Secure Connection
69
Table 36. Advanced Security Configuration Fields
Click
Apply
to save any changes for the current boot session. The changes take effect immediately but
are not retained across a switch reset unless you click
Save Configuration
.
Secure Connection
The HPE OfficeConnect 1850 series switch software allows the administrator to enable or disable
Secure HTTP protocol (HTTPS). When enabled, the administrator can establish a secure connection
with the switch using the Secure Sockets Layer (SSL) protocol. Secure HTTP can help ensure that
communication between the management system and the switch is protected from eavesdropping and
man-in-the-middle attacks.
You can upload an SSL certificate to the switch or have the switch generate its own certificate. The
SSL certificate functions as a digital passport, enabling client web browsers to verify the identity of the
switch before accessing it.
The certificate provides information to the browser such as the server name, the trusted certificate
authority (CA) that issued the certificate, the date it was issued, and the switch’s public key.
Field
Description
Auto DoS
Enable this option to enable all the DoS prevention mechanisms with default values. Enabling
this feature makes all the fields in the remainder of the table inaccessible (grayed-out). When
disabled, you can individually turn on and off the DoS features and change their default
values. This feature and all the individual DoS protections are disabled by default.
Prevent Land Attack
Enable this option to drop packets for which the source IP address equals the destination IP
address.
Prevent TCP Blat Attack
Enable this option to drop packets for which the TCP source port equals the TCP destination
port.
Prevent UDP Blat Attack
Enable this option to drop packets that have a UDP source port equal to the UDP destination
port.
Prevent Invalid TCP Flags
Attack
Enable this option to drop packets that have TCP Flags SYN and FIN set.
Prevent TCP Fragment
Attack
Enable this option to drop IP packets that have an IP fragment offset equal to 1.
Check First Fragment Only
Enable this option to drop packets that have a TCP header smaller than the minimum TCP
header size, which is hard-coded to 20 bytes.
Prevent Smurf Attack
Enable this option to drop ICMP Echo packets (ping) that are sent to a broadcast IP address.
Prevent Ping Flood Attack
Enable this option to prevent ping flooding by limiting the number of ICMP ping packets.
Prevent SYN Flood Attack
Enable this option to limit the rate of TCP connection requests so that they are not received
faster than they can be processed.
NOTE:
SSL is described in client/server terminology, where the SSL-enabled switch is the server and a web
browser is the client.
