Document Outline

• HP Procurve Series 4100GL Switches
  • Copyright and Disclaimer
  • Contents
    • Getting Started
    • Configuring Username and Password Security
    • TACACS+ Authentication
    • RADIUS Authentication and Accounting
    • Configuring Secure Shell (SSH)
    • Configuring Secure Socket Layer (SSL)
    • Configuring Port-Based Access Control (802.1x)
    • Configuring and Monitoring Port Security
    • Using Authorized IP Managers
  • Getting Started
    • Contents
    • Introduction
    • Overview of Access Security Features
    • Command Syntax Conventions
    • Simulating Display Output
      • Command Prompts
      • Screen Simulations
    • Related Publications
      • Product Notes and Software Update Information
      • Physical Installation and Initial Network Access
      • General Switch Management and Configuration
      • Command Line Interface Reference Guide
      • Release Notes
    • Getting Documentation From the Web
    • Sources for More Information
    • Need Only a Quick Start?
      • IP Addressing
      • To Set Up and Install the Switch in Your Network
  • 1. Configuring Username and Password Security
    • Contents
    • Overview
    • Configuring Local Password Security
      • Menu: Setting Passwords
        • To Delete Password Protection (Including Recovery from a Lost Password):
        • To Recover from a Lost Manager Password:
      • CLI: Setting Passwords and Usernames
        • Configuring Manager and Operator Passwords
        • To Remove Password Protection
      • Web: Setting Passwords and Usernames
        • To Configure (or Remove) Usernames and Passwords in the Web Browser Interface
  • 2. TACACS+ Authentication
    • Contents
    • Overview
    • Terminology Used in TACACS Applications:
    • General System Requirements
    • General Authentication Setup Procedure
    • Configuring TACACS+ on the Switch
      • Before You Begin
      • CLI Commands Described in this Section
      • Viewing the Switch’s Current Authentication Configuration
      • Viewing the Switch’s Current TACACS+ Server Contact Configuration
      • Configuring the Switch’s Authentication Methods
      • Configuring the Switch’s TACACS+ Server Access
        • Adding, Removing, or Changing the Priority of a TACACS+ Server
        • Configuring an Encryption Key
        • Configuring the Timeout Period
    • How Authentication Operates
      • General Authentication Process Using a TACACS+ Server
      • Local Authentication Process
      • Using the Encryption Key
        • General Operation
        • Encryption Options in the Switch
    • Controlling Web Browser Interface Access When Using TACACS+ Authentication
    • Messages Related to TACACS+ Operation
    • Operating Notes
  • 3. RADIUS Authentication and Accounting
    • Contents
    • Overview
      • Authentication
      • Accounting
    • Terminology
    • Switch Operating Rules for RADIUS
    • General RADIUS Setup Procedure
      • Preparation:
    • Configuring the Switch for RADIUS Authentication
      • Outline of the Steps for Configuring RADIUS Authentication
      • 1. Configure Authentication for the Access Methods You Want RADIUS To Protect
      • 2. Configure the Switch To Access a RADIUS Server
      • 3. Configure the Switch’s Global RADIUS Parameters
    • Local Authentication Process
    • Controlling Web Browser Interface Access When Using RADIUS Authentication
    • Configuring RADIUS Accounting
      • Operating Rules for RADIUS Accounting
      • Steps for Configuring RADIUS Accounting
        • 1. Configure the Switch To Access a RADIUS Server
        • 2. Configure Accounting Types and the Controls for Sending Reports to the RADIUS Server
        • 3. (Optional) Configure Session Blocking and Interim Updating Options
    • Viewing RADIUS Statistics
      • General RADIUS Statistics
      • RADIUS Authentication Statistics
      • RADIUS Accounting Statistics
    • Changing RADIUS-Server Access Order
    • Messages Related to RADIUS Operation
  • 4. Configuring Secure Shell (SSH)
    • Contents
    • Overview
      • Client Public Key Authentication (Login/Operator Level) with User Password Authentication (Enable/Manager Level)
      • Switch SSH and User Password Authentication
    • Terminology
    • Prerequisite for Using SSH
    • Public Key Formats
    • Steps for Configuring and Using SSH for Switch and Client Authentication
    • General Operating Rules and Notes
    • Configuring the Switch for SSH Operation
      • 1. Assigning a Local Login (Operator) and Enable (Manager) Password
        • To Configure Local Passwords
      • 2. Generating the Switch’s Public and Private Key Pair
        • To Generate or Erase the Switch’s Public/Private RSA Host Key Pair
      • 3. Providing the Switch’s Public Key to Clients
        • Displaying the Public Key
      • 4. Enabling SSH on the Switch and Anticipating SSH Client Contact Behavior
        • SSH Client Contact Behavior
        • To enable SSH on the switch
      • 5. Configuring the Switch for SSH Authentication
        • Option A: Configuring SSH Access for Password-Only SSH Authentication
        • Option B: Configuring the Switch for Client Public-Key SSH Authentication
      • 6. Use an SSH Client To Access the Switch
    • Further Information on SSH Client Public-Key Authentication
      • To Create a Client-Public-Key Text File
      • Replacing or Clearing the Public Key File
      • Enabling Client Public-Key Authentication
    • Messages Related to SSH Operation
  • 5. Configuring Secure Socket Layer (SSL)
    • Contents
    • Overview
      • Server Certificate authentication with User Password Authentication
    • Terminology
    • Prerequisite for Using SSL
    • Steps for Configuring and Using SSL for Switch and Client Authentication
    • General Operating Rules and Notes
    • Configuring the Switch for SSL Operation
      • 1. Assigning a Local Login (Operator) and Enable (Manager)Password
        • Using the web browser interface To Configure Local Passwords
      • 2. Generating the Switch’s Server Host Certificate
        • To Generate or Erase the Switch’s Server Certificate with the CLI
          • CLI commands used to generate a Server Host Certificate
        • Comments on certificate fields.
          • CLI Command to view host certificates
        • Generate a Self-Signed Host Certificate with the Web browser interface
        • Generate a CA-Signed server host certificate with the Web browser interface
      • 3. Enabling SSL on the Switch and Anticipating SSL Browser Contact Behavior
        • SSL Client Contact Behavior
        • Using the CLI interface to enable SSL
        • Using the web browser interface to enable SSL
    • Common Errors in SSL setup
  • 6. Configuring Port-Based Access Control (802.1x)
    • Contents
    • Overview
      • Why Use Port-Based Access Control?
      • General Features
        • Authenticating Users
        • Providing a Path for Downloading 802.1x Supplicant Software
        • Authenticating One Switch to Another
        • Accounting
    • How 802.1x Operates
      • Authenticator Operation
      • Switch-Port Supplicant Operation
    • Terminology
    • General Operating Rules and Notes
    • General Setup Procedure for Port-Based Access Control (802.1x)
      • Do These Steps Before You Configure 802.1x Operation
      • Overview: Configuring 802.1x Authentication on the Switch
    • Configuring Switch Ports as 802.1x Authenticators
      • 1. Enable 802.1x Authentication on Selected Ports
      • 3. Configure the 802.1x Authentication Method
      • 4. Enter the RADIUS Host IP Address(es)
      • 5. Enable 802.1x Authentication on the Switch
    • 802.1x Open VLAN Mode
      • Introduction
      • Use Models for 802.1x Open VLAN Modes
      • Operating Rules for Authorized-Client and Unauthorized-Client VLANs
      • Setting Up and Configuring 802.1x Open VLAN Mode
        • Preparation
        • Configuring General 802.1x Operation:
        • Configuring 802.1x Open VLAN Mode
        • Inspecting 802.1x Open VLAN Mode Operation
      • 802.1x Open VLAN Operating Notes
    • Option For Authenticator Ports: Configure Port-Security To Allow Only 802.1x Devices
    • Configuring Switch Ports To Operate As Supplicants for 802.1x Connections to Other Switches
      • Enabling a Switch Port To Operate as a Supplicant
      • Configuring a Supplicant Switch Port
    • Displaying 802.1x Configuration, Statistics, and Counters
      • Show Commands for Port-Access Authenticator
      • Viewing 802.1x Open VLAN Mode Status
      • Show Commands for Port-Access Supplicant
        • Note on Supplicant Statistics
    • How RADIUS/802.1x Authentication Affects VLAN Operation
      • Static VLAN Requirement
        • If the Port Used by the Client Is Not Configured as an Untagged Member of the Required Static VLAN
    • Messages Related to 802.1x Operation
  • 7. Configuring and Monitoring Port Security
    • Contents
    • Overview
    • Basic Operation
      • Default Port Security Operation
      • Intruder Protection
      • General Operation for Port Security
      • Blocking Unauthorized Traffic
      • Trunk Group Exclusion
    • Planning Port Security
    • Port Security Command Options and Operation
      • Retention of Static Addresses
        • Learned Addresses
        • Assigned/Authorized Addresses
      • Displaying Current Port Security Settings
        • Using the CLI To Display Port Security Settings
      • Configuring Port Security
        • Specifying Authorized Devices and Intrusion Responses
        • Adding an Authorized Device to a Port
        • Removing a Device From the “Authorized” List for a Port
    • Web: Displaying and Configuring Port Security Features
    • Reading Intrusion Alerts and Resetting Alert Flags
      • Notice of Security Violations
      • How the Intrusion Log Operates
      • Keeping the Intrusion Log Current by Resetting Alert Flags
        • Menu: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags
      • CLI: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags
        • Using the Event Log To Find Intrusion Alerts
          • From the CLI
          • From the Menu Interface:
          • For More Event Log Information
        • Web: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags
    • Operating Notes for Port Security
      • Identifying the IP Address of an Intruder
      • Proxy Web Servers
      • “Prior To” Entries in the Intrusion Log
      • Alert Flag Status for Entries Forced Off of the Intrusion Log
      • LACP Not Available on Ports Configured for Port Security
  • 8. Using Authorized IP Managers
    • Contents
    • Overview
    • Options
    • Access Levels
    • Defining Authorized Management Stations
      • Overview of IP Mask Operation
      • Menu: Viewing and Configuring IP Authorized Managers
        • Editing or Deleting an Authorized Manager Entry
      • CLI: Viewing and Configuring Authorized IP Managers
        • Listing the Switch’s Current Authorized IP Manager(s)
        • Configuring IP Authorized Managers for the Switch
          • To Authorize Manager Access
          • To Edit an Existing Manager Access Entry
          • To Delete an Authorized Manager Entry
    • Web: Configuring IP Authorized Managers
    • Building IP Masks
      • Configuring One Station Per Authorized Manager IP Entry
      • Configuring Multiple Stations Per Authorized Manager IP Entry
      • Additional Examples for Authorizing Multiple Stations
    • Operating Notes
  • Index
    • Numerics
    • A
    • C
    • D
    • E
    • I
    • L
    • M
    • O
    • P
    • Q
    • R
    • S
    • T
    • U
    • V
    • W