ページ1に含まれる内容の要旨
ProCurve Switches
Access Security Guide
Switch 2600 Series
Switch 2600-PWR Series
Switch 2800 Series
Switch 4100 Series
Switch 6108 Series
ページ2に含まれる内容の要旨
ページ3に含まれる内容の要旨
ProCurve Switch 2600 Series Switch 2600-PWR Series Switch 2800 Series Switch 4100gl Series Switch 6108 December 2008 Access Security Guide
ページ4に含まれる内容の要旨
© Copyright 2001-2008 Hewlett-Packard Company, L..P. Disclaimer The information contained herein is subject to change without HEWLETT-PACKARD COMPANY MAKES NO WARRANTY notice. OF ANY KIND WITH REGARD TO THIS MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS Publication Number FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not 5990-6024 be liable for errors contained herein or for incidental or December 2008 consequential damages in connection
ページ5に含まれる内容の要旨
Contents Product Documentation About Your Switch Manual Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi Feature Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xii 1 Getting Started Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
ページ6に含まれる内容の要旨
Front-Panel Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-7 When Security Is Important . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-7 Front-Panel Button Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-8 Configuring Front-Panel Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-10 Password Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
ページ7に含まれる内容の要旨
4 TACACS+ Authentication Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2 Terminology Used in TACACS Applications: . . . . . . . . . . . . . . . . . . . . . . . . 4-3 General System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-5 General Authentication Setup Pr
ページ8に含まれる内容の要旨
1. Configure Authentication for the Access Methods You Want RADIUS To Protect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-8 2. Configure the Switch To Access a RADIUS Server . . . . . . . . . . . . 5-10 3. Configure the Switch’s Global RADIUS Parameters . . . . . . . . . . . 5-12 Local Authentication Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-16 Controlling Web Browser Interface Access When Using
ページ9に含まれる内容の要旨
6. Use an SSH Client To Access the Switch . . . . . . . . . . . . . . . . . . . . . 6-21 Further Information on SSH Client Public-Key Authentication . . . . . . . . 6-21 Messages Related to SSH Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-27 7 Configuring Secure Socket Layer (SSL) Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
ページ10に含まれる内容の要旨
Configuring Switch Ports as 802.1X Authenticators . . . . . . . . . . . . . . . . . 8-15 1. Enable 802.1X Authentication on Selected Ports . . . . . . . . . . . . . . 8-15 3. Configure the 802.1X Authentication Method . . . . . . . . . . . . . . . . . 8-19 4. Enter the RADIUS Host IP Address(es) . . . . . . . . . . . . . . . . . . . . . . 8-20 5. Enable 802.1X Authentication on the Switch . . . . . . . . . . . . . . . . . 8-20 802.1X Open VLAN Mode . . . . . . . . . . . . . . . . . . . . . .
ページ11に含まれる内容の要旨
MAC Lockdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-17 Differences Between MAC Lockdown and Port Security . . . . . . . . . 9-19 Deploying MAC Lockdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-21 MAC Lockout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-25 Port Security and MAC Lockout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-27 IP
ページ12に含まれる内容の要旨
Defining Authorized Management Stations . . . . . . . . . . . . . . . . . . . . . . . . . 11-4 Overview of IP Mask Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-4 Menu: Viewing and Configuring IP Authorized Managers . . . . . . . . . 11-5 CLI: Viewing and Configuring Authorized IP Managers . . . . . . . . . . . 11-6 Web: Configuring IP Authorized Managers . . . . . . . . . . . . . . . . . . . . . . . . . 11-9 Building IP Masks . . . . . . . . . . . . . . . . . . . . .
ページ13に含まれる内容の要旨
Product Documentation About Your Switch Manual Set The switch manual set includes the following: ■ Read Me First - a printed guide shipped with your switch. Provides software update information, product notes, and other information. ■ Installation and Getting Started Guide - a printed guide shipped with your switch. This guide explains how to prepare for and perform the physical installation and connection to your network. ■ Management and Configuration Guide - included as a PDF file on the
ページ14に含まれる内容の要旨
Product Documentation Feature Index For the manual set supporting your switch model, the following feature index indicates which manual to consult for information on a given software feature. (Note that some software features are not supported on all switch models.) Feature Management and Advanced Traffic Access Security Configuration Management Guide 802.1Q VLAN Tagging - X - 802.1X Port-Based Priority X - - Authentication -- X Authorized IP Managers - - X Config File X -- Copy Command X - -
ページ15に含まれる内容の要旨
Product Documentation Feature Management and Advanced Traffic Access Security Configuration Management Guide LACP X -- Link X - - LLDP X -- MAC Address Management X - - MAC Lockdown - - X MAC Lockout - - X MAC-based Authentication - - X Monitoring and Analysis X - - Multicast Filtering - X - Network Management Applications (LLDP, SNMP) X - - Passwords - - X Ping X - - Port Configuration X -- Port Security - - X Port Status X -- Port Trunking (LACP) X - - Port-Based Access Control - - X Port-Bas
ページ16に含まれる内容の要旨
Product Documentation Feature Management and Advanced Traffic Access Security Configuration Management Guide Source-Port Filters - - X Spanning Tree (STP, RSTP, MSTP) - X - SSH (Secure Shell) Encryption - - X SSL (Secure Socket Layer) - - X Stack Management (Stacking) - X - Syslog X - - System Information X -- TACACS+ Authentication - - X Telnet Access X -- TFTP X - - Time Protocols (TimeP, SNTP) X -- Traffic/Security Filters - - X Troubleshooting X -- VLANs - X - Web-based Authentication - - X
ページ17に含まれる内容の要旨
1 Getting Started Contents Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2 Overview of Access Security Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2 Management Access Security Protection . . . . . . . . . . . . . . . . . . . . . . . . 1-3 General Switch Traffic Security Guidelines . . . . . . . . . . . . . . . . . . . . . . 1-4 Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
ページ18に含まれる内容の要旨
Getting Started Introduction Introduction This Access Security Guide describes how to use ProCurve’s switch security features to protect access to your switch. This guide is intended to support the following switches: ■ ProCurve Series 2600 ■ ProCurve Series 2600-PWR ■ ProCurve Series 2800 ■ ProCurve Series 4100gl ■ ProCurve Switch 6108 For an overview of other product documentation for the above switches, refer to “Product Documentation” on page xi. The Product Documentation CD-ROM shipped w
ページ19に含まれる内容の要旨
Getting Started Overview of Access Security Features ■ Secure Socket Layer (SSL) (page 7-1): Provides remote web access to the switch via encrypted authentication paths between the switch and management station clients capable of SSL/TLS operation. ■ Port-Based Access Control (802.1X) (page 8-1): On point-to-point connections, enables the switch to allow or deny traffic between a port and an 802.1X-aware device (supplicant) attempting to access the switch. Also enables the switch to opera
ページ20に含まれる内容の要旨
Getting Started Overview of Access Security Features Table 1-1. Management Access Security Protection Security Feature Offers Protection Against Unauthorized Client Access to Offers Protection Switch Management Features Against Unauthorized Client Connection Telnet SNMP Web SSH Access to the (Net Mgmt) Browser Client Network Local Manager and Operator PtP: Yes No Yes Yes No 1 Usernames and Passwords Remote: Yes No Yes Yes No 1 TACACS+ PtP: Yes No No Yes No Remote: Yes No No Yes No 1 RADIUS
