Numerics 3DES 6-3, 7-3 802.1X See port-based access control. 8-1 A aaa authentication 4-8 aaa port-access See Web or MAC Authentication. access levels, authorized IP managers 11-3 accounting address authorized for port security 9-3 authentication See TACACS. authorized addresses for IP management security 11-4 for port security 9-3 authorized IP managers access levels 11-3 building IP masks 11-9 configuring in browser interface 11-7, 11-9 configuring in console 11-5 definitions of single and multiple 11-4 effect of duplicate IP addresses 11-12 IP mask for multiple stations 11-10 IP mask for single station 11-9 IP mask operation 11-4 operating notes 11-12 overview 11-1 precedence over other security 11-2 troubleshooting 11-12 C certificate CA-signed 7-4 root 7-4 self-signed 7-4 Clear button to delete password protection 2-5 configuration port security 9-5 RADIUS SSH See SSH. connection inactivity time 2-3 console, for configuring authorized IP managers 11-5 D DES 6-3, 7-3 disclaimer 1-ii duplicate IP address effect on authorized IP managers 11-12 E event log intrusion alerts 9-36 F filter, source-port applicable models 10-2 configuring 10-5 editing 10-9 filter indexing 10-8 filter type 10-7, 10-12 idx 10-7, 10-8, 10-12 index 10-7, 10-8, 10-12 multinetted VLAN 10-3 named source-port filters 10-10 operating rules 10-4, 10-10 operation 10-2 port-trunk operation 10-2, 10-6 show 10-7, 10-12 value 10-7, 10-12 viewing 10-7, 10-12 G GVRP, static VLAN not advertised 8-47 I inconsistent value, message 9-14 intrusion alarms entries dropped from log 9-37 event log 9-36 prior to 9-37 Intrusion Log Index 1
prior to 9-33, 9-35 IP authorized IP managers 11-1 reserved port numbers 6-17 IP lockdown 9-28 IP masks building 11-9 for multiple authorized manager stations 11-10 for single authorized manager station 11-9 operation 11-4 K kill command 6-11 L LACP 802.1X not allowed 8-11, 8-15, 8-48 M MAC Authentication authenticator operation 3-5 blocked traffic 3-4 CHAP defined 3-9 usage 3-4 client status 3-29 configuration commands 3-23 configuring on the switch 3-22 switch for RADIUS access 3-15 the RADIUS server 3-14 features 3-4 general setup 3-12 LACP not allowed 3-11 rules of operation 3-10 show status and configuration 3-27 terminology 3-9 manager password 2-2, 2-4 manager password recommended 4-7 MD5 message inconsistent value 9-14 O open VLAN mode See port access control OpenSSH 6-3 OpenSSL 7-2 operating notes authorized IP managers 11-12 port security 9-37 operator password 2-2, 2-4 P password browser/console access 2-3 case-sensitive 2-4 caution 2-3 delete 2-4 deleting with the Clear button 2-5 if you lose the password 2-5 incorrect 2-3 length 2-4 operator only, caution 2-3 pair 2-2 setting 2-4 password pair 2-2 password security 6-18 port security configuration 9-2 port security authorized address definition 9-3 basic operation 9-2 configuring 9-5 configuring in browser interface 9-29, 9-36 event log 9-36 IP lockdown 9-28 notice of security violations 9-29 operating notes 9-37 overview 9-2 prior to 9-37 proxy web server 9-37 port-based access control authenticate switch 8-4 authenticate users 8-4 authenticator backend state 8-38 authenticator operation 8-6, 8-8 authenticator, show commands 8-38 2 Index
block traffic 8-3 blocking non-802.1x device 8-33 CHAP 8-3 chap-radius 8-19 configuration commands 8-15 configuration overview 8-13 configuration, displaying 8-38 configuring method 8-19 counters 8-38 EAP 8-3 EAPOL 8-9 eap-radius 8-19 enabling on ports 8-15 enabling on switch 8-20 features 8-3 general setup 8-12 GVRP effect 8-47 LACP not allowed 8-48 local 8-19 local username and password 8-4 MD5 8-8 messages 8-48 open VLAN authorized client 8-22 configuration 8-28, 8-30 general operation 8-21 mode 8-21 operating notes 8-31 operating rules 8-25 PVID, no 8-40 security breach 8-31 set up 8-27 status, viewing 8-40 suspended VLAN 8-41 unauthorized client 8-22 use models 8-22 VLAN, after authentication 8-22, 8-26, 8-31 VLAN, tagged 8-21, 8-22, 8-23, 8-26, 8-31, 8-42 operation 8-6 overview 8-3 port-security, with 802.1X 8-32 RADIUS 8-3 RADIUS host IP address 8-20 rules of operation 8-10 show commands 8-38 show commands, supplicant 8-43 statistics 8-38 supplicant operation 8-8 supplicant operation, switch-port 8-7 supplicant state 8-43 supplicant statistics, note 8-43 supplicant, configuring 8-34 supplicant, configuring switch port 8-36 supplicant, enabling 8-35 switch username and password 8-4 terminology 8-8 troubleshooting, gvrp 8-44 used with port-security 8-32 VLAN operation 8-44 prior to 9-33, 9-35, 9-37 Privacy Enhanced Mode (PEM) See SSH. proxy web server 9-37 Q quick start 1-8 R RADIUS accounting 5-2, 5-17 accounting, configuration outline 5-19 accounting, configure server access 5-20 accounting, configure types on switch 5-22 accounting, exec 5-18, 5-22 accounting, interim updating 5-24 accounting, network 5-22 accounting, operating rules 5-19 accounting, server failure 5-19 accounting, session-blocking 5-24 accounting, start-stop method 5-23 accounting, statistics terms 5-26 accounting, stop-only method 5-23 accounting, system 5-18, 5-22 authentication options 5-2 authentication, local 5-16 bypass RADIUS server 5-9 commands, accounting 5-17 commands, switch 5-6 configuration outline 5-7 Index 3
configure server access 5-10 configuring switch global parameters 5-12 general setup 5-5 local authentication 5-9 MD5 5-4 messages 5-31 network accounting 5-18 operating rules, switch 5-4 security 5-9 security note 5-2 server access order 5-19 server access order, changing 5-29 servers, multiple 5-13 show accounting 5-28 show authentication 5-27 SNMP access security not supported 5-2 statistics, viewing 5-25 terminology 5-3 TLS 5-4 Web browser authentication 5-7 web-browser access controls 5-17 web-browser security not supported 5-2, 5-17 RADIUS accounting reserved port numbers 6-17, 7-20 S security authorized IP managers 11-1 per port 9-2 security violations notices of 9-29 security, password See SSH. setting a password 2-4 setup screen 1-8 show locked down MAC addresses 9-25 locked out MAC addresses 9-26 SSH authenticating switch to client 6-3 authentication, client public key 6-2 authentication, user password 6-2 caution, restricting access 6-20 caution, security 6-18 CLI commands 6-9 client behavior 6-15, 6-16 client public-key authentication 6-19, 6-21 client public-key, clearing 6-25 client public-key, creating file 6-23 client public-key, displaying 6-25 configuring authentication 6-18 crypto key 6-11 disabling 6-11 enable 6-16, 7-19 enabling 6-15 erase host key pair 6-11 generate host key pair 6-11 generating key pairs 6-10 host key pair 6-11 key, babble 6-11 key, fingerprint 6-11 keys, zeroing 6-11 key-size 6-17 known-host file 6-13, 6-15 man-in-the-middle spoofing 6-16 messages, operating 6-27 OpenSSH 6-3 operating rules 6-8 outbound SSH not secure 6-8 password security 6-18 password-only authentication 6-18 passwords, assigning 6-9 PEM 6-4 prerequisites 6-5 public key 6-5, 6-13 public key, displaying 6-14 reserved IP port numbers 6-17 security 6-18 SSHv1 6-2 SSHv2 6-2 stacking, security 6-8 steps for configuring 6-6 supported encryption methods 6-3 switch key to client 6-12 terminology 6-4 unauthorized access 6-20, 6-26 version 6-2 zeroing a key 6-11 zeroize 6-11 SSL CA-signed 7-4, 7-15 CA-signed certificate 7-4, 7-15 CLI commands 7-7 client behavior 7-17, 7-18 4 Index
crypto key 7-10 disabling 7-10 enabling 7-17 erase certificate key pair 7-10 erase host key pair 7-10 generate CA-signed certificate 7-15 generate host key pair 7-10 generate self-signed 7-13 generate self-signed certificate 7-10, 7-13 generate server host certificate 7-10 generating Host Certificate 7-9 host key pair 7-10 key, babble 7-12 key, fingerprint 7-12 man-in-the-middle spoofing 7-18 OpenSSL 7-2 operating notes 7-6 operating rules 7-6 passwords, assigning 7-7 prerequisites 7-5 remove self-signed certificate 7-10 remove server host certificate 7-10 reserved TCP port numbers 7-20 root 7-4 root certificate 7-4 self-signed 7-4, 7-13 self-signed certificate 7-4, 7-10, 7-13 server host certificate 7-10 SSL server 7-3 SSLv3 7-2 stacking, security 7-6 steps for configuring 7-5 supported encryption methods 7-3 terminology 7-3 TLSv1 7-2 troubleshooting, operating 7-21 version 7-2 zeroize 7-10, 7-12 stacking SSH security 6-8 SSL security 7-6 T TACACS aaa parameters 4-12 authentication 4-3 authentication process 4-20 authentication, local 4-22 authorized IP managers, effect 4-25 configuration, authentication 4-11 configuration, encryption key 4-19 configuration, server access 4-15 configuration, timeout 4-20 configuration, viewing 4-10 encryption key 4-6, 4-15, 4-16, 4-19 encryption key, general operation 4-23 encryption key, global 4-20 general operation 4-2 IP address, server 4-15 local manager password requirement 4-26 messages 4-25 NAS 4-3 overview 1-2 precautions 4-5 preparing to configure 4-8 preventing switch lockout 4-15 privilege level code 4-7 server access 4-15 server priority 4-18 setup, general 4-5 show authentication 4-8 system requirements 4-5 TACACS+ server 4-3 testing 4-5 timeout 4-15 troubleshooting 4-6 unauthorized access, preventing 4-7 web access, controlling 4-24 web access, no effect on 4-5 tacacs-server 4-8 TCP reserved port numbers 7-20 TLS troubleshooting authorized IP managers 11-12 trunk filter, source-port 10-2, 10-6 LACP, 802.1X not allowed 8-15 See also LACP. U user name Index 5
V cleared 2-5 value, inconsistent 9-14 VLAN 802.1X 8-44 802.1X, ID changes 8-47 802.1X, suspend untagged VLAN 8-41 filter, source-port 10-3 not advertised for GVRP 8-47 W warranty 1-ii Web Auth/MAC Auth applicable models 3-2 Web Authentication authenticator operation 3-5 blocked traffic 3-4 CHAP defined 3-9 usage 3-4 client status 3-29 configuration commands 3-18 configuring on the switch 3-17 switch for RADIUS access 3-15 features 3-4 general setup 3-12 LACP not allowed 3-11 redirect URL 3-9 rules of operation 3-10 show status and configuration 3-26 terminology 3-9 web browser interface, for configuring authorized IP managers 11-7, 11-9 web browser interface, for configuring port security 9-29, 9-36 web server, proxy 9-37 6 Index