HP ProCurve Series 2600 Bedienungsanleitung

hp procurve

switch 2600 series

switch 2800 series

switch 4100 series

switch 6108

access security guide

www.hp.com/go/hpprocurve

HP ProCurve

Switch 2600 Series

Switch 2800 Series

Switch 4100GL Series

Switch 6108

Access Security Guide

August 2003

mation contained herein is subject to change without notice.

Publication Number

5990-6024

August 2003

Edition 1

Applicable Products

HP ProCurve Switch 2626 (J4900A)

HP ProCurve Switch 2650 (J4899A)

HP ProCurve Switch 2824 (J4903A)

HP ProCurve Switch 2848 (J4904A)

HP ProCurve Switch 4104GL (J4887A)

HP ProCurve Switch 4108GL (J4865A)

HP ProCurve Switch 6108 (J4902A)

Trademark Credits

Windows NT®, Windows®, and MS Windows® are US

registered trademarks of Microsoft Corporation.

Software Credits

SSH on HP ProCurve Switches is based on the OpenSSH

software toolkit. This product includes software developed

by the OpenSSH Project for use in the OpenSSH Toolkit. For

more information on OpenSSH, visit http://

www.openssh.com.

SSL on HP ProCurve Switches is based on the OpenSSL

software toolkit. This product includes software developed

by the OpenSSL Project for use in the OpenSSL Toolkit. For

more information on OpenSSL, visit

http://www.openssl.org.

This product includes cryptographic software written by

Eric Young ([email protected])

This product includes software written by Tim Hudson

(tjh@cryptsoft.com)

Disclaimer

HEWLETT-PACKARD COMPANY MAKES NO WARRANTY

OF ANY KIND WITH REGARD TO THIS MATERIAL,

INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

WARRANTIES OF MERCHANTABILITY AND FITNESS

FORA PARTICULAR PURPOSE. Hewlett-Packard shall not

be liable for errors contained herein or for incidental or

consequential damages in connection with the furnishing,

performance, or use of this material.

Hewlett-Packard Company shall not be liable for technical

or editorial errors or omissions contained herein. The

information is provided "as is" without warranty of any kind

and is subject to change without notice. The warranties for

Hewlett-Packard Company products are set forth in the

express limited warranty statements for such products.

Nothing herein should be construed as constituting an

additional warranty.

Hewlett-Packard assumes no responsibility for the use or

reliability of its software on equipment that is not furnished

by Hewlett-Packard.

Warranty

See the Customer Support/Warranty booklet included with

the product.

A copy of the specific warranty terms applicable to your

Hewlett-Packard products and replacement parts can be

obtained from your HP Sales and Service Office or

authorized dealer.

Hewlett-Packard Company€

8000 Foothills Boulevard, m/s 5551€

Roseville, California 95747-5551€

http://www.hp.com/go/hpprocurve ii€

Contents

1 Getting Started

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1€

Introduction and Applicable Switches . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2€

About the Feature Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2€

Overview of Access Security Features . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3€

CommandSyntax Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5€

Simulating Display Output . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5€

Command Prompts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5€

Screen Simulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-6€

Port Identity Convention for Examples . . . . . . . . . . . . . . . . . . . . . . . . . 1-6€

Related Publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-6€

Getting Documentation From the Web . . . . . . . . . . . . . . . . . . . . . . . . . . 1-8€

Sources for More Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-9€

Need Onlya Quick Start? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-10€

To Set Up and Install the Switch in Your Network . . . . . . . . . . . . . . 1-10€

2 Configuring Username and Password Security

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1€

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2€

Configuring Local Password Security . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4€

Menu: Setting Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4€

CLI: Setting Passwords and Usernames . . . . . . . . . . . . . . . . . . . . . . . . . 2-5€

Web: Setting Passwords and Usernames . . . . . . . . . . . . . . . . . . . . . . . . 2-6€

iii

3 TACACS+ Authentication

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1€

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2€

Terminology Used in TACACS Applications: . . . . . . . . . . . . . . . . . . . . 3-3€

General System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-5€

General Authentication Setup Procedure . . . . . . . . . . . . . . . . . . . . . . . 3-5€

Configuring TACACS+ on the Switch . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-8€

BeforeYou Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-8€

CLI CommandsDescribed in this Section . . . . . . . . . . . . . . . . . . . . . . . 3-9€

Viewing the Switch’s Current Authentication Configuration . . . . . . . 3-9€

Viewing the Switch’s Current TACACS+ Server Contact €

Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-10€

Configuring the Switch’s Authentication Methods . . . . . . . . . . . . . . . 3-11€

Configuring the Switch’sTACACS+ Server Access . . . . . . . . . . . . . . 3-15€

How Authentication Operates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-20€

General Authentication Process Using a TACACS+ Server . . . . . . . . 3-20€

Local Authentication Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-22€

Using the Encryption Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-23€

Controlling WebBrowser Interface Access When Using

TACACS+ Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-24€

Messages Related to TACACS+ Operation . . . . . . . . . . . . . . . . . . . . . 3-25€

Operating Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-25€

4 RADIUS Authentication and Accounting

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1€

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2€

Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-3€

Switch Operating Rules for RADIUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-4€

General RADIUS Setup Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-5€

Configuring the Switch for RADIUS Authentication . . . . . . . . . . . . . 4-6€

Outline of the Steps for Configuring RADIUS Authentication . . . . . . 4-6€

1. Configure Authentication for the Access Methods You Want €

RADIUS To Protect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-8€

2. Configure the Switch To Access a RADIUS Server . . . . . . . . . . . . 4-10€

3. Configure the Switch’s Global RADIUS Parameters . . . . . . . . . . . 4-12€

Local Authentication Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-16€

Controlling WebBrowser Interface Access When Using

RADIUS Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-17€

Configuring RADIUS Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-17€

Operating Rules for RADIUS Accounting . . . . . . . . . . . . . . . . . . . . . . 4-19€

Steps for Configuring RADIUS Accounting . . . . . . . . . . . . . . . . . . . . . 4-19€

Viewing RADIUS Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-25€

General RADIUS Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-25€

RADIUS Authentication Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-27€

RADIUS Accounting Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-28€

Changing RADIUS-Server Access Order . . . . . . . . . . . . . . . . . . . . . . . 4-29€

Messages Related to RADIUSOperation . . . . . . . . . . . . . . . . . . . . . . . 4-31€

5 Configuring Secure Shell (SSH)

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1€

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-2€

Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-4€

Prerequisite for Using SSH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-5€

Public Key Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-5€

Steps for Configuring and Using SSH for Switch and Client

Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-6€

General Operating Rules and Notes. . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-8€

Configuring the Switch for SSH Operation . . . . . . . . . . . . . . . . . . . . . . 5-9€

1. Assigning a Local Login (Operator)and Enable (Manager) €

Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-9€

2. Generating the Switch’s Public and Private Key Pair . . . . . . . . . . 5-10€

3. Providing the Switch’s Public Key to Clients . . . . . . . . . . . . . . . . . . 5-12€

4. Enabling SSH on the Switch and Anticipating SSH Client€

Contact Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-15€

5. Configuring the Switch for SSH Authentication . . . . . . . . . . . . . . . 5-18€

6. Use an SSH Client To Access the Switch . . . . . . . . . . . . . . . . . . . . . 5-21€

Further Information on SSH Client Public-Key Authentication . 5-21€

Messages Related to SSH Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-27€

6 Configuring Secure Socket Layer (SSL)

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-1€

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-2€

Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-3€

Prerequisite for Using SSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-5€

Steps for Configuring and UsingSSL for Switch and Client

Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-5€

General Operating Rules and Notes. . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-6€

Configuring the Switch for SSL Operation . . . . . . . . . . . . . . . . . . . . . . 6-7€

1. Assigning a Local Login (Operator) and Enable (Manager)€

Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-7€

2. Generating the Switch’s Server Host Certificate . . . . . . . . . . . . . . . . 6-9€

3. Enabling SSL on the Switch and Anticipating SSL Browser€

Contact Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-17€

Common Errors in SSL setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-21€

7 Configuring Port-Based Access Control (802.1x)

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-1€

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-2€

Why Use Port-Based Access Control? . . . . . . . . . . . . . . . . . . . . . . . . . . 7-2€

General Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-2€

How 802.1x Operates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-5€

Authenticator Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-5€

Switch-Port Supplicant Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-6€

Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-7€

General Operating Rules and Notes. . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-9€

General Setup Procedure for Port-Based Access Control

(802.1x) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-11€

Do These Steps Before You Configure 802.1x Operation . . . . . . . . . 7-11€

Overview: Configuring 802.1x Authentication on the Switch . . . . . . 7-12€

Configuring Switch Ports as 802.1x Authenticators . . . . . . . . . . . . 7-14€

1. Enable 802.1x Authentication on Selected Ports . . . . . . . . . . . . . . 7-14€

3. Configure the 802.1x Authentication Method . . . . . . . . . . . . . . . . . 7-18€

4. Enter the RADIUSHost IP Address(es) . . . . . . . . . . . . . . . . . . . . . . 7-19€

5. Enable 802.1x Authentication on the Switch . . . . . . . . . . . . . . . . . . 7-19€

802.1x Open VLAN Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-20€

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-20€

Use Modelsfor 802.1x Open VLAN Modes . . . . . . . . . . . . . . . . . . . . . 7-21€

Operating Rules for Authorized-Client and Unauthorized-Client€

VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-24€

Setting Up and Configuring 802.1x Open VLAN Mode . . . . . . . . . . . . 7-26€

802.1x Open VLAN Operating Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-30€

Option For Authenticator Ports: Configure Port-Security To

Allow Only 802.1x Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-31€

Configuring Switch Ports To Operate As Supplicants for 802.1x

Connections to Other Switches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-33€

Displaying 802.1x Configuration, Statistics, and Counters . . . . . . 7-37€

Show Commands for Port-Access Authenticator . . . . . . . . . . . . . . . . 7-37€

Viewing 802.1x Open VLAN Mode Status . . . . . . . . . . . . . . . . . . . . . . . 7-39€

Show Commands for Port-Access Supplicant . . . . . . . . . . . . . . . . . . . 7-42€

How RADIUS/802.1x Authentication Affects VLAN Operation . . 7-43€

Messages Related to 802.1xOperation . . . . . . . . . . . . . . . . . . . . . . . . 7-47€

8 Configuring and Monitoring Port Security

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-1€

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-2€

Basic Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-2€

Blocking Unauthorized Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-3€

Trunk Group Exclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-4€

Planning Port Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-5€

vii

Port Security Command Options and Operation . . . . . . . . . . . . . . . . . 8-6€

Retention of StaticMAC Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-10€

Displaying Current Port Security Settings . . . . . . . . . . . . . . . . . . . . . . 8-10€

Configuring Port Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-12€

Web: Displaying and Configuring Port Security Features . . . . . . . 8-17€

Reading Intrusion Alerts and Resetting Alert Flags . . . . . . . . . . . . 8-17€

Notice of Security Violations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-17€

How the Intrusion Log Operates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-18€

Keeping the Intrusion Log Current by Resetting Alert Flags . . . . . . . 8-19€

Using the Event Log To Find Intrusion Alerts . . . . . . . . . . . . . . . . . . . 8-24€

Web: Checking for Intrusions, Listing Intrusion Alerts, and €

Resetting Alert Flags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-24€

Operating Notes for Port Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-25€

9 Traffic/Security Filters (HP ProCurve Switch 2824 and

2848)

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-1€

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-2€

Using Source-Port Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-4€

Operating Rules for Source-Port Filters . . . . . . . . . . . . . . . . . . . . . . . . . 9-4€

Configuring a Source-Port Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-5€

Viewing a Source-Port Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-7€

Filter Indexing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-8€

Editing a Source-Port Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-9€

10 Using Authorized IP Managers

Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-1€

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-2€

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-3€

AccessLevels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-3€

viii

Andere Handbücher für ProCurve Series 2600

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere HP Netzwerk-Router Handbücher

HP StoreOnce 2900 Handbuch

HP MSR ASM Bedienungsanleitung

HP StorageWorks MPX200 Programmierhandbuch

HP FlexNetwork MSR3012 Bedienungsanleitung

HP FlexNetwork MSR3064 Bedienungsanleitung

HP 5920 Bedienungsanleitung

HP 6400/8400 Bedienungsanleitung

HP MSR954 Series Bedienungsanleitung

HP MSR2000 Series Bedienungsanleitung

HP J4093A Bedienungsanleitung

HP N1200 - StorageWorks Network Storage Router Bedienungsanleitung

HP StorageWorks MPX200 Programmierhandbuch

HP MSR SERIES Bedienungsanleitung

HP FlexNetwork HSR6800 Bedienungsanleitung

HP MSR20-20 Bedienungsanleitung

HP 5500 si series Bedienungsanleitung

HP 1920 Gigabit Ethernet Switch Series Bedienungsanleitung

HP StorageWorks M2402 Bedienungsanleitung

HP MSR930 Series Bedienungsanleitung

HP 6400cl Bedienungsanleitung

HP HPE FlexNetwork MSR Router Series Bedienungsanleitung

HP MSR20-1X Series Bedienungsanleitung

HP 7000dl Series Bedienungsanleitung

HP Fax 650 Bedienungsanleitung

Beliebte Netzwerk-Router Handbücher anderer Marken

Allnet

Allnet ALL0333AU Bedienungsanleitung

HomeSeer

HomeSeer HT-SEL Bedienungsanleitung

Sercomm

Sercomm Genesis OC3505D Bedienungsanleitung

Billion

Billion BIPAC 5102 Series Bedienungsanleitung

TP-Link

TP-Link TD-8817 Bedienungsanleitung

Motorola

Motorola MR1900 Bedienungsanleitung

Digi

Digi IX14 Bedienungsanleitung

Cisco

Cisco NCS 540 Handbuch

XAVi

XAVi X8821e Bedienungsanleitung

BEC

BEC 6200WZL Bedienungsanleitung

MikroTik

MikroTik hAP ac3 Series Bedienungsanleitung

Korenix

Korenix JetNet 5428G Series Bedienungsanleitung

NETGEAR

NETGEAR FS526T - Switch Bedienungsanleitung

Korenix

Korenix JetNet 5710G Series Bedienungsanleitung

Automated Logic

Automated Logic ZN551 Betriebsanleitung

Cisco

Cisco ASR 1000 Series Bedienerhandbuch

EnGenius

EnGenius ESR-9710 Bedienungsanleitung

Cisco

Cisco 805 Series Bedienungs- und Sicherheitshinweise