HP 2600 Series manual

ProCurve Switches Access Security Guide Switch 2600 Series Switch 2600-PWR Series Switch 2800 Series Switch 4100 Series Switch 6108 Series[...]

[...]

ProCurve Switch 2600 Series Switch 2600-PWR Series Switch 2800 Series Switch 4100gl Series Switch 6108 Access Security Guide December 2008[...]

Hewlett-Packa rd Company 8000 Foothills Boulevard, m/s 5551 Roseville, California 95747-5551 http://www .procurve.com © Copyright 2001-2008 Hewle tt-Packard Company, L..P . The information contained herein is subject to change without notice. Publication Number 5990-6024 Decembe r 2008 Applicable Products ProCurve Switch 2 626 (J4900A/B) ProCurve [...]

iii Contents Product Documentation About Your Switch Manual S et . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi Feature Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii 1 Getting Started Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .[...]

iv Front-Panel Secu rity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-7 When Security Is Important . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-7 Front-Pan el Button Fu nctions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-8 Configuring Front-Panel Securit[...]

v 4 TACACS+ Authentication Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2 Terminology Used in TACACS Appl ications: . . . . . . . . . . . . . . . . . . .[...]

vi 1. Configure Authenticatio n for th e Access Methods Yo u Want RADIUS To Protect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-8 2. Config ure the Switch To Access a RADI US Server . . . . . . . . . . . . 5-10 3. Configure th e Switch’s Global RADIUS Parameters . . . . . . . . . . . 5-12 [...]

vii 6. Use an SSH Client To Access the Switch . . . . . . . . . . . . . . . . . . . . . 6-21 Further Informati on on SSH Client Public -Key Authentication . . . . . . . . 6-21 Messages Related to SSH Operat ion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-27 7 Configuring Secure Socket Layer (SSL) Contents . . . . . . . . . . . . .[...]

viii Configuring Sw itch Ports as 8 02.1X Authenticators . . . . . . . . . . . . . . . . . 8-15 1. Enable 802.1X Authentic a tion on Selected Ports . . . . . . . . . . . . . . 8-15 3. Configure the 8 02.1X Auth entication Method . . . . . . . . . . . . . . . . . 8-19 4. Enter the RADIUS Host IP Address(es) . . . . . . . . . . . . . . . . . . . . . [...]

ix MAC Lockdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-17 Differences Betw een MAC Lockdow n and Po rt Security . . . . . . . . . 9-19 Deploying MAC Lockdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-21 MAC Lockout . . . . . . . . . . . . . . . . . . . . . . . . . [...]

x Defining Authorized Management Stations . . . . . . . . . . . . . . . . . . . . . . . . . 11-4 Overview of IP Mask Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-4 Menu: Viewing an d Configuring IP Author ized Managers . . . . . . . . . 11-5 CLI: Viewing and Conf iguring Authorized IP Managers . . . . . . . . . . . 11-6 [...]

xi Product Documentation About Y our Switch Manual Set The switch manual set includes the following: ■ Read Me First - a printed gui de shipped with your switch. Provides software update infor mation, product not es, and other informati on. ■ Installation an d Getting Started Gu ide - a printed gu ide shipped with your switch. This guide explai[...]

xii Product Documentation Feature Index For the manual set supporting your switch model, the follo wing feature index indicates which manual to consult for in formation on a given software feature. (Note that some software f eatures are not supported on all switch models.) Feature Management and Configuration Advanced T raffic Management Access Sec[...]

xiii Product Documentation LACP X -- Link X - - LLDP X -- MAC Address Management X - - MAC Lockdown - - X MAC Lockout - - X MAC-based Authentication - - X Monitoring and Analysis X - - Multicast Filtering - X - Network Management Applications (LLDP , SNMP) X - - Passwords - - X Ping X - - Port Configuration X -- Port Security - - X Port Status X --[...]

xiv Product Documentation Source-Port Filters - - X Spanning T r ee (STP , RSTP , MSTP) - X - SSH (Secure Shell) Encryption - - X SSL (Secure Socket Layer) - - X Stack Management (Stacking) - X - Syslog X - - System Information X -- T ACACS+ Authentication - - X T elnet Access X -- TFTP X - - T ime Protocols (T imeP , SNTP) X -- T r affic/Security [...]

1-1 1 Getting Started Contents Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2 Overview of Access Security Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2 Management Access Security Prot ection . . . . . . . . . . . . . . . . . . . . . . . . 1-3 General Sw[...]

1-2 Getting Started Introduction Introduction This Access Security Guide describes how to use ProCurve’ s switch security features to protect access to your swit ch. This guid e is intended to support the following switches: ■ ProCurve Series 2600 ■ ProCurve Series 2600-PWR ■ ProCurve Series 2800 ■ ProCurve Series 4100gl ■ ProCurve Swit[...]

1-3 Getting Started Overview of Access Security Features ■ Secure Socket Layer (SSL) (page 7-1): Provides remote web access to the switch via encrypted a uthen tication paths between the sw itch and management statio n cli ents capable of SSL/TLS operation. ■ Port-Based Access Control (802.1X) (page 8-1): On point- to-point connections, enables[...]

1-4 Getting Started Overview of Access Security Features T abl e 1-1. Management Access Security Pro tection General Switch T raffi c Security Guidelines Where the switch is running multiple secu rity options, it i mplements network traffic security based on the OSI (Ope n Systems Intercon nection mod el) precedence of the individual opti ons, from[...]

1-5 Getting Started Conventions Conventions This guide uses the following conventi ons for command syntax and displ ayed information . Feature Descriptions by Model In cases where a software feature is no t available in a ll of the swi tch models covered by this guide, the section head ing spec ifically indic ates which pro duct or product series o[...]

1-6 Getting Started Conventions Command Prompts In the defaul t configurat ion, your swit ch displays one of the follow ing CLI prompts: ProCurve Switch 4104# ProCurve Switch 4108# ProCurve Switch 2626# ProCurve Switch 2650# ProCurve Switch 6108# T o simplify recognition, th is guide uses ProCurve to represent command prompts for all models. For ex[...]

1-7 Getting Started Sources for More Information Sources for More Information For additional information ab out switch operation and feat ures not covered in this gui de, consult t he following sources: ■ For informati on on which product manual to consult o n a given software feature, re fer to “Pro duct Documentation” on page xi. Note For t[...]

1-8 Getting Started Need Only a Quick Start? Figure 1-3. Getting Help in the CLI ■ For information on specific featur es in the W eb browser interface, use the online help . For more information, refer to the Management and Configuration Guide for your switch. ■ For further inf ormation on ProCu rve Networking switch technology , visit the ProC[...]

1-9 Getting Started Need Only a Quick Start? T o Set Up and In stall the Switch in Y our Network Important! Use the Installation and Getting Started Guide shipped with your swit ch for the follow ing: ■ Notes, cauti ons, and warn ings related to installing and using the switch and its related modules ■ Instructions for physically i nstalling th[...]

1-10 Getting Started Need Only a Quick Start? — This page is intentionally unused. —[...]

2-1 2 Configuring Username and Password Security Contents Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2 Configurin g Local Password Se curity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4 Menu: Setting Passwords . . . . . . . . . . . . . . . . . . . . . . .[...]

2-2 Configuring Username and Password Security Overview Overview Console access includes both the menu interface and the CLI. There are two levels of console access: Manager and Operator . For security , you can set a password pair (username and password) on each of these lev els. Note Usernames are optional. Also, in th e menu interface, you can c[...]

2-3 Configuring Username and Password Security Overview T o configure password security: 1. Set a Manager password pair (and an Operator password pair , if applicable for your system). 2. Exit from the cur rent console session. A Manager password pair will now be needed for full access to the console. If you do steps 1 and 2, above, then th e next [...]

2-4 Configuring Username and Password Security Configuring Local Password Security Configuring Local Password Security Menu: Setting Passwords As noted earlier in this section, usernames are optional. Conf iguring a user - name requires either the CLI or the web browser interface. 1. From the Main Menu select: 3. Console Passwords Figure 2-1. The S[...]

2-5 Configuring Username and Password Security Configuring Local Password Security If you have physical access to the swit ch, press and hold the Clear button (on the front of the switch) for a minimum of one second to clear all password protection, th en enter new passwords as described earlier in this chapter . If you do not have physical access [...]

2-6 Configuring Username and Password Security Configuring Local Password Security T o Remove Password Protection . Removing password protection means to eliminat e password security . This command prompt s you to verify th at you want to remove one or both passwords, then clears the indicat ed password(s). (This command also clears the username as[...]

2-7 Configuring Username and Password Security Front-Panel Security Front-Panel Security The front-pane l security features pro vide the abilit y to independ ently enable or disable some of t he functions of the t wo buttons located on th e front of the switch for clearing t he password (Clear button) or restoring the switch to its factory default [...]

2-8 Configuring Username and Password Security Front-Panel Security As a result of increased security co ncerns, customers now have the ability to stop someone from r emoving passwords by di sabling the Clear and/or Reset buttons on t he front of th e switch. Front-Panel Button Functions The front pan el of the switch in cludes the Reset button and[...]

2-9 Configuring Username and Password Security Front-Panel Security Reset Button Pressing the Reset but ton alone fo r one second causes the switch to reboot. Figure 2-6. Press and hold the Reset Butto n for One Second T o Reboot the Switch Restoring the Factory Default Configuration Y ou can also use the Reset button together with the Clear button[...]

2-10 Configuring Username and Password Security Front-Panel Security 3. Release the Reset button and wait fo r about one second for the Self -T est LED to start flash ing. 4. When the Self-T est LED begins flashing, release the Clear button . This process restores the switch config uration to the factor y default settings. Configuring Front-Panel S[...]

2-11 Configuring Username and Password Security Front-Panel Security • Modify the operation of the Reset+Clear combi nation (page 2-9) so that the switch stil l reboots, but does not restore the switch’ s factory default configurat ion settings. (Use of t he Reset button alone, to simply reboot the swit ch, is not affected.) • Disable or re-e[...]

2-12 Configuring Username and Password Security Front-Panel Security For example, show front-pane l-security produces the followin g output when the switch is conf igured with the defa ult front-pane l security settings. Figure 2-7. The Default Front-Panel Security Settin gs Disabling the Clear Password Fun ction of the Clear Button on the Switch?[...]

2-13 Configuring Username and Password Security Front-Panel Security Re-Enabling the Clear Button on the Switch’ s Front Panel and Setting or Changing the “Reset-On-Clear” Operation For example, suppose that password-clear is disabl ed and you want to restore it to its defaul t configuration (enabl ed, with reset-on-clear disabled). Syntax: [[...]

2-14 Configuring Username and Password Security Front-Panel Security Figure 2-9. Example of Re-Enabling the Clea r Button’ s Default Operation Changing the Operation of the Reset+Clear Combination In thei r default co nfigurati on, using the Reset+Cle ar buttons i n the combi na- tion descri bed under “Resto ring the Factory Def ault Configurat[...]

2-15 Configuring Username and Password Security Front-Panel Security Figure 2-10. Exampl e of Disabling the Factory Re set Option Password Recovery The passwo rd recovery f eature is enabled by default an d provides a method for regaining management ac cess to the switch (without resetting the switch to its factory default co nfiguration) in t he e[...]

2-16 Configuring Username and Password Security Front-Panel Security Steps for Disabling Password-Recovery . 1. Set the CLI to the gl obal interface context. 2. Use show front-panel -security to determine wh ethe r the factory-re set parameter is enab led. If it is disabled, use the front-panel-security fa ctory- reset command to enable it. 3. Pres[...]

2-17 Configuring Username and Password Security Front-Panel Security Figure 2-11. Example of the Step s for Disabling Password-Recovery Password Recovery Process If you have lost the switch’ s manager username/password, but passwor d- rec ove ry is enabled, then you can use the Password Recovery Process to gain management access to the switch wit[...]

2-18 Configuring Username and Password Security Front-Panel Security — This page is intentionally unused. —[...]

3-1 3 W eb and MAC Authentication for the Series 2600/2600-PWR and 2800 Switches Contents Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2 Client Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3 General Features . . . . . .[...]

3-2 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Overview Overview Applicable Swi tch Models. W eb and MAC Authenticat ion are available on these current ProCurve swit ch models: ■ ProCurve Series 2600 and 2600-PWR Switches ■ ProCurve Series 2800 Switches W eb and MAC Authentication are designed for employment on t[...]

3-3 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Overview MAC Authentication (MAC-Auth). This method grants access to a secure network by authenticati ng devices fo r access to the ne twork. When a device connects to the switch , either by direct link or through t he network, the switch forwards the device’ s MAC add[...]

3-4 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Overview General Features W eb and MAC Au thenticatio n on the Pr oCurve Series 2600, 2600-PWR , and 2800 switches i nclude the following: ■ On a port configured for W eb or MAC Authentication, th e switch operates as a port-access authenticator using a RADIUS server a[...]

3-5 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches How Web and MAC Authentication Operate How W eb and MAC Authentication Operate Authenticator Operation Before gaining access to the network cl ients first present their authentication credentials to the sw itch. The switch th en verifies the supp lied creden tials with a[...]

3-6 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches How Web and MAC Authentication Operate Figure 3-2. Progress Message During Authentication If the client is authenticated and the maximum number of cli ents allowed on the port ( client-limit ) has not been reache d, the por t is assigned to a static, untagged VLAN for ne[...]

3-7 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches How Web and MAC Authentication Operate moves have not been en abled ( client-moves ) on the ports, the sessi on ends and the client must reauthenticate for ne twork access. At the end of the session the port returns to its pre- authentication state. Any changes to the po[...]

3-8 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches How Web and MAC Authentication Operate 4. If neither 1, 2, or 3, above, apply , then the c lient session does not have access to any statically configured, untag ged VLANs and client access is blocke d. The assigned port VLAN remains in pl ace until the session ends. Cli[...]

3-9 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Terminology T erminology Authorized-C lient VLAN: Like the Unaut horized-Client VL AN, this is a conventional, static, untagged, port-b ased VLAN previously config ured on the switch by the System Administr ator . The intent in using this VLAN is to provide authenti cate[...]

3-10 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Operating Rules and Notes Operating Rules and Notes ■ Y ou can configure one type o f authenti cation on a port. That is, the following au thentication types are mutually exclusive on a given port: • W eb Authentication • MAC Authentication • 802.1X ■ Order of[...]

3-11 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Operating Rules and Notes 2. If there is no RADIUS-assigned VLAN, then, for the duratio n of the client session, the port belongs to the Authorized VLAN ( if configured) and tempor arily drops all other VLAN memberships. 3. If neither 1 or 2, above, apply , but the port[...]

3-12 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches General Setup Procedure for Web/MAC Authentica tion Note on W eb/ MAC Authentication and LACP The switch does n ot allow W eb or MAC Authentication and LACP to both be enabled at the same time on the same po rt. The switch automatically disables LACP on ports configured[...]

3-13 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches General Setup Procedure for Web/MAC Authentication a. If you configure the RADIUS server to assign a VLAN for an authen- ticated client, this assignment o verrides any VLAN assignments con- figured on the switc h while the au thenticated client session remains active. N[...]

3-14 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches General Setup Procedure for Web/MAC Authentica tion Additional Information fo r Configuring the RADIUS Server T o Support MAC Authentication On the RADIUS server , config ure the client device authenticat ion in the same way that you woul d any other cl ient, except: ?[...]

3-15 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Configuring the Switch To Access a RADIUS Server Configuring the Switch T o Access a RADIUS Server This section descr ibes the minima l co mmands for config uring a RADIUS server to support W eb-Auth and MAC Auth. F or information on other RADI US command opti ons, refe[...]

3-16 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Configuring the Switch To Access a RADIUS Server For example, to configure the switch to access a RADIUS server at IP address 192.168.32.11 using a server -specifi c shared secret key of ‘2Pzo22’ Figure 3-4. Example of Config uring a Switch T o Access a RADIUS Serve[...]

3-17 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Configuring Web Authentic ation Configuring W eb Authentication This feature is available onl y on the Series 2600, 2600-PWR , and 2800 switches. Overview 1. If you have not already done so, configure a local username and password pair on th e switch. 2. Identify or cre[...]

3-18 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Configuring Web Authentica tion Configure the Switch for W eb-Based Authentication Command Page Configuration Level aaa port-access web-based dhcp-addr 3-18 aaa port-access web-based dhcp-lease 3-18 [no] aaa port-access web-based [e] < port-list > 3-19 [auth-vid] [...]

3-19 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Configuring Web Authentic ation Syntax: [no] aaa port-access web -based [e] < port-list > Enables web-based authenti cation on the specified ports. Use the no form of the command to disable web- based authentication on the specified ports. Syntax: aaa port-access [...]

3-20 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Configuring Web Authentica tion Syntax: aaa port-access w eb-based [e] < port-list > [logoff-period] <60-9999999>] Specifies the period, in seco nds, that the switch enforces for an implicit logoff. This parameter is equivalent to the MAC age interval in a t[...]

3-21 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Configuring Web Authentic ation Syntax: aaa port-access w eb-based [e] < port-list > [redirec t-url < url >] no aaa port-access we b-based [e] < port-list > [redirect-url] Specifies the URL that a user is redirected to after a successful login. An y va[...]

3-22 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Configuring MAC Authentication on the Switch Configuring MAC Authentication on the Switch This feature is available onl y on the Series 2600, 2600-PWR , and 2800 Switches. Overview 1. If you have not already done so, configure a local username and password pair on th e [...]

3-23 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Configuring MAC Authent ication on the Switch Configure the Switch for MAC-Based Authentication Command Page Configuration Level aaa port-access mac-based addr -forma t 3-23 [no] aaa port-access mac-based [e] < port-list >3 - 2 3 [addr -limit] 3-24 [addr -moves] 3[...]

3-24 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Configuring MAC Authentication on the Switch Syntax: aaa port-access m ac-based [e] < port-list > [add r -limit <1-32>] Specifies the maximum number of authenticated MACs to allow on the port. (Default: 1) Syntax: [no] aaa port-access mac -based [e] < por[...]

3-25 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Configuring MAC Authent ication on the Switch Syntax: aaa port-access m ac-based [e] < port-list > [quiet-period <1 - 65535>] Specifies the time period, in seconds, the switch should wait before attemp ting an authentication request for a MAC address that fa[...]

3-26 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Show Status and Configuration of Web-Based Authentication Show Status and Configuration of W eb-Based Authentication Command Page show port-access [ port-list ] web-based 3-26 [clients] 3-26 [config] 3-26 [config [auth-server]] 3-27 [config [web-server]] 3-27 show port-[...]

3-27 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Show Status and Configuration of MAC-Based Authentication Show Status and Configuration of MAC-Based Authentication Syntax: show port-access [ port-list ] web-based [con fig [auth-server]] Shows W eb Authentication set tings for all ports or the specified ports, along w[...]

3-28 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Show Status and Configuration of MAC-Based Authentication Syntax: show port-access [ port-list ] mac-base d [clients] ] Shows the port address, M AC address, session status, and elapsed session time for attached clients on all ports or the specified ports. Ports with mu[...]

3-29 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Show Client Status Show Client Status The table below sho ws the possible client status in formation that may be reported by a W e b-based or MAC-based ‘ show ... clients’ command. Reported Status Available Netwo rk Connection Possible Explanations authenticated Aut[...]

3-30 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Show Client Status — This page is intentionally unused. —[...]

4-1 4 T ACACS+ Authentication Contents Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2 Terminology Used in TACACS Appl ications: . . . . . . . . . . . . . . . . . . . . . . . . 4-3 General System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

4-2 TACACS+ Authentication Configuring TACACS+ on the Switch Overview T ACACS+ authentication enables you to use a central server to a llow or deny access to the switch (and other T ACACS- a ware devices) in your network. This means that you can use a central database to create multi ple unique username/ password sets with associated privil ege lev[...]

4-3 TACACS+ Authentication Configuring TACACS+ on the Switch tion services. If the switch fails to connect to any T ACACS+ server , it defaults to its own loc ally assigned passwor ds for authentication c ontrol if it has bee n configured to do so. For both Consol e and Telnet access you can configure a login (read-only) and an enable (r ead/write)[...]

4-4 TACACS+ Authentication Configuring TACACS+ on the Switch • Local Authentication: This method uses username/password pairs configured locally on the switch; on e pair each for manager - level and operator -level access to the switch. Y ou can assign loca l usernames and passwords through the CLI or web browser inter - face. (Using the menu int[...]

4-5 TACACS+ Authentication Configuring TACACS+ on the Switch General System Requirements T o use T ACACS+ authentication, you need th e following: ■ A T ACACS+ server applicat ion installed and configured on o ne or more servers or managemen t stations in your network. (There are several T ACACS+ software packages available.) ■ A switch configu[...]

4-6 TACACS+ Authentication Configuring TACACS+ on the Switch other access type (console, in this case) open in case the T elnet access fails due to a configuration problem. The fo llowing procedure outlines a general setup procedure. Note If a complete access lockou t occurs on the switch as a result of a T ACACS+ configuration, see “T roubleshoo[...]

4-7 TACACS+ Authentication Configuring TACACS+ on the Switch Note on Privilege Levels When a T ACACS+ server au thenticates an access re quest from a switch, it includes a privilege leve l code for th e switch to use in determining which privilege level to grant to the terminal requesti ng acc ess. The switch interprets a privileg e level code of ?[...]

4-8 TACACS+ Authentication Configuring TACACS+ on the Switch configuration in your T ACACS+ ser ver application fo r mis-configura- tions or missing data that could aff ect the server’ s interoperation with the switch. 8. After your testing shows that T elnet access using the T ACACS+ server is working properly , configure your T ACACS+ server ap[...]

4-9 TACACS+ Authentication Configuring TACACS+ on the Switch CLI Commands Described in this Section V iewing the Switch’ s Current Authentication Configuration This comma nd lists the n umber of logi n attempts t he switch al lows in a sin gle login session, and the pr imary/secondary access methods confi gured for each type of acc ess. Syntax : [...]

4-10 TACACS+ Authentication Configuring TACACS+ on the Switch V iewing the Switch’ s Curren t T ACACS+ Server Contact Configuration This comma nd lists the ti meout period, encryption key , and the IP addre sses of the first-choice and backup T ACACS + servers the switch can contact. Syntax: show tacacs For example, if the switch was configur ed [...]

4-11 TACACS+ Authentication Configuring TACACS+ on the Switch Configuring the Switch’ s Authentication Methods The aaa authentication command conf igures the access control for console port and T elnet access to the switch . That is, for both access methods, aaa authenticatio n specifies whether to use a T ACACS + server or the switch’ s local [...]

4-12 TACACS+ Authentication Configuring TACACS+ on the Switch T abl e 4-1. AAA Authenticatio n Parameters As shown in the next table, login and en able access is a lways available loc ally through a direct terminal connection to the switch’ s console port. However , for T e lnet access, you can configure T ACACS+ to deny access if a T ACACS+ serv[...]

4-13 TACACS+ Authentication Configuring TACACS+ on the Switch T abl e 4-2. Primary/Secondary Aut hentication T able Caution Regarding the Use of Local for Login Primary Access During local authentication (which uses passwords config ured in the switch instead of in a T ACACS+ server), the sw itch grants read-only access if you enter the Operator pa[...]

4-14 TACACS+ Authentication Configuring TACACS+ on the Switch For example, here is a set of access options and the corre sponding commands to configure them: Console Login (Operato r or Read-Only) Access: Primary using T ACACS+ server . Secondary using Local. ProCurve (config)# aaa authentication console login tacacs lo cal Console Enable ( Manager[...]

4-15 TACACS+ Authentication Configuring TACACS+ on the Switch Configuring the Switch’ s T ACACS+ Server Access The tacacs-server command configures these parameters: ■ The host IP address(es) for up to three T ACACS+ servers; one first- choice and up to two backups. Desi gnating backup se rvers provides for a continuati on of authentication ser[...]

4-16 TACACS+ Authentication Configuring TACACS+ on the Switch Note on Encryption Keys Encryption keys configured in the sw it ch must exactly ma tch the encryption keys configured in T ACACS+ servers th e switch will a ttempt to use for authentication. If you configure a global encryption key , the switch uses it only with servers for which you hav[...]

4-17 TACACS+ Authentication Configuring TACACS+ on the Switch T abl e 4-3. Details on Configuri ng T ACACS Servers and Keys Name Default Range tacacs-server host < ip-addr > none n/a This command specifies the IP address of a device running a T A CACS+ server application. Optionally , it can also specify the unique, per -server encryption key[...]

4-18 TACACS+ Authentication Configuring TACACS+ on the Switch Adding, Removing, or Changing th e Priority of a T ACACS+ Server . Suppose that the switch was already co nfigured to use T ACACS+ servers at 10.28.227.10 and 10.28.227.15 . In this cas e, 10.28.227.15 was entered first, and so is listed as the first-choice server: Figure 4-4. Example of[...]

4-19 TACACS+ Authentication Configuring TACACS+ on the Switch Figure 4-5. Example of the Switch After Assigni ng a Different “First-Choice” Server T o remove the 10.28.227.1 5 device as a T ACACS+ server , you would use this command: ProCurve(config)# no tacacs-server host 10.28.227.15 Configuring an Encryption Key . Use an encryption key in th[...]

4-20 TACACS+ Authentication Configuring TACACS+ on the Switch To delete a per-server e ncryption key in the switch, re-enter the tacacs-server host comman d without th e key parameter. For example, if you have north01 configured as the encryption key for a TACACS+ server with an IP address of 10.28.227.104 and you wa nt to eliminate the key, you wo[...]

4-21 TACACS+ Authentication Configuring TACACS+ on the Switch Using figure 4-6, a bove, after either sw itch detects an opera tor’ s logon request from a remote or directly connecte d terminal, the fo ll owing events occur: 1. The switch queries the fir st-cho i ce T ACACS+ server for authentication of the request. • If the switc h does not rec[...]

4-22 TACACS+ Authentication Configuring TACACS+ on the Switch Local Authentication Process When the switch is configured to use T ACACS+, it reverts to local authentica- tion only if on e of these two cond itions exists: ■ “Local” is the authentication option for the access method being used. ■ T ACACS+ is the primary authenticat ion mode f[...]

4-23 TACACS+ Authentication Configuring TACACS+ on the Switch Using the Encryption Key General Operation When used, the encr yption key (sometime s term ed “key”, “secret key”, or “secret”) helps to pr event unauthoriz ed intruders on th e network from read ing username and password information in T ACAC S+ packets moving between the sw[...]

4-24 TACACS+ Authentication Configuring TACACS+ on the Switch For example, you would use the next co mmand to configure a global encryp- tion key in the sw itch to match a key ent ered as north40camp us in two target TACACS+ servers. (That is, both servers use the same key for your switch.) Note that you do not need the se rver IP addr esses to con[...]

4-25 TACACS+ Authentication Configuring TACACS+ on the Switch Messages Related to T ACACS+ Operation The switch generates the CLI message s listed below . However , you may see other messages generated in your T ACACS+ server a pplication. For informa- tion on such messages, re fer to the documentation you rec eived with the application . Operating[...]

4-26 TACACS+ Authentication Configuring TACACS+ on the Switch ■ When T ACACS+ is not enabled on th e switch—or when the switch’ s only designated T ACACS+ servers ar e not accessible— setting a local Operator password wi thout also setting a local Manager password does not protect the s witch from manager -level access by unauthor - ized pe[...]

5-1 5 RADIUS Authentication and Accounting Contents Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-2 Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-3 Switch Operating Rules for RADIUS . . . . . . . . . . . . .[...]

5-2 RADIUS Authenti cation and Accounting Overview Overview RADIUS ( Remote Authentication Dial-In User Service ) enables yo u to use up to three servers (one primary server and one or two backups) and mai ntain separate authentication and accountin g for each RADIUS serve r employed. For authentication, this allows a differ ent password for each u[...]

5-3 RADIUS Authentication and Accounting Terminology T erminology CHAP (Challenge-Handshake Authe ntication Protocol): A challenge- response authentication protocol that uses the Message Digest 5 (MD5) hashing scheme to encrypt a response to a challenge from a RADI US server . EAP (Extensib le Authenticati on Protocol ): A general PPP authenticatio[...]

5-4 RADIUS Authenti cation and Accounting Switch Operating Rules for RADIUS Switch Operating Rules for RADIUS ■ Y ou must have at least one RADIU S server accessible to the switch. ■ The switch supports authentication and accounting us ing up to three RADIUS servers. The switch accesse s the servers in the order in which they are listed by show[...]

5-5 RADIUS Authentication and Accounting General RADIUS Setup Proced ure General RADIUS Setup Procedure Preparation: 1. Configure one to three RADIUS server s to support the switch. (That is, one primary server and one or two ba ckups.) Refer to the documentation provided with the RADIUS server application. 2. Before configuring the switch, co llec[...]

5-6 RADIUS Authenti cation and Accounting Configuring the Switch fo r RADIUS Authe ntication Configuring the Switch for RADIUS Authentication • Determine an acceptable timeout period for the switch to wa it fo r a server to respond to a request. ProCurve recommends that you begin with the default (five second s). • Determine how many times you [...]

5-7 RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication Outline of the Steps fo r Configuring RADIUS Authentication There ar e three ma in steps to con figuring RADIU S authentic ation: 1. Configure RADIUS authentication fo r controlling access through one or more of the follow ing • Serial port •T e l n e t ?[...]

5-8 RADIUS Authenti cation and Accounting Configuring the Switch fo r RADIUS Authe ntication • Server Dead- T ime: The period during wh ich the switch wil l not send new authentication requests to a RADIUS server that has failed to respond to a previous request. This avoids a wait for a request to time out on a server that is unavailable. If you [...]

5-9 RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication For example, suppose you have alread y configured local passwords on th e switch, but w ant to use RADIUS to pr otect primary T elnet and SSH access without allo wing a secondary T elne t or SSH access option (w hich would be the switch’ s local passwords): [...]

5-10 RADIUS Authenti cation and Accounting Configuring the Switch fo r RADIUS Authe ntication 2. Configure the Switch T o Access a RADIUS Server This section describes how to c onfigure the switch to interact with a RADIUS server for both authenticat ion and accounting services. Note If you want to configure RADIUS accoun ti ng on the switch, go to[...]

5-11 RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication For example, suppose you h ave configured the switch as shown in figure 5 -3 and you now need to make the following changes: 1. Change the encryption k ey for the server at 10.33 .18.1 27 to “source0127”. 2. Add a RADIUS server with an IP ad dress of 10.3[...]

5-12 RADIUS Authenti cation and Accounting Configuring the Switch fo r RADIUS Authe ntication 3. Configure the Switch’ s Global RADIUS Parameters Y ou can configure the sw itch for the following g lobal RADIUS parameters: ■ Number of login attempts: In a given session, specifies how many tries at entering the correct username and password pair [...]

5-13 RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication Note Where the switch has multiple RADIUS se rvers co nfigured to supp ort authen- tication requests, if the firs t server fails to respond, then the switch tries the next server in the list, and so -on. If none of the servers respon d, then the switch attemp[...]

5-14 RADIUS Authenti cation and Accounting Configuring the Switch fo r RADIUS Authe ntication For example, suppose that your switch is configured to use three RADIUS servers for authenticating access through T elnet and SSH. T wo of these servers use the same encryption key . In this case your pla n is to configure the switch with the following g l[...]

5-15 RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication Figure 5-6. Listings of Globa l RADIUS Parameters Configured In Figure 5-5 ProCurve# show authentication Status and Counters - Authent ication Information Login Attempts : 2 Respect Privilege : Disabled | Login Log in Enable Enable Access Task | Primary Sec o[...]

5-16 RADIUS Authenti cation and Accounting Local Authentication Process Local Authentication Process When the switch is configured to use RADIUS, it reverts to l ocal authentication only if o ne of these two cond itions exists : ■ “Local” is the authentication option for the access method being used. ■ The switch has been con figured to que[...]

5-17 RADIUS Authentication and Accounting Controlling Web Browser Interface Acces s When Using RADIUS Authentication Controlling W eb Browser Interface Access When Using RADIUS Authentication T o prevent unauthori zed access through the web browser interface, do one or more of the follow ing: ■ For Series 2600, 2600- PWR, and Series 2800 switches[...]

5-18 RADIUS Authenti cation and Accounting Configuring RADIUS Accounting Note This section assumes you have already: ■ Configured RADIUS authen tic ation on the swit ch for one or mo re access methods ■ Configured one or more RADIUS servers to support the switch If you have not already done so, refer to “General RADIUS Setup Proced ure” on [...]

5-19 RADIUS Authentication and Accounting Configuring RADIUS Accounting The switch forwards the accounting info rmation it collects to the designated RADIUS server , where the information is formatted, stored , and managed by the server . For more inform ation on this a spect of RA DIUS account ing, refer to the docum entation provi ded with your R[...]

5-20 RADIUS Authenti cation and Accounting Configuring RADIUS Accounting – Optional—if yo u are also configuring the switch fo r RADIUS authentication, and n eed a unique encryption key for use during authentication sessions with th e RADIUS server you are desig- nating, configure a server -speci fi c key . This key ov errides the global encryp[...]

5-21 RADIUS Authentication and Accounting Configuring RADIUS Accounting (For a more comple te description of th e radius-server command and its options, turn to page 5-10.) For example, suppose you want to th e switch t o use the RADIUS server described below for both authent i cation and ac counting purpose s. ■ IP address: 10.33.18.151 ■ A no[...]

5-22 RADIUS Authenti cation and Accounting Configuring RADIUS Accounting Figure 5-7. Example of Configu ring for a RADIUS Se rver with a Non-Def ault Accounting UDP Port Number The radius-server command as shown in figure 5-7, above, configures the switch to use a RADIUS serv er at IP a ddress 10.33.1 8.151, with a (non- default) UDP accounting por[...]

5-23 RADIUS Authentication and Accounting Configuring RADIUS Accounting ■ Start-Stop: • Send a start record acc ounting notice at the beginning of the account- ing session and a stop record noti c e at the end of the session. Bot h notices include the latest data the switch has co llected for the requested accounting type (N etwork, Exec, or Sy[...]

5-24 RADIUS Authenti cation and Accounting Configuring RADIUS Accounting 3. (Optional) Configure Sessi on Blocking and Interim Updating Options These optional parameters give you additi onal control ov er account ing data. ■ Updates: In addition to usin g a Start-Stop or Sto p-Only trigger , you can optionally configur e the switch to send period[...]

5-25 RADIUS Authentication and Accounting Viewing RADIUS Statistics V iewing RADIUS Statistics General RADIUS Statistics Figure 5-10. Example of Genera l RADIUS Information from Sh ow Radius Command Figure 5-11. RADIUS Server Information From th e Show Radius Host Comma nd Syntax: show radius [ho st < ip-addr >] Shows general RADIUS configura[...]

5-26 RADIUS Authenti cation and Accounting Viewing RADIUS Statistics T abl e 5-2. V alues for Show Radius Host Output (Figure 5-11) Te r m Definition Round T r ip T ime The time interval between the mo st recent Accounting-Response and th e Accounting- Request that matched it from this RADIUS accounting server . Pending Requests The number of RADIU[...]

5-27 RADIUS Authentication and Accounting Viewing RADIUS Statistics RADIUS Authentication Statistics Figure 5-12. Example of Login Attempt and Primary/Se condary Authenticatio n Information from the Show Authenticatio n Command Figure 5-13. Example of RADI US Authentication Inform ation from a Speci fic Server Syntax: show aut henti cation Displays[...]

5-28 RADIUS Authenti cation and Accounting Viewing RADIUS Statistics RADIUS Accounting Statistics Figure 5-14. Listing the Account ing Configuration in t he Switch Figure 5-15. Example of RADIUS Account ing Information fo r a Specific Server Syntax: show acco unting Lists configured accounting interval, “Empty User” suppres- sion status, accoun[...]

5-29 RADIUS Authentication and Accounting Changing RADIUS-Ser ver Access Order Figure 5-16. Example Listing of Active RADIUS Accounting Session s on the Switch Changing RADIUS-Server Access Order The switch tries to access RADIUS ser vers according to the order in which their IP addresses are listed by the show radius command. Also, when you add a [...]

5-30 RADIUS Authenti cation and Accounting Changing RADIUS-Server Access Order T o excha nge the positions of the addre sses so that the server at 10.10.10.003 will be the first choice and the server at 10.10.10.001 will be the la st, you would do the follow ing: 1. Delete 10.10.10.003 from the list. This opens the third (lowest) position in the li[...]

5-31 RADIUS Authentication and Accounting Messages Related to RADIUS Operation Messages Related to RADIUS Operation Message Meaning Can’t reach RADIUS server < x.x.x.x >. A designated RADIUS server is not responding to an authentication request. T ry pinging the server to determine whether it is accessi ble to the switch. If the server is a[...]

5-32 RADIUS Authenti cation and Accounting Messages Related to RADIUS Operation — This page is intentionally unused. —[...]

6-1 6 Configuring Secure Shell (SSH) Contents Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-2 Terminology . . . . . . . . . . . . . . . . . . . . . . . . [...]

6-2 Configuring Secure Shell (SSH) Overview Overview The ProCurve swi tches covered i n this guide use Secure Sh ell version 1 or 2 (SSHv1 or SSHv2) to provide remote access to management functions on the switches via encrypted paths between the switc h and ma nagement station clients capable of S SH operation. SSH provides T elnet- like function s[...]

6-3 Configuring Secure Shell (SSH) Overview Note SSH in the ProCurve is based on the OpenSSH software t oolkit. For more informatio n on OpenSSH, visit http://www.openssh.com . Switch SSH and User Password Authentication . This option is a subset of the client public-key aut hentication show in figure 6-1. It occurs if the switch has SSH enabled bu[...]

6-4 Configuring Secure Shell (SSH) Terminology T erminology ■ SSH Server: A ProCurve switch with SSH enabled. ■ Key Pair: A pair of keys generated by the switch or an SSH client application. Each pair incl udes a public key , that can be r ead by anyone an d a private key , that is hel d internally in the switch or by a client. ■ PEM (Privacy[...]

6-5 Configuring Secure Shell (SSH) Prerequisite for Using SSH Prerequisite for Using SSH Before using the switch as an SSH se rver , you must install a publicly or commercially available SSH client application on the computer(s) yo u use for management access to the switch. If you wa nt client public-key authentication (page 6-2), then the clie nt [...]

6-6 Configuring Secure Shell (SSH) Steps for Configuring and Using SSH fo r Switch and Client Authentication Steps for Configuring and Using SSH for Switch and Client Authentication For two-way authentication between the switch and an SSH client, you must use the lo gin (O perator) level. T abl e 6-1. SSH Options The general steps for configuri ng [...]

6-7 Configuring Secure Shell (SSH) Steps for Configuring and Using SSH for Switch and Client Authentication B. Switch Prep aration 1. Assign a login (Operator) and enable (Manager) password on the switch (page 6-9). 2. Generate a public/private key pa ir on the switch (page 6-10). Y ou need to do this only once. The k ey remains in the switch even [...]

6-8 Configuring Secure Shell (SSH) General Operating Rules and Notes General Operating Rules and Notes ■ Public keys generated on an SSH client must be expor table to the switch. The switch can only store ten keys client key pairs. ■ The switch’ s own public/private key pair and the (optio nal) client public key file are stored in the sw itch[...]

6-9 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation Configuring the Switch for SSH Operation 1. Assign Local Login (Opera tor) and Enable (Manager) Password At a minimum, ProCurve recommends th at you always assign at least a Manager password to the switch. Othe rwise, under some circumstances, anyone with T elnet, web, or s[...]

6-10 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation Figure 6-5. Example of Config uring Local Passwords 2. Generate the Switch’ s Pu blic and Private Key Pair Y ou must gene rate a public and private ho st key pair on the switch. The switch uses this key pa ir , along with a dyna mically generated session key pair to nego[...]

6-11 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation Notes When you generate a host key pair on the switch, the switch places the key pair in flash memory (a nd not in the running-config file). Also, the switch maintains the key pair across reboots, including p ower cycles. Y ou should consider this key pair to be "perm[...]

6-12 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation For example, to generat e and display a new key: Figure 6-6. Example of Gen erating a Public/ Private Host Key Pair for the Switch The 'show crypto host-pub lic-key' displays data in two diff erent formats because your client may store it in eith er of these form[...]

6-13 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation distribution to clients is to use a dire ct, serial connection between the sw itch and a management device (laptop, PC, or UNIX w orkstation), as described below . The public key generated by the swit ch consists of three parts, separated by one blank space each: Figure 6-[...]

6-14 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation 4. Add any data required by your SSH c lient ap plication . For example Before saving the key to an SSH cli ent’ s "known hosts" file you may have to insert the switch’ s IP address: Figure 6-9. Example of a Switch Public Ke y Edited T o Includ e the Switch?[...]

6-15 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation Figure 6-10. Examples of Visual Phonetic and Hexadecimal Conversio ns of the Switch’ s Public Key The two commands sho wn in figure 6-10 convert the displa yed format of the switch’ s (host) public key for easier visu al compari son of th e switch’ s publ ic key to a[...]

6-16 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation SSH Client Contact Behavio r . At the first contact be twee n the switch and an SSH client, if you have not copied th e switch’ s public key into the clie nt, your client’ s first connect ion to the switch wil l questio n the connect ion and, for security reasons, give[...]

6-17 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation The ip ssh key-si ze command affects only a per -se ssion, internal server key the switch creates, uses, and discards. This key is not accessible from the user interface . The switch ’ s public (host) key is a separate, accessible key that is always 8 96 bits. Note on Po[...]

6-18 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation Caution Protect your private key file from ac cess by anyone ot her than yourself. If someone can access your private key file , they can then penetrate SSH security on the switch by ap pearing to be you. SSH does not p rotect the switch fr om unauthorized access via the w[...]

6-19 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation Option B: Config uring the Switch fo r Client Public-Key SSH Authentication. When configured with this option, t he switch uses its pub- lic key to authenticate itself to a client, but the client must also provide a client public-key f or the swit ch to authenticate . This[...]

6-20 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation For example, assume that you have a client public-key fil e named Client- Keys.pub (on a TFTP server at 10.33.18.117 ) ready for down loading to the switch. For SSH access to the switch you wa nt to allow only clients having a private key that matche s a public key found i[...]

6-21 Configuring Secure Shell (SSH) Further Information on SSH Client Public-Key Authentication Figure 6-13 shows how to check the results of the above commands. Figure 6-13. SSH Configuration an d Clie nt-Public-Key Listing From Fi gure 6-12 6. Use an SSH Client T o Access the Switch T est the SSH config uration on th e switch to ensure that you h[...]

6-22 Configuring Secure Shell (SSH) Further Information on SSH Cli ent Public-Key Authentication When conf igured for S SH operati on, the switc h automati cally attemp ts to use its own host pu blic-key to authenticat e itself to SSH client s. T o provide the optional, opposite service—cl ient public-key authen ticatio n to the switch—you can [...]

6-23 Configuring Secure Shell (SSH) Further Information on SSH Client Public-Key Authentication a. Combines the decrypte d byte seq uence with specific session data. b. Uses a secure hash algorithm to create a hash version of this informa - tion. c. Returns the hash version to the switch. 7. The switch computes i ts own hash version of the data in [...]

6-24 Configuring Secure Shell (SSH) Further Information on SSH Cli ent Public-Key Authentication 1. Use your SSH client application to cr eate a public/priva te key pair . Refer to the documentation provided with yo ur SSH client ap plication for details. The switch sup ports the foll owing cli ent-public-key properties: 2. Copy the client ’ s pu[...]

6-25 Configuring Secure Shell (SSH) Further Information on SSH Client Public-Key Authentication For example, if you wan ted to copy a client public-key file named clientkeys.txt from a TFTP server at 10.38.252.195 an d then display th e file contents: Figure 6-15. Example of Cop ying and Displaying a Client Pub lic-Key File Containing T wo Clien t [...]

6-26 Configuring Secure Shell (SSH) Further Information on SSH Cli ent Public-Key Authentication Enabling Clie nt Public -Key Authentication. After you TFTP a client- public-key f ile into the switc h (describ ed above), you can configure the swi tch to allow one of the followin g: ■ If an SSH client’ s public key matches the switch’ s client[...]

6-27 Configuring Secure Shell (SSH) Messages Related to SSH Operation Messages Related to SSH Operation Message Meaning 00000K Peer unreachable. Indicates an error in communicating with the tftp server or not finding the file to download. Causes include such factors as: • Incorrect IP configuration on the switch • Incorrect IP address in the co[...]

6-28 Configuring Secure Shell (SSH) Messages Related to SSH Operation Generating new RSA ho st key. If the cache is depleted, this could take up to two minutes. After you execute the crypt o key generate ssh [rsa] command, the switch displa ys this message while it is gene ratin g the key . Host RSA key file corrupt or not found. Use 'crypto k[...]

7-1 7 Configuring Secure Socket Layer (SSL) Contents Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-2 Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-3 Prerequisite for Using SSL . . . . . . . . . . . . . . . .[...]

7-2 Configuring Secure Socket Layer (SSL) Overview Overview The ProCurve sw itches covered by th is manual use Secure Socket Layer V ersion 3 (SSLv3) and support for T rans port Layer Security(TLSv1) to provide remote web access to the switches vi a encrypted paths be tween the switch and management station clients capable of SSL/TLS operation. Not[...]

7-3 Configuring Secure Socket Layer (SSL) Terminology Figure 7-1. Switch/User Auth entication SSL on the ProCurve swi tches supports these data encrypti on methods: ■ 3DES (168-bit, 112 Effectiv e) ■ DES (56-bit) ■ RC4 (40-bit, 128-bit) Note: ProCurve switches use RS A public key algorithms and Dif fie-Hellman. All references to a key mean ke[...]

7-4 Configuring Secure Socket Layer (SSL) Terminology ■ Self-Signed Certif icate: A certificate not verifi ed by a third-party certificate authority (CA). Self-signed certificate s provide a reduced level of security compared to a CA-signed certificate . ■ CA-Signed Certificate: A certificate verified by a third party certif- icate auth ority ([...]

7-5 Configuring Secure Socket Layer (SSL) Prerequisite for Using SSL Prerequisite for Using SSL Before using the switch as an SSL se rver , you must install a publicly or commercially availabl e SSL enabled we b browser applicat ion on the com- puter(s) you use for manage ment acce ss to the switch. Steps for Configuring and Using SSL for Switch an[...]

7-6 Configuring Secure Socket Layer (SSL) General Operating Rules and Notes General Operating Rules and Notes ■ Once you generate a certificate on the switch you should avoid re- generating the certificat e without a compe lling reason. Otherwise, you will have to re-introduce the swi tch’ s certificate on all manage- ment stations (clients) yo[...]

7-7 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Configuring the Switch for SSL Operation 1. Assign Local Login (Opera tor) and Enable (Manager) Password At a minimum, ProCurve recommends th at you always assign at least a Manager password to the switch. Othe rwise, under some circumstances, anyone with T elnet, we[...]

7-8 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Using the web browser interface T o Configure Local Passwo rds. Y ou can configure both the Op erator and Manager passwo rd on one screen. T o access the web browser interfac e refer to the chapter titled “Using the W eb Browser Interface ” in the Management and [...]

7-9 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation 2. Generate the Switch’ s Server Host Certificate Y ou must gene rate a server certifi cate on the switc h before enabling SSL. The switch uses th is server certifi cate, along with a dynamical ly generated session key pair to negotiate an en cryption method an d s[...]

7-10 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation T o Generate or Erase the Switch’ s Server Certificate with the CLI Because the host certificate is stored in flash instead of the ru nning-config file, it is not necessary to use write memory to save the certificate. Erasing the host certificate automatically dis[...]

7-11 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Comments on Certificate Fields. There are a number arguments used in th e generation of a server certificate. table 7-1, “Certificate Fi eld Descriptions” de scribes these argu ments. T abl e 7-1. Certificate Field Descript ions For example, to generate a ke y a[...]

7-12 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Notes “Zeroizing” the switch’ s server host ce rtificate or key automatically disables SSL (sets web-managemen t ssl to No ). Thus , if you zeroize the server host certificate or key and then generate a new key and server certificate, you must also re-enable S[...]

7-13 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Generate a Self-Signed Host Ce rtificate with the W eb browser interface Y ou can configure SSL from the web b rowser interface. For mo re information on how to acc ess the web bro wser interfa ce, refer to the chapter ti tled “Using the W eb Browser Interface” [...]

7-14 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation For example, to generate a new host certificate via the we b browsers inter - face: Figure 7-5. Self-Signe d Certificate gene ration via SSL Web Browser Interface Scree n T o view the current host certifi cate in the web browser interface: 1. Proceed to the Security[...]

7-15 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Figure 7-6. Web browser Interface showing current SSL Host Certif icate Generate a CA-Signed server host certificate with the W eb Browser Interface This section d escribes ho w to install a CA-Signed ser v er host certificate from the web browser interface. (For mo[...]

7-16 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation The installation of a CA-signed certif icate involves interaction with other entities and consi sts of three phases. The first phase is the creation of the CA certificate request, which is then copied off from the switch for submission t o the certificate authority [...]

7-17 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Figure 7-7. Example of a Certificate Request and Reply 3. Enable SSL on the Sw itch and Anticipate SSL Browser Contact Behavior T he web-management ssl comma nd enables SSL on the switch and modifies parameters the sw itch uses for transactions with client s. After [...]

7-18 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Note Before enabling SSL on the switch yo u must genera te the switch’ s host certificate and key . If you have not alr eady done so, refer to “2. Generate the Switch’ s Server Host Certificate” on page 7-9. When configured for SSL, the switch uses its host [...]

7-19 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Using the CLI interface to enable SSL T o enable SSL on the switc h 1. Generate a Host certificate if you h ave not already done so. (Refer to “2. Generate the Switch’ s Server Ho st Certificate” on page 7-9.) 2. Execute the web-man agement ssl command. T o di[...]

7-20 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Figure 7-8. Using the web b rowser interface to enabl e SSL and select TCP port number Note on Port Number ProCurve recommends us ing the default IP port number (443). However , you can use web-management ssl tcp-port to specify any T CP port for SSL connec- tions e[...]

7-21 Configuring Secure Socket Layer (SSL) Common Errors in SSL Setup Common Errors in SSL Setup Error During Possible Cause Generating host certificate on CL I Y ou have not generated a certificate key . (Refer to “CLI commands used to generate a Server Host Certificate” on page 7-10.) Enabling SSL on the CLI or Web browse r interface Y ou hav[...]

7-22 Configuring Secure Socket Layer (SSL) Common Errors in SSL Setup — This page is intentionally unused. —[...]

8-1 8 Configuring Port-Based Access Control (802.1X) Contents Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-3 Why Use Port-Based Access Control? . . . . . . . . . . . . . . . . . . . . . . . . . . 8-3 General Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .[...]

8-2 Configuring Port-Based Ac cess Cont rol (802.1X) Contents Configuring Sw itch Ports To Operate As Supplicants for 802.1X Con nections to O ther Switche s . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-34 Displaying 802.1X Configuratio n, Statistics, and C ounters . . . . . . . . . . . . 8-38 Show Commands for Port-Access Au thentica [...]

8-3 Configuring Port-Based Access Control (802.1X) Overview Overview Why Use Port-Based Access Control? Local area networks are often deploye d in a way that allows unauthorized clients to attach to network devices, or allows unauthorized users to get access to unattended clients on a netw or k. Also, the use of DHCP services and zero configurati o[...]

8-4 Configuring Port-Based Ac cess Cont rol (802.1X) Overview ■ Local authentication of 802.1X clients using the switch’ s local user - name and password (as an altern ative to RADIUS authentication). ■ T emporary on-demand change of a po rt’ s VLAN member ship status to support a current client’ s session. (This does not include po rts t[...]

8-5 Configuring Port-Based Access Control (802.1X) Overview Figure 8-1. Example of an 802.1X Application Accounting . The switch also provide s RA DIU S Network accounting for 802.1X access. Re fer to “ RADIUS Authentication and Accounting” on page 5-1. RADIUS Server LAN Core 802.1X-Aware Client (Supplica nt) Switch Running 802.1X and Connected[...]

8-6 Configuring Port-Based Ac cess Cont rol (802.1X) How 802.1X Operates How 802.1X Operates Authenticator Operation This operation pro vides security on a direct, point-to-point link between a single client an d the switch, where bo th devices are 802.1X-aware. (If you expect desirable cl ients that d o no t have the necessary 802.1X supplicant so[...]

8-7 Configuring Port-Based Access Control (802.1X) How 802.1X Operates Switch-Port Supplicant Operation This operation provides se curi ty on links between 802.1X-aware switches. For example, suppose that you want to connect two switches, where: ■ Switch “A” has port A1 configured for 802.1X supplicant operation. ■ Y ou want to connect port[...]

8-8 Configuring Port-Based Ac cess Cont rol (802.1X) Terminology • A “failure” response cont inues the block on port B5 and caus es port A1 to wait for the “held-time” peri od be fore trying again to achieve authentication th rough port B5. Note Y o u can configure a switc h port to op erate as both a supplicant and an authenticator at th[...]

8-9 Configuring Port-Based Access Control (802.1X) Terminology EAP (Extensible Au thentication P rotocol) : EAP enables network access that supports multip le authentication methods. EAPOL: Extensible Authenticat ion Protocol Over LAN, as defined in the 802.1X standard . Friendly Clie nt: A client that does not p ose a s ecurity risk if given acces[...]

8-10 Configuring Port-Based Ac cess Cont rol (802.1X) General Operating Rules and Notes member of that VLAN as long as at least one o ther port on the swi tch is statically configured as a tagge d or untagged member of the same Unau- thorized-Client VLAN. Untagged VLAN Membership: A port can be an untagged member of only one VLAN. (In the f actory-[...]

8-11 Configuring Port-Based Access Control (802.1X) General Operating Rules and Notes ■ If a client already has access to a switch port when you c onfigure the port for 802.1X authenticator operati on, the port will block the client from further network access until it can be authenticated. ■ On a port configured for 802.1X wi th RADIUS authent[...]

8-12 Configuring Port-Based Ac cess Cont rol (802.1X) General Setup Procedure for Port-B ased Access Control (802.1X) General Setup Procedure for Port-Based Access Control (802.1X) Do These Steps Before Y ou Configure 802.1X Operation 1. Configure a local username and pa ssword on the switch for both the Operator (login) and Manager (enable) access[...]

8-13 Configuring Port-Based Access Control (802.1X) General Setup Procedure for Port -Based Access C ontrol (802.1X) Overview: Configuring 802. 1X Authentication on the Switch This section outl ines the steps for configuring 802.1X on the switch. For detailed inf ormation on each step, refer to “RADIUS Auth entication an d Accounting” on page 5[...]

8-14 Configuring Port-Based Ac cess Cont rol (802.1X) General Setup Procedure for Port-B ased Access Control (802.1X) 7. If you are using Port S ecurity on the switch, conf igure the switch to allow only 802.1X access on ports configured for 802 .1X operation, and (if desired) the ac tion to take if an unauthorized devi ce attempts access through a[...]

8-15 Configuring Port-Based Access Control (802.1X) Configuring Switch Ports as 802.1X Authenticators Configuring Switch Ports as 802.1X Authenticators 1. Enable 802.1X Authentica tion on Selected Ports This task configures the indivi dual ports you want to operate as 802.1X authenticators for point-to-poi nt links to 802.1X-aware clients or switch[...]

8-16 Configuring Port-Based Ac cess Cont rol (802.1X) Configuring Switch Ports as 802.1X Authenticators Syntax: aaa port-access a uthenticator < port -list > Enables specified ports to op erate as 802.1X authen ti- cators with current per- port authenticator configura- tion. To activa te configured 80 2.1X operation , you must enable 802. 1X [...]

8-17 Configuring Port-Based Access Control (802.1X) Configuring Switch Ports as 802.1X Authenticators Sets the period of time the switch waits for a supplicant response to an EAP re quest. If the suppli cant does not respond within the configured time frame, the session times out. (Default: 30 seconds) aaa port-access a uthenticator < port -list[...]

8-18 Configuring Port-Based Ac cess Cont rol (802.1X) Configuring Switch Ports as 802.1X Authenticators Configures an existing, stat ic VLAN to be the Autho- rized-Client VLAN. Refer to “80 2.1X Open VLAN Mode” on page 8-21. aaa port-access a uthenticator < port -list > (Syntax Continued) [initialize] On the specified ports, bl ocks inbou[...]

8-19 Configuring Port-Based Access Control (802.1X) Configuring Switch Ports as 802.1X Authenticators 3. Configure the 802.1X Authentication Method This task speci fies how the swit ch will authenticate the cr edentials provided by a supplicant connected to a switch port configured as an 802.1X authenti- cator . For example, to e nable the switch t[...]

8-20 Configuring Port-Based Ac cess Cont rol (802.1X) Configuring Switch Ports as 802.1X Authenticators 4. Enter the RADIUS Host IP Address(es) If you selected either eap-radius or chap-radius for th e authentication method, configure the switch to use 1 to 3 RADIUS servers for authentication. The following syntax shows th e basic commands. For cov[...]

8-21 Configuring Port-Based Access Control (802.1X) 802.1X Open VLAN Mode 802.1X Open VLAN Mode This section describes how to use the 802.1X Open VLAN mode to configur e unauthorized-client and authorized-client VLANs on po rts configured as 802.1X authentica tors. Introduction Configuring the 802.1X Op en VLAN mode on a port changes how the port r[...]

8-22 Configuring Port-Based Ac cess Cont rol (802.1X) 802.1X Open VLAN Mode 1. 1st Priority: The port joins a VLAN to which it has been assigned by a RADIUS server during au thentication. 2. 2nd Priority: If RADIUS authentic ation do es not include assigning the port to a VLAN, then th e switch assigns the port to the VLAN en tered in the port’ s[...]

8-23 Configuring Port-Based Access Control (802.1X) 802.1X Open VLAN Mode T able 8-1. 802.1X Open VLAN Mode Options 802.1X Per -Port Configuration Port Response No Open VLAN mode: The port automatically blocks a client that c annot initiate an authent ication sessi on. Open VLAN mode with both of the f ollowing configure d: Unauthorized-Client VLAN[...]

8-24 Configuring Port-Based Ac cess Cont rol (802.1X) 802.1X Open VLAN Mode Open VLAN Mode with Only an Unauthor ized-Clie nt VLAN Configured: • When the port detects a client, it automatically b ecomes an untagged member of this VLAN. T o limit security risks, the ne twork services and acce ss available on this VLAN should in clude only what a c[...]

8-25 Configuring Port-Based Access Control (802.1X) 802.1X Open VLAN Mode Operating Rules for Au thorized-Client and Unauthorized-Client VLANs Condition Rule Static VLANs used as Authorize d- Client or Unauthorized-Client VLANs These must be configured o n the switch before you co nfigure an 802.1X authenticator port to use them. (Use the vlan <[...]

8-26 Configuring Port-Based Ac cess Cont rol (802.1X) 802.1X Open VLAN Mode Note: If you use th e same VLAN as the Unau thorized-Client VLAN for all authenti- cator ports, unauth enticated clients on different ports can communicate wit h each other . However , in this case, y ou can improve securi ty between authen- ticator ports by usin g the swit[...]

8-27 Configuring Port-Based Access Control (802.1X) 802.1X Open VLAN Mode Setting Up and Configuring 802.1X Open VLAN Mode Preparation. This section assumes use of bot h the Unauthorized-Client and Authorized-Client VLANs. Refer to T abl e 8-1 on page 8-23 for other options. Before you configu re the 802.1X Open VLAN m ode on a port: ■ Statically[...]

8-28 Configuring Port-Based Ac cess Cont rol (802.1X) 802.1X Open VLAN Mode ■ Ensure that the switch is connec ted to a RADIUS server configured to support auth enticatio n requests from clients using ports config- ured as 802.1X authenti cators. (The RADIUS server should not be on the Unauthorized-Client VLAN.) Note that as an alternative, you c[...]

8-29 Configuring Port-Based Access Control (802.1X) 802.1X Open VLAN Mode 3. If you selected either eap-radius or chap-ra dius for step 2, use the radius host command to configure up to thr ee RADIUS server IP address(es) on the switch. 4. Activate authentication on the switch. 5. T est both the au thorized and unauthorized access to your system to[...]

8-30 Configuring Port-Based Ac cess Cont rol (802.1X) 802.1X Open VLAN Mode Configuring 802.1 X Open VLAN Mode. Use these commands to actually configure Open VLAN mode. For a listin g of the steps needed to prepare the switch for using Open VLAN mode, re fer to “Preparation” on page 8-27. For example, suppose you want to conf igure 802.1X port-[...]

8-31 Configuring Port-Based Access Control (802.1X) 802.1X Open VLAN Mode Inspecting 802.1X Op en VLAN Mode Operation. For inf ormation an d an example on viewing current Ope n VLAN mode operat ion, refer to “Viewing 802.1X Open VLAN Mode Status” on page 8-40. 802.1X Open VLAN Operating Notes ■ Although you can configure Open VL AN mode to us[...]

8-32 Configuring Port-Based Ac cess Cont rol (802.1X) Option For Authenticator Ports: Configure Port-Security To Allow Only 802.1X Devices ■ If an authenticat ed c lient loses authenti cation during a session in 802.1X Open VLAN mode, the port VL AN membership reverts back to the Unauthori zed-Client VLAN. If t h ere is no Unauthorized-Cli ent VL[...]

8-33 Configuring Port-Based Access Control (802.1X) Option For Authenticator Ports: Configure Port-Security To Allow Only 802.1X Devices Note on Blocking a Non- 802.1X Device If the por t’ s 802.1 X authenticator control mode is config ured to auth orized (as shown below , instead of aut o ), then the first sour ce MAC address from any device, wh[...]

8-34 Configuring Port-Based Ac cess Cont rol (802.1X) Configuring Switch Ports To Operate As Supp licants for 802.1X Connect ions to Other Switches Configuring Switch Ports T o Operate As Supplicants for 802.1X Connections to Other Switches Y ou can configure a switch port to operate as a supplicant in a connec tion to a port on another 802.1X-a wa[...]

8-35 Configuring Port-Based Access Control (802.1X) Configuring Switch Ports To Operate As Suppli cants for 802.1X Connections to Other Switches 1. When port A1 on switch “A” is firs t connect ed to a port on switch “B”, or if the ports are already connected an d either switch reboots, port A1 begins sending sta rt packets to port B5 on swi[...]

8-36 Configuring Port-Based Ac cess Cont rol (802.1X) Configuring Switch Ports To Operate As Supp licants for 802.1X Connect ions to Other Switches Configuring a Supplicant Switch Port. Note that you must enable suppli - cant operation on a port before you ca n change the supplic ant configuration. This means you must execute the supp licant comman[...]

8-37 Configuring Port-Based Access Control (802.1X) Configuring Switch Ports To Operate As Suppli cants for 802.1X Connections to Other Switches aaa port-access supplic ant [ethernet] < port-list > (Syntax Continu ed) [auth-timeout < 1 - 300 > ] Sets the period of time the port waits to receive a challenge from the authentica tor . If t[...]

8-38 Configuring Port-Based Ac cess Cont rol (802.1X) Displaying 802.1X C onfiguration, Statistics, and Counters Displaying 802.1X Configuration, Statistics, and Counters Show Commands for Port -Access Authenticator 802.1X Authentication Commands page 8-15 802.1X Supplicant Commands page 8-34 802.1X Open VLAN Mode Commands page 8-21 802.1X-Related [...]

8-39 Configuring Port-Based Access Control (802.1X) Displaying 802.1X Configurat ion, Statistics, and Counters show port-access au thenticator (Syntax Conti nued) config [[e] < port-list >] S hows: • Whether port-access authenticator is active • The 802.1X configuration of the ports configured as 802.1X authenticators If you do not specif[...]

8-40 Configuring Port-Based Ac cess Cont rol (802.1X) Displaying 802.1X C onfiguration, Statistics, and Counters V iewing 802.1X Open VLAN Mode Status Y ou can examine the switch’ s curre nt VLAN status by using the show port- access authentic ator and show vlan < vlan-id > commands as il lustrated i n this section. Figure 8-5 shows an exam[...]

8-41 Configuring Port-Based Access Control (802.1X) Displaying 802.1X Configurat ion, Statistics, and Counters ■ When the Unauth VLAN ID is configured and matches the Current VLAN ID in the above comman d output, an unauthenticat ed client i s connected to the por t. (This assume s the port is not a statically configured member of the VLAN you ar[...]

8-42 Configuring Port-Based Ac cess Cont rol (802.1X) Displaying 802.1X C onfiguration, Statistics, and Counters Figure 8-6. Example of Showin g a VLAN with Ports Configured for Open VLAN Mo de Unauthorized VLAN ID < vlan -id >: Lists the VID of the static VLAN configured as the unauthorized VLAN for the indicated port. 0: No unauthorized VLA[...]

8-43 Configuring Port-Based Access Control (802.1X) Displaying 802.1X Configurat ion, Statistics, and Counters Show Commands for Po rt-Access Supplicant Note on Supplicant Statistics. For each port configured as a supplicant, show port-access supplic ant statistics [e] < port-l ist >] displays th e source MAC address and statistics for transa[...]

8-44 Configuring Port-Based Ac cess Cont rol (802.1X) How RADIUS/802.1X Authenticat ion Affects VLAN Operation supplicant port to another without clearin g the statistics data from the first port, the authenticator’ s MAC address wil l appear in the supplicant statistics for both ports. How RADIUS/802.1X Authentication Affects VLAN Operation Stat[...]

8-45 Configuring Port-Based Access Control (802.1X) How RADIUS/802.1X Authenticat ion Affects VLAN Operation For example, suppose that a RADIUS-au thenticated, 802.1X-a ware client o n port A2 requires access to VLAN 22, but VLA N 22 is config ured for no access on port A2, and VLAN 33 is conf igured as untagged on port A2: Figure 8-7. Example of a[...]

8-46 Configuring Port-Based Ac cess Cont rol (802.1X) How RADIUS/802.1X Authenticat ion Affects VLAN Operation Figure 8-8. The Active Configuration for VLAN 22 T e mporarily Changes for the 802.1X Session ■ W ith the preceding in mind, since (s tatic) VLAN 33 is configured as untagged on port A2 (see figure 8- 7), and since a port can be untagged[...]

8-47 Configuring Port-Based Access Control (802.1X) How RADIUS/802.1X Authenticat ion Affects VLAN Operation When the 802.1X client’ s session on port A2 en ds, the port discards the temporary untagged VLAN membership. At this time the static VLAN actually configured as untagged on the port again bec omes available. Thus, when the RADIUS-authenti[...]

8-48 Configuring Port-Based Ac cess Cont rol (802.1X) Messages Related to 802.1X Operation Messages Related to 802.1X Operation T able 8-3. 802.1X Operating Messages Message Meaning Port < port-list > is not an authenticator. The ports in the port list have not been enabled as 802.1X authenticators. Use this comm and to enable the ports as au[...]

9-1 9 Configuring and Monitoring Port Security Contents Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-2 Basic Operation . . . . . . . . . . . . . . . . . [...]

9-2 Configuring and Monitoring Port Security Overview Overview Using Port Security , you can configure each switch po rt with a unique list of the MAC addresses of devices that ar e authorized to access the netw ork through that port. This enables individ u al ports to detect, prevent, and log attempts by unauthorized devices to communicate th roug[...]

9-3 Configuring and Monitoring Port Security Overview General Operation for Port Security . On a per -port basis, you can configure security measure s to block un authori zed devices, and to send notic e of security violations. O nce you have configured port secu rity , you can then monitor the network for security viol ations through one o r more [...]

9-4 Configuring and Monitoring Port Security Overview Figure 9-1. Example of How Port Security Controls Access Note Broadcast and Mu lticast traffic is not “un authorized” traffic, an d can be read by intruders connect ed to a port on wh ich you have configured port security . T runk Group Exclusion Port security d oes not operate on eit her a [...]

9-5 Configuring and Monitoring Port Security Planning Port Security Planning Port Security 1. Plan your port securi ty configuration and moni toring according to the following: a. On which ports do you want port secu rity? b. Which devices (MAC addresses) ar e authorized on each port and how many device s do you want to allow p er port (up to 8)? c[...]

9-6 Configuring and Monitoring Port Security Port Security Command Options and Operation Port Security Command Options and Operation Port Security Comm ands Used in This Section This section de scribes the CLI port secu rity command and how th e switch acquires a nd maintai ns authorized addresses. Note Use the global configuration level to execute[...]

9-7 Configuring and Monitoring Port Security Port Security Command Options and Operation Syntax: port -security [e] < port-list > learn-mode < continuou s | static | configured | port-access > Continuous (Default) : Appears in the factory-default setting or when you execute no port-security . Allows the port to learn addresses from inbo[...]

9-8 Configuring and Monitoring Port Security Port Security Command Options and Operation Syntax: port-sec urity [e] < port-list > (- Continued -) learn-mode < continuous | static | configured | port-access > (- Continued -) Configured: The s tatic-configured op tion operates the same as the static-learn option on the preceding page, exc[...]

9-9 Configuring and Monitoring Port Security Port Security Command Options and Operation Syntax: port-sec urity [e] < port-list > (- Continued -) action < none | send-a larm | send-disable > Specifies whethe r an SNMP trap is sent to a networ k man- agement station. Operates when: • Learn mode is set to learn-mode static (static-learn[...]

9-10 Configuring and Monitoring Port Security Port Security Command Options and Operation Retention of Stat ic MAC Addresses Learned MAC Addresses In the following two cases, a po rt in Static learn mode ( learn-mode static ) retains a le arned MAC ad dress even if y ou later rebo ot the swit ch or disabl e port security for that port: ■ The port[...]

9-11 Configuring and Monitoring Port Security Port Security Command Options and Operation Using the CLI T o Display Port Security Settings. Syntax : show port-security show port-security [e] <port number> show port-security [e] [< port number >-< port number ]. . .[,< port number >] W ithout p ort parameters, show port-security[...]

9-12 Configuring and Monitoring Port Security Port Security Command Options and Operation The following command example shows th e option for entering a range of ports, including a series of no n-contiguous ports. Note that no spaces are allowed in the po rt number portion of the command string: ProCurve(config)# show port-security A1-A3,A6,A8 Conf[...]

9-13 Configuring and Monitoring Port Security Port Security Command Options and Operation ProCurve(config)# port-security a1 learn-mode static mac-address 0c0090-123456 action send-disable This example configures port A5 to: ■ Allow two MAC a ddresses, 00c100-7fec00 and 0060b0-889e00, as the authorized devices. ■ Send an al arm to a mana gement[...]

9-14 Configuring and Monitoring Port Security Port Security Command Options and Operation Figure 9-4. Example of Adding an Authorized Device to a Port W ith the above configuration for port A1, the foll owing comma nd adds the 0c0090-456456 MAC address as th e second authorized address. ProCurve(config)# port-security a1 mac-address 0c0090- 456456 [...]

9-15 Configuring and Monitoring Port Security Port Security Command Options and Operation If you are adding a device (MAC address) to a port on which th e Authorized Addresses list is already full (as controll ed by the port’ s current Address Limit setting), then you must increase the Address Limit in order to add the device, even if you want to[...]

9-16 Configuring and Monitoring Port Security Port Security Command Options and Operation T o remove a device (MAC address) from the “Authorized” list and wh en the current number of devices equa ls the Address Li mit value, you sh ould first reduce the Address Limit value by 1, then remove the unwanted device. Note When you have configured the[...]

9-17 Configuring and Monitoring Port Security MAC Lockdown Figure 9-8. Example of Port A1 After Removing One MAC Address MAC Lockdown MAC Lockdown is available on the Series 2600, 2600-PWR, and 28 00 switches only. MAC Lockdown, al so known as “stati c addressing,” is the p ermanent assign- ment of a gi ven MAC address (and VLAN, or V irtual Lo[...]

9-18 Configuring and Monitoring Port Security MAC Lockdown How It W orks. When a device’ s MAC address is locked down to a port (typically in a pair with a VLAN) all in formation sent to that MAC address must go through the locked-down port. If the device is mo ved to another port it cannot receive data. T raffic to the designa ted MAC address go[...]

9-19 Configuring and Monitoring Port Security MAC Lockdown Y ou cannot perform MAC Lockd own and 802.1x authentication o n the same port or on the same MAC ad dress. MA C Lockdown and 802.1x authentication are mutually exclusive. Lockdown is permitted on static trun ks (manually configured link aggrega- tions). Differences Between MAC Lo ckdown and[...]

9-20 Configuring and Monitoring Port Security MAC Lockdown MAC Lockdown Operating Notes Limits. There is a limit of 500 MAC Loc kdowns that you can safely code per switch. T o truly lock down a MAC addr ess it would be necessary to use the MAC Lockdown command for every MAC Address and VLAN I D on every switch. In reality few net work administra to[...]

9-21 Configuring and Monitoring Port Security MAC Lockdown Deploying MAC Lockdown When you deploy MAC Lockdown you ne ed to consider how you use i t within your networ k topology to ensure security . In some cases where you are using techniques such as Spanning T ree Protocol (STP) to speed up network performanc e by providing mu ltiple paths for d[...]

9-22 Configuring and Monitoring Port Security MAC Lockdown Figure 9-9. MAC Lockdown Deployed At the Netw ork Edge Provides Security Basic MAC Lockdown Deployment. I n the Model Network T opology sho wn above, the switches that are connected to the edge of the net work each h ave one and only one connection to the core network. This means each sw it[...]

9-23 Configuring and Monitoring Port Security MAC Lockdown The key points for this Model T opology are: • The Core Network is sep arated from the edge by the use of switches which have been “locked down” for security . • All switches connected to the edge (outside us ers) each have only one port they can use to co nnect to th e Core Network[...]

9-24 Configuring and Monitoring Port Security MAC Lockdown Figure 9-10. Conne ctivity Problems Using MAC Lo ckdown with Multipl e Paths The resultant connectivit y issues would prevent you from locking do wn Server A to Switch 1. And when you remove the MAC Lockdown from Switch 1 (to prevent broadcast storms or other connectivit y issues), you then[...]

9-25 Configuring and Monitoring Port Security MAC Lockout Displaying status. Locked down ports are list ed in the output of the show running-config command in the CLI . The show st atic-mac command also lists the locked down MAC addr esses, as shown below . Figure 9-11. Listing Locked Down Ports MAC Lockout MAC Lockout is availabl e on the S eries [...]

9-26 Configuring and Monitoring Port Security MAC Lockout Lockout command ( lockout-mac < mac-address > ). When the wireless clients then attempt to use the network, the switch recogni zes the i ntruding MAC addresses and prevents them from sending or receiving data on that network. If a particular MAC address c an be identified as unwanted o[...]

9-27 Configuring and Monitoring Port Security MAC Lockout Figure 9-12. Listi ng Locked Out Port s Port Security and MAC Lockout MAC Lockout is in dependent of port-secur ity and in fact wil l override it. MAC Lockout is pref erable to port-secu rity to stop access from kn own devices because it can be configured for all ports on the switch with one[...]

9-28 Configuring and Monitoring Port Security IP Lockdown IP Lockdown IP lockdown is ava ilable on the Series 2600 and 2 800 switches only . The “IP lockdown” utility enables you to re strict incoming traffic on a port to a specific IP address/subnet, and de ny all o ther traffic on that por t. Operating Rules for IP Lockdown ■ Users cannot s[...]

9-29 Configuring and Monitoring Port Security Web: Displaying and Configur ing Port Security Features W eb: Displaying and Configuring Port Security Features 1. Click on the Security tab. 2. Click on [Port Security] . 3. Select the settings you want and, if you are usi n g the Static Learn Mode, add or edit the Author ized Addresses field. 4. Imple[...]

9-30 Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags • In the menu interface: – The Port Status screen includ es a per -port intrusion alert – The Event Log includes per -port entries for security vi ola- tions • In the w eb browser i nterface: – The Alert Log’ s Status | Overvie w window incl[...]

9-31 Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags Keeping the Intrusion Log Cu rrent by Resetting Alert Flags When a violation occurs on a port, an alert flag is set for that port and the violation is en tered in the Intrusion Lo g. Th e switch can detect and handle subsequent intr usions on that port,[...]

9-32 Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags Figure 9-14. Example of Port Status Sc reen with Intrusion Alert on Port A3 2. T ype [I] ( I ntrusion log ) to display the I ntrusion Log. Figure 9-15. Example of the I ntrusion Log Display The above example shows two intrusio ns for port A3 and one int[...]

9-33 Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags (The intrusion lo g holds up to 20 intrusi on records and deletes an intrusion re cord only wh en the log becomes full and a new intrusi on is subsequentl y detected .) Note also that the “ prior to ” text in the record fo r the earlie st intrusion [...]

9-34 Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags CLI: Checking for Intrusions, Listing Intrusion Alerts , and Resetting Alert Flags The following commands display port status, including whether there are intrusion alerts for any port(s), list the last 20 intrusions, and either reset the alert flag on [...]

9-35 Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags Figure 9-17. Example of t he Intrusion Log with Mu ltiple Entries for the Same Po rt The above ex ample shows three i ntrusions for port A1 . Since the switc h can show only one un cleared intrusion per po rt, the older two i ntrusions in th is example [...]

9-36 Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags Using the Event Log T o Find Intrusion Alerts The Event Log lists port securit y intrusions as: W MM/DD/YY HH:MM:SS FFI: port A3 - Security V iolation where “ W ” is the severit y level of the log entry and FF I is the system module that generated t[...]

9-37 Configuring and Monitoring Port Security Operating Notes for Port Security a. Click on the Security tab. b. Click on [Intrusion Log] . “Ports with Intrusion Flag” indicates any ports for which the alert fla g has not been cleared. c. T o clear the current alert flags, click on [Reset Alert Flags] . T o access the web-based Help provided fo[...]

9-38 Configuring and Monitoring Port Security Operating Notes for Port Security LACP Not A vailable on Ports Co nfigured for Port Security . To m a i n - tain security , LACP is not allowe d on po rts configured for port se curity . If y ou configure port securi ty on a port on which L ACP (active or passive) is configured, the switch remo ves the [...]

10-1 10 T r affic/Security Filters (ProCurve Series 2600/2600- PWR and 2800 Switches) Contents Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-2 Using Source-[...]

10-2 Traffic/Security Filters (ProCurve Series 2600/260 0-PWR a nd 2800 Switches) Overview Overview This chapter describes the use of sour ce-port filters on the Seri es 2600/ 2600-PWR switches and on the Serie s 28 00 switches. For info rmation on filters for the Series 25 00 switches, refer to the Management and Configur ation Guide provided for [...]

10-3 Traffic/Security Filters (ProCurve Se ries 2600/2600-PW R and 2800 Switches) Overview from receiving traf fic from workstati on "X", you would configure a fi lter to drop traffic from port 5 to port 7. The re sultin g filter woul d drop traffic from port 5 to port 7, but would forward all other traffic from any source port to any des[...]

10-4 Traffic/Security Filters (ProCurve Series 2600/260 0-PWR a nd 2800 Switches) Using Source-Port Filters Using Source-Port Filters This feature is available onl y on the Series 2600, 2600-PWR , and 2800 switches. Operating Rules for Source-Port Filters ■ Y ou can configure one source-port filt er for each physical port or port trunk on the swi[...]

10-5 Traffic/Security Filters (ProCurve Se ries 2600/2600-PW R and 2800 Switches) Using Source-Port Filters Configuring a Source-Port Filter The source-port filter command operates from the gl obal configuration level. Example of Creating a Source- Port Filter . For example, assume that you want to create a source-port filter th at drops all traffi[...]

10-6 Traffic/Security Filters (ProCurve Series 2600/260 0-PWR a nd 2800 Switches) Using Source-Port Filters Configuring a Filter on a Port T runk. This operation uses the same com- mand as that used for configuring a filt er on an individual port. However , the configuratio n process requires two steps: 1. Configure the port trunk. 2. Configure a f[...]

10-7 Traffic/Security Filters (ProCurve Se ries 2600/2600-PW R and 2800 Switches) Using Source-Port Filters V iewing a Source-Port Filter Y ou can list all source-port filters co nfigur ed in the switch and, optionally , the detailed info rmation on a specific filter . For example, assume that these th ree filters exist on the switch: Syntax: show [...]

10-8 Traffic/Security Filters (ProCurve Series 2600/260 0-PWR a nd 2800 Switches) Using Source-Port Filters If you wanted to determine the index number for the filter on source port 3 and then view a listing the filter deta ils on source port 3, you wo uld use the show filter and show fi lter [ INDEX ] commands, as shown in figure 10-4. Figure 10-4[...]

10-9 Traffic/Security Filters (ProCurve Se ries 2600/2600-PW R and 2800 Switches) Using Source-Port Filters Editing a Source-Port Filter The switch includes in one filter the action(s) for al l destination po rts and/or trunks configured for a given source port. Thus, if a source-por t filter already exists and you want to change the cu rrently con[...]

10-10 Traffic/Security Filters (ProCurve Series 2600/260 0-PWR a nd 2800 Switches) Using Source-Port Filters Using Named Source-Port Filters This feature is available only on the Series 2600 and 2600-PWR switches. Named source-port filters are filters that may be used on multiple ports and port trunks. As with regular sourc e-port filters, a po rt [...]

10-11 Traffic/Security Filters (ProCurve Se ries 2600/2600-PW R and 2800 Switches) Using Source-Port Filters A named source-por t filter must f irst be defined and configured befo re it can be applied. In the follow ing example two named source-port filters are defined, web-o nly and accounting . ProCurve(config)# filter source-port named-filter we[...]

10-12 Traffic/Security Filters (ProCurve Series 2600/260 0-PWR a nd 2800 Switches) Using Source-Port Filters V iewing a Named Source-Port Filter Y ou ca n list all source-port filters co nfigured in the switch, both named and unnamed, and t heir action using the show command below . Sample Configuration for Named Source-Port Filters A company wants[...]

10-13 Traffic/Security Filters (ProCurve Se ries 2600/2600-PW R and 2800 Switches) Using Source-Port Filters Defining and Con figuring Example Named Source-P ort Filters. While named source-p ort filters may be defined and configured in two steps, this is not necessary . Here we de fine and conf igure each of the named source-port filters for our e[...]

10-14 Traffic/Security Filters (ProCurve Series 2600/260 0-PWR a nd 2800 Switches) Using Source-Port Filters ProCurve(config)# show filter Traffic/Security Filters IDX Filter Type | Value --- ------------ + ------------------- 1 Source Port | 2 2 Source Port | 3 3 Source Port | 4 4 Source Port | 5 5 Source Port | 6 6 Source Port | 8 7 Source Port |[...]

10-15 Traffic/Security Filters (ProCurve Se ries 2600/2600-PW R and 2800 Switches) Using Source-Port Filters Using the IDX value in the show filter command, we can see how traffic is filtered on a specif ic port ( Va l u e ).The two outputs bel ow show a non- accounting and an accou nting swi tch port. ProCurve(config)# show filter 4 Traffic/Securi[...]

10-16 Traffic/Security Filters (ProCurve Series 2600/260 0-PWR a nd 2800 Switches) Using Source-Port Filters The same command, using IDX 26, shows how traffic from the In ternet is handled. As the company grows, mo re resources are requir ed in accounting. T w o additional accounting workstations are added and attached to ports 12 and 13. A second [...]

10-17 Traffic/Security Filters (ProCurve Se ries 2600/2600-PW R and 2800 Switches) Using Source-Port Filters The following revisions to the named so urce-po rt filter definiti ons maintain the desired network traffi c management, as shown in the Action column of the show command. W e next apply the updated named source-p ort filters to th e appropr[...]

10-18 Traffic/Security Filters (ProCurve Series 2600/260 0-PWR a nd 2800 Switches) Using Source-Port Filters — This page is intentionally unused. —[...]

11-1 11 Using Authorized IP Managers Contents Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-2 Configuration Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-3 Access Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .[...]

11-2 Using Authorized IP Managers Overview Overview Authorized IP Manager Features The Authorized IP Managers feature us es IP addresses and masks to deter - mine which station s (PCs or workstat ions) can access the switch through the network. Th is covers access throug h the followin g means: – T elnet and other terminal emul ation applicatio n[...]

11-3 Using Authorized IP Managers Access Levels Configuration Options Y ou can configure: ■ Up to 10 authorized manager addresses , where eac h address applies to either a singl e management station or a group o f stations ■ Manager or Operator access privil eges (for T e lnet, SNMPv1, and SNMPv2c access only) Caution Configuring Aut horized IP[...]

11-4 Using Authorized IP Managers Defining Authorized Management Stations Defining Authorized Management Stations ■ Authorizin g Single Stati ons: The table entry au thorizes a single management station to have IP acce ss to the switch. T o use this method, just enter the IP addre ss of an authorized management station in the Authorized Manager I[...]

11-5 Using Authorized IP Managers Defining Authorized Management Stations 255.255.255.252 uses the 4th octet of a given Authorized Manager IP address to authorize four IP add resses for manage ment station access. The details on how to use IP masks are provided un der “Building IP Masks” on page 11-9. Note The IP Mask is a method for recogniz i[...]

11-6 Using Authorized IP Managers Defining Authorized Management Stations Figure 11-2. Example of How T o Add an Auth orized Manager Entry (Continued) Editing or Dele ting an Au thorized Manage r Entry . Go to the IP Ma nag- ers List screen (figure 11-1), high light the desired entry , and press [E] (for Edit ) or [D] (for Delete ). CLI: Vi ewing a[...]

11-7 Using Authorized IP Managers Defining Authorized Management Stations Figure 11-3. Example of the Show IP Authorized-Manager Disp lay The above example shows an Authorized IP Ma nager List that allows statio ns to access the switch a s shown below: Configuring IP Authorized Managers for the Switch T o Authorize Manager Access. This comman d aut[...]

11-8 Using Authorized IP Managers Defining Authorized Management Stations Similarly , the next command authoriz es manager -level access for any station having an IP address of 1 0.28.227.101 through 103: ProCurve(config)# ip authorized-managers 10.28.227.101 255.255.255.252 access manager If you omit the < mask bits > when adding a new autho[...]

11-9 Using Authorized IP Managers Web: Configuring IP Authorized Managers W eb: Configuring IP Authorized Managers In the web browse r interf ace you can configure IP Authorized Mana gers as described below . T o Add, Modify , or Delete an IP Authorized Manager address: 1. Click on the Security tab. 2. Click on [Authorized Addresses]. 3. Enter the [...]

11-10 Using Authorized IP Managers Building IP Masks Configuring Multiple Statio ns Per Authorized Manager IP Entry The mask de termines whet he r the IP address of a station on the netwo rk meets the criteria you specify . Th at is, for a given Author ize d Manager entry , the switch applies the IP mask to the IP address you sp ecify to determine [...]

11-11 Using Authorized IP Managers Building IP Masks Figure 11-6. Example of How th e Bitmap in the IP Mask Defines Authorized Manager Addresses Additional Examples for Au thorizing Mult iple Stations 4th Octet of IP Mask: 4th Octet of Authorized IP Address: 249 5 Bit Numbers Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Bit V alues 128 64 32 16 [...]

11-12 Using Authorized IP Managers Operating Notes Operating Notes ■ Network Security Precautions: Y ou can enhance your network ’ s security by keeping physical access to the switc h restricted to autho- rized personnel, usin g the password features bui lt into the switch, using the ad ditional security features described in this manual, and p[...]

Index – 1 Index Numerics 3DES … 6-3, 7-3 802.1X See port-based a ccess control. …8 - 1 A aaa authentication … 4-8 aaa port-access See Web or MAC Authentication. access levels, authoriz ed IP manage rs … 11-3 accounting See RADIUS. address authorized for port security … 9-3 authentication See TACACS. authorized addresses for IP managemen[...]

2 – Index I inconsistent value, message … 9-14 intrusion alarms entries dropped from log … 9-37 event log … 9-36 prior to … 9-37 Intrusion Log prior to … 9-33, 9-35 IP authorized IP managers … 11-1 reserved port numbers … 6-17 IP lockdown … 9-28 IP masks building … 11-9 for multiple authorized manager stations … 11-10 for sing[...]

Index – 3 prior to … 9-37 proxy web server … 9-37 port-based access control authenticate switch … 8-4 authenticate users … 8-4 authenticator backend state … 8-38 authenticator operation … 8-6, 8-8 authenticator, show commands … 8-38 authorized IP managers, precedence … 11-2 block traffic … 8-3 blocking non-802.1X device … 8-33[...]

4 – Index accounting, system … 5-18, 5-22 authentication options … 5-2 authentication, local … 5-16 authorized IP managers, precedence … 11-2 bypass RADIUS server … 5-9 commands, accounting … 5-17 commands, sw itch … 5-6 configuration outline … 5-7 configure server access … 5-10 configuring switch global parameters … 5-12 gene[...]

Index – 5 zeroing a key … 6-11 zeroize … 6- 11 SSL CA-signed … 7-4, 7-15 CA-signed certifi cate … 7-4, 7-15 CLI commands … 7-7 client behavi or … 7-17, 7-18 crypto key … 7-10 disabling … 7-10 enabling … 7-17 erase certificate key pair … 7-10 erase host key pair … 7-10 generate CA-signed certificate … 7-15 generate host key[...]

6 – Index See also LACP. U user name cleared … 2-5 V value, inconsistent … 9-1 4 VLAN 802.1X … 8-44 802.1X, ID changes … 8 -47 802.1X, suspend untagged VLAN … 8-41 filter, source-port … 10-3 not advertised for GVRP … 8-47 W w a r r a n t y…1 - i i Web Auth/MAC Auth applicable models … 3-2 Web Authentication authenticator operati[...]

— This page is intentionally unused. —[...]

© 2000 - 2008 Hewlett-Packard Development Company , LP . The information contained herein is subject to change without notice. December 2008 Manual Part Number 5990-6024[...]