HP (Hewlett-Packard) 2600-PWR Series manual

ProCurve Switches Access Security Guide Switch 2600 Series Switch 2600-PWR Series Switch 2800 Series Switch 4100 Series Switch 6108 Series[...]

[...]

ProCurve Switch 2600 Series Switch 2600-PWR Series Switch 2800 Series Switch 4100gl Series Switch 6108 Access Security Guide December 2008[...]

Hewlett-Packa rd Company 8000 Foothills Boulevard, m/s 5551 Roseville, California 95747-5551 http://www .procurve.com © Copyright 2001-2008 Hewle tt-Packard Company, L..P . The information c ontained herein is subject to change without notice. Publication Number 5990-6024 December 2008 Applicable Products ProCurve Switch 2 626 (J4900A/B) ProCurve [...]

iii Contents Product Documentation About Your Swi tch Manual Se t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi Feature Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii 1 Getting Started Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

iv Front-Panel Secu rity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-7 When Security Is Important . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-7 Front-Panel Button Functi ons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-8 Configuring Front-Panel Security[...]

v 4 TACACS+ Authentication Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2 Terminology Used in TACACS Appl ications: . . . . . . . . . . . . . . . . . . .[...]

vi 1. Configure Au thentication for th e Access Methods You Want RADIUS To Protect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-8 2. Configu re the Switch To Access a RADI US Server . . . . . . . . . . . . 5-10 3. Configure the Sw itch’s Global RADIUS Parameters . . . . . . . . . . . 5-12 L[...]

vii 6. Use an SSH Client To Access the Switch . . . . . . . . . . . . . . . . . . . . . 6-21 Further Informati on on SSH Client Pu blic -Key Authentication . . . . . . . . 6-21 Messages Related to SSH Operati on . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-27 7 Configuring Secure Socket Layer (SSL) Contents . . . . . . . . . . . . [...]

viii Configuring Sw itch Ports as 8 02.1X Authenticators . . . . . . . . . . . . . . . . . 8-15 1. Enable 802.1X Authentic a tion on Selected Ports . . . . . . . . . . . . . . 8-15 3. Configure the 802.1X Auth entication Method . . . . . . . . . . . . . . . . . 8-19 4. Enter the RADIUS Host IP Address(es) . . . . . . . . . . . . . . . . . . . . . .[...]

ix MAC Lockdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-17 Differences Betwee n MAC Lockdown an d Po rt Security . . . . . . . . . 9-19 Deploying MAC Lockdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-21 MAC Lockout . . . . . . . . . . . . . . . . . . . . . . . . . [...]

x Defining Authorized Management Stations . . . . . . . . . . . . . . . . . . . . . . . . . 11-4 Overview of IP Mask Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-4 Menu: Viewing and Co nfiguring IP Author ized Managers . . . . . . . . . 11-5 CLI: Viewing and Conf iguring Authorized IP Manager s . . . . . . . . . . . 11-6[...]

xi Product Documentation About Y our Switch Manual Set The switch manual set includes the following: ■ Read Me First - a printed guid e shipped with your switch. Provides software update infor mation, product notes, and other information . ■ Installation and Getting Started Guid e - a printed gu ide shipped with your switch. This guide explai n[...]

xii Product Documentation Feature Index For the manual set supporting your switch model, the followi ng feature index indicates which manual to consult for in formation on a given software feature. (Note that some software f eatures are not supported on all switch models.) Feature Management and Configuration Advanced T raffic Management Access Sec[...]

xiii Product Documentation LACP X -- Link X - - LLDP X -- MAC Address Management X - - MAC Lockdown - - X MAC Lockout - - X MAC-based Authentication - - X Monitoring and Analysis X - - Multicast Filtering - X - Network Management Applications (LLDP , SNMP) X - - Passwords - - X Ping X - - Port Configuration X -- Port Security - - X Port Status X --[...]

xiv Product Documentation Source-Port Filters - - X Spanning T ree (STP , RSTP , MSTP) - X - SSH (Secure Shell) Encryption - - X SSL (Secure Socket Layer) - - X Stack Management (Stacking) - X - Syslog X - - System Information X -- T ACACS+ Authentication - - X T elnet Access X -- TFTP X - - T ime Protocols (T imeP , SNTP) X -- T raffic/Security Fi[...]

1-1 1 Getting Started Contents Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2 Overview of Access Security Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2 Management Access Security Prot ection . . . . . . . . . . . . . . . . . . . . . . . . 1-3 General Sw[...]

1-2 Getting Started Introduction Introduction This Access Security Guide de scribes how to use ProCurve’ s switch security features to protect access to your swit ch. This guid e is intended to support the following switches: ■ ProCurve Series 2600 ■ ProCurve Series 2600-PWR ■ ProCurve Series 2800 ■ ProCurve Series 4100gl ■ ProCurve Swi[...]

1-3 Getting Started Overview of Access Security Features ■ Secure Socket Layer (SSL) (page 7-1): Provides remote web acc ess to the switch via encrypted authe n tication paths between the switch and management statio n clients capable of SSL/TLS operation. ■ Port-Based Access Control (802.1X) (page 8-1): On point- to-point connections, enables [...]

1-4 Getting Started Overview of Access Security Features T abl e 1-1. Management Access Security Pro tection General Switch T raffi c Security Guidelines Where the switch is ru nning multiple securi ty options, it impl ements network traffic security based on the OSI (Ope n Systems Intercon nection model ) precedence of the individual opti ons, fro[...]

1-5 Getting Started Conventions Conventions This guide uses the following conventi ons for command syntax and displ ayed information. Feature Descriptions by Model In cases where a software feature is no t ava ilable in a ll of the swi tch models covered by this guide, the section head ing spec ifically indicate s which produ ct or product series o[...]

1-6 Getting Started Conventions Command Prompts In the defaul t configurat ion, your swit ch displays one of the following CLI prompts: ProCurve Switch 4104# ProCurve Switch 4108# ProCurve Switch 2626# ProCurve Switch 2650# ProCurve Switch 6108# T o sim plify recognition, this gu ide uses ProCurve to represent co mmand prompts for all models. For e[...]

1-7 Getting Started Sources for More Information Sources for More Information For additional i nformation ab out switch operation and feat ures not covered in this guide , consult the following so urces: ■ For information on which product manual to consult o n a given software feature, refer to “Pro duct Documentation” on page xi. Note For th[...]

1-8 Getting Started Need Only a Quick Start? Figure 1-3. Getting Help in the CLI ■ For information on specific featur es in the W eb browser interface, use the online help. For m ore information, refer to the Management and Configuration Guide for your switch. ■ For further inform ation on ProCur ve Networking switch tech nology , visit the Pro[...]

1-9 Getting Started Need Only a Quick Start? T o Set Up and In stall the Switch in Y our Network Important! Use the Installation and Gettin g Started Guide shipped with your switch for the followin g: ■ Notes, cauti ons, and warnin gs related t o installing and using the switch and its related modules ■ Instructions fo r physically i nstalling [...]

1-10 Getting Started Need Only a Quick Start? — This page is intentionally unused. —[...]

2-1 2 Configuring Username and Password Security Contents Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2 Configuring Lo cal Password Se curity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4 Menu: Setting Passwords . . . . . . . . . . . . . . . . . . . . . . .[...]

2-2 Configuring Username and Password Security Overview Overview Console access includes both the menu interface and the CLI. There are two levels of console access: Manager and Operator . For security , you can set a password pair (username and password) on each of these lev els. Note Usernames are optional. Also, in th e menu interface, yo u can [...]

2-3 Configuring Username and Password Security Overview T o configure password security: 1. Set a Manager password pair (and an Operator password pair , if applicable for your system). 2. Exit from the cur rent console session. A Manager password pair will now be needed for full acc ess to the console. If you do steps 1 and 2, above, then th e next[...]

2-4 Configuring Username and Password Security Configuring Local Password Security Configuring Local Password Security Menu: Setting Passwords As noted earlier in this section, usernames ar e optional. Configu ring a user - name requires either the CLI or the web browser interface. 1. From the Main Menu select: 3. Console Passwords Figure 2-1. The [...]

2-5 Configuring Username and Password Security Configuring Local Password Security If you have physical access to the switch , press and hold the Clear button (on the front of th e switch) for a minimum of one second to clear all passwo rd protection, th en enter new passwords as described earlier in this chapter . If you do not have physical acces[...]

2-6 Configuring Username and Password Security Configuring Local Password Security T o Remove Password Protection. Removing password protection means to eliminate passw ord security . This command prompt s you to verify that you want to remove one or both passwords, then clears the indicate d password(s). (This command also clears the username asso[...]

2-7 Configuring Username and Password Security Front-Panel Security Front-Panel Security The front-panel sec urity features pro vide the ability t o independent ly enable or disable some of the f unctions of the two buttons located on th e front of the switch for clearing the passwo rd (Clear button) or rest oring the switch to its factory default [...]

2-8 Configuring Username and Password Security Front-Panel Security As a result of increased security co ncerns, customers now have the ability to stop someone from r emoving passwords by disabl ing the Clear and/or Reset buttons on the f ront of the switch. Front-Panel Button Functions The front pan el of the switch in cludes the Reset button and [...]

2-9 Configuring Username and Password Security Front-Panel Security Reset Button Pressing the Reset butt on alone for o ne second causes the switch to reboot. Figure 2-6. Press and hold the Reset Butto n for One Second T o Reb oot the Switch Restoring the Factory Default Configuration Y ou can also use the Reset button together with the Clear butto[...]

2-10 Configuring Username and Password Security Front-Panel Security 3. Release the Reset button and wait fo r about one second for the Self- T est LED to start flashing . 4. When the Self-T est LED be gins flashing, release the Clear button . This process restores the switch config uration to the factor y default settings. Configuring Front-Panel [...]

2-11 Configuring Username and Password Security Front-Panel Security • Modify the operation of the Reset+Clear combina tion (page 2-9) so that the switch stil l reboots, but does not restore the switch’ s factory default configuratio n settings. (Use of the Reset button alone, to simply reboot the swit ch, is not affected.) • Disable or re-en[...]

2-12 Configuring Username and Password Security Front-Panel Security For example, show front-pane l-security produces the following ou tput when the switch is configu red with the defa ult front-panel secu rity settings. Figure 2-7. The Default Front-Panel Security Settin gs Disabling the Clear Password Fun ction of the Clear Button on the Switch?[...]

2-13 Configuring Username and Password Security Front-Panel Security Re-Enabling the Clear Button on the Switch’ s Front Panel and Setting or Changing the “Reset-On-Clear” Operation For example, suppose that password-clear is disabled and you want to restore it to its defaul t configuration (enabled, with reset-on-clear disabled). Syntax: [no[...]

2-14 Configuring Username and Password Security Front-Panel Security Figure 2-9. Example of Re-Enabling the Clea r Button’ s Default Operation Changing the Operation of the Reset+Clear Combination In their d efault conf iguration, using th e Reset+Clea r buttons in the combin a- tion describe d under “Restorin g the Factory Defau lt Configurati[...]

2-15 Configuring Username and Password Security Front-Panel Security Figure 2-10. Example of Di sabling the Factory Re set Option Password Recovery The password recovery f eature is en abled by d efault an d provides a m ethod for regaining management access to the switch (without resetting the switch to its factory default co nfiguration) in t he [...]

2-16 Configuring Username and Password Security Front-Panel Security Steps for Disabling Password-Recovery . 1. Set the CLI to the gl obal interface context. 2. Use show front-panel-se curity to determine wh ethe r the factory-reset parameter is enab led. If it is disabled, use the front-panel-security fa ctory- reset command to enable it. 3. Press[...]

2-17 Configuring Username and Password Security Front-Panel Security Figure 2-11. Example of the Step s for Disabling Password-Recovery Password Recovery Process If you have lost the switch’ s manager username/password, but passwor d- rec ove ry is enabled, then you can use the Password Recovery Process to gain management access to the switch wit[...]

2-18 Configuring Username and Password Security Front-Panel Security — This page is intentionally unused. —[...]

3-1 3 W eb and MAC Authentication for the Series 2600/2600-PWR and 2800 Switches Contents Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2 Client Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3 General Features . . . . . .[...]

3-2 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Overview Overview Applicable Switch Models. W eb and MAC Authenticat ion are available on these current ProCurve swit ch models: ■ ProCurve Series 2600 and 2600-PWR Switches ■ ProCurve Series 2800 Switches W eb and MAC Authentication are designed for employment on th[...]

3-3 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Overview MAC Authentication (MAC-Auth). This method grants access to a secure network by authenticati ng devices fo r access to the netw ork. When a device connects to the switch , either by direct link or through t he network, the switch forwards the device’ s MAC add[...]

3-4 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Overview General Features W eb and MAC Au thentication o n the Pr oCurve Series 2600, 2600-PWR , and 2800 switches inc lude the following: ■ On a port configured for W eb or MAC Authentication, th e switch operates as a port-access authenticator using a RADIUS server a[...]

3-5 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches How Web and MAC Authentication Operate How W eb and MAC Authentication Operate Authenticator Operation Before gaining access to the network cl ients first present their authentication credentials to the sw itch. The switch then verifies the supp lied creden tials with a [...]

3-6 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches How Web and MAC Authentication Operate Figure 3-2. Progress Message During Authentication If the client is authenticated and the maximum number of cli ents allowed on the port ( client-limit ) has not been reached, the por t is assigned to a static, untagged VLAN for net[...]

3-7 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches How Web and MAC Authentication Operate moves have not been en abled ( client-moves ) on the ports, the sessi on ends and the client must reau thenticate fo r ne twork access. At the end of the session the port returns to its pre- authentication state. Any changes to the [...]

3-8 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches How Web and MAC Authentication Operate 4. If neither 1, 2, or 3, above, apply , then the clie nt session does not have access to any statically configured, untag ged VLANs and client access is blocked. The assigned port VLAN remains in pl ace until the session ends. Clie[...]

3-9 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Terminology T erminology Authorized-C lient VLAN: L ike the Unaut horized-Client VLAN, t his is a conventional, static, untagged, port-b a sed VLAN previously configured on the switch by the System Administrator . The intent in using this VLAN is to provide authenti cate[...]

3-10 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Operating Rules and Notes Operating Rules and Notes ■ Y ou can configure one type o f authenticat ion on a port. That is, the following au thentication typ es are mutually exclusive on a given port: • W eb Authentication • MAC Authentication • 802.1X ■ Order o[...]

3-11 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Operating Rules and Notes 2. If there is no RADIUS-assigned VLAN, then, for the duration of the client session, t he port belongs to th e Authorized VLAN ( if configured) and temporari ly drops all other VLAN memberships. 3. If neither 1 or 2, above, apply , but the por[...]

3-12 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches General Setup Procedure for Web/MAC Authentication Note on We b/ MAC Authentication and LACP The switch does not allow W eb or MAC Authentication and LACP to both be enabled at the same time on the same po rt. The switch automatically disables LACP on ports configured f[...]

3-13 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches General Setup Procedure for Web/MAC Authentication a. If you configure the RADIUS server to assign a VLAN for an authen- ticated client, this assignment o verrides any VLAN assignments con- figured on the switc h while the au thenticated client session remains active. N[...]

3-14 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches General Setup Procedure for Web/MAC Authentication Additional Information fo r Configuring the RADIUS Server T o Support MAC Authentication On the RADIUS server , configure the cl ient device authenticat ion in the same way that you would any other cl ient, except: ■ [...]

3-15 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Configuring the Switch To Ac cess a RADIUS Server Configuring the Switch T o Access a RADIUS Server This section describ es the minima l comma nds for configur ing a RADIUS server to support W eb-Auth and MAC Auth. F or information on other RADI US command options, refe[...]

3-16 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Configuring the Switch To Access a RADIUS Server For example, to configure the switch to access a RADIUS server at IP address 192.168.32.11 using a server -specifi c shared secret key of ‘2Pzo22’ Figure 3-4. Example of Config uring a Switch T o Access a RADIUS Serve[...]

3-17 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Configuring Web Authentication Configuring W eb Authentication This feature is available only on the Series 2600, 2600-PWR, an d 2800 switches. Overview 1. If you have not already done so, configure a local username and password pair on th e switch. 2. Identify or creat[...]

3-18 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Configuring Web Authentication Configure the Switch for W eb-Based Authentication Command Page Configuration Level aaa port-access web-based dhcp-addr 3-18 aaa port-access web-based dhcp-lease 3-18 [no] aaa port-access web-based [e] < port-list > 3-19 [auth-vid] 3[...]

3-19 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Configuring Web Authentication Syntax: [no] aaa port-access web-ba sed [e] < port-list > Enables web-based authenti cation on the specified ports. Use the no form of the command to disable web- based authentication on the specified ports. Syntax: aaa port-access w[...]

3-20 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Configuring Web Authentication Syntax: aaa port-access w eb-based [e] < port-list > [logoff-period] <60-9999999>] Specifies the period, in seco nds, that the switch enforces for an implicit logoff. This parameter is equivalent to the MAC age interval in a tr[...]

3-21 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Configuring Web Authentication Syntax: aaa port-access w eb-based [e] < port-list > [redirec t-url < url >] no aaa port-access web-b ased [e] < port-list > [redirect-url] Specifies the URL that a user is redirected to after a successful login. An y val[...]

3-22 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Configuring MAC Authentication on the Switch Configuring MAC Authentication on the Switch This feature is available only on the Series 2600, 2600-PWR, an d 2800 Switches. Overview 1. If you have not already done so, configure a local username and password pair on th e s[...]

3-23 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Configuring MAC Authent ication on the Switch Configure the Switch for MAC-Based Authentication Command Page Configuration Level aaa port-access mac-based addr -format 3-23 [no] aaa port-access mac-based [e] < port-list >3 - 2 3 [addr -limit] 3-24 [addr -moves] 3-[...]

3-24 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Configuring MAC Authentication on the Switch Syntax: aaa port-access m ac-based [e] < port-list > [add r -limit <1-32>] Specifies the maximum number of authenticated MACs to allow on the port. (Default: 1) Syntax: [no] aaa port-access mac-ba sed [e] < por[...]

3-25 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Configuring MAC Authent ication on the Switch Syntax: aaa port-access m ac-based [e] < port-list > [quiet-period <1 - 65535>] Specifies the time period, in seconds, the switch should wait before attemp ting an authentication request for a MAC address that fa[...]

3-26 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Show Status and Configuration of Web-Based Authentication Show Status and Configuration of W eb-Based Authentication Command Page show port-access [ port-list ] web-based 3-26 [clients] 3-26 [config] 3-26 [config [auth-server]] 3-27 [config [web-server]] 3-27 show port-[...]

3-27 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Show Status and Configuration of MAC-Based Authentication Show Status and Configuration of MAC-Based Authentication Syntax: show port-access [ port-list ] web-based [config [ auth-server]] Shows W eb Authentication set tings for all ports or the specified ports, along w[...]

3-28 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Show Status and Configuration of MAC-Based Authentication Syntax: show port-access [ port-list ] mac-based [ clients]] Shows the port address, M AC address, session status, and elapsed session time for attached clients on all ports or the specified ports. Ports with mul[...]

3-29 Web and MAC Authentication for the Series 2600/2 600-PWR and 2800 Switches Show Client Status Show Client Status The table below show s the possible client status in formation that may be reported by a W eb-based or MAC-based ‘ show ... clients’ command. Reported Status Available Netwo rk Connection Possible Explanations authenticated Auth[...]

3-30 Web and MAC Authentication for the Series 2600/260 0-PWR and 2800 Switches Show Client Status — This page is intentionally unused. —[...]

4-1 4 T ACACS+ Authentication Contents Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2 Terminology Used in TACACS Appl ications: . . . . . . . . . . . . . . . . . . . . . . . . 4-3 General System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

4-2 TACACS+ Authentication Configuring TACACS+ on the Switch Overview T ACACS+ authentication enables you to use a central server to a llow or deny access to the switch (and other T ACACS-a ware devices) in your network. This means that you can use a central database to create multiple uni que username/ password sets with associated privil ege leve[...]

4-3 TACACS+ Authentication Configuring TACACS+ on the Switch tion services. If the switch fails to connect to any T ACACS+ server , it defaults to its own locally assigned passwords f or authentication c ontrol if it has been configured to do so. For both Consol e and Telnet access you can configure a login (read-only) and an enable (r ead/write) p[...]

4-4 TACACS+ Authentication Configuring TACACS+ on the Switch • Local Authentication: This method uses username/password pairs configured locally on the switch; on e pair each for manager - level and operator -level access to the switch. Y ou can assign loca l usernames and passwords through the CLI or web browser inter - face. (Using the menu int[...]

4-5 TACACS+ Authentication Configuring TACACS+ on the Switch General System Requirements T o use T ACACS+ authentication, you need th e following: ■ A T ACACS+ server applicati on installed and co nfigured on o ne or more servers or management stations in your netw ork. (There are several T ACACS+ software packages available.) ■ A switch config[...]

4-6 TACACS+ Authentication Configuring TACACS+ on the Switch other access type (console, in this case) open in case the T elnet access fails due to a configuration problem. The fo llowing procedure outlines a general setup procedure. Note If a complete access lockou t occurs on the switch as a result of a T ACACS+ configuration, see “T roubleshoo[...]

4-7 TACACS+ Authentication Configuring TACACS+ on the Switch Note on Privilege Levels When a T ACACS+ server au thenticates an access re quest from a switch, it includes a privilege leve l code for th e switch to use in determining which privilege level to grant to the te rminal requesti ng access. The switch interprets a privilege level code of ?[...]

4-8 TACACS+ Authentication Configuring TACACS+ on the Switch configuration in your T ACACS+ ser ver application fo r mis-configura- tions or missing data that could aff ect the server’ s interoperation with the switch. 8. After your testing shows that T elnet access using the T ACACS+ server is working properly , configure your T ACACS+ server ap[...]

4-9 TACACS+ Authentication Configuring TACACS+ on the Switch CLI Commands Described in this Section V iewing the Switch’ s Current Authentication Configuration This command lists the numb er of logi n attempts t he switch all ows in a sin gle login session, and the pr imary/secondary access methods config ured for each type of access. Syntax : sh[...]

4-10 TACACS+ Authentication Configuring TACACS+ on the Switch V iewing the Switch’ s Curren t T ACACS+ Server Contact Configuration This comma nd lists the tim eout period, encrypti on key , and the IP addresses of the first-choice and backup T ACACS + servers the switch can contact. Syntax: show tacacs For example, if the switch was configur ed [...]

4-11 TACACS+ Authentication Configuring TACACS+ on the Switch Configuring the Switch’ s Authentication Methods The aaa authentication command configures the access control for console port and T elnet access to the switch . That is, for both access methods, aaa authentication specifies whether to use a T ACACS + server or the switch’ s local au[...]

4-12 TACACS+ Authentication Configuring TACACS+ on the Switch T abl e 4-1. AAA Authentication Pa rameters As shown in the next table, login and en able access is always available locall y through a direct t erminal connection to the switch’ s console port. However , for T elnet access, you can configure T ACACS+ to deny access if a T ACACS+ serve[...]

4-13 TACACS+ Authentication Configuring TACACS+ on the Switch T abl e 4-2. Primary/Secondary Aut hentication T able Caution Regarding the Use of Local for Login Primary Access During local authentication (which uses passwords config ured in the switch instead of in a T ACACS+ server), the sw itch grants read-only access if you enter the Operator pa[...]

4-14 TACACS+ Authentication Configuring TACACS+ on the Switch For example, here is a set of acce ss options and the corre sponding commands to configure them: Console Login (Operator or Re ad-Only) Access: Primary using T ACACS+ server . Secondary using Local. ProCurve (config)# aaa authentication console login tacacs local Console Enable (Ma nager[...]

4-15 TACACS+ Authentication Configuring TACACS+ on the Switch Configuring the Switch’ s T ACACS+ Server Access The tacacs-server command configures these parameters: ■ The host IP address(es) for up to three T ACAC S+ servers; one first- choice and up to two backups. Desi gnating backup se rvers provides for a continuation of authentication ser[...]

4-16 TACACS+ Authentication Configuring TACACS+ on the Switch Note on Encryption Keys Encryption keys configured in the swit ch must exactly ma tch the encryption keys configured in T ACACS+ servers th e switch will a ttempt to use for authentication. If you configure a global encryption key , the switch uses it only with servers for which you have[...]

4-17 TACACS+ Authentication Configuring TACACS+ on the Switch T abl e 4-3. Details on Configuring T ACACS Servers and Keys Name Default Range tacacs-server host < ip-addr > none n/a This command specifies the IP address of a device running a T A CACS+ server application. Optionally, it can also specify the unique, per -server encryption key t[...]

4-18 TACACS+ Authentication Configuring TACACS+ on the Switch Adding, Removing, or Cha nging th e Priority of a T AC ACS+ Server . Suppose that the switch was already co nfigured to use T ACACS+ servers at 10.28.227.10 and 10.28.227.15 . In this cas e, 10.28.227.15 was entered first, and so is listed as the first-choice server: Figure 4-4. Example [...]

4-19 TACACS+ Authentication Configuring TACACS+ on the Switch Figure 4-5. Example of the Switch After Assigni ng a Different “First-Choice” Server T o remove the 10.28.227.1 5 device as a T ACACS+ server , you would use this command: ProCurve(config)# no tacacs-server host 10.28.227.15 Configuring an Encryption Key . Use an encryption key in th[...]

4-20 TACACS+ Authentication Configuring TACACS+ on the Switch To delete a per-server encry ption key in the switch, re-enter the tacacs-server host comman d without th e key parameter. For example, if you have north01 configured as the encryption key for a TACACS+ server with an IP address of 10.28.227.104 and you wa nt to eliminate the key, you wo[...]

4-21 TACACS+ Authentication Configuring TACACS+ on the Switch Using figure 4-6, above, after either sw itch detects an operator’ s logon request from a remote or di rectly connecte d terminal, the fo ll owing events occur: 1. The switch queries the first- choi ce T ACACS+ server for authentication of the request. • If the switch d oes not recei[...]

4-22 TACACS+ Authentication Configuring TACACS+ on the Switch Local Authentication Process When the switch is configured to use T ACACS+, it reverts to local authentica- tion only if one of these two condit ions exists: ■ “Local” is the authentication option for the access method being used. ■ T ACACS+ is the primary authenticat ion mode fo[...]

4-23 TACACS+ Authentication Configuring TACACS+ on the Switch Using the Encryption Key General Operation When used, the encr yption key (sometimes t erm ed “key”, “secret key”, or “secret”) helps to pr event unauthorized intruders on the network from readin g username and password information in T ACAC S+ packets moving between the swit[...]

4-24 TACACS+ Authentication Configuring TACACS+ on the Switch For example, you would use the next co mmand to configure a global encryp- tion key in the switc h to match a key entered as north40campus in two target TACACS+ servers. (That is, both servers use the same key for your switch.) Note that you do not need the serv er IP addr esses to confi[...]

4-25 TACACS+ Authentication Configuring TACACS+ on the Switch Messages Related to T ACACS+ Operation The switch generates the CLI message s listed below . How ever , you may see other messages generated in your T ACACS+ server a pplication. For informa- tion on such messages, re fer to the documentation you rec eived with the application . Operatin[...]

4-26 TACACS+ Authentication Configuring TACACS+ on the Switch ■ When T ACACS+ is not enabled on th e switch—or when the switch’ s only designated T ACACS+ servers ar e not accessible— setting a local Operator password wi thout also setting a local Manager password does not protect the s witch from manager -level a ccess by unauthor - ized p[...]

5-1 5 RADIUS Authentication and Accounting Contents Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-2 Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-3 Switch Operating Rules for RADIUS . . . . . . . . . . . . .[...]

5-2 RADIUS Authenti cation and Accounting Overview Overview RADIUS ( Remote Authentication Dial-In User Service ) enables yo u to use up to three servers (one primary server and one or two backups) and maint ain separate authentication and accountin g for each RADIUS server employed. For authentication, this allows a differ ent password for each us[...]

5-3 RADIUS Authentication and Accounting Terminology T erminology CHAP (Challenge-Handshake Authe ntication Protocol): A challenge- response authentication protocol that uses the Message Digest 5 (MD5) hashing scheme to encrypt a response to a challenge from a RADI US server . EAP (Extensibl e Authentication Protocol): A general PPP authentication [...]

5-4 RADIUS Authenti cation and Accounting Switch Operating Rules for RADIUS Switch Operating Rules for RADIUS ■ Y ou must ha ve at least one RADIU S server accessible to the switch. ■ The switch supports authentication and ac counting us ing up to three RADIUS servers. The switch accesse s the servers in the order in which they are listed by sh[...]

5-5 RADIUS Authentication and Accounting General RADIUS Setup Procedure General RADIUS Setup Procedure Preparation: 1. Configure one to three RADIUS server s to support the switch. (That is, one primary server and one or two ba ckups.) Refer to the documentation provided with the RADIUS server application. 2. Before configuring the switch, co llect[...]

5-6 RADIUS Authenti cation and Accounting Configuring the Switch fo r RADIUS Authentication Configuring the Switch for RADIUS Authentication • Determine an acceptable timeout period for the switch to wa it for a server to respond to a request. ProCurve recommends that you begin with the default (five seconds). • Determine how many times you wan[...]

5-7 RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication Outline of the Steps fo r Configuring RADIUS Authentication There ar e three main steps to con figuring RADIUS authentica tion: 1. Configure RADIUS authentication fo r controlling access through one or more of the followin g • Serial port •T e l n e t •S[...]

5-8 RADIUS Authenti cation and Accounting Configuring the Switch fo r RADIUS Authentication • Server Dead-T ime: The period during which the switch will no t send new authentication requests to a RADIUS server that has failed to respond to a previous request. This avoids a wait for a request to time out on a server that is unavailable. If you wan[...]

5-9 RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication For example, suppose you have alread y configured local passwords on the switch, but want to use RADIUS to pr otect primary T elnet and SSH access without allo wing a secondary T elnet or SS H access option (w hich would be the switch’ s local passwords): Fi[...]

5-10 RADIUS Authenti cation and Accounting Configuring the Switch fo r RADIUS Authentication 2. Configure the Switch T o Access a RADIUS Server This section desc ribes how to con figure the switch to interact with a RADIUS server for both authenticat ion and accounting services. Note If you want to configure RADIUS accounti ng on the switch, go to [...]

5-11 RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication For example, suppose you h ave configured the switch as shown in figure 5-3 and you now need to make the following changes: 1. Change the encryption k ey for the server at 10.33 .18.127 to “source0 127”. 2. Add a RADIUS server with an IP ad dress of 10.33[...]

5-12 RADIUS Authenti cation and Accounting Configuring the Switch fo r RADIUS Authentication 3. Configure the Switch’ s Global RADIUS Parameters Y ou can configure the sw itch for the following glo bal RADIUS parameters: ■ Number of login attempts: In a given session, specifies how many tries at entering the correct username and password pair a[...]

5-13 RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication Note Where the switch has multiple RADIUS se rvers conf igured to support authen- tication requests, if the firs t server fails to respond, then the switch tries the next server in the list, and so-o n. If none of the servers respond, t hen the switch attempt[...]

5-14 RADIUS Authenti cation and Accounting Configuring the Switch fo r RADIUS Authentication For example, suppose that your switch is configured to use three RADIUS servers for authenticating access through T elnet and SSH. T wo of these servers use the same encryption key . In this case your pla n is to configure the switch with the following g lo[...]

5-15 RADIUS Authentication and Accounting Configuring the Switch for RADIUS Authentication Figure 5-6. Listings of Globa l RADIUS Parameters Configured In Figure 5-5 ProCurve# show authentication Status and Counters - Authentication Information Login Attempts : 2 Respect Privilege : Disabled | Login Login Enable Enable Access Task | Primary Seconda[...]

5-16 RADIUS Authenti cation and Accounting Local Authentication Process Local Authentication Process When the switch is configured to use RADIUS, it reverts to l ocal authentication only if one of these two condit ions exists: ■ “Local” is the authentication option for the access method being used. ■ The switch has been con figured to quer [...]

5-17 RADIUS Authentication and Accounting Controlling Web Browser Interface Acces s When Using RADIUS Authentication Controlling W eb Browser Interface Access When Using RADIUS Authentication T o prevent unauthorized acce ss through the web browser interface, do one or more of the followin g: ■ For Series 2600, 2600-PWR , and Series 2800 switches[...]

5-18 RADIUS Authenti cation and Accounting Configuring RADIUS Accounting Note This section assumes you have already: ■ Configured RADIUS authen ticat ion on the switch for one or more access methods ■ Configured one or more RADIUS servers to support the switch If you have not already done so, refer to “General RADIUS Setup Procedure” on pag[...]

5-19 RADIUS Authentication and Accounting Configuring RADIUS Accounting The switch forwards the accounting info rmation it collects to the designated RADIUS server , where the information is formatted, stored , and managed by the server . For more inform ation on t his aspect of R ADIUS accoun ting, refer to the docume ntation provided with your RA[...]

5-20 RADIUS Authenti cation and Accounting Configuring RADIUS Accounting – Optional—if you are also conf iguring the switch for RADIUS authentication, and n eed a unique encryption key for use duri ng authentication sessions with th e RADIUS server you are desig- nating, configure a server -specifi c key . This key ov errides the global encrypt[...]

5-21 RADIUS Authentication and Accounting Configuring RADIUS Accounting (For a more complete d escription of th e radius-server command and its options, turn to page 5-10.) For example, suppose you want to th e switch t o use the RADI US server described below for both authenti cation and acco unting purpose s. ■ IP address: 10.33.18.151 ■ A no[...]

5-22 RADIUS Authenti cation and Accounting Configuring RADIUS Accounting Figure 5-7. Example of Configu ring for a RADIUS Se rver with a Non-Def ault Accounting UDP Port Number The radius-server command as shown in figure 5-7, above, configures the switch to use a RADIUS serv er at IP a ddress 10.33.1 8.151, with a (non-de fault) UDP accounting por[...]

5-23 RADIUS Authentication and Accounting Configuring RADIUS Accounting ■ Start-Stop: • Send a start record acc ounting notice at the beginning of the account- ing session and a stop record noti ce at the end of the session. Bot h notices include the latest data the switch has co llected for the requested accounting type (N etwork, Exec, or Sys[...]

5-24 RADIUS Authenti cation and Accounting Configuring RADIUS Accounting 3. (Optional) Configure Sessi on Blocking and Interim Updating Options These optional parameters give you additi onal control ov er accounting data. ■ Updates: In addition to using a St art-Stop or Sto p-Only trigger , you can optionally configur e the switch to send periodi[...]

5-25 RADIUS Authentication and Accounting Viewing RADIUS Statistics V iewing RADIUS Statistics General RADIUS Statistics Figure 5-10. Example of Genera l RADIUS Information from Sh ow Radius Command Figure 5-11. RADIUS Server Information From the Show Radius Host Command Syntax: show radius [host < ip-add r >] Shows general RADIUS configurati[...]

5-26 RADIUS Authenti cation and Accounting Viewing RADIUS Statistics T able 5-2. V alues for Show Radius Host Output (Figure 5-11) Te r m Definition Round T rip T ime The time interval between the mo st recent Accounting-Respo nse and the Accounting- Request that matched it from this RADIUS accounting server . Pending Requests The number of RADIUS [...]

5-27 RADIUS Authentication and Accounting Viewing RADIUS Statistics RADIUS Authentication Statistics Figure 5-12. Example of Login Attempt and Primary/Se condary Authenticatio n Information from the Sho w Authentication Comma nd Figure 5-13. Example of RADIUS Aut hentication Inform ation from a Speci fic Server Syntax: show aut hentica tion Display[...]

5-28 RADIUS Authenti cation and Accounting Viewing RADIUS Statistics RADIUS Accounting Statistics Figure 5-14. Listing the Account ing Configuration in t he Switch Figure 5-15. Example of RADIUS Account ing Information for a Spe cific Server Syntax: show account ing Lists configured accounting interval, “Empty User” suppres- sion status, accoun[...]

5-29 RADIUS Authentication and Accounting Changing RADIUS-Ser ver Access Order Figure 5-16. Example Listing of Active RADIUS Accounting Sessions on t he Switch Changing RADIUS-Server Access Order The switch tries to access RADIUS ser vers according to the order in which their IP addresses are listed by the show radius command. Also, when you add a [...]

5-30 RADIUS Authenti cation and Accounting Changing RADIUS-Server Access Order T o excha nge the positions of the addre sses so that the server at 10.10 .10.003 will be the first choice and the server at 10.10.10.001 will be the last, you w ould do the follow ing: 1. Delete 10.10.10.003 from the list. This opens the third (lowest) position in the l[...]

5-31 RADIUS Authentication and Accounting Messages Related to RADIUS Operation Messages Related to RADIUS Operation Message Meaning Can’t reach RADIUS server < x.x.x.x >. A designated RADIUS server is not responding to an authentication request. T ry pinging the server to determine whether it is accessi ble to the switch. If the server is a[...]

5-32 RADIUS Authenti cation and Accounting Messages Related to RADIUS Operation — This page is intentionally unused. —[...]

6-1 6 Configuring Secure Shell (SSH) Contents Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-2 Terminology . . . . . . . . . . . . . . . . . . . . . . . . [...]

6-2 Configuring Secure Shell (SSH) Overview Overview The ProCurve swit ches covered i n this guide use Secure Sh ell version 1 or 2 (SSHv1 or SSHv2) to provide remote acc ess to management functions on the switches via encrypted paths between the switc h and ma nagement station clients capable of S SH operation. SSH provides T elnet-lik e functions[...]

6-3 Configuring Secure Shell (SSH) Overview Note SSH in the ProCurve is based on the OpenSSH software t oolkit. For more informatio n on OpenSSH, visit http://www .openssh .com . Switch SSH and User Password Authentication . This option is a subset of the client pu blic-key aut hentication show in figure 6-1. It occurs if the switch has SSH enabled[...]

6-4 Configuring Secure Shell (SSH) Terminology T erminology ■ SSH Server: A ProCurve switch with SSH enabled. ■ Key Pair: A pair of keys generated by the switch or an SSH client application. Each pair includ es a public key , that can be r ead by anyone and a pri vate key , that is held internally in the switch or by a client. ■ PEM (Privacy [...]

6-5 Configuring Secure Shell (SSH) Prerequisite for Using SSH Prerequisite for Using SSH Before using the switch as an SSH se rver , you must install a publicly or commercially avail able SSH client appli cation on the computer(s) you use for management access to the switch. If you wa nt client public-key authentic ation (page 6-2), then the clie n[...]

6-6 Configuring Secure Shell (SSH) Steps for Configuring and Using SSH fo r Switch and Client Authentication Steps for Configuring and Using SSH for Switch and Client Authentication For two-way authentication be tween the switch and an SSH client, you must use the logi n (O perator) level. T able 6-1. SSH Options The general steps for configuring S[...]

6-7 Configuring Secure Shell (SSH) Steps for Configuring and Using SSH for Switch and Client Authentication B. Switch Prep aration 1. Assign a login (Operator) and enable (Manager) password on th e switch (page 6-9). 2. Generate a public/private key pa ir on the switch (page 6-10). Y ou need to do this only once. The k ey remains in the swi tch eve[...]

6-8 Configuring Secure Shell (SSH) General Operating Rules and Notes General Operating Rules and Notes ■ Public keys generated on an SSH client must be expor table to the switch. The switch can only store ten keys client key pairs. ■ The switch’ s own public/private key pair and the (optio nal) client public key file are stored in the switch?[...]

6-9 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation Configuring the Switch for SSH Operation 1. Assign Local Login (Opera tor) and Enable (Manager) Password At a minimum, ProCurve recommends th at you always assign at least a Manager password to the switch. Othe rwise, under some circumstances, anyone with T elnet, web, or s[...]

6-10 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation Figure 6-5. Example of Config uring Local Passwords 2. Generate the Switch’ s Pu blic and Private Key Pair Y ou must genera te a public and private ho st key pair on the switch. The switch uses this key pai r , along with a dyna mically generated session key pair to nego[...]

6-11 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation Notes When you generate a host key pair on the switch, the switch places the key pair in flash memory (a nd not in the running-config file). Also, the switch maintains the key pai r across reboots, including p ower cycles. Y ou should consider this key pair to be "per[...]

6-12 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation For example, to generat e and display a new key: Figure 6-6. Example of Gen erating a Public/ Private Host Key Pair for the Switch The 'show crypto host-publi c-key' displays data in two diff erent formats because your client may store it in eith er of these form[...]

6-13 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation distribution to clients is to use a dire ct, serial connection between the sw itch and a management device (laptop, PC, or UNIX workstat ion), as described below . The public key gen erated by the switch consists of three parts, separated by one blank space each: Figure 6-[...]

6-14 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation 4. Add any data required by your SSH c lient ap plication. For example Be fore saving the key to an SSH client’ s "known hosts" file you may have to insert the switch’ s IP address: Figure 6-9. Example of a Sw itch Public Ke y Edited T o Includ e the Switch?[...]

6-15 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation Figure 6-10. Examples of Visual Phonetic and He xadecimal Conversions of the Switch’ s Public Key The two commands sho wn in figure 6-10 convert the displa yed format of the switch’ s (host) public key for easier visu al comparison of th e switch’ s public key to a c[...]

6-16 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation SSH Client Contact Behavio r . At the first contact be tween the switch and an SSH client, if you have not copied th e switch’ s public key into the clie nt, your client’ s first connect ion to the switch wil l question the connectio n and, for security reasons, give y[...]

6-17 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation The ip ssh key-siz e command affects only a per -se ssion, inte rnal server key the switch creates, uses, and discards. This key is not accessible from the user interface. The switch’ s public (host ) key is a separate, accessibl e key that is always 896 bits. Note on Po[...]

6-18 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation Caution Protect your private key file from ac cess by anyone ot her than yourself. If someone can access your private key file, they can then penetrate SSH security on the switch by ap pearing to be you. SSH does not prot ect the switch fr om unauthorized access via the we[...]

6-19 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation Option B: Config uring the Switch for Cl ient Public-Key SSH Authentication. When configured with this option, the sw itch uses its pub- lic key to authenticate itself to a client, but the client must also pr ovide a client public-key f or the swit ch to authenticate. Thi [...]

6-20 Configuring Secure Shell (SSH) Configuring the Switch for SSH Operation For example, assume that you have a client public-key fil e named Client- Keys.pub (on a TFTP server at 10.33.18.117 ) ready for down loading to the switch. For SSH access to the sw itch you want to a llow only clients ha ving a private key t hat matche s a public key foun[...]

6-21 Configuring Secure Shell (SSH) Further Information on SSH Cli ent Public-Key Authentication Figure 6-13 shows how to check the results of the above commands. Figure 6-13. SSH Configuration an d Clie nt-Public-Key Listing From Fi gure 6-12 6. Use an SSH Client T o Access the Switch T est the SSH configur ation on th e switch to ensure that you [...]

6-22 Configuring Secure Shell (SSH) Further Information on SSH Cli ent Public-Key Authentication When config ured for S SH operation, the switch automatic ally attemp ts to use its own host pu blic-key to authenticate itself to SSH clients. T o provide the optional, opposite service—client public-key authen ticatio n to the switch—you can confi[...]

6-23 Configuring Secure Shell (SSH) Further Information on SSH Cli ent Public-Key Authentication a. Combines the decrypte d byte seq uence with specific session data. b. Uses a secure hash algorithm to create a hash version of this informa- tion. c. Returns the hash version to the switch. 7. The switch computes its own hash version of the data in s[...]

6-24 Configuring Secure Shell (SSH) Further Information on SSH Cli ent Public-Key Authentication 1. Use your SSH client application to cr eate a public/private key pair . Refer to the documentation pr ovided with your SSH client appl ication for details. The switch sup ports the foll owing client-publ ic-key properties: 2. Copy the client’ s publ[...]

6-25 Configuring Secure Shell (SSH) Further Information on SSH Cli ent Public-Key Authentication For example, if you wanted t o copy a client public-key file named clientkeys.txt from a TFTP server at 10.38.252.195 an d then display th e file contents: Figure 6-15. Example of Copying a nd Displaying a Client Public-Key File Containing T wo Client P[...]

6-26 Configuring Secure Shell (SSH) Further Information on SSH Cli ent Public-Key Authentication Enabling Clie nt Public -Key Authentication. After you TFTP a client- public-key file into the switc h (describ ed above), you can configure the switch to allow one of th e following : ■ If an SSH client’ s public key matches the switch’ s client-[...]

6-27 Configuring Secure Shell (SSH) Messages Related to SSH Operation Messages Related to SSH Operation Message Meaning 00000K Peer unreachable. Indicates an error in communicating with the tftp server or not finding the file to download. Causes include such factors as: • Incorrect IP configuration on the switch • Incorrect IP address in the co[...]

6-28 Configuring Secure Shell (SSH) Messages Related to SSH Operation Generating new RSA host ke y. If the cache is depleted, this could take up to two minutes. After you execute the crypt o key generate ssh [rsa] command, the switch displays this me ssage while it is gene rating t he key . Host RSA key file corrupt or not found. Use 'crypto k[...]

7-1 7 Configuring Secure Socket Layer (SSL) Contents Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-2 Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-3 Prerequisite for Using SSL . . . . . . . . . . . . . . . .[...]

7-2 Configuring Secure Socket Layer (SSL) Overview Overview The ProCurve switc hes covered by th is manual use Secure Socket Layer V ersion 3 (SSLv3) and support for T rans port Layer Security(TLSv1) to provide remote web access to the switches vi a encrypted paths be tween the switch and management station clients capable of SSL/TLS operation. Not[...]

7-3 Configuring Secure Socket Layer (SSL) Terminology Figure 7-1. Switch/User Authent ication SSL on the ProCurve switch es supports these data encrypti on methods: ■ 3DES (168-bit, 112 Effective) ■ DES (56-bit) ■ RC4 (40-bit, 128-bit) Note: ProCurve switches use RS A public key algorithms and Dif fie-Hellman. All references to a key mean key[...]

7-4 Configuring Secure Socket Layer (SSL) Terminology ■ Self-Signed Certif icate: A certificate not verifi ed by a third- party certificate authority (CA). Self-signed certificate s provide a reduced level of security compared to a CA-signed certificate. ■ CA-Signed Certificate: A certificate verified by a third party certif- icate auth ority ([...]

7-5 Configuring Secure Socket Layer (SSL) Prerequisite for Using SSL Prerequisite for Using SSL Before using the switch as an SSL se rver , you must install a publicly or commercially available SSL enabled we b browser application on the com- puter(s) you use for manage ment acce ss to the switch. Steps for Configuring and Using SSL for Switch and [...]

7-6 Configuring Secure Socket Layer (SSL) General Operating Rules and Notes General Operating Rules and Notes ■ Once you generate a certificate on the switch you should avoid re- generating the certificat e without a compelli ng reason. Otherwise, you will have to re-introduce the switch’ s certificate on all manage- ment stations (clients) you[...]

7-7 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Configuring the Switch for SSL Operation 1. Assign Local Login (Opera tor) and Enable (Manager) Password At a minimum, ProCurve recommends th at you always assign at least a Manager password to the switch. Othe rwise, under some circumstances, anyone with T elnet, we[...]

7-8 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Using the web browser interface T o Configure Local Passwo rds. Y ou can configure both the Op erator and Manager passwo rd on one screen. T o access the web browser interface re fer to the chapter titled “Using the W eb Browser Interface ” in the Management and [...]

7-9 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation 2. Generate the Switch’ s Server Host Certificate Y ou must genera te a server certificate on the switc h before enabling SSL. The switch uses this se rver certific ate, along with a dynamicall y generated session key pair to negotiate an en cryption method and ses[...]

7-10 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation T o Generate or Erase the Switch’ s Server Certificate with the CLI Because the host certificate is stored in flash instead of the runn ing-config file, it is not necessary to use write memory to save the certificate. Erasing the host certificate automatically dis[...]

7-11 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Comments on Certificate Fields. There are a number arguments used in th e generation of a server certificate. table 7-1, “Cer tificate Fiel d Descriptions” desc ribes these argu ments. T abl e 7-1. Certificate Field Descript ions For example, to generate a ke y [...]

7-12 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Notes “Zeroizing” the switch’ s server host ce rtificate or key automatically disables SSL (sets web-managemen t ssl to No ). Thus, if you zer oize the server host certificate or key and then generate a new key and server certificate, you must also re-enable S[...]

7-13 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Generate a Self-Signed Host Ce rtificate with the W eb browser interface Y ou can configure SSL from the web b rowser interface. For mo re information on how to acc ess the web browser interfa ce, refer to the chapter ti tled “Using the W eb Browser Interface” i[...]

7-14 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation For example, to generate a new host certificate via the web brow sers inter - face: Figure 7-5. Self-Signed Ce rtificate genera tion via SSL Web Browser Interface Scree n T o view the curre nt host certifi cate in the web browser interface: 1. Proceed to the Securit[...]

7-15 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Figure 7-6. Web browser Interface showing current SSL Host Certifica te Generate a CA-Signed server host certificate with the W eb Browser Interface This section d escribes how to install a CA- Signed serv er host certificate from the web browser interface. (For mor[...]

7-16 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation The installation of a CA- signed certif ic ate involves in teraction with o ther entities and consis ts of three phases. The first phase is the creation of the CA certificate request, which is then copied off from the switch for submission to the certificate authori[...]

7-17 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Figure 7-7. Example of a Ce rtificate Request a nd Reply 3. Enable SSL on the Sw itch and Anticipate SSL Browser Contact Behavior T he web-management ssl comma nd enables SSL on the switch and modifies parameters the swit ch uses for transactions with client s. Afte[...]

7-18 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Note Before enabling SSL on the switch yo u must genera te the switch’ s host certificate and key . If you have not alr eady done so, refer to “2. Generate the Switch’ s Server Host Certificate” on page 7-9. When configured for SSL, the switch uses its host [...]

7-19 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Using the CLI interface to enable SSL T o ena ble SSL on the switch 1. Generate a Host certificate if you h ave not already done so. (Refer to “2. Generate the Switch’ s Server Ho st Certifi cate” on page 7-9.) 2. Execute the web-man agement ssl command. T o d[...]

7-20 Configuring Secure Socket Layer (SSL) Configuring the Switch for SSL Operation Figure 7-8. Using the web brow ser interface to enable SSL an d select TCP port number Note on Port Number ProCurve recommends usin g the default IP port number (443). However , you can use web-management ssl tcp-port to specify any TCP port for SSL connec- tions ex[...]

7-21 Configuring Secure Socket Layer (SSL) Common Errors in SSL Setup Common Errors in SSL Setup Error During Possible Cause Generating host certificate on CL I Y ou have not generated a certificate key . (Refer to “CLI commands used to generate a Server Host Certificate” on page 7-10.) Enabling SSL on the CLI or Web browse r interface Y ou hav[...]

7-22 Configuring Secure Socket Layer (SSL) Common Errors in SSL Setup — This page is intentionally unused. —[...]

8-1 8 Configuring Port-Based Access Control (802.1X) Contents Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-3 Why Use Port-Based Access Control? . . . . . . . . . . . . . . . . . . . . . . . . . . 8-3 General Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .[...]

8-2 Configuring Port-Based Ac cess Cont rol (802.1X) Contents Configuring Swit ch Ports To Operate As S upplicants fo r 802.1X Conne ctions to Oth er Switche s . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-34 Displaying 802.1X Configuratio n, Statistics, and C ounters . . . . . . . . . . . . 8-38 Show Commands for Port-Access Auth entic[...]

8-3 Configuring Port-Based Access Control (802.1X) Overview Overview Why Use Port-Based Access Control? Local area networks are often deploye d in a way that allows unauthorized clients to attach to network devices, or allows unauthorized users to get access to unattended clients on a networ k. Also, the use of DHCP services and zero configuration [...]

8-4 Configuring Port-Based Ac cess Cont rol (802.1X) Overview ■ Local authentication of 802.1X clients using the switch’ s local user - name and password (as an altern ative to RADIUS authentication). ■ T emporary on-demand change of a po rt’ s VLAN membership status to support a cu rrent client’ s session. (This does not include ports th[...]

8-5 Configuring Port-Based Access Control (802.1X) Overview Figure 8-1. Example of an 802.1X Application Accounting . The switch also provide s RA DIUS Network accounting for 802.1X access. Re fer to “ RADIUS Authentication and Accounting” on page 5-1. RADIUS Server LAN Core 802.1X-Aware Client (Supplica nt) Switch Running 802.1X and Connected [...]

8-6 Configuring Port-Based Ac cess Cont rol (802.1X) How 802.1X Operates How 802.1X Operates Authenticator Operation This operation provi des security on a direct, point-to-point link between a single client an d the switch, where bo th devices are 802.1X-aware. (If you expect desirable cl ients that d o no t have the necessary 8 02.1X supplicant s[...]

8-7 Configuring Port-Based Access Control (802.1X) How 802.1X Operates Switch-Port Supplicant Operation This operation provides se curity on links between 802.1X- aware switches. For example, suppose that you want to connect two switches, where: ■ Switch “A” has port A1 configured for 802.1X supplicant operation. ■ Y ou want to connect port[...]

8-8 Configuring Port-Based Ac cess Cont rol (802.1X) Terminology • A “failure” response conti nues the block on port B5 and causes po rt A1 to wait for the “held-time” peri od before trying again to achieve authentication th rough port B5. Note Y ou can configure a switch po rt to op erate as both a supplicant and an authenticator at the [...]

8-9 Configuring Port-Based Access Control (802.1X) Terminology EAP (Extensible Auth entication P rotocol) : EAP enables network access that supports multiple authen tication methods. EAPOL: Extensible Authenticat ion Protocol Over LAN, as defined in the 802.1X standard . Friendly Clie nt: A client that does not pose a s ecurity risk if given access[...]

8-10 Configuring Port-Based Ac cess Cont rol (802.1X) General Operating Rules and Notes member of that VLAN as long as at least one oth er port on the swi tch is statically configured as a tagge d or untagged member of the same Unau- thorized-Client VLAN. Untagged VLAN Membership: A port can be an untagged member of only one VLAN. (In the fa ctory-[...]

8-11 Configuring Port-Based Access Control (802.1X) General Operating Rules and Notes ■ If a client already has access to a switch port when you configure the port for 802.1X authenticator operati on, the port will block the client from further network access until it can be authenticated. ■ On a port configured for 802.1X wi th RADIUS authenti[...]

8-12 Configuring Port-Based Ac cess Cont rol (802.1X) General Setup Procedure for Port-B ased Access Control (802.1X) General Setup Procedure for Port-Based Access Control (802.1X) Do These Steps Before Y ou Configure 802.1X Operation 1. Configure a local username and pa ssword on the switch for both the Operator (login) and Manager (enable) access[...]

8-13 Configuring Port-Based Access Control (802.1X) General Setup Procedure for Port -Based Access C ontrol (802.1X) Overview: Configuring 802. 1X Authentication on the Switch This section outl ines the steps for configuring 802.1X on the switch. For detailed inf ormation on each step, refer to “RADIUS Authen tication and Accounting” on page 5-[...]

8-14 Configuring Port-Based Ac cess Cont rol (802.1X) General Setup Procedure for Port-B ased Access Control (802.1X) 7. If you are using Port S ecurity on the switch, conf igure the switch to allow only 802.1X access on ports configured for 802 .1X operation, and (if desired) the act ion to take if an unauthorized devi ce attempts access through a[...]

8-15 Configuring Port-Based Access Control (802.1X) Configuring Switch Ports as 802.1X Authenticators Configuring Switch Ports as 802.1X Authenticators 1. Enable 802.1X Authentica tion on Selected Ports This task configures the indivi dual ports you want to operate as 802.1X authenticators for po int-to-point links to 802.1X-aware clients or switch[...]

8-16 Configuring Port-Based Ac cess Cont rol (802.1X) Configuring Switch Ports as 802.1X Authenticators Syntax: aaa port-access a uthenticator < port -list > Enables specified ports to op erate as 802.1X authen ti- cators with current per- port authenticator configura- tion. To activa te configured 802. 1X operation , you must enable 802.1X a[...]

8-17 Configuring Port-Based Access Control (802.1X) Configuring Switch Ports as 802.1X Authenticators Sets the period of time the switch waits for a supplicant response to an EAP re quest. If the suppli cant does not respond within the configured time frame, the session times out. (Default: 30 seconds) aaa port-access auth enticator < port-list [...]

8-18 Configuring Port-Based Ac cess Cont rol (802.1X) Configuring Switch Ports as 802.1X Authenticators Configures an existing, stat ic VLAN to be the Autho- rized-Client VLAN. Refer to “802.1X Op en VLAN Mode” on page 8-21. aaa port-access auth enticator < port-list > (Syntax Continued) [initialize] On the specified ports, bl ocks inboun[...]

8-19 Configuring Port-Based Access Control (802.1X) Configuring Switch Ports as 802.1X Authenticators 3. Configure the 802.1X Authentication Method This task specif ies how the swit ch will authenticate the cr edentials provided by a supplicant connected to a switch port configured as an 802.1X authenti- cator . For example, to enabl e the switch t[...]

8-20 Configuring Port-Based Ac cess Cont rol (802.1X) Configuring Switch Ports as 802.1X Authenticators 4. Enter the RADIUS Host IP Address(es) If you selected either e ap-radius or chap-radius for the a uthentication m ethod, configure the switch to use 1 to 3 RADIUS servers for authentication. The following syntax shows th e basic commands. For c[...]

8-21 Configuring Port-Based Access Control (802.1X) 802.1X Open VLAN Mode 802.1X Open VLAN Mode This section describes how to use the 802.1X Open VLAN mode to configur e unauthorized-client and authorized-client VLANs on po rts configured as 802.1X authenticators. Introduction Configuring the 802.1X Op en VLAN mode on a port changes how the port re[...]

8-22 Configuring Port-Based Ac cess Cont rol (802.1X) 802.1X Open VLAN Mode 1. 1st Priority: The port joins a VLAN to which it has been a ssigned by a RADIUS server during auth entication. 2. 2nd Priority: If RAD IUS authenticati on do es not include assigning the port to a VLAN, then th e switch assigns the port to the VLAN entere d in the port’[...]

8-23 Configuring Port-Based Access Control (802.1X) 802.1X Open VLAN Mode T able 8-1. 802.1X Open VLAN Mode Options 802.1X Per -Port Configuration Port Response No Open VLAN mode: The port auto matically blocks a client that c annot initiate an authenti cation sessio n. Open VLAN mode with both of the f ollowing configured: Unauthorized-Client VLAN[...]

8-24 Configuring Port-Based Ac cess Cont rol (802.1X) 802.1X Open VLAN Mode Open VLAN Mode with Only an Unauthoriz ed-Clie nt VLAN Configured: • When the port dete cts a client, it automatically b ecomes an untagged member of this VLAN. T o limit security risks, the netwo rk services and access a vailable on this VLAN should includ e only what a [...]

8-25 Configuring Port-Based Access Control (802.1X) 802.1X Open VLAN Mode Operating Rules for Au thorized-Client and Unauthorized-Client VLANs Condition Rule Static VLANs used as Authorize d- Client or Unauthorized-Client VLANs These must be configured o n the switch before you co nfigure an 802.1X authenticator port to use them. (Use the vlan <[...]

8-26 Configuring Port-Based Ac cess Cont rol (802.1X) 802.1X Open VLAN Mode Note: If you use th e same VLAN as the Unau thorized-Client VLAN for all authenti- cator ports, unauth enticated clients on different ports can communicate wit h each other . Howev er , in this case, y ou can improve securi ty between authen- ticator ports by usin g the swi[...]

8-27 Configuring Port-Based Access Control (802.1X) 802.1X Open VLAN Mode Setting Up and Configuring 802.1X Open VLAN Mode Preparation. This section assumes use of bot h the Unauthorized-Client and Authorized-Client VLANs. Re fer to T able 8-1 on page 8- 23 for other options. Before you configu re the 802.1X Open VLAN mode o n a port: ■ Staticall[...]

8-28 Configuring Port-Based Ac cess Cont rol (802.1X) 802.1X Open VLAN Mode ■ Ensure that the switch is connec ted to a RADIUS server configured to support auth enticatio n requests from clients using ports config- ured as 802.1X authenti cators. (The RADIUS server should not be on the Unauthorized-Client VLAN.) Note that as an alternative, you c[...]

8-29 Configuring Port-Based Access Control (802.1X) 802.1X Open VLAN Mode 3. If you selected either eap-radius or chap -radius for step 2, use the radius host command to configure up to thr ee RADIUS server IP address(es) on the switch. 4. Activa te authentication on the switch. 5. T est both the au thorized and unauthorized access to your system t[...]

8-30 Configuring Port-Based Ac cess Cont rol (802.1X) 802.1X Open VLAN Mode Configuring 802.1X Open VLAN Mode. Use these commands to actually configure Open VLAN mode. For a listin g of the steps needed to prepare the switch for using Open VLAN mode, re fer to “Preparation” on page 8-27. For example, suppose you want to conf igure 802.1X port-a[...]

8-31 Configuring Port-Based Access Control (802.1X) 802.1X Open VLAN Mode Inspecting 802.1X Open VLAN Mode Operation. For info rmation and an example on viewing current Open VLAN mode operatio n, refer to “Viewing 802.1X Open VLAN Mode Status” on page 8-40. 802.1X Open VLAN Operating Notes ■ Although you can configure Open VL AN mode to use t[...]

8-32 Configuring Port-Based Ac cess Cont rol (802.1X) Option For Authenticator Ports: Configure Port-Security To Allow Only 802.1X Devices ■ If an authenticat ed c lient loses authenti cation during a session in 802.1X Open VLAN mode, the port VL AN membership reverts back to the Unauthorize d-Client VLAN. If th ere is no Unauthorized-Client VLAN[...]

8-33 Configuring Port-Based Access Control (802.1X) Option For Authenticator Ports: Configure Port-Security To Allow Only 802.1X Devices Note on Blocking a Non- 802.1X Device If the port’ s 802.1 X authenticator c ontrol mode is configured to authorized (as shown below , instead of aut o ), then the first sour ce MAC address from any device, whet[...]

8-34 Configuring Port-Based Ac cess Cont rol (802.1X) Configuring Switch Ports To Operate As Supp licants for 802.1X Connect ions to Other Switches Configuring Switch Ports T o Operate As Supplicants for 802.1X Connections to Other Switches Y ou can configure a switch port to operate as a supplicant in a connec tion to a port on another 802.1X-a wa[...]

8-35 Configuring Port-Based Access Control (802.1X) Configuring Switch Ports To Operate As Suppli cants for 802.1X Connections to Other Switches 1. When port A1 on switch “A” is firs t connecte d to a port on switch “B”, or if the ports are already connec ted an d either switch reboots, port A1 begins sending sta rt packets to port B5 on sw[...]

8-36 Configuring Port-Based Ac cess Cont rol (802.1X) Configuring Switch Ports To Operate As Supp licants for 802.1X Connect ions to Other Switches Configuring a Supplicant Switch Port. Note that you must enable suppli- cant operation on a port before you ca n change the supplic ant config uration. This means you must execute the supp licant comman[...]

8-37 Configuring Port-Based Access Control (802.1X) Configuring Switch Ports To Operate As Suppli cants for 802.1X Connections to Other Switches aaa port-access supplicant [ ethernet] < port-list > (Syntax Continu ed) [auth-timeout < 1 - 300 > ] Sets the period of time the port waits to receive a challenge from the authentica tor . If t[...]

8-38 Configuring Port-Based Ac cess Cont rol (802.1X) Displaying 802.1X C onfiguration, Statistics, and Counters Displaying 802.1X Configuration, Statistics, and Counters Show Commands for Port -Access Authenticator 802.1X Authentication Commands page 8-15 802.1X Supplicant Commands page 8-34 802.1X Open VLAN Mode Commands page 8-21 802.1X-Related [...]

8-39 Configuring Port-Based Access Control (802.1X) Displaying 802.1X Configurat ion, Statistics, and Counters show port-access au thenticator (Syntax Conti nued) config [[e] < port-list >] S hows: • Whether port-access authenticator is active • The 802.1X configuration of the ports configured as 802.1X authenticators If you do not specif[...]

8-40 Configuring Port-Based Ac cess Cont rol (802.1X) Displaying 802.1X C onfiguration, Statistics, and Counters V iewing 802.1X Open VLAN Mode Status Y ou can examine the switch’ s curre nt VLAN status by using the show port- access authenticator and show vlan < vlan-id > commands as illu strated in this section. Figure 8-5 shows an exampl[...]

8-41 Configuring Port-Based Access Control (802.1X) Displaying 802.1X Configurat ion, Statistics, and Counters ■ When the Unauth VLAN ID is configured and matches the Current VLAN ID in the above comman d output, an unauthenticat ed client is connected to the port. (Th is assume s the port is not a statically configured member of the VLAN you are[...]

8-42 Configuring Port-Based Ac cess Cont rol (802.1X) Displaying 802.1X C onfiguration, Statistics, and Counters Figure 8-6. Example of Showin g a VLAN with Ports Configured for Open VLAN Mo de Unauthorized VLAN ID < vlan -id >: Lists the VID of the static VLAN configured as the unauthorized VLAN for the indicated port. 0: No unauthorized VLA[...]

8-43 Configuring Port-Based Access Control (802.1X) Displaying 802.1X Configurat ion, Statistics, and Counters Show Commands for Po rt-Access Supplicant Note on Supplicant Statistics. For each port configured as a supplicant, show port-access supplic ant statistics [e] < port-l ist >] displays th e source MAC address and statistics for transa[...]

8-44 Configuring Port-Based Ac cess Cont rol (802.1X) How RADIUS/802.1X Authenticat ion Affects VLAN Operation supplicant port to another without clearin g the statistics data from the first port, the au thenticator’ s MAC address wil l appear in the supplicant statistics for both ports. How RADIUS/802.1X Authentication Affects VLAN Operation Sta[...]

8-45 Configuring Port-Based Access Control (802.1X) How RADIUS/802.1X Authenticat ion Affects VLAN Operation For example, suppose that a RADIUS-au thenticated, 802.1X-a ware client on port A2 requires access to VLAN 22, but VLA N 22 is config ured for no access on port A2, and VLAN 33 is conf igured as untagged on port A2: Figure 8-7. Example of an[...]

8-46 Configuring Port-Based Ac cess Cont rol (802.1X) How RADIUS/802.1X Authenticat ion Affects VLAN Operation Figure 8-8. The Active Configuration for VLAN 22 T emporarily Changes for the 802.1X Session ■ W ith the preceding in mind, since (s tatic) VLAN 33 is configured as untagged on port A2 (see figure 8- 7), and since a port can be untagged [...]

8-47 Configuring Port-Based Access Control (802.1X) How RADIUS/802.1X Authenticat ion Affects VLAN Operation When the 802.1X client’ s session on port A2 ends, th e port discards the temporary untagged VLAN membership. At this time the static VLAN actually configured as untagged on the port again becomes av ailable. Thus, when the RADIUS-authenti[...]

8-48 Configuring Port-Based Ac cess Cont rol (802.1X) Messages Related to 802.1X Operation Messages Related to 802.1X Operation T able 8-3. 802.1X Ope rating Messages Message Meaning Port < port-list > is not an authenticator. The ports in the port list have not been enabled as 802.1X authenticators. Use this comm and to enable the ports as a[...]

9-1 9 Configuring and Monitoring Port Security Contents Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-2 Basic Operation . . . . . . . . . . . . . . . . . [...]

9-2 Configuring and Monitoring Port Security Overview Overview Using Port Security , you can configure each switch po rt with a unique list of the MAC addresses of devices that ar e authorized to access the network through that port. This enables individ u al ports to detect, prevent, and log attempts by unaut horized devices to communicate throu g[...]

9-3 Configuring and Monitoring Port Security Overview General Operation for Port Security . On a per -port basis, you can configure security measure s to block un authori zed devices, and to send notic e of security violations. O nce you have configured port secu ri ty , you can then monitor the network for security viol ations through one or more [...]

9-4 Configuring and Monitoring Port Security Overview Figure 9-1. Example of How Port Security Controls Access Note Broadcast and Mult icast traffic is not “unau thorized” traffic, and can be read by intruders connecte d to a port on wh ich you have configured port security . T runk Group Exclusion Port security does no t operate on eit her a s[...]

9-5 Configuring and Monitoring Port Security Planning Port Security Planning Port Security 1. Pl an your port securi ty configuration and moni toring according to the following: a. On which ports do y ou want port security? b. Which devices (MAC addresses) ar e authorized on each port and how many device s do you wan t to allow p er port (up to 8)?[...]

9-6 Configuring and Monitoring Port Security Port Security Command Options and Operation Port Security Command Options and Operation Port Security Comm ands Used in This Section This section descr ibes the CLI port secu rity command and how th e switch acquires a nd maintains authorized addresses. Note Use the global configuration level to execute [...]

9-7 Configuring and Monitoring Port Security Port Security Command Options and Operation Syntax: port-sec urity [e] < port-list > learn-mode < continuou s | static | configured | p ort-access > Continuous (Default) : Appears in the factory-default setting or when you execute no port-security. Allows the port to learn addresses from inbo[...]

9-8 Configuring and Monitoring Port Security Port Security Command Options and Operation Syntax: port-sec urity [e] < port-list > (- Continued -) learn-mode < continuous | static | configured | port-access > (- Continued -) Configured: The s tatic-configured op tion operates the same as the static-learn option on the preceding page, exc[...]

9-9 Configuring and Monitoring Port Security Port Security Command Options and Operation Syntax: port-sec urity [e] < port-list > (- Continued -) action < none | send-alarm | send-disable > Specifies whethe r an SNMP trap is sent to a network m an- agement station. Operates when: • Learn mode is set to learn-mode static (static-learn)[...]

9-10 Configuring and Monitoring Port Security Port Security Command Options and Operation Retention of Stat ic MAC Addresses Learned MAC Addresses In the following two cases, a po rt in Static learn mode ( learn-mode static ) retains a learne d MAC address even if y ou later reboot the switch or disable port security for that port: ■ The port lea[...]

9-11 Configuring and Monitoring Port Security Port Security Command Options and Operation Using the CLI T o Display Port Security Settings. Syntax : show port-security show port-security [e] <port number> show port-security [e] [< port number >-< port number ]. . .[,< port number >] W ithout port parameters, show port-security [...]

9-12 Configuring and Monitoring Port Security Port Security Command Options and Operation The following command example shows th e option for entering a range of ports, including a series of non- contiguous ports. Note that no spaces are allowed in the po rt number portion of the command string: ProCurve(config)# show port-security A1-A3,A6,A8 Conf[...]

9-13 Configuring and Monitoring Port Security Port Security Command Options and Operation ProCurve(config)# port-security a1 learn-mode static mac-address 0c0090-123456 action send-disable This example configures port A5 to: ■ Allow two MAC addresses, 0 0c100-7fec00 and 0060b0-889e00, as the authorized devices. ■ Send an al arm to a mana gement[...]

9-14 Configuring and Monitoring Port Security Port Security Command Options and Operation Figure 9-4. Example of Adding an Authorized Device to a Port W ith the above configuration for port A1, the follow ing command adds the 0c0090-456456 MAC addres s as th e second authorized address. ProCurve(config)# port-security a1 mac-address 0c0090- 456456 [...]

9-15 Configuring and Monitoring Port Security Port Security Command Options and Operation If you are adding a device (MAC address) to a port on which the Au thorized Addresses list is already full (as controll ed by the port’ s current Address Limit setting), then you must increase the Address Limit in order to add the device, even if you want to[...]

9-16 Configuring and Monitoring Port Security Port Security Command Options and Operation T o remove a device (MAC a ddress) from the “Authorized” list and when the current number of devices equals the Address Li mit value, you sh ould first reduce the Address Limit value by 1, then remove the unwanted device. Note When you have configured the [...]

9-17 Configuring and Monitoring Port Security MAC Lockdown Figure 9-8. Example of Port A1 After Removing One MAC Address MAC Lockdown MAC Lockdown is available on the Seri es 2600, 2600-PWR, and 28 00 switches only. MAC Lockdown, al so known as “static addr essing,” is the p ermanent assign- ment of a given MAC address (and VLAN, or V i rtual L[...]

9-18 Configuring and Monitoring Port Security MAC Lockdown How It W orks. When a device’ s MAC address is locked down to a port (typically in a pair with a VLAN) all in formation sent to that MAC address must go through the locked-down port. If the device is mo ved to another port it cannot receive data. T raffic to the designated MAC address goe[...]

9-19 Configuring and Monitoring Port Security MAC Lockdown Y ou cannot perform MAC Lockdow n and 802.1x authentication on t he same port or on the same MAC address. M A C Lockdown and 802.1x authentication are mutually exclusive. Lockdown is permitted on static trun ks (manually configured link aggrega- tions). Differences Between MAC Lo ckdown and[...]

9-20 Configuring and Monitoring Port Security MAC Lockdown MAC Lockdown Operating Notes Limits. There is a limit of 500 MAC Lockdowns that you can sa fely code per switch. T o truly lo ck down a MAC ad dr ess it would be necessary to use the MAC Lockdown command fo r every MAC Address and VLAN I D on every switch. In reality few netw ork administra[...]

9-21 Configuring and Monitoring Port Security MAC Lockdown Deploying MAC Lockdown When you deploy MAC Lockdown you ne ed to consider how you use it within your network topology to ensure security . In some cases where you are using techniques such as Spanning T ree Protocol (STP) to speed up n etwork performance by providing mult iple paths for d e[...]

9-22 Configuring and Monitoring Port Security MAC Lockdown Figure 9-9. MAC Lockdown Deployed At the Network Ed ge Provides Security Basic MAC Lockdown Deployment. I n the Model Network T opology shown above, the switches that are connected to the edge of the netwo rk each hav e one and only one connection to the core network. This means each switc [...]

9-23 Configuring and Monitoring Port Security MAC Lockdown The key points for this Model T opology are: • The Core Ne twork is separat ed from the edge by the use of switches which have been “locked down” for security . • All switches connected to the edge (outside us ers) each have only one port they can use to co nnect to th e Core Networ[...]

9-24 Configuring and Monitoring Port Security MAC Lockdown Figure 9-10. Connecti vity Problems Using MAC Lockdo wn with Multiple Paths The resultant connectivit y issues would prevent you from locking do wn Server A to Switch 1. And when you remove the MAC Lockdown from Switch 1 (to prevent broadcast storms or other connectivity is sues), you then [...]

9-25 Configuring and Monitoring Port Security MAC Lockout Displaying status. Locked down ports are list ed in the output of the show running-config command in the CLI . The show stat ic-mac command also lists the locked down MAC addr esses, as shown below . Figure 9-11. Listing Locked Down Ports MAC Lockout MAC Lockout is availabl e on the S eries [...]

9-26 Configuring and Monitoring Port Security MAC Lockout Lockout command ( lockout-mac < mac-address > ). When the wireless clients then attempt to use the network, the switch recogni zes the intr uding MAC addresses and prevents them from sending or receiving data on that network. If a particular MAC address can be iden tified as unwanted o[...]

9-27 Configuring and Monitoring Port Security MAC Lockout Figure 9-12. Listi ng Locked Out Ports Port Security and MAC Lockout MAC Lockout is independ ent of port-secur ity and in fact will override it. MAC Lockout is preferab le to port-securit y to stop access from kn own devices because it can be configured for all ports on the switch with one c[...]

9-28 Configuring and Monitoring Port Security IP Lockdown IP Lockdown IP lockdown is ava ilable on the Series 2600 and 2 800 switches only. The “IP lockdown” utility enables you to restrict incomi ng traffic on a port to a specific IP address/subnet, and de ny all other traffic on that por t. Operating Rules for IP Lockdown ■ Users cannot spe[...]

9-29 Configuring and Monitoring Port Security Web: Displaying and Configur ing Port Security Features W eb: Displaying and Configuring Port Security Features 1. Click on the Security tab . 2. Click on [Port Security] . 3. Sel ect the settings you want and, if you are usin g the Static Learn Mode, add or edit the Author ized Addresses field. 4. Im p[...]

9-30 Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags • In the menu interface: – The Port Status screen includ es a per -port intrusion alert – The Event Log includes per -port entries for security viol a- tions • In the web browser in terface: – The Alert Log’ s Status | Overview wi ndow inclu[...]

9-31 Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags Keeping the Intrusion Log Cu rrent by Resetting Alert Flags When a violation occurs on a port, an alert flag is set for that port and the violation is entered in the Intrusion Lo g. The switch can detect and hand le subsequent intr usions on that port, [...]

9-32 Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags Figure 9-14. Example of Port Status Sc reen with Intrusion Alert on Po rt A3 2. T ype [I] ( I ntrusion log ) to display the Intru sion Log. Figure 9-15. Example of the Intrusion Log Display The above example shows two intrusions for port A3 and one intr[...]

9-33 Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags (The intrusion log ho lds up to 20 intrusi on records and deletes an intrusion re cord only when the log becomes full and a new intrusion is subsequentl y detected.) Note also that the “ prior to ” text in the record fo r the earlie st intrusion mea[...]

9-34 Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags CLI: Checking for Intrusions, Listing Intrusion Alerts , and Resetting Alert Flags The following commands display port status, including whether there are intrusion alerts for any port(s), list the last 20 intrusions, and either reset the alert flag on [...]

9-35 Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags Figure 9-17. Example of the In trusion Log with Multi ple Entries for the Same Port The above exam ple shows three intr usions for port A1. Si nce the switch ca n show only one uncleared i ntrusion per port, the older two in trusions in th is example ha[...]

9-36 Configuring and Monitoring Port Security Reading Intrusion Alerts and Resetting Alert Flags Using the Event Log T o Find Intrusion Alerts The Event Log lists port security in trusions as: W MM/DD/YY HH:MM:SS FFI: port A3 - Security Violation where “ W ” is the severity level of the log entry and FF I is the system module that generated the[...]

9-37 Configuring and Monitoring Port Security Operating Notes for Port Security a. Click on the Security tab. b. Click on [Intrusion Log] . “Ports with Intrusion Flag” indicates any ports for which the alert flag has not been cleared. c. T o clea r the current alert flags, c lick on [Reset Alert Flags] . T o access the web-based Help provided f[...]

9-38 Configuring and Monitoring Port Security Operating Notes for Port Security LACP Not A vailable on Ports Co nfigured for Port Security . To m a i n - tain security , LACP is not allowed on po rts configured for port securi ty . If you configure port security o n a port on which LACP (acti ve or passive) is configured, the switch remo ves the LA[...]

10-1 10 T raffic/Security Filters (ProCurve Series 2600/2600- PWR and 2800 Switches) Contents Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-2 Using Source-P[...]

10-2 Traffic/Security Filters (ProCurve Series 2600/260 0-PWR and 2800 Switches) Overview Overview This chapter describes the use of sour ce-port filters on the Seri es 2600/ 2600-PWR switches and on the Series 28 00 switches. For info rmation on filters for the Series 250 0 switches, refer to the Management and Configur ation Guide provided for th[...]

10-3 Traffic/Security Filters (ProCurve Se ries 2600/2600-PW R and 2800 Switches) Overview from receiving traf fic from workstation "X" , you would configure a fi lter to drop traffic from port 5 to port 7. The re sulting f ilter would drop traffic from port 5 to port 7, but would forward all other traffic from any source port to any dest[...]

10-4 Traffic/Security Filters (ProCurve Series 2600/260 0-PWR and 2800 Switches) Using Source-Port Filters Using Source-Port Filters This feature is available only on the Series 2600, 2600-PWR, an d 2800 switches. Operating Rules for Source-Port Filters ■ Y ou can configure one source-port fi lt er for each physical port or port trunk on the swit[...]

10-5 Traffic/Security Filters (ProCurve Se ries 2600/2600-PW R and 2800 Switches) Using Source-Port Filters Configuring a Source-Port Filter The source-port filter command operates from the glob al configuration level. Example of Creating a Source-Port Fi lter . For example, assume that you want to create a source- port filter th at drops all traff[...]

10-6 Traffic/Security Filters (ProCurve Series 2600/260 0-PWR and 2800 Switches) Using Source-Port Filters Configuring a Filter on a Port T runk. This operation uses the same com- mand as that used for configuring a filt er on an individual port. However , the configuration pro cess requires two steps: 1. Configure the port trunk. 2. Configure a fi[...]

10-7 Traffic/Security Filters (ProCurve Se ries 2600/2600-PW R and 2800 Switches) Using Source-Port Filters V iewing a Source-Port Filter Y ou can list all source-port filters co nfigur ed in the switch and, optionally , the detailed info rmation on a specific filter . For example, assume that these th ree filters exist on the switch: Syntax: show [...]

10-8 Traffic/Security Filters (ProCurve Series 2600/260 0-PWR and 2800 Switches) Using Source-Port Filters If you wanted to determine the index number for the filter on source port 3 and then view a listing the filter deta ils on source port 3, you wo uld use the show filter and show fi lter [ INDEX ] commands, as shown in figure 10-4. Figure 10-4.[...]

10-9 Traffic/Security Filters (ProCurve Se ries 2600/2600-PW R and 2800 Switches) Using Source-Port Filters Editing a Source-Port Filter The switch includes in one filter the action(s) for al l destination po rts and/or trunks configured for a given source por t. Thus, if a source-port fi lter already exists and you want to change the cu rrently co[...]

10-10 Traffic/Security Filters (ProCurve Series 2600/260 0-PWR and 2800 Switches) Using Source-Port Filters Using Named Source-Port Filters This feature is available only on the Series 2600 and 2600-PWR switches. Named source-port filters are filters that may be used on multiple ports and port trunks. As with regular source-p ort filters, a po rt o[...]

10-11 Traffic/Security Filters (ProCurve Se ries 2600/2600-PW R and 2800 Switches) Using Source-Port Filters A named source-port f ilter must f irst be defined and co nfigured before it can be applied. In the followin g example two named source-port filt ers are defined, web-only and accounting . ProCurve(config)# filter source-port named-filter we[...]

10-12 Traffic/Security Filters (ProCurve Series 2600/260 0-PWR and 2800 Switches) Using Source-Port Filters Viewing a Named Source-Port Filter Y ou can list all source-port filters co nfigured in the switch, both named and unnamed, and t heir action using the show command below . Sample Configuration for Named Source-Port Filters A company wants to[...]

10-13 Traffic/Security Filters (ProCurve Se ries 2600/2600-PW R and 2800 Switches) Using Source-Port Filters Defining and Con figuring Example Named Source-Port Fi lters. While named source-p ort filters may be defined and configured in two steps, this is not necessary . Here we de fine and conf igure each of the named source-port filters for ou r [...]

10-14 Traffic/Security Filters (ProCurve Series 2600/260 0-PWR and 2800 Switches) Using Source-Port Filters ProCurve(config)# show filter Traffic/Security Filters IDX Filter Type | Value --- ------------ + ------------------- 1 Source Port | 2 2 Source Port | 3 3 Source Port | 4 4 Source Port | 5 5 Source Port | 6 6 Source Port | 8 7 Source Port | [...]

10-15 Traffic/Security Filters (ProCurve Se ries 2600/2600-PW R and 2800 Switches) Using Source-Port Filters Using the IDX value in the show filter command, we can see how traffic is filtered on a specif ic port ( Va l u e ).The two outputs below sh ow a non- accounting and an accou nting switch port. ProCurve(config)# show filter 4 Traffic/Securit[...]

10-16 Traffic/Security Filters (ProCurve Series 2600/260 0-PWR and 2800 Switches) Using Source-Port Filters The same command, using IDX 26, shows how traffic from the In ternet is handled. As the company grows, mo re resources are requir ed in accounting. T wo additional accounting workstations are added and attached to ports 12 and 13. A second se[...]

10-17 Traffic/Security Filters (ProCurve Se ries 2600/2600-PW R and 2800 Switches) Using Source-Port Filters The following revisions to the named so urce-port fi lter definiti ons maintain the desired network traffic management , as shown in the Action column of t he show command. W e next apply the updated named source-p ort filters to the appropr[...]

10-18 Traffic/Security Filters (ProCurve Series 2600/260 0-PWR and 2800 Switches) Using Source-Port Filters — This page is intentionally unused. —[...]

11-1 11 Using Authorized IP Managers Contents Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-2 Configuration Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-3 Access Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .[...]

11-2 Using Authorized IP Managers Overview Overview Authorized IP Manager Features The Authorized IP Managers feature us es IP addresses and masks to deter - mine which stations (PCs or workstat ions) can access the switch through the network. This cov ers access through th e following me ans: – T elnet and other terminal emul ation applicatio ns[...]

11-3 Using Authorized IP Managers Access Levels Configuration Options Y ou can configure: ■ Up to 10 authorized manager addresses , where eac h address applies to either a single management station or a group of stations ■ Manager or Operator access privil eges (for T elnet, SN MPv1, and SNMPv2c access only) Caution Configuring Autho rized IP M[...]

11-4 Using Authorized IP Managers Defining Authorized Management Stations Defining Authorized Management Stations ■ Authorizing Sin gle Station s: The table entry au thorizes a single management station to have IP acce ss to the switch. T o use this method, just enter the IP addre ss of an authorized management station in the Authorized Manager I[...]

11-5 Using Authorized IP Managers Defining Authorized Management Stations 255.255.255.252 uses the 4th octet of a given Authorized Manager IP address to authorize four IP addr esses for manage ment station access. The details o n how to use IP masks are provided un der “Building IP Masks” on page 11-9. Note The IP Mask is a method for recogniz [...]

11-6 Using Authorized IP Managers Defining Authorized Management Stations Figure 11-2. Example of How T o Add an Authorized Man ager Entry (Continued) Editing or Dele ting an Au thorized Manager Entry . Go to the IP Ma nag- ers List screen (figure 11-1), high light the desired entry , and press [E] (for Edit ) or [D] (for Delete ). CLI: Vi ewing an[...]

11-7 Using Authorized IP Managers Defining Authorized Management Stations Figure 11-3. Example of the Show IP Auth orized-Manager Display The above example shows an Authorized IP Ma nager List that allows statio ns to access the switch as show n below: Configuring IP Authorized Managers for the Switch T o Authorize Manager Access. This comman d aut[...]

11-8 Using Authorized IP Managers Defining Authorized Management Stations Similarly , the next command authoriz es manager -level access for any station having an IP address of 10.28.227 .101 through 103: ProCurve(config)# ip authorized-managers 10.28.227.101 255.255.255.252 access manager If you omit the < mask bits > when adding a new autho[...]

11-9 Using Authorized IP Managers Web: Configuring IP Authorized Managers W eb: Configuring IP Authorized Managers In the web browse r interf ace you can configure IP Authorized Mana gers as described below . T o Add, Modify , or Delete an IP Authorized Manager address: 1. Click on the Security tab. 2. Click on [Authorized Addresses]. 3. Enter the [...]

11-10 Using Authorized IP Managers Building IP Masks Configuring Multiple Statio ns Per Authorized Manager IP Entry The mask dete rmines whet he r the IP address of a station on the network meets the criteria you specify . Th at is, for a given Author ized Manager entry , the switch applies the IP mask to the IP address you sp ecify to determine a [...]

11-11 Using Authorized IP Managers Building IP Masks Figure 11-6. Example of How th e Bitmap in the IP Mask Defines Authorized Manager Addresses Additional Examples for Au thorizing Mult iple Stations 4th Octet of IP Mask: 4th Octet of Authorized IP Address: 249 5 Bit Numbers Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Bit V alues 128 64 32 16 [...]

11-12 Using Authorized IP Managers Operating Notes Operating Notes ■ Network Security Precautions: Y ou can enhance your network’ s security by keeping physical access to the switch re stricted to autho- rized personnel, using th e password features bui lt into the switch, using the addi tional security features described in this manual, and pr[...]

Index – 1 Index Numerics 3DES … 6-3, 7-3 802.1X See port-based acc ess control. …8 - 1 A aaa authentication … 4-8 aaa port-access See Web or MAC Authentication. access levels, authoriz ed IP managers … 11-3 accounting See RADIUS. address authorized for port security … 9-3 authentication See TACACS. authorized addresses for IP management[...]

2 – Index I inconsistent value, message … 9-14 intrusion alarms entries dropped from log … 9-37 event log … 9-36 prior to … 9-37 Intrusion Log prior to … 9-33, 9-35 IP authorized IP managers … 11-1 reserved port numbers … 6-17 IP lockdown … 9-28 IP masks building … 11-9 for multiple authorized manager stations … 11-10 for sing[...]

Index – 3 prior to … 9-37 proxy web server … 9-37 port-based access control authenticate switch … 8-4 authenticate users … 8-4 authenticator backend state … 8-38 authenticator operation … 8-6, 8-8 authenticator, show commands … 8-38 authorized IP managers, precedence … 11-2 block traffic … 8-3 blocking non-802.1X device … 8-33[...]

4 – Index accounting, system … 5-18, 5-22 authentication options … 5-2 authentication, local … 5-16 authorized IP managers, precedence … 11-2 bypass RADIUS server … 5-9 commands, accounting … 5-17 commands, switch … 5 -6 configuration outline … 5-7 configure server access … 5-10 configuring switch global parameters … 5-12 gene[...]

Index – 5 zeroing a key … 6-11 zeroize … 6-11 SSL CA-signed … 7-4, 7-15 CA-signed certifi cate … 7-4, 7-15 CLI commands … 7-7 client behavi or … 7-17, 7-18 crypto key … 7-10 disabling … 7-10 enabling … 7-17 erase certificate key pair … 7-10 erase host key pair … 7-10 generate CA-signed certificate … 7-15 generate host key [...]

6 – Index See also LACP. U user name cleared … 2-5 V value, inconsistent … 9-1 4 VLAN 802.1X … 8-44 802.1X, ID changes … 8 -47 802.1X, suspend untagged VLAN … 8-41 filter, source-port … 10-3 not advertised for GVRP … 8-47 W w a r r a n t y…1 - i i Web Auth/MAC Auth applicable models … 3-2 Web Authentication authenticator operati[...]

— This page is intentionally unused. —[...]

© 2000 - 2008 Hewlett-Packard Development Company , LP . The information contained herein is subject to change without notice. December 2008 Manual Part Number 5990-6024[...]