Resumen del contenido incluido en la página 1
53-1002601-01
®
28 September 2012
Brocade ICX 6650
Security Configuration Guide
Supporting FastIron Software Release 07.5.00
Resumen del contenido incluido en la página 2
Copyright © 2012 Brocade Communications Systems, Inc. All Rights Reserved. Brocade, Brocade Assurance, the B-wing symbol, BigIron, DCX, Fabric OS, FastIron, MLX, NetIron, SAN Health, ServerIron, TurboIron, VCS, and VDX are registered trademarks, and AnyIO, Brocade One, CloudPlex, Effortless Networking, ICX, NET Health, OpenScript, and The Effortless Network are trademarks of Brocade Communications Systems, Inc., in the United States and/or in other countries. Other brands, products, or servic
Resumen del contenido incluido en la página 3
Contents About This Document Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi Supported hardware and software . . . . . . . . . . . . . . . . . . . . . . . . . . . xi Brocade ICX 6650 slot and port numbering . . . . . . . . . . . . . . . . . . . .xi How this document is organized . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii Document conventions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii Tex
Resumen del contenido incluido en la página 4
Passwords used to secure access . . . . . . . . . . . . . . . . . . . . . . . . . . .13 Setting a Telnet password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13 Setting passwords for management privilege levels . . . . . . . . . 14 Recovering from a lost password . . . . . . . . . . . . . . . . . . . . . . . . 16 Displaying the SNMP community string . . . . . . . . . . . . . . . . . . . 16 Specifying a minimum password length. . . . . . . . . . . . . . . . . . . 16 Local user acco
Resumen del contenido incluido en la página 5
Chapter 2 SSH2 and SCP SSH version 2 overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .63 Tested SSH2 clients. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64 SSH2 supported features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64 SSH2 unsupported features . . . . . . . . . . . . . . . . . . . . . . . . . . . .64 SSH2 authentication types. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .65 Configuring SSH2. . . . . .
Resumen del contenido incluido en la página 6
Configuring standard numbered ACLs. . . . . . . . . . . . . . . . . . . . . . . .86 Standard numbered ACL syntax . . . . . . . . . . . . . . . . . . . . . . . . .86 Configuration example for standard numbered ACLs . . . . . . . . 87 Standard named ACL configuration. . . . . . . . . . . . . . . . . . . . . . . . . . 87 Standard named ACL syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . .88 Configuration example for standard named ACLs . . . . . . . . . . .90 Extended numbered ACL conf
Resumen del contenido incluido en la página 7
ACL statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .118 ACLs to control multicast features . . . . . . . . . . . . . . . . . . . . . . . . . .118 Enabling and viewing hardware usage statistics for an ACL . . . . .118 Displaying ACL information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119 Troubleshooting ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119 Policy Based Routing . . . . . . . . . . . . .
Resumen del contenido incluido en la página 8
Configuring adaptive rate limiting . . . . . . . . . . . . . . . . . . . . . . . . . .144 Marking Class of Service parameters in adaptive rate limiting145 Handling packets that exceed the rate limit . . . . . . . . . . . . . . . . . .147 Dropping packets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .147 Permitting packets at low priority . . . . . . . . . . . . . . . . . . . . . . .148 Enabling and using ACL statistics . . . . . . . . . . . . . . . . . . . . . . . . . .1
Resumen del contenido incluido en la página 9
Displaying 802.1X information. . . . . . . . . . . . . . . . . . . . . . . . . . . . .184 Displaying 802.1X configuration information . . . . . . . . . . . . .184 Displaying 802.1X statistics . . . . . . . . . . . . . . . . . . . . . . . . . . .187 Clearing 802.1X statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . .188 Displaying dynamically assigned VLAN information . . . . . . . .188 Displaying information about dynamically applied MAC address filters and IP ACLs. . . . . . . .
Resumen del contenido incluido en la página 10
Dynamic MAC-based VLAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .213 Configuration notes and feature limitations for dynamic MAC-based VLAN. . . . . . . . . . . . . . . . . . . . . . . . . .213 Dynamic MAC-based VLAN CLI commands . . . . . . . . . . . . . . .213 Dynamic MAC-based VLAN configuration example . . . . . . . . .214 MAC-based VLAN configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . .215 Using MAC-based VLANs and 802.1X security on the same port .
Resumen del contenido incluido en la página 11
Multi-device port authentication configuration. . . . . . . . . . . . . . . .236 Enabling multi-device port authentication . . . . . . . . . . . . . . . .237 Specifying the format of the MAC addresses sent to the RADIUS server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .238 Specifying the authentication-failure action . . . . . . . . . . . . . .238 Generating traps for multi-device port authentication . . . . . .239 Defining MAC address filters. . . . . . . . . . .
Resumen del contenido incluido en la página 12
Chapter 11 Rate Limiting and Rate Shaping Port-based rate limiting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .273 How port-based fixed rate limiting works . . . . . . . . . . . . . . . . . 274 Rate limiting in hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274 Configuration notes for port-based fixed rate limiting. . . . . . .275 Configuring a port-based fixed rate limiting policy . . . . . . . . .275 Displaying the port-based fixed rate limiting confi
Resumen del contenido incluido en la página 13
Chapter 13 Limiting Broadcast, Multicast, and Unknown Unicast Traffic Broadcast, unknown Unicast, and Multicast rate limiting . . . . . . .299 Configuration notes and feature limitations . . . . . . . . . . . . . .299 Configuring rate limiting for BUM traffic. . . . . . . . . . . . . . . . . .299 Viewing rate limits set on BUM traffic . . . . . . . . . . . . . . . . . . .300 Index Brocade ICX 6650 Security Configuration Guide xiii 53-1002601-01
Resumen del contenido incluido en la página 14
xiv Brocade ICX 6650 Security Configuration Guide 53-1002601-01
Resumen del contenido incluido en la página 15
About This Document The Brocade ICX 6650 is a ToR (Top of Rack) Ethernet switch for campus LAN and classic Ethernet data center environments. Audience This document is designed for system administrators with a working knowledge of Layer 2 and Layer 3 switching and routing. If you are using a Brocade Layer 3 Switch, you should be familiar with the following protocols if applicable to your network: IP, RIP, OSPF, BGP, ISIS, PIM, and VRRP. Supported hardware and software This document is specifi
Resumen del contenido incluido en la página 16
Brocade ICX 6650 slot and port numbering • Slot 2 is located on the back of the Brocade ICX 6650 device and contains ports 1 through 3 on the top row and port 4 on the bottom row. These ports are 2x40 GbE QSFP+. Refer to the following figure. Slot 2 Slot 2 Slot 3 • Slot 3 is located on the back of the Brocade ICX 6650 device and contains ports 1 through 8. These ports are 4 x 10 GbE breakout ports and require the use of a breakout cable. Refer to the previous figure. How this document is org
Resumen del contenido incluido en la página 17
Brocade ICX 6650 slot and port numbering Document conventions This section describes text formatting conventions and important notice formats used in this document. Text formatting The narrative-text formatting conventions that are used are as follows: bold text Identifies command names Identifies the names of user-manipulated GUI elements Identifies keywords and operands Identifies text to enter at the GUI or CLI italic text Provides emphasis Identifies variables Identifies paths and Internet
Resumen del contenido incluido en la página 18
Brocade ICX 6650 slot and port numbering ATTENTION An Attention statement indicates potential damage to hardware or data. CAUTION A Caution statement alerts you to situations that can be potentially hazardous to you or cause damage to hardware, firmware, software, or data. DANGER A Danger statement indicates conditions or situations that can be potentially lethal or extremely hazardous to you. Safety labels are also attached directly to products to warn of these conditions or situations. Noti
Resumen del contenido incluido en la página 19
Brocade ICX 6650 slot and port numbering • Brocade ICX 6650 Diagnostic Reference • Unified IP MIB Reference • Ports-on-Demand Licensing for the Brocade ICX 6650 The latest versions of these guides are posted at http://www.brocade.com/ethernetproducts. Additional information This section lists additional Brocade and industry-specific documentation that you might find helpful. Brocade resources To get up-to-the-minute information, go to http://my.brocade.com to register at no cost for a user ID
Resumen del contenido incluido en la página 20
Brocade ICX 6650 slot and port numbering Document feedback Quality is our first concern at Brocade and we have made every effort to ensure the accuracy and completeness of this document. However, if you find an error or an omission, or you think that a topic needs further development, we want to hear from you. Forward your feedback to: documentation@brocade.com Provide the title and version number of the document and as much detail as possible about your comment, including the topic heading a
