H3C Technologies H3C S6300 Series Switches User Manual

Security configuration guide

H3C S6300 Switch Series

Security Configuration Guide

Hangzhou H3C Technologies Co., Ltd.
http://www.h3c.com

Software version: Release 23xx
Document version: 6W101-20150407

This manual is related to the following products:

H3C S5820V2 Series Switches H3C S5830 Series Switches H3C S5830V2 Series Switches H3C S3600V2 Series Switches

Table of contents

Document Outline

Title Page
Preface
- Audience
- Conventions
- About the H3C S6300 documentation set
- Obtaining documentation
- Technical support
- Documentation feedback
Contents
Configuring AAA
- Overview
- FIPS compliance
- AAA configuration considerations and task list
- Configuring AAA schemes
- Configuring AAA methods for ISP domains
- Enabling the session-control feature
- Setting the maximum number of concurrent login users
- Displaying and maintaining AAA
- AAA configuration examples
- Troubleshooting RADIUS
- Troubleshooting HWTACACS
- Troubleshooting LDAP
802.1X overview
- 802.1X architecture
- Controlled/uncontrolled port and port authorization status
- 802.1X-related protocols
  - Packet formats
    - EAP packet format
    - EAPOL packet format
  - EAP over RADIUS
    - EAP-Message
    - Message-Authenticator
- Initiating 802.1X authentication
  - 802.1X client as the initiator
  - Access device as the initiator
- 802.1X authentication procedures
Configuring 802.1X
- H3C implementation of 802.1X
- Configuration prerequisites
- 802.1X configuration task list
- Enabling 802.1X
- Enabling EAP relay or EAP termination
- Setting the port authorization state
- Specifying an access control method
- Setting the maximum number of concurrent 802.1X users on a port
- Setting the maximum number of authentication request attempts
- Setting the 802.1X authentication timeout timers
- Configuring the online user handshake function
- Configuring the authentication trigger function
  - Configuration guidelines
  - Configuration procedure
- Specifying a mandatory authentication domain on a port
- Configuring the quiet timer
- Enabling the periodic online user re-authentication function
- Displaying and maintaining 802.1X
- 802.1X authentication configuration example
Configuring MAC authentication
- Overview
  - User account policies
  - Authentication methods
- Configuration prerequisites
- Configuration task list
- Enabling MAC authentication
- Specifying a MAC authentication domain
- Configuring the user account format
- Configuring MAC authentication timers
- Setting the maximum number of concurrent MAC authentication users on a port
- Configuring MAC authentication delay
- Displaying and maintaining MAC authentication
- MAC authentication configuration examples
  - Local MAC authentication configuration example
  - RADIUS-based MAC authentication configuration example
Configuring portal authentication
- Overview
- Portal configuration task list
- Configuration prerequisites
- Configuring a portal authentication server
- Configuring a portal Web server
- Enabling portal authentication on an interface
  - Configuration restrictions and guidelines
  - Configuration procedure
- Referencing a portal Web server for an interface
- Controlling portal user access
- Configuring portal detection functions
- Configuring the portal fail-permit function
- Configuring BAS-IP for unsolicited portal packets sent to the portal authentication server
- Enabling portal roaming
- Logging out portal users
- Displaying and maintaining portal
- Portal configuration examples
- Troubleshooting portal
Configuring port security
- Overview
  - Port security features
    - NTK
    - Intrusion protection
  - Port security modes
- Configuration task list
- Enabling port security
- Setting port security's limit on the number of secure MAC addresses on a port
- Setting the port security mode
- Configuring port security features
  - Configuring NTK
  - Configuring intrusion protection
- Configuring secure MAC addresses
  - Configuration prerequisites
  - Configuration procedure
- Ignoring authorization information from the server
- Enabling MAC move
- Displaying and maintaining port security
- Port security configuration examples
- Troubleshooting port security
  - Cannot set the port security mode
  - Cannot configure secure MAC addresses
Configuring password control
- Overview
- FIPS compliance
- Password control configuration task list
- Enabling password control
- Setting global password control parameters
- Setting user group password control parameters
- Setting local user password control parameters
- Setting super password control parameters
- Displaying and maintaining password control
- Password control configuration example
Managing public keys
- Overview
- FIPS compliance
- Creating a local key pair
  - Configuration guidelines
  - Configuration procedure
- Distributing a local host public key
- Destroying a local key pair
- Configuring a peer host public key
  - Importing a peer host public key from a public key file
  - Entering a peer host public key
- Displaying and maintaining public keys
- Examples of public key management
  - Example for entering a peer host public key
  - Example for importing a public key from a public key file
Configuring PKI
- Overview
- FIPS compliance
- PKI configuration task list
- Configuring a PKI entity
- Configuring a PKI domain
- Requesting a certificate
- Aborting a certificate request
- Obtaining certificates
- Verifying PKI certificates
  - Verifying certificates with CRL checking
  - Verifying certificates without CRL checking
- Specifying the storage path for the certificates and CRLs
- Exporting certificates
- Removing a certificate
- Configuring a certificate access control policy
- Displaying and maintaining PKI
- PKI configuration examples
- Troubleshooting PKI configuration
Configuring IPsec
- Overview
- IPsec tunnel establishment
- Implementing ACL-based IPsec
- Configuring IPsec for IPv6 routing protocols
  - Configuration task list
  - Configuring a manual IPsec profile
- Configuring SNMP notifications for IPsec
- Displaying and maintaining IPsec
- IPsec configuration examples
Configuring IKE
- Overview
- FIPS compliance
- IKE configuration prerequisites
- IKE configuration task list
- Configuring an IKE profile
- Configuring an IKE proposal
- Configuring an IKE keychain
- Configuring the global identity information
- Configuring the IKE keepalive function
- Configuring the IKE NAT keepalive function
- Configuring IKE DPD
- Enabling invalid SPI recovery
- Setting the maximum number of IKE SAs
- Configuring SNMP notifications for IKE
- Displaying and maintaining IKE
- IKE configuration examples
  - Main mode IKE with pre-shared key authentication configuration example
    - Network requirements
    - Configuration procedure
  - Verifying the configuration
- Troubleshooting IKE
Configuring SSH
- Overview
  - How SSH works
  - SSH authentication methods
- FIPS compliance
- Configuring the device as an SSH server
- Configuring the device as an Stelnet client
- Configuring the device as an SFTP client
- Configuring the device as an SCP client
- Displaying and maintaining SSH
- Stelnet configuration examples
- SFTP configuration examples
  - Password authentication enabled SFTP server configuration example
    - Network requirements
    - Configuration procedure
  - Publickey authentication enabled SFTP client configuration example
    - Network requirements
    - Configuration procedure
- SCP configuration examples
  - Network requirements
  - Configuration procedure
- NETCONF over SSH configuration example with password authentication
Configuring SSL
- Overview
  - SSL security services
  - SSL protocol stack
- FIPS compliance
- SSL configuration task list
- Configuring an SSL server policy
- Configuring an SSL client policy
- Displaying and maintaining SSL
Configuring IP source guard
- Overview
  - Static IP source guard binding entries
  - Dynamic IP source guard binding entries
    - Dynamic IPv4 source guard
    - Dynamic IPv6 source guard
- IP source guard configuration task list
- Configuring the IPv4 source guard feature
  - Enabling IPv4 source guard on an interface
  - Configuring a static IPv4 source guard binding entry
    - Configuring a global static IPv4 source guard binding entry
    - Configuring a static IPv4 source guard binding entry on an interface
- Configuring the IPv6 source guard feature
  - Enabling IPv6 source guard on an interface
  - Configuring a static IPv6 source guard binding entry
    - Configuring a global static IPv6 source guard binding entry
    - Configuring a static IPv6 source guard binding entry on an interface
- Displaying and maintaining IP source guard
- IP source guard configuration examples
Configuring ARP attack protection
- ARP attack protection configuration task list
- Configuring unresolvable IP attack protection
- Configuring ARP packet rate limit
  - Configuration guidelines
  - Configuration procedure
- Configuring source MAC-based ARP attack detection
- Configuring ARP packet source MAC consistency check
- Configuring ARP active acknowledgement
- Configuring authorized ARP
  - Configuration procedure
- Configuring ARP detection
- Configuring ARP scanning and fixed ARP
  - Configuration restrictions and guidelines
  - Configuration procedure
- Configuring ARP gateway protection
- Configuring ARP filtering
Configuring MFF
- Overview
- Configuring MFF
- Displaying and maintaining MFF
- MFF configuration examples
  - Manual-mode MFF configuration example in a tree network
    - Network requirements
    - Configuration procedure
  - Manual-mode MFF configuration example in a ring network
    - Network requirements
    - Configuration procedure
Configuring crypto engines
- Overview
- Displaying and maintaining crypto engines
Configuring FIPS
- Overview
- Configuration restrictions and guidelines
- Configuring FIPS mode
- FIPS self-tests
- Displaying and maintaining FIPS
- FIPS configuration examples
Index