HP 10500 series User manual
HP 10500 Switch Series
Security
Configuration Guide
Part number: 5998-2214
Software version: Release 1201 and later
Document version: 6W102-20130530
Legal and notice information
© Copyright 2013 Hewlett-Packard Development Company, L.P.
No part of this documentation may be reproduced or transmitted in any form or by any means without
prior written consent of Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS
MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained
herein or for incidental or consequential damages in connection with the furnishing, performance, or
use of this material.
The only warranties for HP products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an
additional warranty. HP shall not be liable for technical or editorial errors or omissions contained
herein.
i
Contents
Configuring AAA ························································································································································· 1
Overview············································································································································································1
RADIUS······································································································································································2
HWTACACS ·····························································································································································7
Domain-based user management ···························································································································9
AAA for MPLS L3VPNs ········································································································································· 10
Protocols and standards ······································································································································· 10
RADIUS attributes ·················································································································································· 11
FIPS compliance ····························································································································································· 14
Configuration considerations and task list ·················································································································· 14
Configuring AAA schemes············································································································································ 16
Configuring local users········································································································································· 16
Configuring RADIUS schemes······························································································································ 20
Configuring HWTACACS schemes····················································································································· 32
Configuring AAA methods for ISP domains················································································································ 38
Configuration prerequisites ·································································································································· 39
Creating an ISP domain ······································································································································· 39
Configuring ISP domain attributes······················································································································· 40
Configuring authentication methods for an ISP domain ··················································································· 41
Configuring authorization methods for an ISP domain····················································································· 42
Configuring accounting methods for an ISP domain························································································· 44
Tearing down user connections···································································································································· 45
Configuring a NAS ID-VLAN binding·························································································································· 46
Displaying and maintaining AAA ································································································································ 46
AAA configuration examples········································································································································ 47
AAA for Telnet users by an HWTACACS server ······························································································· 47
Local authentication and authorization for Telnet users···················································································· 48
Authentication/authorization for SSH/Telnet users by a RADIUS server························································ 49
AAA for portal users by a RADIUS server ·········································································································· 52
AAA for 802.1X users by a RADIUS server······································································································· 60
Level switching authentication for Telnet users by an HWTACACS server····················································· 66
Troubleshooting AAA ···················································································································································· 69
Troubleshooting RADIUS······································································································································· 69
Troubleshooting HWTACACS······························································································································ 71
802.1X overview ·······················································································································································72
802.1X architecture······················································································································································· 72
Controlled/uncontrolled port and port authorization status······················································································ 72
802.1X-related protocols ·············································································································································· 73
EAP over RADIUS ·················································································································································· 74
Initiating 802.1X authentication··································································································································· 75
802.1X client as the initiator································································································································ 75
Access device as the initiator······························································································································· 75
802.1X authentication procedures ······························································································································ 76
A comparison of EAP relay and EAP termination······························································································ 76
EAP relay································································································································································ 77
EAP termination ····················································································································································· 78
Configuring 802.1X ··················································································································································80
HP implementation of 802.1X ······································································································································ 80
ii
Access control methods ········································································································································ 80
Using 802.1X authentication with other features ······························································································ 80
Configuration prerequisites··········································································································································· 85
802.1X configuration task list······································································································································· 85
Enabling 802.1X···························································································································································· 86
Enabling EAP relay or EAP termination ······················································································································· 86
Setting the port authorization state ······························································································································ 87
Specifying an access control method ·························································································································· 88
Setting the maximum number of concurrent 802.1X users on a port······································································· 88
Setting the maximum number of authentication request attempts ············································································· 88
Setting the 802.1X authentication timeout timers······································································································· 89
Configuring the online user handshake function ········································································································ 89
Configuration guidelines ······································································································································ 90
Configuration procedure ······································································································································ 90
Enabling the proxy detection function ························································································································· 90
Configuring the authentication trigger function ·········································································································· 91
Configuration guidelines ······································································································································ 91
Configuration procedure ······································································································································ 91
Specifying a mandatory authentication domain on a port························································································ 92
Configuring the quiet timer ··········································································································································· 92
Enabling the periodic online user re-authentication function····················································································· 93
Configuration guidelines ······································································································································ 93
Configuration procedure ······································································································································ 93
Configuring a VLAN group··········································································································································· 93
Configuring an 802.1X guest VLAN ··························································································································· 94
Configuration guidelines ······································································································································ 94
Configuration prerequisites ·································································································································· 95
Configuration procedure ······································································································································ 95
Configuring an Auth-Fail VLAN···································································································································· 95
Configuration guidelines ······································································································································ 95
Configuration prerequisites ·································································································································· 96
Configuration procedure ······································································································································ 96
Configuring an 802.1X critical VLAN ························································································································· 96
Configuration guidelines ······································································································································ 96
Configuration prerequisites ·································································································································· 97
Configuration procedure ······································································································································ 97
Specifying supported domain name delimiters··········································································································· 97
Displaying and maintaining 802.1X ··························································································································· 98
802.1X authentication configuration example ··········································································································· 98
Network requirements··········································································································································· 98
Configuration procedure ······································································································································ 99
Verifying the configuration·································································································································100
802.1X guest VLAN and VLAN assignment configuration example······································································101
Network requirements·········································································································································101
Configuration procedure ····································································································································102
Verifying the configuration·································································································································103
802.1X with ACL assignment configuration example ·····························································································103
Network requirements·········································································································································103
Configuration procedure ····································································································································104
Verifying the configuration·································································································································104
Configuring EAD fast deployment ························································································································· 106
Overview·······································································································································································106
Free IP···································································································································································106
URL redirection·····················································································································································106
iii
Configuration prerequisites·········································································································································106
Configuring a free IP ···················································································································································106
Configuring the redirect URL·······································································································································107
Setting the EAD rule timer ···········································································································································107
Displaying and maintaining EAD fast deployment···································································································107
EAD fast deployment configuration example············································································································108
Network requirements·········································································································································108
Configuration procedure ····································································································································108
Verifying the configuration·································································································································109
Troubleshooting EAD fast deployment·······················································································································110
Web browser users cannot be correctly redirected ·································································································110
Configuring MAC authentication··························································································································· 111
Overview·······································································································································································111
User account policies··········································································································································111
Authentication approaches ································································································································111
MAC authentication timers·································································································································112
Using MAC authentication with other features ·········································································································112
VLAN assignment ················································································································································112
ACL assignment ···················································································································································112
Guest VLAN ·························································································································································112
Critical VLAN·······················································································································································113
Configuration task list ··················································································································································113
Basic configuration for MAC authentication·············································································································113
Configuring MAC authentication globally········································································································114
Configuring MAC authentication on a port ·····································································································114
Specifying a MAC authentication domain················································································································115
Configuring a MAC authentication guest VLAN ······································································································115
Configuring a MAC authentication critical VLAN····································································································116
Configuring MAC authentication delay·····················································································································117
Displaying and maintaining MAC authentication ····································································································117
MAC authentication configuration examples············································································································118
Local MAC authentication configuration example···························································································118
RADIUS-based MAC authentication configuration example···········································································119
ACL assignment configuration example············································································································121
Configuring portal authentication·························································································································· 124
Overview·······································································································································································124
Extended portal functions ···································································································································124
Portal system components···································································································································124
Portal authentication modes ·······························································································································126
Portal support for EAP·········································································································································127
Layer 3 portal authentication process ···············································································································127
Portal authentication across VPNs·····················································································································131
Configuration task list ··················································································································································131
Configuration prerequisites·········································································································································132
Specifying the portal server ········································································································································133
Enabling portal authentication····································································································································133
Controlling access of portal users ······························································································································134
Configuring a portal-free rule·····························································································································134
Configuring an authentication source subnet···································································································135
Setting the maximum number of online portal users························································································135
Specifying a portal authentication domain ······································································································136
Configuring RADIUS related attributes ······················································································································136
Specifying NAS-Port-Type for an interface ·······································································································136
iv
Specifying the NAS-Port-ID for an interface ·····································································································137
Specifying a NAS ID profile for an interface ···································································································137
Specifying a source IP address for outgoing portal packets ···················································································138
Specifying an auto redirection URL for authenticated portal users·········································································138
Configuring portal detection functions·······················································································································139
Configuring the portal server detection function······························································································139
Configuring portal user information synchronization······················································································140
Logging off portal users···············································································································································141
Displaying and maintaining portal ····························································································································141
Portal configuration examples ····································································································································142
Configuring direct portal authentication···········································································································142
Configuring re-DHCP portal authentication······································································································147
Configuring cross-subnet portal authentication ································································································149
Configuring direct portal authentication with extended functions··································································151
Configuring re-DHCP portal authentication with extended functions ····························································153
Configuring cross-subnet portal authentication with extended functions·······················································155
Configuring portal server detection and portal user information synchronization·······································157
Cross-subnet portal authentication across VPNs ······························································································163
Troubleshooting portal·················································································································································165
Inconsistent keys on the access device and the portal server·········································································165
Incorrect server port number on the access device··························································································165
Configuring port security········································································································································ 166
Port security features ····················································································································································166
Port security modes ······················································································································································166
Working with guest VLAN and Auth-Fail VLAN ·······································································································169
Configuration task list ··················································································································································169
Enabling port security ··················································································································································170
Setting port security's limit on the number of MAC addresses on a port·······························································170
Setting the port security mode ····································································································································171
Configuration prerequisites ································································································································171
Configuration procedure ····································································································································171
Configuring port security features ······························································································································171
Configuring NTK ·················································································································································172
Configuring intrusion protection ························································································································172
Enabling port security traps································································································································173
Configuring secure MAC addresses ··························································································································173
Configuration prerequisites ································································································································174
Configuration procedure ····································································································································174
Ignoring authorization information from the server··································································································175
Displaying and maintaining port security··················································································································175
Port security configuration examples ·························································································································176
Configuring the autoLearn mode·······················································································································176
Configuring the userLoginWithOUI mode ········································································································178
Configuring the macAddressElseUserLoginSecure mode················································································183
Troubleshooting port security······································································································································185
Cannot set the port security mode·····················································································································186
Cannot configure secure MAC addresses ········································································································186
Cannot change port security mode when a user is online··············································································186
Configuring a user profile ······································································································································ 188
User profile configuration task list······························································································································188
Creating a user profile ················································································································································188
Applying a QoS policy ···············································································································································189
Enabling a user profile ················································································································································189
v
Displaying and maintaining user profiles··················································································································190
Managing public keys············································································································································ 191
Configuration task list ··················································································································································191
Creating a local asymmetric key pair························································································································192
Displaying or exporting the local host public key ····································································································192
Destroying a local asymmetric key pair ····················································································································193
Specifying the peer public key on the local device··································································································194
Displaying public keys·················································································································································195
Public key configuration examples·····························································································································195
Manually specifying the peer public key on the local device ········································································195
Importing a public key from a public key file···································································································197
Configuring SSH ····················································································································································· 200
Overview·······································································································································································200
How SSH operates··············································································································································200
SSH authentication ··············································································································································201
FIPS compliance ··················································································································································202
SSH support for MPLS L3VPN ····························································································································202
Configuring the device as an SSH server··················································································································202
SSH server configuration task list ······················································································································202
Generating local DSA or RSA key pairs···········································································································203
Enabling the SSH server function·······················································································································203
Enabling the SFTP server function······················································································································204
Configuring the user interfaces for SSH clients································································································204
Configuring a client's host public key···············································································································205
Configuring an SSH user····································································································································206
Setting the SSH management parameters ········································································································207
Setting the DSCP value for packets sent by the SSH server············································································208
Configuring the device as an Stelnet client···············································································································208
Stelnet client configuration task list····················································································································209
Specifying a source IP address or source interface for the Stelnet client ······················································209
Enabling/disabling first-time authentication ·····································································································209
Establishing a connection to an Stelnet server ·································································································210
Setting the DSCP value for packets sent by the Stelnet client ·········································································211
Configuring the device as an SFTP client ··················································································································212
SFTP client configuration task list·······················································································································212
Specifying a source IP address or source interface for the SFTP client ·························································212
Establishing a connection to an SFTP server ····································································································212
Working with SFTP directories···························································································································213
Working with SFTP files······································································································································214
Displaying help information ·······························································································································214
Terminating the connection with the SFTP server ·····························································································215
Setting the DSCP value for packets sent by the SFTP client ············································································215
Configuring the device as an SCP client ···················································································································215
SCP client configuration task list························································································································215
Transferring files with an SCP server·················································································································216
Displaying and maintaining SSH ·······························································································································216
Stelnet configuration examples···································································································································217
When the switch acts as an Stelnet server for password authentication·······················································217
When the switch acts as an Stelnet server for publickey authentication·······················································219
When the switch acts as an Stelnet client for password authentication························································224
When the switch acts as an Stelnet client for publickey authentication ························································227
SFTP configuration examples ······································································································································229
When the switch acts as an SFTP server for password authentication··························································229
vi
When the switch acts as an SFTP client for publickey authentication ···························································231
Configuring TCP attack protection························································································································· 235
Enabling the SYN Cookie feature ······························································································································235
Displaying and maintaining TCP attack protection ··································································································235
Configuring IP source guard ·································································································································· 236
IP source guard overview············································································································································236
Static IP source guard entries·····························································································································236
Dynamic IPv4 source guard entries···················································································································237
Configuration task list ··················································································································································237
Configuring the IPv4 source guard function··············································································································238
Enabling IPv4 source guard on a port ··············································································································238
Configuring a static IPv4 source guard entry···································································································239
Setting the maximum number of IPv4 source guard entries allowed on a port············································240
Configuring the IPv6 source guard function··············································································································240
Enabling IPv6 source guard on a port ··············································································································240
Configuring a static IPv6 source guard entry···································································································241
Setting the maximum number of IPv6 source guard entries allowed on a port············································242
Displaying and maintaining IP source guard············································································································242
IP source guard configuration examples ···················································································································243
Static IPv4 source guard entry configuration····································································································243
Dynamic IPv4 source guard using DHCP snooping ························································································245
Dynamic IPv4 source guard using DHCP relay································································································246
Static IPv6 source guard entry configuration····································································································247
Global static IP source guard configuration·····································································································248
Troubleshooting IP source guard ································································································································250
Configuring ARP attack protection························································································································· 251
ARP attack protection configuration task list ·············································································································251
Configuring unresolvable IP attack protection ··········································································································252
Configuring ARP source suppression ················································································································252
Enabling ARP black hole routing ·······················································································································252
Displaying and maintaining ARP source suppression ·····················································································252
Unresolvable IP attack protection configuration example···············································································253
Configuring ARP packet rate limit ······························································································································254
Configuring ARP packet rate limit ·····················································································································254
Configuring source MAC-based ARP attack detection ····························································································254
Displaying and maintaining source MAC-based ARP attack detection·························································255
Source MAC-based ARP attack detection configuration example ·································································255
Configuring ARP active acknowledgement ···············································································································256
Configuring ARP detection··········································································································································257
Configuring user validity check ·························································································································257
Configuring ARP packet validity check·············································································································258
Configuring ARP restricted forwarding ·············································································································259
Displaying and maintaining ARP detection ······································································································259
User validity check configuration example·······································································································259
User validity check and ARP packet validity check configuration example··················································261
ARP restricted forwarding configuration example ···························································································262
Configuring ARP automatic scanning and fixed ARP·······························································································264
Configuration guidelines ····································································································································264
Configuration procedure ····································································································································265
Configuring ND attack defense ····························································································································· 266
Overview·······································································································································································266
Enabling source MAC consistency check for ND packets·······················································································267
vii
Configuring URPF···················································································································································· 268
URPF check modes ··············································································································································268
URPF work flow····················································································································································268
Network application ···········································································································································271
Configuring URPF·························································································································································271
URPF configuration example ······························································································································272
Configuring MFF ····················································································································································· 273
Basic concepts ·····················································································································································274
MFF operation modes·········································································································································274
MFF work flow·····················································································································································275
Protocols and standards ·····································································································································275
Configuring MFF ··························································································································································275
Displaying and maintaining MFF ·······························································································································277
MFF configuration examples·······································································································································277
Configuring auto-mode MFF in a tree network ································································································277
Configuring auto-mode MFF in a ring network································································································278
Configuring manual-mode MFF in a tree network ···························································································280
Configuring manual-mode MFF in a ring network···························································································282
Configuring password control································································································································ 284
FIPS compliance ···························································································································································286
Password control configuration task list·····················································································································286
Enabling password control ·········································································································································287
Setting global password control parameters ············································································································288
Setting user group password control parameters·····································································································289
Setting local user password control parameters·······································································································290
Setting super password control parameters ··············································································································291
Setting a local user password in interactive mode···································································································291
Displaying and maintaining password control ·········································································································291
Password control configuration example ··················································································································292
Configuring FIPS······················································································································································ 295
Overview·······································································································································································295
FIPS self-tests ·································································································································································295
Power-up self-test ·················································································································································295
Conditional self-tests············································································································································295
Triggering a self-test ············································································································································295
Configuring FIPS···························································································································································296
Enabling the FIPS mode······································································································································296
Triggering a self-test ············································································································································296
Displaying and maintaining FIPS ·······························································································································297
FIPS configuration example·········································································································································297
Configuring IPsec ···················································································································································· 299
IPsec overview ······························································································································································299
Basic concepts ·····················································································································································299
Protocols and standards ·····································································································································302
FIPS compliance ···························································································································································302
Configuring IPsec ·························································································································································302
Implementing ACL-based IPsec ···································································································································302
Feature restrictions and guidelines ····················································································································302
ACL-based IPsec configuration task list ·············································································································302
Configuring ACLs ················································································································································303
Configuring an IPsec transform set····················································································································304
Configuring an IPsec policy ·······························································································································305
viii
Applying an IPsec policy group to an interface·······························································································309
Configuring the IPsec session idle timeout········································································································309
Enabling ACL checking of de-encapsulated IPsec packets ·············································································310
Configuring the IPsec anti-replay function ········································································································310
Configuring packet information pre-extraction ································································································311
Enabling invalid SPI recovery ····························································································································311
Displaying and maintaining IPsec ······························································································································312
IPsec configuration examples······································································································································312
IKE-based IPsec tunnel for IPv4 packets configuration example·····································································312
Configuring IKE······················································································································································· 315
IKE overview ·································································································································································315
IKE security mechanism·······································································································································315
IKE operation ·······················································································································································315
IKE functions·························································································································································316
Relationship between IKE and IPsec··················································································································317
Protocols and standards ·····································································································································317
FIPS compliance ···························································································································································317
IKE configuration task list ············································································································································317
Configuring a name for the local security gateway·································································································318
Configuring an IKE proposal ······································································································································318
Configuring an IKE peer··············································································································································319
Setting keepalive timers···············································································································································321
Setting the NAT keepalive timer·································································································································321
Configuring a DPD detector········································································································································322
Disabling next payload field checking ······················································································································322
Displaying and maintaining IKE·································································································································323
IKE configuration example ··········································································································································323
Troubleshooting IKE ·····················································································································································326
Invalid user ID······················································································································································326
Proposal mismatch ··············································································································································326
Failing to establish an IPsec tunnel····················································································································327
ACL configuration error ······································································································································327
Support and other resources ·································································································································· 328
Contacting HP ······························································································································································328
Subscription service ············································································································································328
Related information······················································································································································328
Documents····························································································································································328
Websites·······························································································································································328
Conventions ··································································································································································329
Index ········································································································································································ 331
1
Configuring AAA
Overview
Authentication, Authorization, and Accounting (AAA) provides a uniform framework for implementing
network access management. It can provide the following security functions:
•Authentication—Identifies users and determines whether a user is valid.
•Authorization—Grants user rights and controls user access to resources and services. For example,
a user who has successfully logged in to the device can be granted read and print permissions to
the files on the device.
•Accounting—Records all network service usage information, including service type, start time, and
traffic. The accounting function provides information required for charging, and allows for network
security surveillance.
AAA typically uses a client/server model, as shown in Figure 1. The client runs on the network access
server (NAS), which is also referred to as the access device. The server maintains user information
centrally. In an AAA network, the NAS is a server for users, but a client for AAA servers.
Figure 1 AAA application scenario
The NAS uses the authentication server to authenticate any user who tries to log in, use network resources,
or access other networks. The NAS transparently transmits the authentication, authorization, and
accounting information between the user and the servers. The RADIUS and HWTACACS protocols
define how a NAS and a remote server exchange user information.
The network shown in Figure 1 comprises a RADIUS server and an HWTACACS server. You can choose
different servers for different security functions. For example, you can use the HWTACACS server for
authentication and authorization, and the RADIUS server for accounting.
You can implement any of the three security functions provided by AAA as needed. For example, if your
company wants employees to be authenticated before they access specific resources, configure an
authentication server. If network usage information is needed, you must also configure an accounting
server.
AAA can be implemented through multiple protocols. The device supports RADIUS and HWTACACS, of
which RADIUS is most often used.
Remote user NAS RADIUS server
HWTACACS server
Internet
Network
2
RADIUS
Remote Authentication Dial-In User Service (RADIUS) is a distributed information interaction protocol that
uses a client/server model. It can protect networks against unauthorized access and is often used in
network environments that require both high security and remote user access.
RADIUS uses UDP port 1812 for authentication and UDP port 1813 for accounting.
RADIUS was originally designed for dial-in user access. With the addition of new access methods,
RADIUS has been extended to support additional access methods, including Ethernet and ADSL.
RADIUS provides access authentication, authorization, and accounting services. The accounting function
collects and records network resource usage information.
Client/server model
The RADIUS client runs on every NAS on the network to pass user information to the RADIUS server and
determines to reject or accept each access request based on the server response.
The RADIUS server runs on the computer or workstation at the network center and maintains information
related to user authentication and network access. It receives connection requests, authenticates users,
and returns access control information (for example, rejecting or accepting the user access request) to the
client.
The RADIUS server typically maintains the following databases: Users, Clients, and Dictionary.
See Figure 2.
Figure 2 RADIUS server databases
•Users—Stores user information, such as the usernames, passwords, applied protocols, and IP
addresses.
•Clients—Stores information about RADIUS clients, such as shared keys and IP addresses.
•Dictionary—Stores RADIUS protocol attributes and their values.
Security and authentication mechanisms
The RADIUS client and the RADIUS server use a shared key to authenticate RADIUS packets and encrypt
user passwords exchanged between them. For security, this key must be manually configured on the
client and the server.
RADIUS servers support multiple authentication protocols, including PAP and CHAP of PPP. A RADIUS
server can also act as the client of another AAA server to provide authentication proxy services.
Basic RADIUS message exchange process
Figure 3 illustrates the interactions between the host, the RADIUS client, and the RADIUS server.
RADIUS servers
Users Clients Dictionary
3
Figure 3 Basic RADIUS message exchange process
RADIUS operates in the following manner:
1. The host initiates a connection request that carries the user's username and password to the
RADIUS client.
2. Having received the username and password, the RADIUS client sends an authentication request
(Access-Request) to the RADIUS server, with the user password encrypted by using the MD5
algorithm and the shared key.
3. The RADIUS server authenticates the username and password. If the authentication succeeds, the
server returns an Access-Accept message containing the user's authorization information. If the
authentication fails, the server returns an Access-Reject message.
4. The RADIUS client permits or denies the user according to the returned authentication result. If it
permits the user, it sends a start-accounting request (Accounting-Request) to the RADIUS server.
5. The RADIUS server returns an acknowledgement (Accounting-Response) and starts accounting.
6. The user accesses the network resources.
7. The host requests the RADIUS client to tear down the connection and the RADIUS client sends a
stop-accounting request (Accounting-Request) to the RADIUS server.
8. The RADIUS server returns an acknowledgement (Accounting-Response) and stops accounting for
the user.
RADIUS packet format
RADIUS uses UDP to transmit messages. To ensure smooth message exchange between the RADIUS
server and the client, RADIUS uses timer management, retransmission, and a backup server
mechanism. Figure 4 shows the RADIUS packet format.
4
Figure 4 RADIUS packet format
Descriptions of the fields are as follows:
•The Code field (1 byte long) indicates the type of the RADIUS packet.
Table 1 Main values of the Code field
Code Packet t
yp
e Descri
p
tion
1 Access-Request
From the client to the server. A packet of this type carries user information for
the server to authenticate the user. It must contain the User-Name attribute
and can optionally contain the attributes of NAS-IP-Address, User-Password,
and NAS-Port.
2 Access-Accept
From the server to the client. If all attribute values carried in the
Access-Request are acceptable, the authentication succeeds, and the server
sends an Access-Accept response.
3 Access-Reject
From the server to the client. If any attribute value carried in the
Access-Request is unacceptable, the authentication fails, and the server sends
an Access-Reject response.
4 Accounting-Request
From the client to the server. A packet of this type carries user information for
the server to start or stop accounting for the user. The Acct-Status-Type
attribute in the packet indicates whether to start or stop accounting.
5 Accounting-Response
From the server to the client. The server sends a packet of this type to notify the
client that it has received the Accounting-Request and has successfully
recorded the accounting information.
•The Identifier field (1 byte long) is used to match request packets and response packets and to detect
duplicate request packets. Request and response packets of the same type have the same identifier.
•The Length field (2 bytes long) indicates the length of the entire packet, including the Code,
Identifier, Length, Authenticator, and Attributes fields. Bytes beyond this length are considered
padding and are ignored at the receiver. If the length of a received packet is less than this length,
the packet is dropped. The value of this field is in the range 20 to 4096.
•The Authenticator field (16 bytes long) is used to authenticate responses from the RADIUS server and
to encrypt user passwords. There are two types of authenticators: request authenticator and
response authenticator.
•The Attributes field (variable in length) carries the specific authentication, authorization, and
accounting information that defines the configuration details of the request or response. This field
may contain multiple attributes, each with three sub-fields:
Code
Attributes
Identifier
0
7
Length
Authenticator
715 31
5
{Type—(1 byte long) Type of the attribute. It is in the range of 1 to 255. Commonly used RADIUS
attributes are defined in RFC 2865, RFC 2866, RFC 2867, and RFC 2868. Table 2 shows a list
of the attributes. For more information, see "Commonly used standard RADIUS attributes."
{Length—(1 byte long) Length of the attribute in bytes, including the Type, Length, and Value
sub-fields.
{Value—(Up to 253 bytes) Value of the attribute. Its format and content depend on the Type and
Length sub-fields.
Table 2 Commonly used RADIUS attributes
No. Attribute No.
Attribute
1 User-Name 45 Acct-Authentic
2 User-Password 46 Acct-Session-Time
3 CHAP-Password 47 Acct-Input-Packets
4 NAS-IP-Address 48 Acct-Output-Packets
5 NAS-Port 49 Acct-Terminate-Cause
6 Service-Type 50 Acct-Multi-Session-Id
7 Framed-Protocol 51 Acct-Link-Count
8 Framed-IP-Address 52 Acct-Input-Gigawords
9 Framed-IP-Netmask 53 Acct-Output-Gigawords
10 Framed-Routing 54 (unassigned)
11 Filter-ID 55 Event-Timestamp
12 Framed-MTU 56-59 (unassigned)
13 Framed-Compression 60 CHAP-Challenge
14 Login-IP-Host 61 NAS-Port-Type
15 Login-Service 62 Port-Limit
16 Login-TCP-Port 63 Login-LAT-Port
17 (unassigned) 64 Tunnel-Type
18 Reply-Message 65 Tunnel-Medium-Type
19 Callback-Number 66 Tunnel-Client-Endpoint
20 Callback-ID 67 Tunnel-Server-Endpoint
21 (unassigned) 68 Acct-Tunnel-Connection
22 Framed-Route 69 Tunnel-Password
23 Framed-IPX-Network 70 ARAP-Password
24 State 71 ARAP-Features
25 Class 72 ARAP-Zone-Access
26 Vendor-Specific 73 ARAP-Security
27 Session-Timeout 74 ARAP-Security-Data
28 Idle-Timeout 75 Password-Retry
29 Termination-Action 76 Prompt
6
No. Attribute No.
Attribute
30 Called-Station-Id 77 Connect-Info
31 Calling-Station-Id 78 Configuration-Token
32 NAS-Identifier 79 EAP-Message
33 Proxy-State 80 Message-Authenticator
34 Login-LAT-Service 81 Tunnel-Private-Group-id
35 Login-LAT-Node 82 Tunnel-Assignment-id
36 Login-LAT-Group 83 Tunnel-Preference
37 Framed-AppleTalk-Link 84 ARAP-Challenge-Response
38 Framed-AppleTalk-Network 85 Acct-Interim-Interval
39 Framed-AppleTalk-Zone 86 Acct-Tunnel-Packets-Lost
40 Acct-Status-Type 87 NAS-Port-Id
41 Acct-Delay-Time 88 Framed-Pool
42 Acct-Input-Octets 89 (unassigned)
43 Acct-Output-Octets 90 Tunnel-Client-Auth-id
44 Acct-Session-Id 91 Tunnel-Server-Auth-id
Extended RADIUS attributes
Attribute 26 (Vender-Specific), an attribute defined in RFC 2865, allows a vendor to define extended
attributes to implement functions that the standard RADIUS protocol does not provide.
A vendor can encapsulate multiple sub-attributes as TLVs in attribute 26 to provide extended functions. As
shown in Figure 5, a sub-attribute encapsulated in attribute 26 consists of the following parts:
•Vendor-ID—ID of the vendor. Its most significant byte is 0. The other three bytes contains a code
that is compliant to RFC 1700. For more information about the proprietary RADIUS sub-attributes of
HP, see "HP proprietary RADIUS sub-attributes."
•Vendor-Type—Type of the sub-attribute.
•Vendor-Length—Length of the sub-attribute.
•Vendor-Data—Contents of the sub-attribute.
Figure 5 Format of attribute 26
7
HWTACACS
HW Terminal Access Controller Access Control System (HWTACACS) is an enhanced security protocol
based on TACACS (RFC 1492). Similar to RADIUS, it uses a client/server model for information
exchange between the NAS and the HWTACACS server.
HWTACACS typically provides AAA services for PPP users, VPDN users, and terminal users. In a typical
HWTACACS scenario, some terminal users need to log in to the NAS for operations. Working as the
HWTACACS client, the NAS sends the username and password of the user to the HWTACACS sever for
authentication. After passing authentication and getting authorized rights, the user logs in to the device
and performs operations. The HWTACACS server records the operations that the user performs.
Differences between HWTACACS and RADIUS
HWTACACS and RADIUS have many features in common, such as using a client/server model, using
shared keys for user information security, and providing flexibility and extensibility. Table 3 lists the
primary differences.
Table 3 Primary differences between HWTACACS and RADIUS
HWTACACS RADIUS
Uses TCP, providing more reliable network
transmission. Uses UDP, providing higher transport efficiency.
Encrypts the entire packet except for the HWTACACS
header.
Encrypts only the user password field in an
authentication packet.
Protocol packets are complicated, and authorization
is independent of authentication. Authentication and
authorization can be deployed on different
HWTACACS servers.
Protocol packets are simple, and the authorization
process is combined with the authentication process.
Supports authorization of configuration commands.
The commands that a user can access depend on both
the user level and AAA authorization. A user can use
only commands that are at, or lower than, the user
level and authorized by the HWTACACS server.
Does not support authorization of configuration
commands. The commands that a user can access
solely depend on the level of the user. A user can use
all commands at, or lower than, the user level.
Basic HWTACACS message exchange process
The following takes a Telnet user as an example to describe how HWTACACS performs user
authentication, authorization, and accounting.
8
Figure 6 Basic HWTACACS message exchange process for a Telnet user
HWTACACS operates in the following manner:
1. A Telnet user sends an access request to the HWTACACS client.
2. Upon receiving the request, the HWTACACS client sends a start-authentication packet to the
HWTACACS server.
3. The HWTACACS server sends back an authentication response to request the username.
4. Upon receiving the response, the HWTACACS client asks the user for the username.
5. The user enters the username.
6. After receiving the username from the user, the HWTACACS client sends the server a
continue-authentication packet that carries the username.
7. The HWTACACS server sends back an authentication response, requesting the login password.
8. Upon receipt of the response, the HWTACACS client asks the user for the login password.
9
9. The user enters the password.
10. After receiving the login password, the HWTACACS client sends the HWTACACS server a
continue-authentication packet that carries the login password.
11. The HWTACACS server sends back an authentication response to indicate that the user has
passed authentication.
12. The HWTACACS client sends the user authorization request packet to the HWTACACS server.
13. The HWTACACS server sends back the authorization response, indicating that the user is now
authorized.
14. Detecting that the user is now authorized, the HWTACACS client pushes its CLI to the user.
15. The HWTACACS client sends a start-accounting request to the HWTACACS server.
16. The HWTACACS server sends back an accounting response, indicating that it has received the
start-accounting request.
17. The user logs off.
18. The HWTACACS client sends a stop-accounting request to the HWTACACS server.
19. The HWTACACS server sends back a stop-accounting response, indicating that the
stop-accounting request has been received.
Domain-based user management
A NAS manages users based on ISP domains. On a NAS, each user belongs to one ISP domain. A NAS
determines the ISP domain for a user by the username entered by the user at login, as shown in Figure
7.
Figure 7 Determining the ISP domain of a user by the username
Authentication, authorization, and accounting of a user depend on the AAA methods configured for the
domain to which the user belongs. If no specific AAA methods are configured for the domain, default
methods are used. By default, a domain uses local authentication, local authorization, and local
accounting.
AAA allows you to manage users based on their access types:
•LAN users—Users on a LAN who must pass 802.1X or MAC address authentication to access the
network.
•Login users—Users who want to log in to the device, including SSH users, Telnet users, FTP users,
and terminal users.
•Portal users—Users who must pass portal authentication to access the network.
10
In addition, AAA provides the following services for login users to enhance device security:
•Command authorization—Enables the NAS to defer to the authorization server to determine
whether a command entered by a login user is permitted, ensuring that login users execute only
commands they are authorized to execute. For more information about command authorization, see
Fundamentals Configuration Guide.
•Command accounting—Allows the accounting server to record all commands executed on the
device or all authorized commands successfully executed. For more information about command
accounting, see Fundamentals Configuration Guide.
•Level switching authentication—Allows the authentication server to authenticate users who perform
privilege level switching. As long as they pass level switching authentication, users can switch their
user privilege levels without logging out and disconnecting current connections. For more
information about user privilege level switching, see Fundamentals Configuration Guide.
You can configure different AAA methods for different types of users in a domain. See "Configuring AAA
methods for ISP domains."
AAA for MPLS L3VPNs
In an MPLS L3VPN scenario where clients in different VPNs are centrally authenticated, you can deploy
AAA across VPNs to enable forwarding of RADIUS and HWTACACS packets across MPLS VPNs. With
this feature, the PE at the left side of the MPLS backbone serves as a NAS and transparently delivers the
AAA packets of private users in VPN 1 and VPN 2 to the AAA servers in VPN 3 for centralized
authentication, as shown in Figure 8. Authentication packets of private users in different VPNs do not
affect each other.
Figure 8 Network diagram
NOTE:
This feature can help a multi-VPN-instance CE to implement portal authentication for VPNs. For more
information about multi-VPN-instance CEs, see
MPLS Configuration Guide
. For more information about
portal authentication, see "Configuring portal authentication."
Protocols and standards
The following protocols and standards are related to AAA, RADIUS, and HWTACACS:
•RFC 2865, Remote Authentication Dial In User Service (RADIUS)
•RFC 2866, RADIUS Accounting
Other manuals for 10500 series
13
Table of contents
Other HP Switch manuals
HP
HP 6125XLG Installation manual
HP
HP 316095-B21 - StorageWorks Edge Switch 2/24 Instruction Manual
HP
HP Altoline 6712 32QSFP+ Series User manual
HP
HP 316095-B21 - StorageWorks Edge Switch 2/24 User manual
HP
HP ProCurve 1700-8 User manual
HP
HP StorageWorks SN6000 User manual
HP
HP FlexFabric 5980 48SFP+6QSFP28 User manual
HP
HP 3600 v2 Series User manual
HP
HP PROCURVE 2910AL User manual
HP
HP 12500 Series Installation manual
HP
HP 3235 User manual
HP
HP ProCurve 4204vl User manual
HP
HP Enterprise OfficeConnect 1405 v3 Series User manual
HP
HP StorageWorks 2/32 - SAN Switch User manual
HP
HP 2920 Series User manual
HP
HP StorageWorks T5518A User manual
HP
HP PROCURVE 2910AL User manual
HP
HP 5500 HI Series User instructions
HP
HP 316095-B21 - StorageWorks Edge Switch 2/24 User manual
HP
HP StorageWorks 2/16-EL User manual
Popular Switch manuals by other brands
Pickering
Pickering LXI 60-102C user manual
Datasheen
Datasheen KvmSwitch! CS08C user manual
IBM
IBM RedBooks SAN24B-5 Installation, service and user guide
D-Link
D-Link DUB-H7 - Hub - USB Quick installation guide
LightwaveRF
LightwaveRF Comfy LW920 Professional Series instruction manual
CAMBRIONIX
CAMBRIONIX TS3-16 user manual
Juniper
Juniper EX2200 Series Hardware guide
Contemporary Controls
Contemporary Controls CTRLink EISK8P-GT installation guide
Blonder tongue
Blonder tongue Clearview HDMI4 quick guide
IP-Ninjar
IP-Ninjar NJR-CTB user manual
Rockwell Automation
Rockwell Automation Allen-Bradley 194U installation instructions
Simon
Simon S82 manual