Document Outline

• Access Security Guide cover.pdf
• !Value_Line-Security-12_2008.pdf
  • ProCurve Switch 2600 Series Switch 2600-PWR Series Switch 2800 Series Switch 4100gl Series Switch 6108
    • Product Documentation
    • Getting Started
      • Contents
      • Introduction
      • Overview of Access Security Features
        • Management Access Security Protection
        • General Switch Traffic Security Guidelines
      • Conventions
        • Feature Descriptions by Model
        • Command Syntax Statements
        • Command Prompts
        • Screen Simulations
        • Port Identity Examples
      • Sources for More Information
      • Need Only a Quick Start?
        • IP Addressing
        • To Set Up and Install the Switch in Your Network
    • Configuring Username and Password Security
      • Contents
      • Overview
      • Configuring Local Password Security
        • Menu: Setting Passwords
        • CLI: Setting Passwords and Usernames
        • Web: Setting Passwords and Usernames
      • Front-Panel Security
        • When Security Is Important
        • Front-Panel Button Functions
          • Clear Button
          • Reset Button
          • Restoring the Factory Default Configuration
        • Configuring Front-Panel Security
          • Disabling the Clear Password Function of the Clear Button on the Switch’s Front Panel
          • Re-Enabling the Clear Button on the Switch’s Front Panel and Setting or Changing the “Reset-On-Clear” Operation
          • Changing the Operation of the Reset+Clear Combination
        • Password Recovery
          • Disabling or Re-Enabling the Password Recovery Process
        • Password Recovery Process
    • Web and MAC Authentication for the Series 2600/2600-PWR and 2800 Switches
      • Contents
      • Overview
        • Client Options
        • General Features
      • How Web and MAC Authentication Operate
        • Authenticator Operation
          • Web-based Authentication
          • MAC-based Authentication
      • Terminology
      • Operating Rules and Notes
      • General Setup Procedure for Web/MAC Authentication
        • Do These Steps Before You Configure Web/MAC Authentication
        • Additional Information for Configuring the RADIUS Server To Support MAC Authentication
      • Configuring the Switch To Access a RADIUS Server
      • Configuring Web Authentication
        • Overview
        • Configure the Switch for Web-Based Authentication
      • Configuring MAC Authentication on the Switch
        • Overview
        • Configure the Switch for MAC-Based Authentication
      • Show Status and Configuration of Web-Based Authentication
      • Show Status and Configuration of MAC-Based Authentication
      • Show Client Status
    • TACACS+ Authentication
      • Contents
      • Overview
      • Terminology Used in TACACS Applications:
      • General System Requirements
      • General Authentication Setup Procedure
      • Configuring TACACS+ on the Switch
        • Before You Begin
        • CLI Commands Described in this Section
        • Viewing the Switch’s Current Authentication Configuration
        • Viewing the Switch’s Current TACACS+ Server Contact Configuration
        • Configuring the Switch’s Authentication Methods
        • Configuring the Switch’s TACACS+ Server Access
      • How Authentication Operates
        • General Authentication Process Using a TACACS+ Server
        • Local Authentication Process
        • Using the Encryption Key
          • General Operation
          • Encryption Options in the Switch
      • Controlling Web Browser Interface Access When Using TACACS+ Authentication
      • Messages Related to TACACS+ Operation
      • Operating Notes
    • RADIUS Authentication and Accounting
      • Contents
      • Overview
      • Terminology
      • Switch Operating Rules for RADIUS
      • General RADIUS Setup Procedure
      • Configuring the Switch for RADIUS Authentication
        • Outline of the Steps for Configuring RADIUS Authentication
        • 1. Configure Authentication for the Access Methods You Want RADIUS To Protect
        • 2. Configure the Switch To Access a RADIUS Server
        • 3. Configure the Switch’s Global RADIUS Parameters
      • Local Authentication Process
      • Controlling Web Browser Interface Access When Using RADIUS Authentication
      • Configuring RADIUS Accounting
        • Operating Rules for RADIUS Accounting
        • Steps for Configuring RADIUS Accounting
          • 1. Configure the Switch To Access a RADIUS Server
          • 2. Configure Accounting Types and the Controls for Sending Reports to the RADIUS Server
          • 3. (Optional) Configure Session Blocking and Interim Updating Options
      • Viewing RADIUS Statistics
        • General RADIUS Statistics
        • RADIUS Authentication Statistics
        • RADIUS Accounting Statistics
      • Changing RADIUS-Server Access Order
      • Messages Related to RADIUS Operation
    • Configuring Secure Shell (SSH)
      • Contents
      • Overview
      • Terminology
      • Prerequisite for Using SSH
      • Public Key Formats
      • Steps for Configuring and Using SSH for Switch and Client Authentication
      • General Operating Rules and Notes
      • Configuring the Switch for SSH Operation
        • 1. Assign Local Login (Operator) and Enable (Manager) Password
        • 2. Generate the Switch’s Public and Private Key Pair
        • 3. Provide the Switch’s Public Key to Clients
        • 4. Enable SSH on the Switch and Anticipate SSH Client Contact Behavior
        • 5. Configure the Switch for SSH Authentication
        • 6. Use an SSH Client To Access the Switch
      • Further Information on SSH Client Public-Key Authentication
      • Messages Related to SSH Operation
    • Configuring Secure Socket Layer (SSL)
      • Contents
      • Overview
      • Terminology
      • Prerequisite for Using SSL
      • Steps for Configuring and Using SSL for Switch and Client Authentication
      • General Operating Rules and Notes
      • Configuring the Switch for SSL Operation
        • 1. Assign Local Login (Operator) and Enable (Manager) Password
        • 2. Generate the Switch’s Server Host Certificate
          • To Generate or Erase the Switch’s Server Certificate with the CLI
          • Comments on Certificate Fields.
          • Generate a Self-Signed Host Certificate with the Web browser interface
          • Generate a CA-Signed server host certificate with the Web Browser Interface
        • 3. Enable SSL on the Switch and Anticipate SSL Browser Contact Behavior
          • Using the CLI interface to enable SSL
          • Using the web browser interface to enable SSL
      • Common Errors in SSL Setup
    • Configuring Port-Based Access Control (802.1X)
      • Contents
      • Overview
        • Why Use Port-Based Access Control?
        • General Features
      • How 802.1X Operates
        • Authenticator Operation
        • Switch-Port Supplicant Operation
      • Terminology
      • General Operating Rules and Notes
      • General Setup Procedure for Port-Based Access Control (802.1X)
        • Do These Steps Before You Configure 802.1X Operation
        • Overview: Configuring 802.1X Authentication on the Switch
      • Configuring Switch Ports as 802.1X Authenticators
        • 1. Enable 802.1X Authentication on Selected Ports
        • 3. Configure the 802.1X Authentication Method
        • 4. Enter the RADIUS Host IP Address(es)
        • 5. Enable 802.1X Authentication on the Switch
      • 802.1X Open VLAN Mode
        • Introduction
        • Use Models for 802.1X Open VLAN Modes
        • Operating Rules for Authorized-Client and Unauthorized-Client VLANs
        • Setting Up and Configuring 802.1X Open VLAN Mode
        • 802.1X Open VLAN Operating Notes
      • Option For Authenticator Ports: Configure Port-Security To Allow Only 802.1X Devices
      • Configuring Switch Ports To Operate As Supplicants for 802.1X Connections to Other Switches
      • Displaying 802.1X Configuration, Statistics, and Counters
        • Show Commands for Port-Access Authenticator
        • Viewing 802.1X Open VLAN Mode Status
        • Show Commands for Port-Access Supplicant
      • How RADIUS/802.1X Authentication Affects VLAN Operation
      • Messages Related to 802.1X Operation
    • Configuring and Monitoring Port Security
      • Contents
      • Overview
        • Basic Operation
        • Blocking Unauthorized Traffic
        • Trunk Group Exclusion
      • Planning Port Security
      • Port Security Command Options and Operation
        • Retention of Static MAC Addresses
          • Learned MAC Addresses
          • Assigned/Authorized MAC Addresses
          • Removing Learned and Assigned Static MAC Addresses
        • Displaying Current Port Security Settings
        • Configuring Port Security
          • Specifying Authorized Devices and Intrusion Responses
          • Adding a MAC Address to an Existing Port List
      • MAC Lockdown
        • Differences Between MAC Lockdown and Port Security
          • MAC Lockdown Operating Notes
        • Deploying MAC Lockdown
      • MAC Lockout
        • Port Security and MAC Lockout
      • IP Lockdown
        • Operating Rules for IP Lockdown
        • Using the IP Lockdown Command
      • Web: Displaying and Configuring Port Security Features
      • Reading Intrusion Alerts and Resetting Alert Flags
        • Notice of Security Violations
        • How the Intrusion Log Operates
        • Keeping the Intrusion Log Current by Resetting Alert Flags
          • Menu: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags
          • CLI: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags
        • Using the Event Log To Find Intrusion Alerts
        • Web: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags
      • Operating Notes for Port Security
    • Traffic/Security Filters (ProCurve Series 2600/2600-PWR and 2800 Switches)
      • Contents
      • Overview
      • Using Source-Port Filters
        • Operating Rules for Source-Port Filters
        • Configuring a Source-Port Filter
        • Viewing a Source-Port Filter
        • Filter Indexing
        • Editing a Source-Port Filter
        • Using Named Source-Port Filters
          • Operating Rules for Named Source-Port Filters
          • Defining and Configuring Named Source-Port Filters
          • Viewing a Named Source-Port Filter
          • Sample Configuration for Named Source-Port Filters
    • Using Authorized IP Managers
      • Contents
      • Overview
        • Configuration Options
      • Access Levels
      • Defining Authorized Management Stations
        • Overview of IP Mask Operation
        • Menu: Viewing and Configuring IP Authorized Managers
        • CLI: Viewing and Configuring Authorized IP Managers
          • Listing the Switch’s Current Authorized IP Manager(s)
          • Configuring IP Authorized Managers for the Switch
      • Web: Configuring IP Authorized Managers
      • Building IP Masks
        • Configuring One Station Per Authorized Manager IP Entry
        • Configuring Multiple Stations Per Authorized Manager IP Entry
        • Additional Examples for Authorizing Multiple Stations
      • Operating Notes
        • Numerics
        • A
        • C
        • D
        • E
        • F
        • G
        • I
        • K
        • L
        • M
        • O
        • P
        • Q
        • R
        • S
        • T
        • U
        • V
        • W