HP U.11. User Manual

2510
ProCurve Switches
Access Security Guide
Q.11. (2510-24) U.11. (2510-48)
www.procurve.com
XX XX
ProCurve Series 2510 Switches
January 2008
© Copyright 2008 Hewlett-Packard Company, L.P. The information contained herein is subject to change without notice.
Publication Number
5991-4763 January 2008
Applicable Products
ProCurve Switch 2510-24 (J9019B)
ProCurve Switch 2510-48 (J9020A)
Trademark Credits
Windows NT®, Windows®, and MS Windows® are US registered trademarks of Microsoft Corporation.
Software Credits
SSH on ProCurve Switches is based on the OpenSSH software toolkit. This product includes software developed by the OpenSSH Project for use in the OpenSSH Toolkit. For more information on OpenSSH, visit www.openssh.com.
SSL on ProCurve Switches is based on the Op enSSL software toolkit. This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. For more information on OpenSSL, visit www.openssl.org.
This product includes cryptographic software written by Eric Young (eay@cryptsoft.com)
This product includes software written by Tim Hudson (tjh@cryptsoft.com)
or editorial errors or omissions contained herein. The information is provided "as is" without warranty of any kind and is subject to change without notice. The warranties for Hewlett-Packard Company products are set forth in the express limited warranty statements for such products. Nothing herein should be construed as constituting an additional warranty.
Hewlett-Packard assumes no responsibility for the use or reliability of its software on equipment that is not furnished by Hewlett-Packard.
Warran ty
See the Customer Support/Warranty booklet included with the product.
A copy of the specific warranty terms applicable to your Hewlett-Packard products and replacement parts can be obtained from your HP Sales and Service Office or authorized dealer.
Disclaimer
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material.
Hewlett-Packard Company shall not be liable for technical
Hewlett-Packard Company 8000 Foothills Boulevard, m/s 5551 Roseville, California 95747-5551 http://www.procurve.com

Contents

Product Documentation
About Your Switch Manual Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi
Feature Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xii
1 Getting Started
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2
Overview of Access Security Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2
Management Access Security Protection . . . . . . . . . . . . . . . . . . . . . . . . 1-3
General Switch Traffic Security Guidelines . . . . . . . . . . . . . . . . . . . . . . 1-4
Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5
Command Syntax Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5
Command Prompts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-6
Screen Simulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-6
Port Identity Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-6
Sources for More Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
Need Only a Quick Start? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-8
IP Addressing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-8
To Set Up and Install the Switch in Your Network . . . . . . . . . . . . . . . . 1-9
2 Configuring Username and Password Security
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2
Configuring Local Password Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4
Menu: Setting Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4
CLI: Setting Passwords and Usernames . . . . . . . . . . . . . . . . . . . . . . . . . 2-5
Web: Setting Passwords and Usernames . . . . . . . . . . . . . . . . . . . . . . . . 2-6
iii
Front-Panel Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-7
When Security Is Important . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-7
Front-Panel Button Functions ‘ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-8
Configuring Front-Panel Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-10
Password Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-15
Password Recovery Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-17
3 Web and MAC Authentication
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2
Client Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3
General Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-4
How Web and MAC Authentication Operate . . . . . . . . . . . . . . . . . . . . . . . . 3-5
Authenticator Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-5
Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-9
Operating Rules and Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-10
General Setup Procedure for Web/MAC Authentication . . . . . . . . . . . . . . 3-12
Do These Steps Before You Configure Web/MAC Authentication . . 3-12
Additional Information for Configuring the RADIUS
Server To Support MAC Authentication . . . . . . . . . . . . . . . . . . . . . . . . 3-14
Configuring the Switch To Access a RADIUS Server . . . . . . . . . . . . . . . . 3-15
Configuring Web Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-17
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-17
Configure the Switch for Web-Based Authentication . . . . . . . . . . . . . 3-18
Configuring MAC Authentication on the Switch . . . . . . . . . . . . . . . . . . . . 3-22
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-22
Configure the Switch for MAC-Based Authentication . . . . . . . . . . . . 3-23
Show Status and Configuration of Web-Based Authentication . . . . . . . . 3-26
Show Status and Configuration of MAC-Based Authentication . . . . . . . . 3-28
Show Client Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-30
iv
4 TACACS+ Authentication
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2
Terminology Used in TACACS Applications: . . . . . . . . . . . . . . . . . . . . . . . . 4-3
General System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-5
General Authentication Setup Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-5
Configuring TACACS+ on the Switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-8
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-8
CLI Commands Described in this Section . . . . . . . . . . . . . . . . . . . . . . . 4-9
Viewing the Switch’s Current Authentication Configuration . . . . . . . 4-9
Viewing the Switch’s Current TACACS+ Server
Contact Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-10
Configuring the Switch’s Authentication Methods . . . . . . . . . . . . . . . 4-11
Configuring the Switch’s TACACS+ Server Access . . . . . . . . . . . . . . 4-15
How Authentication Operates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-20
General Authentication Process Using a TACACS+ Server . . . . . . . . 4-20
Local Authentication Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-22
Using the Encryption Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-23
Controlling Web Browser Interface Access When Using TACACS+
Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-24
Messages Related to TACACS+ Operation . . . . . . . . . . . . . . . . . . . . . . . . . 4-25
Operating Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-25
5 RADIUS Authentication and Accounting
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-2
Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-3
Switch Operating Rules for RADIUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-4
General RADIUS Setup Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-5
v
Configuring the Switch for RADIUS Authentication . . . . . . . . . . . . . . . . . . 5-6
Outline of the Steps for Configuring RADIUS Authentication . . . . . . 5-7
1. Configure Authentication for the Access Methods
You Want RADIUS To Protect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-8
2. Configure the Switch To Access a RADIUS Server . . . . . . . . . . . . 5-10
3. Configure the Switch’s Global RADIUS Parameters . . . . . . . . . . . 5-12
Local Authentication Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-16
Controlling Web Browser Interface Access When Using RADIUS
Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-17
Configuring RADIUS Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-17
Operating Rules for RADIUS Accounting . . . . . . . . . . . . . . . . . . . . . . 5-19
Steps for Configuring RADIUS Accounting . . . . . . . . . . . . . . . . . . . . . 5-19
Viewing RADIUS Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-25
General RADIUS Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-25
RADIUS Authentication Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-28
RADIUS Accounting Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-29
Changing RADIUS-Server Access Order . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-30
Messages Related to RADIUS Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-32
6 Configuring Secure Shell (SSH)
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-1
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-2
Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-4
Prerequisite for Using SSH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-5
Public Key Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-5
Steps for Configuring and Using SSH
for Switch and Client Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-6
General Operating Rules and Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-8
Configuring the Switch for SSH Operation . . . . . . . . . . . . . . . . . . . . . . . . . . 6-9
1. Assign Local Login (Operator) and Enable (Manager) Password . 6-9
2. Generate the Switch’s Public and Private Key Pair . . . . . . . . . . . . 6-10
3. Provide the Switch’s Public Key to Clients . . . . . . . . . . . . . . . . . . . 6-12
vi
4. Enable SSH on the Switch and Anticipate SSH
Client Contact Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-15
5. Configure the Switch for SSH Authentication . . . . . . . . . . . . . . . . . 6-18
6. Use an SSH Client To Access the Switch . . . . . . . . . . . . . . . . . . . . . 6-22
Further Information on SSH Client Public-Key Authentication . . . . . . . . 6-23
Messages Related to SSH Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-29
7 Configuring Secure Socket Layer (SSL)
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-1
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-2
Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-3
Prerequisite for Using SSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-5
Steps for Configuring and Using SSL for
Switch and Client Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-5
General Operating Rules and Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-6
1. Assign Local Login (Operator) and Enable (Manager) Password . 7-7
2. Generate the Switch’s Server Host Certificate . . . . . . . . . . . . . . . . . 7-8
3. Enable SSL on the Switch and Anticipate SSL
Browser Contact Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-17
Common Errors in SSL Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-21
8 Configuring Port-Based and Client-Based
Access Control (802.1X)
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-1
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-3
Why Use Port-Based or Client-Based Access Control? . . . . . . . . . . . . 8-3
General Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-3
User Authentication Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-4
Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-7
General 802.1X Authenticator Operation . . . . . . . . . . . . . . . . . . . . . . . . . . 8-10
Example of the Authentication Process . . . . . . . . . . . . . . . . . . . . . . . . 8-10
Switch-Port Supplicant Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-11
General Operating Rules and Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-12
vii
General Setup Procedure for 802.1X Access Control . . . . . . . . . . . . . . . . 8-14
Do These Steps Before You Configure 802.1X Operation . . . . . . . . . 8-14
Overview: Configuring 802.1X Authentication on the Switch . . . . . . 8-15
Configuring Switch Ports as 802.1X Authenticators . . . . . . . . . . . . . . . . . 8-17
1. Enable 802.1X Authentication on Selected Ports . . . . . . . . . . . . . . 8-17
2. Reconfigure Settings for Port-Access . . . . . . . . . . . . . . . . . . . . . . . . 8-20
3. Configure the 802.1X Authentication Method . . . . . . . . . . . . . . . . . 8-23
4. Enter the RADIUS Host IP Address(es) . . . . . . . . . . . . . . . . . . . . . . 8-24
5. Enable 802.1X Authentication on the Switch . . . . . . . . . . . . . . . . . 8-24
6. Optionally Resetting Authenticator Operation . . . . . . . . . . . . . . . . 8-25
802.1X Open VLAN Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-26
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-26
VLAN Membership Priorities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-27
Use Models for 802.1X Open VLAN Modes . . . . . . . . . . . . . . . . . . . . . 8-28
Operating Rules for Authorized-Client and
Unauthorized-Client VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-31
Setting Up and Configuring 802.1X Open VLAN Mode . . . . . . . . . . . . 8-34
802.1X Open VLAN Operating Notes . . . . . . . . . . . . . . . . . . . . . . . . . . 8-38
Option For Authenticator Ports: Configure Port-Security To Allow
Only 802.1X Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-40
viii
Configuring Switch Ports To Operate As
Supplicants for 802.1X Connections to Other Switches . . . . . . . . . . . . . . 8-42
Displaying 802.1X Configuration, Statistics, and Counters . . . . . . . . . . . . 8-47
Show Commands for Port-Access Authenticator . . . . . . . . . . . . . . . . 8-47
Viewing 802.1X Open VLAN Mode Status . . . . . . . . . . . . . . . . . . . . . . 8-50
Show Commands for Port-Access Supplicant . . . . . . . . . . . . . . . . . . . 8-53
How RADIUS/802.1X Authentication Affects VLAN Operation . . . . . . . . 8-54
Messages Related to 802.1X Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-58
9 Configuring and Monitoring Port Security
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-1
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-2
Basic Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-2
Blocking Unauthorized Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-3
Trunk Group Exclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-4
Planning Port Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-5
Port Security Command Options and Operation . . . . . . . . . . . . . . . . . . . . . 9-6
Retention of Static MAC Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-10
Displaying Current Port Security Settings . . . . . . . . . . . . . . . . . . . . . . 9-10
Configuring Port Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-12
Web: Displaying and Configuring Port Security Features . . . . . . . . . . . . . 9-17
Reading Intrusion Alerts and Resetting Alert Flags . . . . . . . . . . . . . . . . . . 9-17
Notice of Security Violations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-17
How the Intrusion Log Operates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-18
Keeping the Intrusion Log Current by Resetting Alert Flags . . . . . . . 9-19
Using the Event Log To Find Intrusion Alerts . . . . . . . . . . . . . . . . . . . 9-24
Web: Checking for Intrusions, Listing Intrusion Alerts,
and Resetting Alert Flags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-25
Operating Notes for Port Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-25
Configuring Protected Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-27
10 Using Authorized IP Managers
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-1
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-2
Configuration Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-3
Access Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-3
Defining Authorized Management Stations . . . . . . . . . . . . . . . . . . . . . . . . . 10-4
Overview of IP Mask Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-4
Menu: Viewing and Configuring IP Authorized Managers . . . . . . . . . 10-5
CLI: Viewing and Configuring Authorized IP Managers . . . . . . . . . . . 10-6
Web: Configuring IP Authorized Managers . . . . . . . . . . . . . . . . . . . . . . . . . 10-9
ix
Building IP Masks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-9
Configuring One Station Per Authorized Manager IP Entry . . . . . . . 10-9
Configuring Multiple Stations Per Authorized Manager IP Entry . . 10-10
Additional Examples for Authorizing Multiple Stations . . . . . . . . . 10-12
Operating Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-12
x

Product Documentation

About Your Switch Manual Set
The switch manual set includes the following:
Read Me First - a printed guide shipped with your switch. Provides
software update information, product notes, and other information.
Installation and Getting Started Guide - a printed guide shipped
with your switch. This guide explains how to prepare for and perform the physical installation and connection to your network.
Management and Configuration Guide - a PDF file on the
ProCurve Networking Web Site. This guide describes how to configure, manage, and monitor basic switch operation.
Advanced Traffic Management Guide - a PDF file on the ProCurve
Networking Web Site. This guide explains the configuration and operation of traffic management features such as spanning tree and VLANs.
Access Security Guide - a PDF file on the ProCurve Networking
Web Site. This guide explains the configuration and operation of access security and user authentication features on the switch.
Release Notes - posted on the ProCurve web site to provide
information on software updates. The release notes describe new features, fixes, and enhancements that become available between revisions of the above guides.
Note For the latest version of all ProCurve switch documentation, including release
notes covering recently added features, visit the ProCurve Networking website at www.procurve.com. Click on Technical support, and then click on Product manuals (all).
xi
Product Documentation

Feature Index

For the manual set supporting your switch model, the following feature index indicates which manual to consult for information on a given software feature.
Feature Management and
Configuration
802.1Q VLAN Tagging - X -
802.1p Priority X - -
802.1X Authentication - - X
Authorized IP Managers - - X
Config File X --
Copy Command X - -
Debug X --
DHCP Configuration - X -
DHCP/Bootp Operation X --
Diagnostic Tools X - -
Downloading Software X --
Event Log X - -
Factory Default Settings X --
File Management X - -
Advanced Traffic Management
Access Security Guide
File Transfers X --
GVRP - X -
IGMP - X -
Interface Access (Telnet, Console/Serial, Web) X - -
IP Addressing X --
LACP X - -
Link X --
xii
Product Documentation
Feature Management and
Configuration
LLDP X - -
MAC Address Management X --
Monitoring and Analysis X - -
Multicast Filtering - X -
Network Management Applications (LLDP, SNMP) X - -
Passwords - - X
Ping X - -
Port Configuration X --
Port Security - - X
Port Status X --
Port Trunking (LACP) X - -
Port-Based Access Control - - X
Port-Based Priority (802.1Q) X - -
Quality of Service (QoS) - X -
Advanced Traffic Management
Access Security Guide
RADIUS Authentication and Accounting - - X
Secure Copy X --
SFTP X - -
SNMP X --
Software Downloads (SCP/SFTP, TFTP, Xmodem) X - -
Spanning Tree (MSTP) - X -
SSH (Secure Shell) Encryption - - X
SSL (Secure Socket Layer) - - X
Stack Management (Stacking) - X -
Syslog X --
System Information X - -
TACACS+ Authentication - - X
xiii
Product Documentation
Feature Management and
Configuration
Telnet Access X - -
TFTP X --
Time Protocols (TimeP, SNTP) X - -
Troubleshooting X --
VLANs - X -
Xmodem X --
Advanced Traffic Management
Access Security Guide
xiv
Getting Started

Contents

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2
Overview of Access Security Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2
Management Access Security Protection . . . . . . . . . . . . . . . . . . . . . . . . 1-3
General Switch Traffic Security Guidelines . . . . . . . . . . . . . . . . . . . . . . 1-4
Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5
Command Syntax Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5
Command Prompts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-6
Screen Simulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-6
Port Identity Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-6
1
Sources for More Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
Need Only a Quick Start? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-8
IP Addressing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-8
To Set Up and Install the Switch in Your Network . . . . . . . . . . . . . . . . 1-9
1-1
Getting Started

Introduction

Introduction
This Access Security Guide describes how to use ProCurve’s switch security features to protect access to your switch. This guide is intended to support the following switches:
ProCurve Switch 2510-24
ProCurve Switch 2510-48
For an overview of other product documentation for the above switches, refer to “Product Documentation” on page xi.
You can download a copy from the ProCurve Networking website, www.procurve.com.

Overview of Access Security Features

1-2
The access security features covered in this guide include:
Local Manager and Operator Passwords (page 2-1): Control
access and privileges for the CLI, menu, and web browser interfaces.
TACACS+ Authentication (page 4-1): Uses an authentication appli-
cation on a server to allow or deny access to a switch.
RADIUS Authentication and Accounting (page 5-1): Like
TACACS+, uses an authentication application on a central server to allow or deny access to the switch. RADIUS also provides accounting services for sending data about user activity and system events to a RADIUS server.
Secure Shell (SSH) Authentication (page 6-1): Provides
encrypted paths for remote access to switch management functions.
Secure Socket Layer (SSL) (page 7-1): Provides remote web access
to the switch via encrypted authentication paths between the switch and management station clients capable of SSL/TLS operation.
Overview of Access Security Features
Port-Based Access Control (802.1X) (page 8-1): On point-to-point
Getting Started
connections, enables the switch to allow or deny traffic between a port and an 802.1X-aware device (supplicant) attempting to access the switch. Also enables the switch to operate as a supplicant for connections to other 802.1X-aware switches.
Port Security (page 9-1): Enables a switch port to maintain a unique
list of MAC addresses defining which specific devices are allowed to access the network through that port. Also enables a port to detect, prevent, and log access attempts by unauthorized devices.
Authorized IP Managers (page 10-1): Allows access to the switch
by a networked device having an IP address previously configured in the switch as “authorized”.

Management Access Security Protection

In considering management access security for your switch, there are two key areas to protect:
Unauthorized client access to switch management features
Unauthorized client access to the network.
Table 1-1 on page 1-4 provides an overview of the type of protection offered by each switch security feature.
Note ProCurve recommends that you use local passwords together with your
switch’s other security features to provide a more comprehensive security fabric than if you use only local passwords.
1-3
Getting Started
Overview of Access Security Features
Table 1-1. Management Access Security Protection
Security Feature Offers Protection Against Unauthorized Client Access to
Connection Tel ne t SNMP
Local Manager and Operator Usernames and Passwords
TA CA C S+ PtP: Ye s No No Yes No
RADIUS
SSH Ptp: Ye s No No Ye s No
SSL Ptp: No No Ye s No No
Port-Based Access Control (802.1X)
Port Security (MAC address) PtP: Yes Yes Yes Yes Yes
Authorized IP Managers PtP: Yes Yes Yes Yes No
1
Remote: Ye s No Ye s Ye s No
Remote: Ye s No No Yes No
Remote: Ye s No No Yes No
Remote: Ye s No No Yes No
Remote: No No Ye s No No
Remote: No No No No No
Remote: Yes Yes Yes Yes Yes
Remote: Yes Yes Yes Yes No
Switch Management Features
Web
(Net Mgmt)
PtP: Ye s No Ye s Ye s No
PtP: Ye s No No Yes No
PtP: Yes Yes Yes Yes Yes
Browser
SSH
Client
Offers Protection
Against
Unauthorized Client
Access to the
Network

General Switch Traffic Security Guidelines

1-4
Where the switch is running multiple security options, it implements network traffic security based on the OSI (Open Systems Interconnection model) precedence of the individual options, from the lowest to the highest. The following list shows the order in which the switch implements configured security features on traffic moving through a given port.
1. Disabled/Enabled physical port
2. Port security
3. Authorized IP Managers
4. Application features at higher levels in the OSI model, such as SSH
(The above list does not address the mutually exclusive relationship that exists among some security features.)
Getting Started

Conventions

Conventions
This guide uses the following conventions for command syntax and displayed information.

Command Syntax Statements

Syntax: aaa port-access authenticator < port-list >
[ control < authorized | auto | unauthorized >]
Vertical bars ( | ) separate alternative, mutually exclusive elements.
Square brackets ( [ ] ) indicate optional elements.
Braces ( < > ) enclose required elements.
Braces within square brackets ( [ < > ] ) indicate a required element
within an optional choice.
Boldface indicates use of a CLI command, part of a CLI command
syntax, or other displayed element in general text. For example:
“Use the copy tftp command to download the key from a TFTP server.”
Italics indicate variables for which you must supply a value when
executing the command. For example, in this command syntax, < port- list > indicates that you must provide one or more port numbers:
Syntax: aaa port-access authenticator < port-list >
1-5
Getting Started
Conventions

Command Prompts

In the default configuration, your switch displays the following CLI prompt:
ProCurve Switch 2510-24#
To simplify recognition, this guide uses ProCurve to represent command prompts for all models. For example:
ProCurve#
(You can use the hostname command to change the text in the CLI prompt.)

Screen Simulations

Figures containing simulated screen text and command output look similar to this:
ProCurve(config)# show version
Image stamp: /sw/code/build/dosx(ndx)
Dec 11 2007 11:44:02
U.11.03
1340
Boot Image: Primary
1-6
Figure 1-1. Example of a Figure Showing a Simulated Screen
In some cases, brief command-output sequences appear outside of a numbered figure. For example:
ProCurve(config)# ip default-gateway 18.28.152.1/24 ProCurve(config)# vlan 1 ip address 18.28.36.152/24 ProCurve(config)# vlan 1 ip igmp

Port Identity Examples

This guide describes software applicable to both chassis-based and stackable ProCurve switches. Where port identities are needed in an example, this guide uses the chassis-based port identity system, such as “A1”, “B3 - B5”, “C7”, etc. However, unless otherwise noted, such examples apply equally to the stackable switches, which for port identities typically use only numbers, such as “1”, “3-5”, “15”, etc.

Sources for More Information

Getting Started
Sources for More Information
For additional information about switch operation and features not covered in this guide, consult the following sources:
For information on which product manual to consult on a given
software feature, refer to “Product Documentation” on page xi.
Note For the latest version of all ProCurve switch documentation, including
release notes covering recently added features, visit the ProCurve Networking Web Site at www.procurve.com. Click on Technical support, and then click on Product manuals (all).
For information on specific parameters in the Menu interface, refer
to the online help provided in the interface. For example:
Figure 1-2. Getting Help in the Menu Interface
Online Help for Menu interface
1-7
Getting Started

Need Only a Quick Start?

For information on a specific command in the CLI, type the command
name followed by “help”. For example:
Figure 1-3. Getting Help in the CLI
For information on specific features in the Web browser interface,
use the online help. For more information, refer to the Management and Configuration Guide for your switch.
For further information on ProCurve Networking switch technology,
visit the ProCurve Networking Website at:
www.procurve.com
1-8
Need Only a Quick Start?

IP Addressing

If you just want to give the switch an IP address so that it can communicate on your network, or if you are not using multiple VLANs, ProCurve recommends that you use the Switch Setup screen to quickly configure IP addressing. To do so, do one of the following:
Enter setup at the CLI Manager level prompt.
ProCurve# setup
Or, run the Menu interface and select 8. Run Setup from the Main Menu.
For more on using the Switch Setup screen, see the Installation and Getting Started Guide you received with the switch.
Need Only a Quick Start?
Getting Started

To Set Up and Install the Switch in Your Network

Important! Use the Installation and Getting Started Guide shipped with your switch for
the following:
Notes, cautions, and warnings related to installing and using the
switch
Instructions for physically installing the switch in your network
Quickly assigning an IP address and subnet mask, setting a Manager
password, and (optionally) configuring other basic features.
Interpreting LED behavior.
For the latest version of the Installation and Getting Started Guide and other documentation for your switch, visit the ProCurve Networking Web site. (Refer to “Product Documentation” on page xi of this guide for further details.)
1-9
Getting Started
Need Only a Quick Start?
1-10
Configuring Username and Password Security

Contents

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2
Configuring Local Password Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4
Menu: Setting Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4
CLI: Setting Passwords and Usernames . . . . . . . . . . . . . . . . . . . . . . . . . 2-5
Web: Setting Passwords and Usernames . . . . . . . . . . . . . . . . . . . . . . . . 2-6
Front-Panel Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-7
When Security Is Important . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-7
Front-Panel Button Functions ‘ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-8
Configuring Front-Panel Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-10
Password Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-15
Password Recovery Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-17
2
2-1
Configuring Username and Password Security

Overview

Overview
Feature Default Menu CLI Web
Set Usernames none page 2-6
Set a Password none page 2-4 page 2-5 page 2-6
Delete Password Protection n/a page 2-4 page 2-6 page 2-6
Show front-panel-security n/a page 1-13
Front-panel-security page 1-13
password-clear enabled page 1-13
reset-on-clear disabled page 1-14
factory-reset enabled page 1-15
password-recovery enabled page 1-15
Console access includes both the menu interface and the CLI. There are two levels of console access: Manager and Operator. For security, you can set a password pair (username and password) on each of these levels.
Note Usernames are optional. Also, in the menu interface, you can configure
passwords, but not usernames. To configure usernames, use the CLI or the web browser interface.
Level Actions Permitted
Manager: Access to all console interface areas.
This is the default level. That is, if a Manager password has not been set prior to starting the current console session, then anyone having access to the console can access any area of the console interface.
Operator: Access to the Status and Counters menu, the Event Log, and the CLI*, but no
*Allows use of the ping, link-test, show, menu, exit, and logout commands, plus the enable command if you can provide the Manager password.
2-2
Configuration capabilities. On the Operator level, the configuration menus, Download OS, and Reboot
Switch options in the Main Menu are not available.
Configuring Username and Password Security
Overview
To configure password security:
1. Set a Manager password pair (and an Operator password pair, if applica­ble for your system).
2. Exit from the current console session. A Manager password pair will now be needed for full access to the console.
If you do steps 1 and 2, above, then the next time a console session is started for either the menu interface or the CLI, a prompt appears for a password. Assuming you have protected both the Manager and Operator levels, the level of access to the console interface will be determined by which password is entered in response to the prompt.
If you set a Manager password, you may also want to configure the
Inactivity Time parameter. (Refer to the Management and Configuration Guide for your switch.) This causes the console session to end after the
specified period of inactivity, thus giving you added security against unautho­rized console access.
Note The manager and operator passwords and (optional) usernames control
access to the menu interface, CLI, and web browser interface.
If you configure only a Manager password (with no Operator password), and in a later session the Manager password is not entered correctly in response to a prompt from the switch, then the switch does not allow management access for that session.
Passwords are case-sensitive.
Caution If the switch has neither a Manager nor an Operator password, anyone
having access to the switch through either Telnet, the serial port, or the web browser interface can access the switch with full manager privileges. Also, if you configure only an Operator password, entering the Operator pass­word enables full manager privileges.
The rest of this section covers how to:
Set passwords
Delete passwords
Recover from a lost password
2-3
Configuring Username and Password Security

Configuring Local Password Security

Configuring Local Password Security

Menu: Setting Passwords

As noted earlier in this section, usernames are optional. Configuring a user­name requires either the CLI or the web browser interface.
1. From the Main Menu select:
3. Console Passwords
2-4
Figure 2-1. The Set Password Screen
2. To set a new password: a. Select Set Manager Password or Set Operator Password. You will then
be prompted with Enter new password.
b. Type a password of up to 16 ASCII characters with no spaces and
press [Enter]. (Remember that passwords are case-sensitive.)
c. When prompted with Enter new password again, retype the new pass-
word and press [Enter].
After you configure a password, if you subsequently start a new console session, you will be prompted to enter the password. (If you use the CLI or web browser interface to configure an optional username, the switch will prompt you for the username, and then the password.)
To Delete Password Protection (Including Recovery from a Lost Password): This procedure deletes all usernames (if configured) and pass-
words (Manager and Operator).
Loading...
+ 264 hidden pages