Brocade Multi-Service IronWare Security Configuration Guide (Supporting R05.6.00) User Manual
Multi-service ironware, Security configuration guide
Table of contents
Document Outline
- Contents
- Securing Access to Management Functions
- Securing access methods
- Restricting remote access to management functions
- Using ACLs to restrict remote access
- Defining the console idle time
- Restricting remote access to the device to specific IP addresses
- Defining the Telnet idle time
- Specifying the maximum login attempts for Telnet access
- Restricting remote access to the device to specific VLAN IDs
- Enabling specific access methods
- Setting passwords
- Setting up local user accounts
- Enabling strict password enforcement
- Web interface login lockout
- Creating an encrypted all-numeric password
- Granting access by time of day
- Configuring SSL security for the Web Management Interface
- Configuring TACACS or TACACS+ security
- How TACACS+ differs from TACACS
- TACACS or TACACS+ authentication, authorization, and accounting
- TACACS or TACACS+ configuration considerations
- Enabling SNMP traps for TACACS
- Identifying the TACACS or TACACS+ servers
- Specifying different servers for individual AAA TACACS functions
- Setting optional TACACS or TACACS+ parameters
- Configuring authentication-method lists for TACACS or TACACS+
- Configuring TACACS+ authorization
- Configuring TACACS+ accounting
- Configuring an interface as the source for all TACACS or TACACS+ packets
- Displaying TACACS or TACACS+ statistics and configuration information
- Validating TACACS+ reply packets
- Configuring RADIUS security
- RADIUS authentication, authorization, and accounting
- RADIUS configuration considerations
- RADIUS configuration procedure
- Configuring Brocade-specific attributes on the RADIUS server
- Enabling SNMP traps for RADIUS
- Identifying the RADIUS server to the Brocade device
- Specifying different servers for individual AAA functions
- Radius health check
- Setting RADIUS parameters
- Configuring authentication-method lists for RADIUS
- Configuring RADIUS authorization
- Configuring RADIUS accounting
- Configuring an interface as the source for all RADIUS packets
- Configuring an IPv6 interface as the source for all RADIUS packets
- Displaying RADIUS configuration information
- Configuring AAA on the console
- Configuring AAA authentication-method lists for login
- Configuring authentication-method lists
- Layer 2 Access Control Lists
- Configuration rules and notes
- Creating a numbered Layer-2 ACL table
- Filtering and priority manipulation based on 802.1p priority
- Inserting and deleting Layer-2 ACL clauses
- Increasing the maximum number of clauses per Layer-2 ACL table
- Binding a numbered Layer-2 ACL table to an interface
- Filtering by MAC address
- Filtering broadcast traffic
- Using the priority option
- Using the priority force option
- Using the priority mapping option
- Using the drop-precedence keyword option
- Using the drop-precedence-force keyword option
- Using the mirror keyword option
- Using the mark flow ID keyword option
- Creating a named Layer-2 ACL table
- ACL accounting
- Displaying Layer-2 ACLs
- Access Control List
- How the Brocade device processes ACLs
- Disabling outbound ACLs for switching traffic
- Default ACL action
- Types of IP ACLs
- ACL IDs and entries
- Configuring numbered and named ACLs
- Simultaneous per VLAN rate limit and QoS
- Modifying ACLs
- Applying ACLs to interfaces
- Enabling ACL duplication check
- Enabling ACL conflict check
- Enabling ACL filtering of fragmented or non-fragmented packets
- ACL filtering for traffic switched within a virtual routing interface
- Filtering and priority manipulation based on 802.1p priority
- ICMP filtering for extended ACLs
- Binding IPv4 inbound ACLs to a management port
- IP broadcast ACL
- IP broadcast ACL CAM
- IP receive ACLs
- ACL CAM sharing for inbound ACLs for IPv4 ACLs (Brocade NetIron XMR and Brocade MLX series devices only)
- Matching on TCP header flags for IPv4 ACLs
- ACL deny logging
- ACL accounting
- Commands
- Configuring an IPv6 Access Control List
- Configuration considerations for dual inbound ACLS on Brocade NetIron CES and Brocade NetIron CER devices
- Configuration considerations for IPv6 ACL and multicast traffic for 2X100GE modules installed on NetIron MLX and NetIron XMR devices
- Configuration considerations for IPv6 outbound ACLs on VPLS, VLL, and VLL-local endpoints
- ACL editing and sequence numbers
- Using IPv6 ACLs as input to other features
- Configuring an IPv6 ACL
- Extended IPv6 ACLs
- Displaying IPv6 ACL definitions
- CAM partitioning
- Applying an IPv6 ACL
- Adding a comment to an IPv6 ACL entry
- ACL CAM sharing for inbound IPv6 ACLs
- Filtering and priority manipulation based on 802.1p priority
- ACL accounting
- Enabling and disabling ACL accounting on Brocade NetIron XMR and Brocade MLX series devices
- ACL accounting on Brocade NetIron CES 2000 and Brocade NetIron CER 2000 devices
- Enabling and disabling IPv6 ACL accounting on Brocade NetIron CES 2000 and Brocade NetIron CER 2000 devices
- Displaying statistics for IPv6 ACL accounting
- IPv6 receive ACLs
- Commands
- Configuring Secure Shell and Secure Copy
- SSH server version 2 support
- Supported SSHv2 clients
- Supported features
- Configuring SSH server
- Generating a host key pair
- Enabling and disabling SSH server by generating and deleting host keys
- Configuring DSA or RSA public key authentication
- Configuring DSA public key authentication
- Setting optional parameters
- Disabling 3-DES
- Displaying SSH server connection information
- Ending an SSH server connection
- Outbound SSHv2 client
- Using an SSH2 client
- Displaying SSH2 client information
- Using Secure Copy
- SSH server version 2 support
- Configuring Multi-Device Port Authentication
- How multi-device port authentication works
- Configuring multi-device port authentication
- Enabling multi-device port authentication
- Configuring an authentication method list for 802.1x
- Setting RADIUS parameters
- Specifying the format of the MAC addresses sent to the RADIUS server
- Specifying the authentication-failure action
- Defining MAC address filters
- Configuring dynamic VLAN assignment
- Specifying the VLAN to which a port is moved after the RADIUS-specified VLAN assignment expires
- Saving dynamic VLAN assignments to the running configuration file
- Clearing authenticated MAC addresses
- Disabling aging for authenticated MAC addresses
- Specifying the aging time for blocked MAC addresses
- Displaying multi-device port authentication information
- Using the MAC Port Security Feature
- Overview
- Configuring the MAC port security feature
- Enabling the MAC port security feature
- Setting the maximum number of secure MAC addresses for an interface
- Setting the port security age timer
- Specifying secure MAC addresses
- Autosaving secure MAC addresses to the startup-config file
- Setting to delete a dynamically learned MAC address on a disabled interface
- Specifying the action taken when a security violation occurs
- Denying specific MAC addresses
- Port security MAC violation limit
- Displaying port security information
- Configuring 802.1x Port Security
- Overview of 802.1x port security
- How 802.1x port security works
- 802.1x port security and sFlow
- Configuring 802.1x port security
- Configuring an authentication method list for 802.1x
- Setting RADIUS parameters
- Configuring dynamic VLAN assignment for 802.1x ports
- Disabling and enabling strict security mode for dynamic filter assignment
- Dynamically applying existing ACLs or MAC address filter
- Configuring per-user IP ACLs or MAC address filters
- Enabling 802.1x port security
- Setting the port control
- Configuring periodic re-authentication
- Re-authenticating a port manually
- Setting the quiet period
- Setting the interval for retransmission of EAP-request or identity frames
- Specifying the number of EAP-request or identity frame retransmissions
- Specifying a timeout for retransmission of messages to the Authentication Server
- Specifying a timeout for retransmission of EAP-request frames to the client
- Initializing 802.1x on a port
- Allowing multiple 802.1x clients to authenticate
- Displaying 802.1x information
- Sample 802.1x configurations
- Protecting against Denial of Service Attacks
- Securing SNMP Access
- ACL Editing and Sequence Numbers