Home » HP Manuals » Servers » HP 6125G » Manual Viewer

HP 6125G HP Networking guide to hardening Comware-based devices - Page 1

HP 6125G Manual

Add to My Manuals
Save this manual to your list of manuals

Page 1 highlights

Technical white paper HP Networking guide to hardening Comware-based devices Table of contents Introduction 2 Management plane 2 General management plane hardening 2 Limiting access to the network with infrastructure ACLs 5 Securing interactive management sessions 7 Fortifying Simple Network Management Protocol 11 Logging best practices 13 HP Comware software configuration management 15 Control plane 16 General control plane hardening 16 Limiting the CPU impact of control plane traffic 18 Securing BGP 20 Securing Interior Gateway Protocols 22 Securing Virtual Router Redundancy Protocol 24 Data plane 24 General data plane hardening 24 Filtering transit traffic with Transit ACLs 25 Anti-spoofing protections 26 Limiting the CPU impact of data plane traffic 30 Traffic identification and traceback 30 Access control with VLAN QoS policy and port access control lists 34 Using private VLANs 35 Port isolation 37

Section	Page
Introduction	2
Management plane	2
General management plane hardening	2
Password control	2
Disable unused services	4
EXEC timeout	4
Using management interfaces	4
Memory Threshold Notification	5
CPU Threshold Notification	5
Limiting access to the network with infrastructure ACLs	5
ICMP packet filtering	6
Filtering IP fragments	6
Securing interactive management sessions	7
Console and AUX ports	7
Control VTY and TTY lines	8
Warning banners	9
Using authentication, authorization, and accounting	9
Authentication, authorization, and accounting with RADIUS	9
Authentication, authorization, and accounting with HWTACACS	10
Authentication and authorization with LDAP	10
Authentication fallback	11
Redundant AAA servers	11
Fortifying Simple Network Management Protocol	11
SNMP community strings	11
SNMP community strings with ACLs	11
SNMP Views	12
SNMP Version 3	12
Logging best practices	13
Send logs to a central location	13
Logging level	13
Do not log to console or monitor sessions	14
Use buffered logging	14
Configure logging source interface	14
Configure logging timestamps	15
HP Comware software configuration management	15
Configuration Replace and Configuration Rollback	15
Backup configuration file and boot file	15
Configuration change notification	16
Control plane	16
General control plane hardening	16
IP ICMP redirects	16
ICMP unreachables	17
ICMP TTL-expiry	17
Proxy ARP	17
Network time protocol	17
Limiting the CPU impact of control plane traffic	18
Understanding control plane traffic	18
FTP and TFTP ACLs	18
User interface ACLs	18
HTTPS ACLs	19
Control plane protection	19
Rate limiting packets on network management interfaces	19
TCP SYN Cookie and protection against Naptha attacks	19
Securing BGP	20
Generalized TTL Security Mechanism	20
BGP peer authentication with MD5	20
Configuring maximum prefixes	20
Filtering BGP prefixes with prefix lists	21
Filtering BGP prefixes with autonomous system path access lists	21
Securing Interior Gateway Protocols	22
Routing protocol authentication and verification with MD5	22
Silent-interface commands	23
Route filtering	23
Securing Virtual Router Redundancy Protocol	24
Data plane	24
General data plane hardening	24
Disable ICMP redirects	24
Disable or limit IP Directed broadcasts	25
Filtering transit traffic with Transit ACLs	25
ICMP packet filtering	25
Filtering IP fragments	26
Anti-spoofing protections	26
URPF	26
IP source guard	26
Port security	27
ARP Detection	29
Anti-spoofing ACLs	29
Limiting the CPU impact of data plane traffic	30
Features and traffic types that impact the CPU	30
Traffic identification and traceback	30
NetStream	30
sFlow	32
Classification ACLs	33
Access control with VLAN QoS policy and port access control lists	34
Access control with VLAN QoS policy	34
Access control with PACLs	34
Access control with MAC	35
Using private VLANs	35
Isolated VLANs	35
Community VLANs	36
Promiscuous ports	36
Port isolation	37
Isolated ports	37
Uplink port	38