Sign In
Upload
Manuals
Brands
HP Manuals
Switch
E6600-48G
HP E6600-48G Manuals
Manuals and User Guides for HP E6600-48G. We have
2
HP E6600-48G manuals available for free PDF download: Access Security Manual, Advanced Traffic Management Manual
HP E6600-48G Access Security Manual (778 pages)
Switch Software
Brand:
HP
| Category:
Switch
| Size: 3.2 MB
Table of Contents
Table of Contents
7
Product Documentation
27
About Your Switch Manual Set
27
Electronic Publications
27
Software Feature Index
28
Security Overview
35
Introduction
35
About this Guide
35
For more Information
35
Access Security Features
36
Network Security Features
40
Getting Started with Access Security
43
Physical Security
43
Quick Start: Using the Management Interface Wizard
44
CLI: Management Interface Wizard
45
Webagent: Management Interface Wizard
46
SNMP Security Guidelines
47
Precedence of Security Options
49
Precedence of Port-Based Security Options
49
Precedence of Client-Based Authentication
49
Dynamic Configuration Arbiter
49
HP E-Network Immunity Manager
50
Arbitrating Client-Specific Attributes
51
HP PMC Identity Driven Manager (IDM)
54
Configuring Username and Password Security
55
Overview
55
Configuring Local Password Security
58
Menu: Setting Passwords
58
CLI: Setting Passwords and Usernames
60
Setting an Encrypted Password
63
Webagent: Setting Passwords and Usernames
64
Saving Security Credentials in a Config File
65
Benefits of Saving Security Credentials
65
Enabling the Storage and Display of Security Credentials
66
Security Settings that Can be Saved
67
Executing Include-Credentials or Include-Credentials
67
Store-In-Config
67
No Include-Credentials Store-In-Config Option
68
Local Manager and Operator Passwords
69
Password Command Options
70
SNMP Security Credentials
71
802.1X Port-Access Credentials
72
TACACS+ Encryption Key Authentication
72
RADIUS Shared-Secret Key Authentication
73
Include-Credentials Radius-Tacacs-Only Option
74
SSH Client Public-Key Authentication
75
Displaying the Status of Include-Credentials on the Switch
78
Storage States When Using Include-Credentials
79
Operating Notes
80
Restrictions
82
Encrypting Credentials in the Configuration File
83
Overview
83
Enabling Encrypt-Credentials
84
Displaying the State of Encrypt-Credentials
85
Affected Commands
86
Important Operating Notes
87
Interaction with Include-Credentials Settings
87
Front-Panel Security
88
When Security Is Important
88
Front-Panel Button Functions
89
Clear Button
89
Reset Button
90
Restoring the Factory Default Configuration
90
Configuring Front-Panel Security
91
Disabling the Clear Password Function of the Clear Button
94
Re-Enabling the Clear Button and Setting or Changing the "Reset-On-Clear" Operation
95
Changing the Operation of the Reset+Clear Combination
96
Password Recovery
98
Disabling or Re-Enabling the Password Recovery Process
98
Password Recovery Process
100
Virus Throttling (Connection-Rate Filtering)
103
Overview of Connection-Rate Filtering
103
Features and Benefits
104
General Operation
105
Filtering Options
105
Application Options
106
Sensitivity to Connection Rate Detection
106
Operating Rules
107
Unblocking a Currently Blocked Host
108
General Configuration Guidelines
109
For a Network that Is Relatively Attack-Free
109
For a Network that Appears to be under Significant Attack
110
Configuring Connection-Rate Filtering
111
Global and Per-Port Configuration
111
Enabling Connection-Rate Filtering and Configuring
112
Sensitivity
112
Configuring the Per-Port Filtering Mode
113
Example of a Basic Connection-Rate Filtering Configuration
114
Viewing and Managing Connection-Rate Status
116
Viewing Connection-Rate Configuration
116
Listing Currently-Blocked Hosts
118
Unblocking Currently-Blocked Hosts
118
Configuring and Applying Connection-Rate Acls
120
Connection-Rate ACL Operation
121
Configuring a Connection-Rate ACL Using Source IP Address Criteria
122
Configuring a Connection-Rate ACL Using UDP/TCP Criteria
124
Applying Connection-Rate Acls
127
Using CIDR Notation to Enter the ACE Mask
127
Example of Using an ACL in a Connection-Rate Configuration
128
Connection-Rate ACL Operating Notes
130
Connection-Rate Log and Trap Messages
132
Web and MAC Authentication
133
Overview
133
Web Authentication
134
MAC Authentication
134
Concurrent Web and MAC Authentication
135
Authorized and Unauthorized Client Vlans
135
RADIUS-Based Authentication
136
Wireless Clients
136
How Web and MAC Authentication Operate
137
Web-Based Authentication
137
MAC-Based Authentication
139
Terminology
141
Operating Rules and Notes
142
Setup Procedure for Web/Mac Authentication
144
Before You Configure Web/Mac Authentication
144
Configuring the RADIUS Server to Support MAC Authentication
147
Configuring the Switch to Access a RADIUS Server
147
Configuring Web Authentication
150
Overview
150
Configuration Commands for Web Authentication
151
Show Commands for Web Authentication
158
Show Port-Access Web-Based Clients [Port-List]
159
Show Port-Access Web-Based Clients <Port-List> Detailed
160
Show Port-Access Web-Based Config [Port-List]
161
Show Port-Access Web-Based Config <Port-List> Detailed
162
Show Port-Access Web-Based Config [Port-List] Auth-Server
163
Show Port-Access Web-Based Config [Port-List] Web-Server
163
Customizing Web Authentication HTML Files (Optional)
164
Implementing Customized Web-Auth Pages
164
Operating Notes and Guidelines
164
Customizing HTML Templates
165
Customizable HTML Templates
166
Index.html
167
Accept.html
169
Authen.html
170
Reject_Unauthvlan.html
172
Retry_Login.html
175
Sslredirect.html
177
Rejectnovlan.html
179
Configuring MAC Authentication on the Switch
180
Overview
180
Configuration Commands for MAC Authentication
181
Configuring the Global MAC Authentication Password
181
Configuring a MAC-Based Address Format
183
Configuring Custom Messages
186
Web Page Display of Access Denied Message
188
HTTP Redirect When MAC Address Not Found
191
How HTTP Redirect Works
192
Diagram of the Registration Process
194
Reauthenticating a MAC-Auth Client
195
Show Command Output
195
Using the Restrictive-Filter Option
195
Configuring the Registration Server URL
196
Operating Notes for HTTP Redirect
196
Unconfiguring a MAC-Auth Registration Server
196
Show Commands for MAC-Based Authentication
197
Client Status
203
TACACS+ Authentication
205
Overview
205
Terminology Used in TACACS Applications
206
General System Requirements
208
General Authentication Setup Procedure
208
Configuring TACACS+ on the Switch
211
Before You Begin
211
CLI Commands Described in this Section
212
Viewing the Switch's Current Authentication Configuration
212
Viewing the Switch's Current TACACS+ Server Contact Configuration
213
Configuring the Switch's Authentication Methods
214
Using the Privilege-Mode Option for Login
214
Authentication Parameters
216
Configuring the TACACS+ Server for Single Login
216
Configuring the Switch's TACACS+ Server Access
221
How Authentication Operates
228
General Authentication Process Using a TACACS+ Server
228
Local Authentication Process
229
Using the Encryption Key
230
General Operation
230
Encryption Options in the Switch
231
Controlling Webagent Access When Using TACACS+ Authentication
232
Messages Related to TACACS+ Operation
233
Operating Notes
234
RADIUS Authentication, Authorization, and Accounting
235
Overview
235
Authentication Services
235
Accounting Services
236
RADIUS-Administered Cos and Rate-Limiting
236
RADIUS-Administered Commands Authorization
236
SNMP Access to the Switch's Authentication Configuration MIB
237
Terminology
238
Switch Operating Rules for RADIUS
239
General RADIUS Setup Procedure
240
Configuring the Switch for Radius Authentication
241
Outline of the Steps for Configuring RADIUS Authentication
242
Configure Authentication for the Access Methods You Want RADIUS to Protect
244
[ Local | None | Authorized]
244
Enable the (Optional) Access Privilege Option
247
Configure the Switch to Access a RADIUS Server
249
[Acct-Port < Port-Number >]
249
[Auth-Port < Port-Number >]
249
[Dyn-Authorization]
250
Configure the Switch's Global RADIUS Parameters
252
[No] Radius-Server Key < Global Key-String
253
Commands
257
Using Multiple RADIUS Server Groups
257
Enhanced Commands
258
Displaying the RADIUS Server Group Information
260
Cached Reauthentication
262
Timing Considerations
263
Using SNMP to View and Configure Switch Authentication Features
266
Changing and Viewing the SNMP Access Configuration
267
Local Authentication Process
270
Controlling Webagent Access
271
Commands Authorization
272
Enabling Authorization
273
Displaying Authorization Information
274
Configuring Commands Authorization on a RADIUS Server
274
Using Vendor Specific Attributes (Vsas)
274
Example Configuration on Cisco Secure ACS for MS Windows
277
Example Configuration Using Freeradius
280
VLAN Assignment in an Authentication Session
281
Tagged and Untagged VLAN Attributes
281
Additional RADIUS Attributes
282
MAC-Based Vlans
285
Accounting Services
286
Accounting Service Types
286
Operating Rules for RADIUS Accounting
287
Acct-Session-ID Options in a Management Session
288
Unique Acct-Session-ID Operation
288
Common Acct-Session-ID Operation
290
Configuring RADIUS Accounting
291
Configure the Switch to Access a RADIUS Server
292
Optional) Reconfigure the Acct-Session-ID Operation
294
Configure Accounting Types and the Controls for Sending Reports to the RADIUS Server
295
Optional) Configure Session Blocking and Interim Updating Options
300
Viewing RADIUS Statistics
301
General RADIUS Statistics
301
RADIUS Authentication Statistics
303
RADIUS Accounting Statistics
305
Changing RADIUS-Server Access Order
306
Creating Local Privilege Levels
309
Configuring Groups for Local Authorization
310
Configuring a Local User for a Group
311
Displaying Command Authorization Information
313
Dynamic Removal of Authentication
314
Limits
314
Overview
314
Configuring the RADIUS Vsas
314
Displaying the Port-Access Information
316
Operating Notes
317
Messages Related to RADIUS Operation
318
Configuring RADIUS Server Support for Switch Services
319
Overview
319
RADIUS Client and Server Requirements
319
Optional HP PCM+ and IDM Network Management Applications
320
RADIUS Server Configuration for Cos (802.1P Priority) and Rate-Limiting
321
Applied Rates for RADIUS-Assigned Rate Limits
323
Viewing the Currently Active Per-Port Cos and Rate-Limiting Configuration Specified by a RADIUS Server
325
Configuring and Using Dynamic (RADIUS-Assigned) Access Control Lists
329
Introduction
329
Terminology
329
Overview of RADIUS-Assigned, Dynamic Acls
333
Traffic Applications
333
Contrasting RADIUS-Assigned and Static Acls
335
How a RADIUS Server Applies a RADIUS-Assigned ACL to a Client on a Switch Port
337
General ACL Features, Planning, and Configuration
338
The Packet-Filtering Process
339
Operating Rules for RADIUS-Assigned Acls
339
Configuring an ACL in a RADIUS Server
341
Nas-Filter-Rule-Options
342
ACE Syntax in RADIUS Servers
344
Example Using the Standard Attribute (92) in an Ipv4 ACL
346
Example Using HP VSA 63 to Assign Ipv6 And/Or Ipv4 Acls
348
Example Using HP VSA 61 to Assign Ipv4 Acls
351
Configuration Notes
353
Configuring the Switch to Support RADIUS-Assigned
354
Acls
354
Displaying the Current RADIUS-Assigned ACL Activity
356
On the Switch
356
Event Log Messages
361
Causes of Client Deauthentication Immediately after Authenticating
361
Monitoring Shared Resources
361
Configuring Secure Shell (SSH)
363
Overview
363
Terminology
365
Prerequisite for Using SSH
366
Public Key Formats
366
Steps for Configuring and Using SSH for Switch and Client Authentication
367
General Operating Rules and Notes
369
Configuring the Switch for SSH Operation
370
Assigning a Local Login (Operator) and Enable (Manager) Password
371
Generating the Switch's Public and Private Key Pair
371
Configuring Key Lengths
374
Providing the Switch's Public Key to Clients
375
Enabling SSH on the Switch and Anticipating SSH Client Contact Behavior
377
Configuring the Switch for SSH Authentication
382
Use an SSH Client to Access the Switch
386
Further Information on SSH Client Public-Key Authentication
387
SSH Client and Secure Sessions
393
Opening a Secure Session to an HP Switch
394
Operating Notes
394
Copying Client Key Files
395
Copying the SSH-Client-Known-Hosts File
396
Replacing or Appending the SSH-Client-Known-Hosts File
396
Copying the SSH Client Known Hosts File to Another Location
397
Copying the Host Public Key
398
Removing the SSH Client Key Pair
398
Removing the SSH Client Known Hosts File
399
Displaying Open Sessions
399
Messages Related to SSH Operation
401
Logging Messages
402
Debug Logging
402
Overview
403
Configuring Secure Socket Layer (SSL)
403
Terminology
405
Authentication
406
Prerequisite for Using SSL
406
Steps for Configuring and Using SSL for Switch and Client
406
General Operating Rules and Notes
407
Configuring the Switch for SSL Operation
408
Assigning a Local Login (Operator) and Enabling (Manager) Password
408
Generating the Switch's Server Host Certificate
408
To Generate or Erase the Switch's Server Certificate
409
With the CLI
409
Comments on Certificate Fields
410
Generate a Self-Signed Host Certificate with the Webagent
414
Generate a CA-Signed Server Host Certificate with the Webagent
415
Enabling SSL on the Switch and Anticipating SSL Browser Contact Behavior
417
Using the CLI Interface to Enable SSL
418
Using the Webagent to Enable SSL
418
Common Errors in SSL Setup
420
Ipv4 Access Control Lists (Acls)
421
Introduction
421
Overview of Options for Applying Ipv4 Acls on the Switch
423
RADIUS-Assigned Acls
423
Static ACLS
423
Command Summary for Standard Ipv4 Acls
425
Command Summary for Ipv4 Extended Acls
426
Command Summary for Enabling, Disabling, and Displaying Acls
427
Terminology
428
ACL Applications
433
Overview
433
Types of Ipv4 Acls
433
RACL Applications
434
Static Port ACL and RADIUS-Assigned ACL Applications
436
VACL Applications
436
RADIUS-Assigned (Dynamic) Port ACL Applications
437
Multiple Acls on an Interface
439
Features Common to All ACL Applications
442
General Steps for Planning and Configuring Acls
443
Introduction
445
Ipv4 Static ACL Operation
445
The Packet-Filtering Process
446
Ipv4 Traffic Management and Improved Network Performance
449
Planning an ACL Application
449
Guidelines for Planning the Structure of a Static ACL
451
Security
451
Ipv4 ACL Configuration and Operating Rules
452
How an ACE Uses a Mask to Screen Packets for Matches
455
What Is the Difference between Network (or Subnet) Masks and the Masks Used with Acls
455
Rules for Defining a Match between a Packet and an Access Control Entry (ACE)
456
Configuring and Assigning an Ipv4 ACL
460
Overview
460
General Steps for Implementing Acls
460
Options for Permit/Deny Policies
461
ACL Configuration Structure
461
Standard ACL Structure
462
Extended ACL Configuration Structure
463
ACL Configuration Factors
465
The Sequence of Entries in an ACL Is Significant
465
A Configured ACL Has no Effect until You Apply It to an Interface
467
Allowing for the Implied Deny Function
467
You Can Assign an ACL Name or Number to an Interface Even if the ACL Does Not Exist in the Switch's Configuration
467
Using the CLI to Create an ACL
468
Using CIDR Notation to Enter the Ipv4 ACL Mask
469
Configuring Standard Acls
470
Command Summary for Standard Acls
470
Configuring Named, Standard Acls
475
Creating Numbered, Standard Acls
475
Configuring Extended Acls
479
Command Summary for Extended Acls
479
Configuring Named, Extended Acls
481
Configuring Numbered, Extended Acls
494
Adding or Removing an ACL Assignment on an Interface
501
Filtering Routed Ipv4 Traffic
501
Filtering Ipv4 Traffic Inbound on a VLAN
502
Filtering Inbound Ipv4 Traffic Per Port
503
Classifier-Based Rate-Limiting with RL-Pacls
504
Deleting an ACL
505
Editing an Existing ACL
506
Using the CLI to Edit Acls
506
General Editing Rules
506
Sequence Numbering in Acls
507
Inserting an ACE in an Existing ACL
508
Deleting an ACE from an Existing ACL
510
Resequencing the Aces in an ACL
511
Attaching a Remark to an ACE
512
Operating Notes for Remarks
515
Displaying ACL Configuration Data
517
Display an ACL Summary
518
Display the Content of All Acls on the Switch
519
Display the RACL and VACL Assignments for a VLAN
520
Display Static Port (and Trunk) ACL Assignments
521
Displaying the Content of a Specific ACL
523
Display All Acls and Their Assignments in the Routing Switch Startup-Config File and Running-Config File
526
Creating or Editing Acls Offline
527
Example of Using the Offline Process
528
Enable ACL "Deny" Logging
532
Requirements for Using ACL Logging
532
ACL Logging Operation
533
Enabling ACL Logging on the Switch
534
Configuring the Logging Timer
536
Monitoring Static ACL Performance
537
Example of ACL Performance Monitoring
539
Example of Resetting ACE Hit Counters to Zero
541
Ipv6 Counter Operation with Multiple Interface Assignments
542
Ipv4 Counter Operation with Multiple Interface Assignments
544
General ACL Operating Notes
548
Configuring Advanced Threat Protection
551
Introduction
551
DHCP Snooping
553
Overview
554
Enabling DHCP Snooping
555
Configuring DHCP Snooping Trusted Ports
557
Enabling DHCP Snooping on VLANS
557
Configuring Authorized Server Addresses
558
Using DHCP Snooping with Option 82
559
Changing the Remote-ID from a MAC to an IP Address
561
Disabling the MAC Address Check
561
The DHCP Binding Database
562
Operational Notes
563
Log Messages
564
Dynamic ARP Protection
566
Introduction
566
Configuring Trusted Ports
568
Enabling Dynamic ARP Protection
568
Adding an IP-To-MAC Binding to the DHCP Database
570
Configuring Additional Validation Checks on ARP Packets
571
Verifying the Configuration of Dynamic ARP Protection
571
Displaying ARP Packet Statistics
572
Dynamic IP Lockdown
573
Monitoring Dynamic ARP Protection
573
Prerequisite: DHCP Snooping
574
Protection against IP Source Address Spoofing
574
Filtering IP and MAC Addresses Per-Port and Per-VLAN
575
Enabling Dynamic IP Lockdown
576
Operating Notes
576
Adding an IP-To-MAC Binding to the DHCP Binding Database
578
Potential Issues with Bindings
578
Adding a Static Binding
579
Verifying the Dynamic IP Lockdown Configuration
579
Displaying the Static Configuration of IP-To-MAC Bindings
580
Debugging Dynamic IP Lockdown
581
Differences between Switch Platforms
582
Using the Instrumentation Monitor
584
Operating Notes
585
Configuring Instrumentation Monitor
586
Examples
587
Viewing the Current Instrumentation Monitor Configuration
588
Traffic/Security Filters and Monitors
589
Overview
589
Introduction
590
Filter Limits
590
Using Port Trunks with Filters
590
Filter Types and Operation
591
Operating Rules for Source-Port Filters
591
Source-Port Filters
591
Example
592
Named Source-Port Filters
593
Defining and Configuring Named Source-Port Filters
594
Operating Rules for Named Source-Port Filters
594
Using Named Source-Port Filters
596
Viewing a Named Source-Port Filter
596
Static Multicast Filters
602
Protocol Filters
603
Configuring Traffic/Security Filters
604
Configuring a Source-Port Traffic Filter
605
Configuring a Filter on a Port Trunk
606
Example of Creating a Source-Port Filter
606
Editing a Source-Port Filter
607
Configuring a Multicast or Protocol Traffic Filter
608
Filter Indexing
609
Displaying Traffic/Security Filters
610
Configuring Port-Based and User-Based Access Control (802.1X)
613
Overview
613
General Features
613
Why Use Port-Based or User-Based Access Control
613
802.1X Port-Based Access Control
615
Accounting
616
Alternative to Using a RADIUS Server
616
Terminology
617
Example of the Authentication Process
620
General 802.1X Authenticator Operation
620
VLAN Membership Priority
621
General Operating Rules and Notes
623
Do These Steps before You Configure 802.1X Operation
625
General Setup Procedure for 802.1X Access Control
625
Overview: Configuring 802.1X Authentication on the Switch
628
Configuring Switch Ports as 802.1X Authenticators
629
Enable 802.1X Authentication on Selected Ports
630
Enable the Selected Ports as Authenticators and Enable
630
The (Default) Port-Based Authentication
630
Specify User-Based Authentication or Return to Port-Based Authentication
631
Example: Configuring Port-Based 802.1X Authentication
632
Example: Configuring User-Based 802.1X Authentication
632
Reconfigure Settings for Port-Access
633
Configure the 802.1X Authentication Method
636
Enter the RADIUS Host IP Address(Es)
637
Enable 802.1X Authentication on the Switch
638
Optional: Configure 802.1X Controlled Directions
639
Optional: Reset Authenticator Operation
639
Wake-On-LAN Traffic
640
Example: Configuring 802.1X Controlled Directions
641
Operating Notes
641
Unauthenticated VLAN Access (Guest VLAN Access)
641
Characteristics of Mixed Port Access Mode
642
Configuring Mixed Port Access Mode
643
802.1X Open VLAN Mode
644
Introduction
644
VLAN Membership Priorities
645
Use Models for 802.1X Open VLAN Modes
646
Operating Rules for Authorized-Client and Unauthorized-Client Vlans
651
Setting up and Configuring 802.1X Open VLAN Mode
654
802.1X Open VLAN Operating Notes
659
Option for Authenticator Ports: Configure Port-Security to Allow Only 802.1X-Authenticated Devices
660
Port-Security
661
Configuring Switch Ports to Operate as Supplicants for 802.1X Connections to Other Switches
662
Example
662
Supplicant Port Configuration
664
Displaying 802.1X Configuration, Statistics, and Counters
667
Show Commands for Port-Access Authenticator
667
Viewing 802.1X Open VLAN Mode Status
676
Show Commands for Port-Access Supplicant
680
How RADIUS/802.1X Authentication Affects VLAN Operation
681
VLAN Assignment on a Port
682
Operating Notes
682
Example of Untagged VLAN Assignment in a RADIUS-Based Authentication Session
684
Enabling the Use of GVRP-Learned Dynamic Vlans in Authentication Sessions
688
Messages Related to 802.1X Operation
690
Configuring and Monitoring Port Security
691
Overview
691
Port Security
692
Basic Operation
692
Disabling Eavesdrop Prevention
693
Eavesdrop Prevention
693
Feature Interactions When Eavesdrop Prevention Is Disabled
694
Blocking Unauthorized Traffic
695
MIB Support
695
Trunk Group Exclusion
696
Planning Port Security
697
Port Security Command Options and Operation
698
Port Security Display Options
698
Configuring Port Security
702
Retention of Static Addresses
707
Clear MAC Address Table
712
Configuring Clearing of Learned MAC Addresses
713
MAC Lockdown
714
Differences between MAC Lockdown and Port Security
716
MAC Lockdown Operating Notes
717
Deploying MAC Lockdown
718
MAC Lockout
722
Port Security and MAC Lockout
724
Notice of Security Violations
725
Reading Intrusion Alerts and Resetting Alert Flags
725
How the Intrusion Log Operates
726
Keeping the Intrusion Log Current by Resetting Alert Flags
726
Menu: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags
727
CLI: Checking for Intrusions, Listing Intrusion Alerts, and Resetting Alert Flags
729
Using the Event Log to Find Intrusion Alerts
731
Operating Notes for Port Security
732
Using Authorized IP Managers
735
Overview
735
Options
737
Access Levels
737
Defining Authorized Management Stations
738
Overview of IP Mask Operation
738
Menu: Viewing and Configuring IP Authorized Managers
739
CLI: Viewing and Configuring Authorized IP Managers
740
Listing the Switch's Current Authorized IP Manager(S)
740
Configuring IP Authorized Managers for the Switch
741
Webagent: Configuring IP Authorized Managers
743
How to Eliminate the Web Proxy Server
744
Using a Web Proxy Server to Access the Webagent
744
Web Proxy Servers
744
Building IP Masks
745
Configuring Multiple Stations Per Authorized Manager IP Entry
745
Configuring One Station Per Authorized Manager IP Entry
745
Additional Examples for Authorizing Multiple Stations
747
Operating Notes
748
Key Management System
749
Overview
749
Terminology
750
Configuring Key Chain Management
750
Creating and Deleting Key Chain Entries
751
Assigning a Time-Independent Key to a Chain
752
Assigning Time-Dependent Keys to a Chain
753
Advertisement
HP E6600-48G Advanced Traffic Management Manual (460 pages)
Switch Software
Brand:
HP
| Category:
Switch
| Size: 2.21 MB
Table of Contents
Table of Contents
5
Product Documentation
15
About Your Switch Manual Set
15
Electronic Publications
15
Software Feature Index
16
1 Static Virtual Lans (Vlans)
23
Overview
23
Introduction
24
General VLAN Operation
24
Types of Static Vlans Available in the Switch
25
Designated Vlans
25
Port-Based Vlans
25
Protocol-Based Vlans
25
Terminology
26
Static VLAN Operation
27
VLAN Environments
28
VLAN Operation
29
Routing Options for Vlans
30
Overlapping (Tagged) Vlans
31
Per-Port Static VLAN Configuration Options
33
VLAN Operating Rules
34
General Steps for Using Vlans
38
Multiple VLAN Considerations
39
Single Forwarding Database Operation
40
Example of an Unsupported Configuration and How to Correct It
41
Multiple Forwarding Database Operation
42
Configuring Vlans
43
Menu: Configuring Port-Based VLAN Parameters
43
To Change VLAN Support Settings
44
Adding or Editing VLAN Names
45
Adding or Changing a VLAN Port Assignment
47
CLI: Configuring Port-Based and Protocol-Based VLAN Parameters
49
Customizing the Show Vlans Output
56
Creating an Alias for Show VLAN Commands
58
Note on Using Pattern Matching with the "Show Vlans Custom" Command
58
Changing the Number of Vlans Allowed on the Switch
59
Webagent: Viewing and Configuring VLAN Parameters
65
802.1Q VLAN Tagging
66
Special VLAN Types
71
VLAN Support and the Default VLAN
71
The Primary VLAN
71
The Secure Management VLAN
72
Preparation
74
Configuration
75
Using DHCP to Obtain an IP Address
76
Deleting the Management VLAN
79
Operating Notes for Management Vlans
79
Voice Vlans
80
Operating Rules for Voice Vlans
80
Components of Voice VLAN Operation
81
Voice VLAN Qos Prioritizing (Optional)
81
Voice VLAN Access Security
82
Effect of Vlans on Other Switch Features
82
Spanning Tree Operation with Vlans
82
IP Interfaces
83
VLAN MAC Address
83
Port Trunks
83
Port Monitoring
83
Jumbo Packet Support
83
VLAN Restrictions
84
Migrating Layer 3 Vlans Using VLAN MAC Configuration
85
VLAN MAC Address Reconfiguration
85
Handling Incoming and Outgoing VLAN Traffic
86
Sending Heartbeat Packets with a Configured MAC Address
87
Configuring a VLAN MAC Address with Heartbeat Interval
88
Operating Notes
88
Example
89
Verifying a VLAN MAC Address Configuration
89
2 Gvrp
91
Overview
91
Introduction
92
General Operation
93
Per-Port Options for Handling GVRP "Unknown Vlans
96
Per-Port Options for Dynamic VLAN Advertising and Joining
98
GVRP and VLAN Access Control
100
Advertisements and Dynamic Joins
100
Port-Leave from a Dynamic VLAN
100
Planning for GVRP Operation
101
Configuring GVRP on a Switch
102
Menu: Viewing and Configuring GVRP
102
CLI: Viewing and Configuring GVRP
103
Web: Viewing and Configuring GVRP
107
GVRP Operating Notes
107
3 Multiple Instance Spanning-Tree Operation
109
Overview
109
Multiple Spanning Tree Protocol (MSTP)
112
MSTP Structure
113
How MSTP Operates
115
MST Regions
115
Regions, Legacy STP and RSTP Switches, and the Common Spanning Tree (CST)
117
MSTP Operation with 802.1Q Vlans
118
Terminology
119
Operating Rules
121
MSTP Compatibility with RSTP or STP
122
Configuring MSTP
123
Planning an MSTP Application
123
MSTP Configuration Overview
125
Configuring MSTP Operation Mode and Global Settings
127
Configuring MSTP Per-Port Parameters
132
Configuring Per Port Parameters
133
Configuring BPDU Filtering
136
Configuring BPDU Protection
137
PVST Protection and Filtering
140
Configuring MST Instance Parameters
145
Configuring MST Instance Per-Port Parameters
147
Enabling or Disabling Spanning Tree Operation
150
Enabling an Entire MST Region at Once or Exchanging One Region Configuration for Another
150
MSTP VLAN Configuration Enhancement
152
Preconfiguring Vlans in an MST Instance
153
Configuring MSTP Instances with the VLAN Range Option
154
Operating Notes for the VLAN Configuration Enhancement
156
How to Save Your Current Configuration
157
Displaying MSTP Statistics and Configuration
159
Displaying Global MSTP Status
160
Displaying Detailed Port Information
162
Displaying Status for a Specific MST Instance
163
Displaying the MSTP Configuration
164
Troubleshooting an MSTP Configuration
168
Displaying the Change History of Root Bridges
168
Displaying Debug Counters for All MST Instances
171
Displaying Debug Counters for One MST Instance
172
Displaying Debug Counters for Ports in an MST Instance
174
Field Descriptions in MSTP Debug Command Output
176
Troubleshooting MSTP Operation
179
Loop Protection
180
Configuring Loop Protection
182
Changing Modes
183
Loop Protection in Port Mode
183
Loop Protection in VLAN Mode
183
Operating Notes
184
Viewing Loop Protection Status
184
Displaying Loop Protection Status in Port Mode
184
Displaying Loop Protection Status in VLAN Mode
185
STP Loop Guard
186
4 Switch Meshing
193
Introduction
193
Switch Meshing Fundamentals
195
Terminology
195
Operating Rules
196
Using a Heterogeneous Switch Mesh
198
Bringing up a Switch Mesh Domain
199
Further Operating Information
199
Configuring Switch Meshing
200
Preparation
200
Menu: to Configure Switch Meshing
200
CLI: to Configure and View Switch Meshing
203
CLI: Configuring Switch Meshing
203
Viewing Switch Mesh Status
204
Operating Notes for Switch Meshing
209
Flooded Traffic
209
Unicast Packets with Unknown Destinations
210
Spanning Tree Operation with Switch Meshing
211
Filtering/Security in Meshed Switches
213
IP Multicast (IGMP) in Meshed Switches
213
Static Vlans
213
Dynamic Vlans
214
Jumbo Packets
214
Mesh Design Optimization
215
Other Requirements and Restrictions
216
5 Quality of Service: Managing Bandwidth more Effectively
219
Using Quality of Service Policies
219
Qos Terminology
222
Qos Operation
224
Globally-Configured Qos
225
Classifier-Based Qos
226
Qos Packet Classification
227
Globally-Configured Packet Classification
227
Classifier-Based Match Criteria
228
Qos Traffic Marking
229
Globally-Configured Traffic Marking
229
Layer 2 802.1P Prioritization
229
Layer 3 DSCP Marking
231
VLAN and Untagged VLAN Environments
232
Classifier-Based Traffic Marking
233
Globally-Configured Qos
234
Global Qos Configuration Procedure
234
Viewing a Global Qos Configuration
236
Global Qos Restrictions
237
Global TCP/UDP Classifier
239
Assigning an 802.1P Priority for a Global TCP/UDP Classifier
240
Operating Notes on Using TCP/UDP Port Ranges
241
Assigning a DSCP Policy for a Global TCP/UDP Classifier
242
Displaying Resource Usage for Qos Policies
248
Global IP-Device Classifier
250
Assigning a Priority for a Global IP-Device Classifier
251
Assigning a DSCP Policy for a Global IP-Device Classifier
253
Global IP Type-Of-Service Classifier
258
Ipv4 Tos/Ipv6 Traffic Class Byte
259
Assigning an 802.1P Priority for a Global IP-Precedence Classifier
261
Assigning an 802.1P Priority for a Global IP-Diffserv Classifier
262
Assigning a DSCP Policy for a Global IP-Diffserv Classifier
266
Comparison of Global IP Type-Of-Service Classifiers
270
Global Layer-3 Protocol Classifier
271
Assigning a Priority for a Global Layer-3 Protocol Classifier
271
Global VLAN-ID Classifier
273
Assigning a Priority for a Global VLAN-ID Classifier
273
Assigning a DSCP Policy for a Global VLAN-ID Classifier
275
Global Source-Port Classifier
280
Assigning a Priority for a Global Source-Port Classifier
280
Assigning a DSCP Policy for a Global Source-Port Classifier
282
IP Multicast (IGMP) Interaction with Qos
288
Advanced Classifier-Based Qos
289
Classifier-Based Qos Model
290
Classifier-Based Qos Configuration Procedure
290
Configuring Qos Actions in a Policy
295
Override of Global Qos Settings
300
Viewing a Classifier-Based Qos Configuration
301
Classifier-Based Qos Restrictions
305
Interaction with Other Software Features
305
Classifier-Based Qos Configuration Examples
306
Qos Policy for Layer 4 TCP/UDP Traffic
307
Qos Policy for Subnet Traffic
307
Differentiated Services Codepoint (DSCP) Mapping
308
Default Priority Settings for Selected Codepoints
309
Displaying Non-Default Codepoint Settings
310
Notes on Changing a Priority Setting
311
Error Messages for DSCP Policy Changes
312
Example of Changing the Priority Setting on a Policy When One or more Classifiers Are Currently Using the Policy
313
Qos Queue Configuration
315
Mapping of Outbound Port Queues
316
Impact of Qos Queue Configuration on Guaranteed Minimum Bandwidth (GMB)
316
Minimum Guaranteed Bandwidth with 8 Queues
317
Configuring the Number of Priority Queues
318
Viewing the Qos Queue Configuration
319
6 Stack Management for the 3500, 3500Yl, 6200Yl and 6600 Switches
321
Introduction to Stack Management on the 3500, 3500Yl, 6200Yl and 6600 Switches
321
Components of HP Stack Management
323
General Stacking Operation
323
Operating Rules for Stacking
325
General Rules
325
Specific Rules
326
Configuring Stack Management
327
Overview of Configuring and Bringing up a Stack
327
General Steps for Creating a Stack
329
Using the Menu Interface to View Stack Status and Configure Stacking
331
Using the Menu Interface to View and Configure a Commander Switch
331
Using the Menu to Manage a Candidate Switch
333
Using the Commander to Manage the Stack
335
Using the Commander to Access Member Switches for Configuration Changes and Monitoring Traffic
341
Converting a Commander or Member to a Member of Another Stack
342
Monitoring Stack Status
343
Using the CLI to View Stack Status and Configure Stacking
347
Using the CLI to View Stack Status
349
Using the CLI to Configure a Commander Switch
351
Adding to a Stack or Moving Switches between Stacks
353
Using the CLI to Remove a Member from a Stack
358
Using the CLI to Access Member Switches for Configuration Changes and Traffic Monitoring
360
SNMP Community Operation in a Stack
362
Using the CLI to Disable or Re-Enable Stacking
363
Transmission Interval
363
Stacking Operation with Multiple Vlans Configured
363
Status Messages
364
7 Qinq (Provider Bridging)
365
Overview
365
Introduction
366
How Qinq Works
367
Terminology
368
Operating Rules and Guidelines
369
Enabling Qinq and Configuring Qinq Modes
369
Configuring Vlans
370
Qinq Mixed Vlan Mode
370
Operating Notes and Restrictions
372
Configuring Qinq
375
General Configuration Steps
375
Enabling Qinq
376
Setting up S-Vlans
376
Configuring Per-Port S-VLAN Membership
377
Configuring Port-Types
378
Configuration Example
379
Updating Qinq Configurations
384
Changing Qinq Modes
384
Disabling Qinq
384
Changing VLAN Port Memberships (Mixed Vlan Mode)
384
Moving Ports between C-Vlans and S-Vlans (Mixed Vlan Mode)
385
Displaying Qinq Config and Status
386
Show Commands for Qinq
386
Show Commands for Vlans
387
Displaying Spanning Tree Status
389
Effects of Qinq on Other Switch Features
390
Event Log Messages
396
8 Classifier-Based Software Configuration
397
Introduction
397
Traffic Classes
398
Traffic Class-Based Configuration Model
398
Creating a Traffic Class
400
Using Match Criteria
400
Traffic Class Configuration Procedure
401
Optional ICMP Match Criteria
410
Optional IGMP Match Criteria
413
Optional TCP and UDP Match Criteria
414
Using CIDR Notation for Ipv4/Ipv6 Addresses
416
Resequencing Match/Ignore Statements
420
Creating a Service Policy
421
Creating a PBR Policy
425
Troubleshooting PBR
427
Modifying Classes in a Policy
427
Resequencing Classes in a Policy
429
Applying a Service Policy to an Interface
430
Displaying Statistics for a Policy
433
Where to Go from here
434
Zone Classes
435
Zone Class-Based Configuration
436
Creating a Zone Class
437
Creating a Zone Policy
439
Modifying Zones and Policies
441
Applying a Zone Policy to a ONE Application
442
Troubleshooting Problems
444
Where to Go from here
445
Index
447
Advertisement
Related Products
HP E6600-24G
HP E6600-24G-4XG
HP E6600-24G-24XG
HP E6600-48G-4XG
HP E6200yl-24G
HP E5400 zl Series
HP procurv e9315m
HP E5412-92G-PoE+/4SFP zl
HP E1369A
HP E3800-24G-2XGT-PoE+ tl
HP Categories
Desktop
Laptop
Server
Monitor
Switch
More HP Manuals
Login
Sign In
OR
Sign in with Facebook
Sign in with Google
Upload manual
Upload from disk
Upload from URL