HP E3800-24G-PoE+-2SFP+ User manual

HP Switch Software
E3800 switches
Software version KA.15.03
September 2011
Access Security Guide

HP Networking E3800 Switches
Access Security Guide
September 2011
KA.15.03

Hewlett-Packard Company
8000 Foothills Boulevard, m/s 5551
Roseville, California 95747-5551
www.hp.com
© Copyright 2008 - 2011 Hewlett-Packard Development Company,
L.P. The information contained herein is subject to change with-
out notice. All Rights Reserved.
This document contains proprietary information, which is
protected by copyright. No part of this document may be
photocopied, reproduced, or translated into another
language without the prior written consent of Hewlett-
Packard.
Publication Number
5998-2707
September 2011
Applicable Products
HP E3800-24G-PoE+-2SFP+ Switch J9573A
HP E3800-48G-PoE+-4SFP+ Switch J9574A
HP E3800-24G-2SFP+ Switch J9575A
HP E3800-48G-4SFP+ Switch J9576A
HP E3800-24GS-2XG tl Switch J9584A
HP E3800-24G-2XGT tl Switch J9585A
HP E3800-48G-4XGT tl Switch J9586A
HP E3800-24G-2XGT-PoE+ tl Switch J9587A
HP E3800-48G-4XGT-PoE+ tl Switch J9588A
HP E3800 4-port Stacking Module J9577A
Trademark Credits
Microsoft, Windows, and Microsoft Windows NT are US
registered trademarks of Microsoft Corporation. Java™ is a
US trademark of Sun Microsystems, Inc.
Disclaimer
The information contained in this document is subject to
change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY
OF ANY KIND WITH REGARD TO THIS MATERIAL,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not
be liable for errors contained herein or for incidental or
consequential damages in connection with the furnishing,
performance, or use of this material.
The only warranties for HP products and services are set
forth in the express warranty statements accompanying
such products and services. Nothing herein should be
construed as constituting an additional warranty. HP shall
not be liable for technical or editorial errors or omissions
contained herein.
Hewlett-Packard assumes no responsibility for the use or
reliability of its software on equipment that is not furnished
by Hewlett-Packard.
Software End User License Agreement and
Hardware Limited Warranty
For the software end user license agreement and the hard-
ware limited warranty information for HP Networking prod-
ucts, visit www.hp.com/networking/support.

iii
Contents
Product Documentation
About Your Switch Manual Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi
Printed Publications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi
Electronic Publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi
Software Feature Index. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxiii
1 Security Overview
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1
About This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1
For More Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1
Access Security Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3
Network Security Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
Getting Started with Access Security . . . . . . . . . . . . . . . . . . . . . . . . . . 1-10
Physical Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-10
Quick Start: Using the Management Interface Wizard . . . . . . . . . . . . 1-11
CLI: Management Interface Wizard . . . . . . . . . . . . . . . . . . . . . . . . 1-12
WebAgent: Management Interface Wizard . . . . . . . . . . . . . . . . . . 1-13
SNMP Security Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-14
Precedence of Security Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-16
Precedence of Port-Based Security Options . . . . . . . . . . . . . . . . . . . . 1-16
Precedence of Client-Based Authentication:
Dynamic Configuration Arbiter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-16
Network Immunity Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-17
Arbitrating Client-Specific Attributes . . . . . . . . . . . . . . . . . . . . . . 1-18
HP Identity-Driven Manager (IDM) . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-20

iv
2 Configuring Username and Password Security
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1
Configuring Local Password Security . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4
Menu: Setting Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4
CLI: Setting Passwords and Usernames . . . . . . . . . . . . . . . . . . . . . . . . . 2-6
WebAgent: Setting Passwords and Usernames . . . . . . . . . . . . . . . . . . . 2-9
Saving Security Credentials in a Config File . . . . . . . . . . . . . . . . . . . 2-10
Benefits of Saving Security Credentials . . . . . . . . . . . . . . . . . . . . . . . . 2-10
Enabling the Storage and Display of Security Credentials . . . . . . . . 2-11
Security Settings that Can Be Saved . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-12
Local Manager and Operator Passwords . . . . . . . . . . . . . . . . . . . . . . . 2-12
Password Command Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-13
SNMP Security Credentials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-14
802.1X Port-Access Credentials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-15
TACACS+ Encryption Key Authentication . . . . . . . . . . . . . . . . . . . . . 2-15
RADIUS Shared-Secret Key Authentication . . . . . . . . . . . . . . . . . . . . 2-16
SSH Client Public-Key Authentication . . . . . . . . . . . . . . . . . . . . . . . . . 2-16
Operating Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-19
Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-21
Front-Panel Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-23
When Security Is Important . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-23
Front-Panel Button Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-24
Clear Button . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-24
Reset Button . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-25
Restoring the Factory Default Configuration . . . . . . . . . . . . . . . . 2-25
Configuring Front-Panel Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-26
Disabling the Clear Password Function of the Clear Button . . . 2-29
Re-Enabling the Clear Button and Setting or
Changing the “Reset-On-Clear” Operation . . . . . . . . . . . . . . . . . . 2-30
Changing the Operation of the Reset+Clear Combination . . . . . 2-31
Password Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-32
Disabling or Re-Enabling the Password Recovery Process . . . . . . . . 2-32
Password Recovery Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-34

v
3 Virus Throttling (Connection-Rate Filtering)
Overview of Connection-Rate Filtering . . . . . . . . . . . . . . . . . . . . . . . . . 3-1
Features and Benefits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2
General Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3
Filtering Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3
Sensitivity to Connection Rate Detection . . . . . . . . . . . . . . . . . . . . 3-4
Application Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-4
Operating Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-6
Unblocking a Currently Blocked Host . . . . . . . . . . . . . . . . . . . . . . 3-6
General Configuration Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-7
For a network that is relatively attack-free: . . . . . . . . . . . . . . . . . . . . . 3-7
For a network that appears to be under significant attack: . . . . . . . . . 3-8
Configuring Connection-Rate Filtering . . . . . . . . . . . . . . . . . . . . . . . . . 3-9
Global and Per-Port Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-9
Enabling Connection-Rate Filtering and Configuring
Sensitivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-10
Configuring the Per-Port Filtering Mode . . . . . . . . . . . . . . . . . . . 3-11
Example of a Basic Connection-Rate Filtering Configuration . . 3-12
Viewing and Managing Connection-Rate Status . . . . . . . . . . . . . . . . . 3-14
Viewing Connection-Rate Configuration . . . . . . . . . . . . . . . . . . . 3-14
Listing Currently-Blocked Hosts . . . . . . . . . . . . . . . . . . . . . . . . . . 3-15
Unblocking Currently-Blocked Hosts . . . . . . . . . . . . . . . . . . . . . . 3-15
Configuring and Applying Connection-Rate ACLs . . . . . . . . . . . . . . 3-17
Connection-Rate ACL Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-18
Configuring a Connection-Rate ACL Using
Source IP Address Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-19
Configuring a Connection-Rate ACL Using UDP/TCP Criteria . . . . . 3-21
Applying Connection-Rate ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-24
Using CIDR Notation To Enter the ACE Mask . . . . . . . . . . . . . . . . . . 3-24
Example of Using an ACL in a Connection-Rate Configuration . . . . 3-25
Connection-Rate ACL Operating Notes . . . . . . . . . . . . . . . . . . . . . . . . 3-27

vi
4 Web and MAC Authentication
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1
Web Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2
MAC Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2
Concurrent Web and MAC Authentication . . . . . . . . . . . . . . . . . . . . . . 4-3
Authorized and Unauthorized Client VLANs . . . . . . . . . . . . . . . . . . . . . 4-3
RADIUS-Based Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-4
Wireless Clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-4
How Web and MAC Authentication Operate . . . . . . . . . . . . . . . . . . . . 4-5
Web-based Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-5
MAC-based Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-7
Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-9
Operating Rules and Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-10
Setup Procedure for Web/MAC Authentication . . . . . . . . . . . . . . . . . 4-12
Before You Configure Web/MAC Authentication . . . . . . . . . . . . . . . . 4-12
Configuring the RADIUS Server To Support MAC Authentication . . 4-15
Configuring the Switch To Access a RADIUS Server . . . . . . . . . . . . . 4-15
Configuring Web Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-18
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-18
Configuration Commands for Web Authentication . . . . . . . . . . . . . . 4-19
Show Commands for Web Authentication . . . . . . . . . . . . . . . . . . . . . . 4-26
Customizing Web Authentication HTML Files (Optional) . . . . . . . 4-32
Implementing Customized Web-Auth Pages . . . . . . . . . . . . . . . . . . . . 4-32
Operating Notes and Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-32
Customizing HTML Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-33
Customizable HTML Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-34
Configuring MAC Authentication on the Switch . . . . . . . . . . . . . . . . 4-48
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-48
Configuration Commands for MAC Authentication . . . . . . . . . . . . . . 4-49
Configuring the Global MAC Authentication Password . . . . . . . 4-49
Configuring a MAC-based Address Format . . . . . . . . . . . . . . . . . 4-51
Configuring Custom Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-54
Web Page Display of Access Denied Message . . . . . . . . . . . . . . . 4-56

vii
HTTP Redirect When MAC Address Not Found . . . . . . . . . . . . . . . . . 4-59
How HTTP Redirect Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-60
Diagram of the Registration Process . . . . . . . . . . . . . . . . . . . . . . . 4-62
Using the Restrictive-Filter Option . . . . . . . . . . . . . . . . . . . . . . . . 4-63
Show Command Output . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-63
Reauthenticating a MAC-Auth Client . . . . . . . . . . . . . . . . . . . . . . . 4-63
Configuring the Registration Server URL . . . . . . . . . . . . . . . . . . . 4-64
Unconfiguring a MAC-Auth Registration Server . . . . . . . . . . . . . 4-64
Operating Notes for HTTP Redirect . . . . . . . . . . . . . . . . . . . . . . . 4-64
Show Commands for MAC-Based Authentication . . . . . . . . . . . . . . . 4-65
Client Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-71
5 TACACS+ Authentication
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1
Terminology Used in TACACS Applications: . . . . . . . . . . . . . . . . . . . . 5-2
General System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-4
General Authentication Setup Procedure . . . . . . . . . . . . . . . . . . . . . . . 5-4
Configuring TACACS+ on the Switch . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-7
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-7
CLI Commands Described in this Section . . . . . . . . . . . . . . . . . . . . . . . 5-8
Viewing the Switch’s Current Authentication Configuration . . . . . . . 5-8
Viewing the Switch’s Current TACACS+
Server Contact Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-9
Configuring the Switch’s Authentication Methods . . . . . . . . . . . . . . . 5-10
Using the Privilege-Mode Option for Login . . . . . . . . . . . . . . . . . 5-10
Authentication Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-12
Configuring the TACACS+ Server for Single Login . . . . . . . . . . . . . . 5-13
Configuring the Switch’s TACACS+ Server Access . . . . . . . . . . . . . . 5-17
How Authentication Operates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-24
General Authentication Process Using a TACACS+ Server . . . . . . . . 5-24
Local Authentication Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-25
Using the Encryption Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-26
General Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-26
Encryption Options in the Switch . . . . . . . . . . . . . . . . . . . . . . . . . 5-27

viii
Controlling WebAgent Access When
Using TACACS+ Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-28
Messages Related to TACACS+ Operation . . . . . . . . . . . . . . . . . . . . . 5-29
Operating Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-30
6 RADIUS Authentication, Authorization, and Accounting
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-1
Authentication Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-1
Accounting Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-2
RADIUS-Administered CoS and Rate-Limiting . . . . . . . . . . . . . . . . . . . 6-2
RADIUIS-Administered Commands Authorization . . . . . . . . . . . . . . . . 6-2
SNMP Access to the Switch’s Authentication Configuration MIB . . . 6-2
Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-3
Switch Operating Rules for RADIUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-4
General RADIUS Setup Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-5
Configuring the Switch for RADIUS Authentication . . . . . . . . . . . . . 6-6
Outline of the Steps for Configuring RADIUS Authentication . . . . . . 6-8
1. Configure Authentication for the Access Methods
You Want RADIUS To Protect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-9
2. Enable the (Optional) Access Privilege Option . . . . . . . . . . . . . . . . 6-12
3. Configure the Switch To Access a RADIUS Server . . . . . . . . . . . . 6-14
4. Configure the Switch’s Global RADIUS Parameters . . . . . . . . . . . 6-17
Using Multiple RADIUS Server Groups . . . . . . . . . . . . . . . . . . . . . . . . 6-21
Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-21
Enhanced Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-22
Displaying the RADIUS Server Group Information . . . . . . . . . . . 6-24
Cached Reauthentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-26
Timing Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-27
Using SNMP To View and Configure
Switch Authentication Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-30
Changing and Viewing the SNMP Access Configuration . . . . . . . . . . 6-31
Local Authentication Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-34
Controlling WebAgent Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-35