CA PKI architecture 266 PKI CA policy 266 PKI certificate 265 PKI certificate export 276 PKI certificate obtain 272 PKI certificate removal 276 PKI certificate request 270 PKI certificate request automatic 271 PKI certificate request manual 272 PKI certificate request abort 272 PKI certificate verification 274 PKI CRL 265 PK...

Страница 526: ...2 1X periodic reauthentication 94 802 1X protocol packet sending rule 100 802 1X reauthentication 93 802 1X ACL assignment 107 802 1X EAD assistant DHCP relay agent 108 802 1X EAD assistant DHCP server 111 AAA 1 19 57 AAA device ID 57 AAA HWTACACS schemes 36 AAA HWTACACS server SSH user 57 AAA ISP domain accounting method 51 AAA ISP domain attribute 48 AAA ISP domain authentication method 49 AAA I...

Страница 527: ...crypto engine 491 direct portal authentication 168 direct portal authentication local portal Web server on router 205 direct portal authentication preauthentication domain 201 dynamic IPv4 source guard IPv4SG DHCP relay agent 450 dynamic IPv4 source guard IPv4SG DHCP snooping 449 dynamic IPv6 source guard IPv6SG DHCPv6 relay agent 453 dynamic IPv6 source guard IPv6SG DHCPv6 snooping 452 extended c...

Страница 528: ...ort security secure MAC addresses 218 portal authentication 136 143 168 portal authentication destination subnet 150 portal authentication detection features 154 portal authentication fail permit 158 portal authentication local portal Web server 162 164 portal authentication MAC binding server 165 portal authentication portal free rule 148 portal authentication server 144 portal authentication ser...

Страница 529: ...ture 266 PKI CA policy 266 PKI certificate export 276 PKI certificate removal 276 PKI certificate based access control policy 277 PKI storage path 275 troubleshooting PKI CRL obtain failure 296 cross subnet extended cross subnet portal authentication configuration 190 portal authentication configuration 179 portal authentication mode 139 crypto engine configuration 491 display 491 maintain 491 cry...

Страница 530: ...server 36 AAA HWTACACS authorization server 37 AAA HWTACACS implementation 6 AAA HWTACACS scheme 36 AAA HWTACACS scheme VPN instance 39 AAA HWTACACS server SSH user 57 AAA HWTACACS shared keys 39 AAA implementation 12 AAA LDAP attribute map for authorization 46 AAA LDAP authentication server 46 AAA LDAP authorization server 46 AAA LDAP implementation 9 AAA LDAP scheme 42 AAA LDAP server SSH user a...

Страница 531: ... Telnet server connection establishment 368 SSH Secure Telnet server connection establishment based on Suite B 370 SSH Secure Telnet server enable 362 SSH server configuration 361 SSH SFTP client 371 SSH SFTP client configuration publickey authentication enabled 401 SSH SFTP configuration 398 SSH SFTP configuration 192 bit Suite B 404 SSH SFTP server configuration password authentication enabled 3...

Страница 532: ...solvable IP attack 456 attack D P 437 crypto engine 491 FIPS 497 host public key 258 IP source guard IPSG 447 IPsec 319 IPsec IKE 336 IPsec IKEv2 356 IPv4 source guard IPv4SG 447 IPv6 source guard IPv6SG 447 keychain 251 MAC authentication 128 ND attack detection 479 password control 246 PKI 278 port security 222 portal authentication 167 public key 260 RA guard policy 483 SSH 380 SSH SFTP help in...

Страница 533: ...X keep online 95 802 1X user IP freezing 100 AAA RADIUS server load sharing 31 AAA RADIUS SNMP notification 35 ARP attack detection logging 467 attack D P log non aggregation 436 attack D P login delay 437 IPsec ACL de encapsulated packet check 312 IPsec IKE invalid SPI recovery 335 IPsec IKEv2 cookie challenge 355 IPsec packet logging 315 IPsec QoS pre classify 315 IPv4 source guard IPv4SG on int...

Страница 534: ...ot 495 500 exporting host public key 258 PKI certificate 276 PKI certificate import export configuration 289 troubleshooting PKI certificate export failure 298 extending extended cross subnet portal authentication configuration 190 extended direct portal authentication configuration 183 extended re DHCP portal authentication configuration 186 F fail portal fail permit feature 158 Federal Informati...

Страница 535: ...uration 477 ND attack detection 479 RA guard 483 static IPv4 source guard IPv4SG configuration 448 static IPv6 source guard IPv6SG configuration 451 fragment attack D P TCP fragment attack prevention 436 IPsec packet DF bit 315 fragmenting IPsec packet fragmentation 318 frame port security configuration 211 214 FTP AAA RADIUS Login Service attribute check method 34 local host public key distributi...

Страница 536: ...ormat 39 Hypertext Transfer Protocol Use HTTP I ICMP attack D P defense policy ICMP flood attack 433 attack D P defense policy ICMPv6 flood attack 433 ID AAA device ID configuration 57 identity IPsec IKE global identity information 333 ignoring port security server authorization information 220 IKE 326 See also ISAKMP configuration 326 328 337 configuration main mode pre shared key authentication ...

Страница 537: ...port temporarily mode 218 port security feature 211 IP global uRPF configuration 490 portal authentication portal free rule 148 security Use IPsec uRPF enable 489 IP address 802 1X user IP freezing enable 100 IP addressing AAA HWTACACS outgoing packet source IP address 40 AAA LDAP server IP address 43 AAA RADIUS outgoing packet source IP address 31 ARP attack detection configuration user packet va...

Страница 538: ... configuration restrictions 307 policy configuration restrictions IKE based 308 protocols and standards 303 QoS pre classify enable 315 RIPng configuration 322 SA 301 security protocols 299 SNMP notification configuration 318 source interface policy bind 314 transform set configuration 305 troubleshoot IKE 342 troubleshoot IKE negotiation failure no proposal match 342 troubleshoot IKE negotiation ...

Страница 539: ...plementation 12 AAA ISP domain accounting method 51 AAA ISP domain attribute 48 AAA ISP domain authentication method 49 AAA ISP domain authorization method 50 AAA ISP domain creation 47 AAA ISP domain method 46 K keepalive IPsec IKE configuration 333 IPsec IKE NAT configuration 334 IPsec IKEv2 NAT 355 key IPsec IKE pre shared key authentication 327 PKI configuration 265 267 278 key pair Secure Tel...

Страница 540: ...out 167 logging in AAA concurrent login user max 56 attack D P login delay 437 attack D P login dictionary attack 428 password expired login 241 password user first login 241 password user login attempt limit 241 password user login control 241 RADIUS Login Service attribute 34 logging off portal authentication online user logout 160 M MAC 802 1X MAC based access control 79 address See MAC address...

Страница 541: ...rning port security autoLearn MAC learning control 212 port security MAC learning control modes 211 port security secure MAC learning control 212 maintaining 802 1X 102 AAA HWTACACS 42 AAA RADIUS 35 ARP attack detection 467 attack D P 437 crypto engine 491 IP source guard IPSG 447 IPsec 319 IPsec IKE 336 IPsec IKEv2 356 IPv4 source guard IPv4SG 447 IPv6 source guard IPv6SG 447 MAC authentication 1...

Страница 542: ...t 160 NAT IPsec IKE keepalive 334 IPsec IKEv2 keepalive 355 ND portal authentication client ND entry conversion 165 ND attack defense configuration 477 configuring ND attack detection 478 configuring RA guard 481 configuring RA guard logging 482 configuring RA guard policy 482 configuring source MAC consistency check 477 IPv6 See IPv6 ND attack defense specifying the attached device role 481 ND at...

Страница 543: ...ble 467 ARP attack detection packet validity check 466 ARP attack detection restricted forwarding 466 ARP attack detection restricted forwarding configuration 470 ARP attack detection user validity check 465 467 ARP attack protection unresolvable IP attack 455 457 ARP attack protection blackhole routing unresolvable IP attack 456 ARP attack protection source suppression unresolvable IP attack 456 ...

Страница 544: ...tection enable 127 MAC authentication redirect URL assignment 119 MAC authentication timer 121 MAC authentication user account format 120 MAC authentication user profile assignment 118 MAC authentication VLAN assignment 116 MAC based quick portal authentication 142 ND attack detection 478 NETCONF over SSH client user line 363 NETCONF over SSH enable 363 NETCONF over SSH password authentication con...

Страница 545: ... line 363 source MAC consistency check 477 SSH client host public key configuration 364 SSH management parameters 366 SSH SCP client device 376 SSH SCP configuration 408 SSH SCP configuration Suite B 409 SSH SCP file transfer password authentication 408 SSH SCP server connection establishment 376 SSH SCP server connection establishment based on Suite B 378 SSH SCP server enable 363 SSH Secure Teln...

Страница 546: ...34 no AAA no accounting method 12 AAA no authentication 12 AAA no authorization 12 notifying AAA RADIUS SNMP notification 35 IPsec IKE SNMP notification 336 IPsec SNMP notification 318 port security SNMP notification 222 NTK ntkonly mode 217 ntk withbroadcasts mode 217 ntk withmulticasts mode 217 port security feature 211 numbering IPsec IKE SA max 335 IPsec tunnel max 319 O obtaining PKI certific...

Страница 547: ...les 163 parameter AAA RADIUS accounting server parameters 27 AAA RADIUS class attribute as CAR parameter 34 configuring SSH management parameters 366 password control parameters global 243 password control parameters local user 245 password control parameters super 246 password control parameters user group 244 password SSH password authentication 359 SSH password publickey authentication 359 SSH ...

Страница 548: ...olicy scanning attack 430 attack D P defense policy single packet attack 429 attack D P defense policy creation 429 IPsec application to interface 312 IPsec configuration manual 307 IPsec IKEv2 configuration 352 IPsec policy IKE based direct 309 IPsec policy IKE based template 310 IPsec policy configuration IKE based 308 IPsec QoS pre classify enable 315 IPsec source interface policy bind 314 IPse...

Страница 549: ...information ignore 220 SNMP notification enable 222 troubleshoot 231 troubleshoot mode cannot be set 231 troubleshoot secure MAC addresses 231 portal authentication AAA server 137 access device 137 authenticated user redirection 164 authentication destination subnet 150 authentication server 137 authentication source subnet 149 BAS IP 158 client 137 client ARP entry conversion enable 165 165 confi...

Страница 550: ...ating with 802 1X EAP relay 76 authenticating with 802 1X EAP termination mode 77 binding IPsec source interface to policy 314 changing AAA RADIUS packet DSCP priority 54 configuring 802 1X 87 configuring 802 1X authentication trigger 92 configuring 802 1X Auth Fail VLAN 97 configuring 802 1X authorization VLAN 104 configuring 802 1X basics 102 configuring 802 1X critical VLAN 98 configuring 802 1...

Страница 551: ...efense policy 429 configuring attack D P defense policy ACK flood attack 431 configuring attack D P defense policy DNS flood attack 434 configuring attack D P defense policy FIN flood attack 432 configuring attack D P defense policy flood attack 431 configuring attack D P defense policy HTTP flood attack 434 configuring attack D P defense policy ICMP flood attack 433 configuring attack D P defense...

Страница 552: ... configuring keychain 250 251 configuring local user auto delete 24 configuring MAC authentication 119 configuring MAC authentication local 128 configuring MAC authentication RADIUS based 130 configuring MAC authentication ACL assignment 132 configuring MAC authentication critical VLAN 125 configuring MAC authentication delay 122 configuring MAC authentication guest VLAN 124 configuring MAC authen...

Страница 553: ...onfiguring SSH device as server 361 configuring SSH device as SFTP client 371 configuring SSH management parameters 366 configuring SSH SCP client device 376 configuring SSH SCP file password authentication 408 configuring SSH Secure Telnet client password authentication enabled 389 configuring SSH Secure Telnet client publickey authentication enabled 392 configuring SSH Secure Telnet server publi...

Страница 554: ...hentication offline detection 127 enabling NETCONF over SSH 363 enabling parallel processing with 802 1X authentication 123 enabling password control 243 enabling port security 214 enabling port security authorization fail offline 221 enabling port security MAC move 220 enabling port security SNMP notification 222 enabling portal authentication 146 enabling portal authentication client ARP entry c...

Страница 555: ...ission attempts max 29 setting AAA RADIUS server status 29 setting AAA RADIUS timer 32 setting AAA RADIUS traffic statistics unit 28 setting AAA RADIUS username format 28 setting IPsec tunnel max 319 setting MAC authentication concurrent port users max 121 setting password control parameters global 243 setting password control parameters local user 245 setting password control parameters super 246...

Страница 556: ...rage path set failure 298 troubleshooting port security mode cannot be set 231 troubleshooting port security secure MAC addresses 231 troubleshooting portal authentication cannot log out users access device 209 troubleshooting portal authentication no page pushed for users 208 troubleshooting portal authentication users cannot log in re DHCP 210 troubleshooting portal authentication users logged o...

Страница 557: ... the attached device role 481 RA guard policy displaying 483 maintaining 483 RADIUS 802 1X EAP over RADIUS 73 802 1X EAP relay enable 88 802 1X EAP termination enable 88 802 1X RADIUS EAP Message attribute 73 802 1X RADIUS Message Authentication attribute 74 AAA configuration 1 19 57 AAA implementation 2 AAA local user configuration 20 AAA MPLS L3VPN implementation 14 AAA scheme 20 accounting serv...

Страница 558: ...HCP relay agent 463 dynamic IPv4 source guard IPv4SG DHCP relay agent configuration 450 dynamic IPv6 source guard IPv6SG DHCPv6 relay agent configuration 453 remote 802 1X authorization VLAN 79 AAA remote accounting method 12 AAA remote authentication 12 AAA remote authentication configuration 19 AAA remote authorization method 12 Remote Authentication Dial In User Service Use RADIUS removing PKI ...

Страница 559: ... 357 troubleshooting IPsec SA negotiation failure tunnel failure 357 scanning attack attack D P defense policy 430 attack D P device preventable attacks 426 scheme AAA 20 AAA HWTACACS 36 AAA HWTACACS scheme VPN instance 39 AAA LDAP 42 AAA LDAP scheme creation 45 AAA RADIUS configuration 24 AAA RADIUS scheme VPN instance 28 SCP client device configuration 376 client local key pair generation 376 cl...

Страница 560: ... AAA LDAP scheme 42 AAA LDAP server SSH user authentication 64 AAA local user 20 AAA MPLS L3VPN implementation 14 AAA protocols and standards 14 AAA RADIUS attribute translation 54 AAA RADIUS attributes 14 AAA RADIUS DAE server 53 AAA RADIUS implementation 2 AAA RADIUS information exchange security mechanism 2 AAA RADIUS packet DSCP priority 54 AAA RADIUS protocols and standards 14 AAA RADIUS sche...

Страница 561: ...tomatic reboot 497 FIPS mode entry manual reboot 498 FIPS mode exit 495 FIPS mode exit automatic reboot 500 FIPS mode exit manual reboot 500 FIPS mode system changes 494 FIPS self test 495 fixed ARP configuration 472 fixed ARP configuration restrictions 472 global uRPF configuration 490 host public key export 258 IP 299 See also IPsec IP source guard IPSG configuration 443 444 448 IP source guard ...

Страница 562: ...y 246 password control enable 243 password control maintain 246 password control parameters global 243 password control parameters local user 245 password control parameters super 246 password control parameters user group 244 password event logging 242 password expiration 240 240 password history 241 password not displayed 242 password setting 239 password updating 240 240 password user first log...

Страница 563: ...in 152 portal user preauthentication IP address pool 152 public key display 260 public key import from file 262 public key management 256 260 RA guard 483 re DHCP portal authentication configuration 176 re DHCP portal authentication preauthentication domain configuration 203 Secure Telnet client local key pair generation 368 Secure Telnet client user line 363 SSH authentication methods 359 SSH cli...

Страница 564: ...leshooting PKI local certificate failure 295 troubleshooting PKI local certificate import failure 297 troubleshooting PKI local certificate request failure 295 troubleshooting PKI storage path set failure 298 uRPF configuration 486 uRPF display 489 uRPF enable 489 user profile configuration 233 233 234 user profile configuration restrictions 233 user profile display 234 server 802 1X authenticatio...

Страница 565: ...uration password authentication enabled 398 server connection establishment 372 server connection establishment based on Suite B 374 server connection termination 375 server enable 362 SSH application 358 SSH management parameters 366 shared key AAA HWTACACS 39 AAA RADIUS 28 signature authentication IKE 327 single packet attack attack D P defense policy 429 attack D P device preventable attacks 42...

Страница 566: ...60 SCP 358 SCP client device 376 SCP client local key pair generation 376 SCP configuration 408 SCP configuration Suite B 409 SCP file transfer password authentication 408 SCP server connection establishment 376 SCP server connection establishment based on Suite B 378 SCP server enable 363 Secure Copy Use SCP Secure FTP Use SFTP Secure Telnet 358 Secure Telnet client configuration password authent...

Страница 567: ...al authentication cross subnet mode 139 portal authentication destination subnet 150 portal authentication direct cross subnet authentication process CHAP PAP authentication 140 portal authentication source subnet 149 super password control parameters 246 suppressing ARP attack protection source suppression unresolvable IP attack 456 switch cross subnet portal authentication configuration 179 dire...

Страница 568: ...uration 128 bit Suite B 394 SSH Secure Telnet packet source IP address 368 SSH Secure Telnet server configuration password authentication enabled 381 SSH Secure Telnet server configuration publickey authentication enabled 383 SSH Secure Telnet server connection establishment 368 SSH Secure Telnet server connection establishment based on Suite B 370 terminal AAA RADIUS Login Service attribute check...

Страница 569: ...access device 209 portal authentication cannot log out users RADIUS server 209 portal authentication no page pushed for users 208 portal authentication users cannot log in re DHCP 210 portal authentication users logged out still exist on server 209 tunnel IPsec tunnel max 319 tunneling IPsec configuration 299 320 IPsec encapsulation tunnel mode 300 IPsec RIPng configuration 322 IPsec tunnel establ...

Страница 570: ... 120 MAC authentication user account policies 115 user authentication password control configuration 239 242 247 password control parameters global 243 password control parameters local user 245 password control parameters super 246 password control parameters user group 244 password event logging 242 password expiration 240 240 password expired login 241 password history 241 password max user acc...

Страница 571: ...ication configuration local portal Web server on router 205 direct portal authentication preauthentication domain configuration 201 extended cross subnet portal authentication configuration 190 extended direct portal authentication configuration 183 extended re DHCP portal authentication configuration 186 PKI 267 portal authentication configuration 136 143 168 portal authentication extended functi...

Результаты поиска

Содержание FlexFabric 5940 SERIES

Отзывы:

Похожие инструкции для FlexFabric 5940 SERIES

Бренды по названию

Популярные бренды

HPE FlexFabric 5940 SERIES, Руководство по настройке безопасности

Результаты поиска

Содержание FlexFabric 5940 SERIES

Отзывы:

Похожие инструкции для FlexFabric 5940 SERIES

Бренды по названию

Популярные бренды