HP StorageWorks MSA 2/8 HP StorageWorks Secure Fabric OS V1.0 User Guide (AA-R - Page 62

Telnet Policy, are in a physically secure area.

Get HP StorageWorks MSA 2/8 - SAN Switch PDF manuals and user guides View all HP StorageWorks MSA 2/8 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 62 highlights

Creating Secure Fabric OS Policies Example: Creating a WSNMP and an RSNMP policy to allow only IP addresses that match 192.168.5.0 read and write access to the fabric: primaryfcs:admin> secPolicyCreate "WSNMP_POLICY", "192.168.5.0" WSNMP_POLICY has been created. primaryfcs:admin> primaryfcs:admin> secPolicyCreate "RSNMP_POLICY", "192.168.5.0" RSNMP_POLICY has been created. primaryfcs:admin> Telnet Policy You can create the Telnet policy to specify the workstations that can use sectelnet or SSH to connect to the fabric. The policy is named TELNET _POLICY and contains a list of the IP addresses for the trusted workstations (workstations that are in a physically secure area). Note: Static host IP addresses are required to implement this policy effectively. Do not use DHCP for hosts that are in the TELNET_POLICY, because as soon as the IP addresses change, the hosts will no longer be able to access the fabric. Restricting output (such as placing a session on "hold" by use of a command or keyboard shortcut) is not recommended. This policy pertains to sectelnet, which can be utilized as soon as a digital certificate is installed on the switch, and SSH. It does not pertain to telnet access because telnet is not available in Secure Mode. Note: An empty TELNET_POLICY blocks all telnet access. To prevent this, keep one or more members in the Telnet policy. If you require an empty Telnet policy, leave a meaningful entry in the API, HTTP, or SERIAL policies to provide some form of access to the switch. If you want to restrict CLI access over the network to SSH, disable telnet as described under "Telnet" on page 15. The possible telnet policy states are shown in Table 5. 62 Secure Fabric OS Version 1.0 User Guide

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
Creating Secure Fabric OS Policies
62
Secure Fabric OS Version 1.0 User Guide
Example:
Creating a WSNMP and an RSNMP policy to allow only IP addresses that
match 192.168.5.0 read and write access to the fabric:
Telnet Policy
You can create the Telnet policy to specify the workstations that can use sectelnet
or SSH to connect to the fabric. The policy is named TELNET _POLICY and
contains a list of the IP addresses for the trusted workstations (workstations that
are in a physically secure area).
Note:
Static host IP addresses are required to implement this policy effectively.
Do not
use DHCP for hosts that are in the TELNET_POLICY, because as soon as the IP
addresses change, the hosts will no longer be able to access the fabric.
Restricting output (such as placing a session on “hold” by use of a command or
keyboard shortcut) is not recommended.
This policy pertains to sectelnet, which can be utilized as soon as a digital
certificate is installed on the switch, and SSH. It does not pertain to telnet access
because telnet is not available in Secure Mode.
Note:
An empty TELNET_POLICY blocks all telnet access. To prevent this, keep one or
more members in the Telnet policy. If you require an empty Telnet policy, leave a
meaningful entry in the API, HTTP, or SERIAL policies to provide some form of access
to the switch.
If you want to restrict CLI access over the network to SSH, disable telnet as described
under “
Telnet
” on page 15.
The possible telnet policy states are shown in
Table 5
.
primaryfcs:admin> secPolicyCreate "WSNMP_POLICY", "192.168.5.0"
WSNMP_POLICY has been created.
primaryfcs:admin>
primaryfcs:admin> secPolicyCreate "RSNMP_POLICY", "192.168.5.0"
RSNMP_POLICY has been created.
primaryfcs:admin>