HP ProCurve 800 Handbuch

ProCurve Network Access

Controller 800

Hardware Installation Guide

Hewlett-Packard Company

8000 Foothills Boulevard, m/s 5551

Roseville, California 95747-5551

http://www.hp.com/networking

Hewlett-Packard Development Company, LP.

The information contained herein is subject to change

without notice.

Publication Number

5998-3237

March 2012

Applicable Products

• ProCurve Network Access Controller 800

J9065A

Trademark Credits

Microsoft®, Windows®, and Windows NT® are US

registered trademarks of Microsoft Corporation.

Adobe® and Acrobat® are trademarks of Adobe Systems

Incorporated. Java™ is a US trademark of Sun

Microsystems, Inc.

Software Credits

SSH on ProCurve Switches is based on the OpenSSH soft-

ware toolkit. This product includes software developed by

the OpenSSH Project for use in the OpenSSH Toolkit. For

more information on OpenSSH, visit

http:// www.openssh.com.

SSL on ProCurve Switches is based on the OpenSSL soft-

ware toolkit. This product includes software developed by

the OpenSSL Project for use in the OpenSSL Toolkit. For

more information on OpenSSL, visit

http://www.openssl.org.

This product includes cryptographic software written by

Eric Young (eay@cryptsoft.com). This product includes

software written by Tim Hudson ([email protected])

Disclaimer

HEWLETT-PACKARD COMPANY MAKES NO WARRANTY

OF ANY KIND WITH REGARD TO THIS MATERIAL,

INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

WARRANTIES OF MERCHANTABILITY AND FITNESS

FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not

be liable for errors contained herein or for incidental or

consequential damages in connection with the furnishing,

performance, or use of this material.

The only warranties for HP products and services are set

forth in the express warranty statements accompanying

such products and services. Nothing herein should be

construed as constituting an additional warranty. HP shall

not be liable for technical or editorial errors or omissions

contained herein.

Hewlett-Packard assumes no responsibility for the use or

reliability of its software on equipment that is not furnished

by Hewlett-Packard.

Warranty

See the Customer Support/Warranty booklet included with

the product.

A copy of the specific warranty terms applicable to your

Hewlett-Packard products and replacement parts can be

obtained from your HP Sales and Service Office or

authorized dealer.

Safety

Before installing and operating this product, please read the

“Installation Precautions:” beginning on page 2-3 and the

safety statements in the “Safety and EMC Regulatory

Statements” beginning on page A-1.

iii

Contents

1 Introduction

ProCurve Network Access Controller 800 . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1

The ProCurve NAC 800 Endpoint Integrity Solution . . . . . . . . . . . . . . 1-2

802.1X . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3

Inline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3

DHCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3

2 Quick Install

Quick Install Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1

Included Parts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2

Installation Precautions: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3

Hardware Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4

Physical . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4

Electrical . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4

Environmental . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4

Acoustic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4

Connectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4

Safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4

Installing the Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-5

1. Prepare the Installation Site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-5

2. Mount the Unit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-6

Rack Mounting the ProCurve NAC 800 . . . . . . . . . . . . . . . . . . . . . . 2-6

Horizontal Surface Mounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-8

3. Connect the Unit to a Power Source . . . . . . . . . . . . . . . . . . . . . . . . . 2-8

4. Connect the Network Cables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-9

5. (Optional) Connect a Console to the Appliance . . . . . . . . . . . . . . . . 2-9

Terminal Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-10

6. Initial Appliance Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-11

Configuring via the Front LCD Display . . . . . . . . . . . . . . . . . . . . . 2-12

A Safety and EMC Regulatory Statements

Safety Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-1

Informations concernant la sécurité . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-2

Hinweise zur Sicherheit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-3

Considerazioni sulla sicurezza . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-4

Consideraciones sobre seguridad . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-5

Safety Information (Japan) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-6

Safety Information (China) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-7

EMC Regulatory Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-8

U.S.A. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-8

Canada . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-8

Australia/New Zealand . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-8

Japan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-8

Korea . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-9

Taiwan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-9

B Recycle Statements

Waste Electrical and Electronic Equipment (WEEE) Statements . . . . . . B-1

Index

1-1

Introduction

ProCurve Network Access Controller 800

Introduction

ProCurve Network Access Controller

800

The ProCurve Network Access Controller 800 (ProCurve NAC 800) provides

a complete solution for managing network access at the network edge. When

used with the ProCurve Manager (PCM) and ProCurve Identity Driven

Manager (IDM) products, you get a single, centralized network management

tool, that lets you secure your network from unauthorized access.

The ProCurve Network Access Controller is comprised of:

• A Linux-based server, with FreeRADIUS software

• ProCurve Identity Driven Manager (IDM) Agent

• ProCurve Network Access Control Endpoint Integrity software

Note Two additional items are required to enable endpoint integrity functionality:

• A ProCurve NAC Endpoint Integrity Agent License

• A ProCurve NAC Implementation Start-up Service, from an autho-

rized ProCurve partner or ProCurve.

This configuration allows you to deploy the appliance in any of the following

methods, to meet your network security needs:

• As a complete access control solution, including a RADIUS server,

with Endpoint Integrity (EI) enforcement, and IDM agent for use with

the PCM and IDM applications

• As a RADIUS server and Endpoint Integrity solution, independent of

PCM and IDM applications.

• As a RADIUS server with the IDM Agent, to provide user authentica-

tion and user-based access control to network resources

• As a standalone RADIUS server, using the LINUX-based freeRADIUS

software pre-installed on the appliance.

1-2

Introduction

ProCurve Network Access Controller 800

Introduction

The ProCurve NAC 800 appliance is fully integrated into the ProCurve Manage-

ment software. Once installed on a network with PCM, the appliance will be

discovered by PCM and you can access the ProCurve NAC management and

configuration application via the PCM and IDM windows.

The ProCurve NAC 800 Endpoint Integrity Solution

Due to the complexity of the configuration options available with the full

ProCurve NAC 800 Endpoint Integrity (EI) solution, ProCurve requires an

implementation service to ensure successful deployment. Please contact your

Authorized ProCurve reseller, or HP ProCurve Support for information on

ordering the ProCurve NAC 800 Endpoint Integrity Implementation service.

The following section provides a brief overview of the options available for

deployment of the endpoint integrity solution.

When utilizing the Endpoint Integrity features of the ProCurve NAC 800, you

can deploy a single ProCurve NAC 800 appliance with endpoint integrity

management and enforcement capabilities. You can also install multiple

ProCurve NAC 800 appliances as Enforcement servers (ESs) across a network

and manage them from one central ProCurve NAC 800 appliance configured

as a Management server (MS). Deploying the appliance in such “clusters”

provides improved performance and redundancy of the RADIUS servers.

The ProCurve NAC Management Server (MS) specifies the enforcement

method (802.1X, inline, or DHCP), how often the end-user clients are retested,

the tests run on the end-user clients, and how to control the end-user clients’

access. The ProCurve NAC Enforcement Servers detect and test end-user

clients on the network for compliance.

1-3

Introduction

ProCurve Network Access Controller 800

Introduction

You can deploy each ProCurve NAC endpoint integrity cluster in one of the

following configurations.

802.1X

When deploying ProCurve NAC in an 802.1X environment, you must install it

where it can communicate with the Remote Authentication Dial-In User

Service (RADIUS) server (or, use the built-in RADIUS server on the ProCurve

NAC 800). The RADIUS server communicates with the 802.1X authenticator,

which performs the quarantining by moving ports or MAC addresses in and

out of virtual local area networks (VLANs).

Inline

When deploying ProCurve NAC inline, it monitors and enforces all client

traffic. When ProCurve NAC is deployed as a single-server installation, it

works as a Layer 2 bridge that requires no changes to the network configura-

tion settings. When ProCurve NAC is installed in a multiple-server installation,

you need to configure the switch that connects the ProCurve NAC Enforce-

ment servers to use Spanning Tree Protocol (STP) if STP is not already

configured.

ProCurve NAC allows clients to access the network, or blocks clients from

accessing the network based on their Internet Protocol (IP) address with a

built-in firewall (iptables).

DHCP

When deploying a ProCurve NAC appliance inline with a Dynamic Host

Configuration Protocol (DHCP) server, all DHCP requests pass through the

ProCurve NAC appliance’s Layer 2 bridge. For a quarantined client, the

ProCurve NAC appliance distributes a quarantined IP address for the client.

ProCurve NAC assigns a DHCP IP address based on the quarantine area

parameters you define during configuration.

If the ProCurve NAC appliance allows the client to have access, it allows your

real DHCP server to distribute a non-quarantined IP address. You can place

restrictions on network access either at the gateway for the client using

Access Control Lists (ACLs), or on the client by removing the client’s gateway

and adding static routes for accessible networks.

(This page intentionally left blank)

2-1

Quick Install

The ProCurve Network Access Controller 800 appliance is easy to install. It

comes with an accessory kit that includes the brackets for mounting the box

in a standard 19-inch telco rack or in an equipment cabinet, and with rubber

feet that can be attached so the appliance can be securely located on a

horizontal surface. The brackets are designed to allow it to be mounted in a

variety of locations and orientations. This chapter shows how to install the

appliance (also referred to here as ‘the unit’).

Quick Install Summary

Follow these steps to install the ProCurve NAC 800. The rest of this chapter

provides details on these steps.

1. Prepare the installation site (page 2-5). Ensure the physical envi-

ronment is properly prepared, including having the correct network

cabling ready to connect to the unit and having an appropriate location

for the unit. Please see page 2-3 for some installation precautions.

2. Mount the appliance (page 2-6). The ProCurve NAC 800 appliance

can be mounted in a 19-inch telco rack, in an equipment cabinet, or on a

horizontal surface.

3. Connect power to the appliance (page 2-8). Once the unit is

mounted, plug it into the nearby main power source.

4. Connect the network cables (page 2-9). Using the appropriate

network cables, connect the unit to the network.

5. Connect a console to the appliance (optional—page 2-9). You may

wish to modify the ProCurve NAC 800 configuration, for example, to

configure an IP address so it can be managed using a Web browser, from

an SNMP network management station, or through a Telnet session.

Configuration changes can easily be made by using the included console

cable to connect a PC to the unit’s console port.

6. Perform the initial appliance configuration (page 2-11). Use the

front panel LCD to set the appliance’s IP address and server type.

2-2

Quick Install

Quick Install Summary

Quick Install

At this point, the unit is fully installed. See the rest of this chapter if you need

more detailed information on any of these installation steps.

Included Parts

The ProCurve NAC 800 appliance (J9065A) has the following components

shipped with it:

■Console cable, DB-9 to RJ45 (5188-6699)

■Accessory kit for ProCurve NAC 800 (5069-5705), which includes:

– two mounting brackets

– eight 8mm Machine Screws screws to attach the mounting brackets to

the unit

– four 5/8-inch number 12-24 screws to attach the unit to a rack

– four rubber feet for horizontal mounting on flat surface

■ProCurve Network Access Controller 800 Hardware Installation Guide,

this manual (5998-3237).

■Customer Support/Warranty booklet (5990-8862)

■Power cord, one of the following:

Japan Power

Cord Warning

For additional configuration information and user instructions, PDF versions

of the documentation for the ProCurve Network Access Controller 800 appli-

ance, including the Users’ Guide, and this Installation Guide are available on

the Web at:

http://www.hp.com/rnd/support/manuals

Australia/New Zealand

China

Continental Europe

Denmark

India

Israel

Japan

Switzerland

South Africa

Taiwan

Thailand

United Kingdom/Hong Kong/

United States/Canada/Mexico

8121-0838

8121-0910

8120-8861

8120-8930

8121-0780

8121-1035

8120-4753

8121-0908

8120-8929

8121-0974

8121-0673

8121-0909

8121-0921

Inhaltsverzeichnis

Andere HP Controller Handbücher

HP Aruba 7024 Benutzerhandbuch

HP ProCurve MSM710 Bedienungsanleitung

HP 30242 Handbuch

HP Smart Array P711m Gebrauchsanweisung

HP P Class 450/500/550/600/650/700/750 Bedienungsanleitung

HP ProCurve MSM760 Bedienungsanleitung

HP 9000 Series 300 Bedienungsanleitung

HP 166207-B21 - Smart Array 5302/32 RAID... Bedienungsanleitung

HP A9890A - Smart Array 6402/128 RAID... Bedienungsanleitung

HP MSM720 Bedienungsanleitung

HP StorageWorks P2000 Bedienungsanleitung

HP 273914-B21 - Smart Array 6404/256 RAID... Bedienungsanleitung

HP HSG80 - StorageWorks RAID Array Controller Handbuch

HP Compaq Presario,Presario 4400 Leitfaden

HP MSM775 zl Bedienungsanleitung

HP HSG80 - StorageWorks RAID Array Controller Bedienungsanleitung

HP netRAID-1M Bedienungsanleitung

HP StorageWorks ESL E Series Bedienungsanleitung

HP StorageWorks 2312 Bedienungsanleitung

HP P420 Bedienungsanleitung

HP MSM7XX Bedienungsanleitung

HP ProCurve MSM750 Bedienungsanleitung

HP Smart Array P212 Bedienungsanleitung

HP HPE MR Gen11 Bedienungsanleitung

Beliebte Controller Handbücher anderer Marken

Digiplex

Digiplex DGP-848 Betriebsanleitung

YASKAWA

YASKAWA SGM series Bedienungsanleitung

Sinope

Sinope Calypso RM3500ZB Bedienungsanleitung

Isimet

Isimet DLA Series Style 2 Installationshandbuch

LSIS

LSIS sv-ip5a Bedienungsanleitung

Airflow

Airflow Uno hab Bedienungsanleitung

ABB

ABB ACS580-01 drives Bedienungsanleitung

Panasonic

Panasonic GM1 Series Bedienungsanleitung

Emerson

Emerson SW93 Bedienungsanleitung

AutoAqua

AutoAqua Smart ATO micro SATO-120P Bedienungsanleitung

Panasonic

Panasonic FP? Positioning Unit RTEX Bedienungsanleitung

Alpha IP

Alpha IP MIOB 21001 Bedienungsanleitung

Siemens

Siemens OpenAir GMA 1 Series Bedienungsanleitung

Surecom

Surecom SR-629 Bedienungsanleitung

Regulus

Regulus SRS1 T Bedienungsanleitung

3M MicroTouch EX113 Bedienungsanleitung

KUHN

KUHN TKS Bedienungsanleitung

S&C

S&C PMH Bedienungs- und Wartungshandbuch