HP 6120XG HP ProCurve Series 6120 Blade Switches Access Security Guide - Page 27

Security Overview Access Security Features Feature SSL SNMP Authorized IP Managers Secure Management VLAN TACACS+ Authentication RADIUS Authentication Default Setting Security Guidelines More Information and Configuration Details disabled Secure Socket Layer (SSL) and Transport Layer Security "Quick Start: Using the (TLS) provide remote Web browser access to the switch Management Interface via authenticated transactions and encrypted paths Wizard" on page 1-10 between the switch and management station clients Chapter 9, "Configuring capable of SSL/TLS operation. The authenticated type Secure Socket Layer (SSL)" includes server certificate authentication with user password authentication. public, unrestricted In the default configuration, the switch is open to access "SNMP Security Guidelines" by management stations running SNMP management on page 1-15 applications capable of viewing and changing the "Quick Start: Using the settings and status data in the switch's MIB Management Interface (Management Information Base). Thus, controlling Wizard" on page 1-10 SNMP access to the switch and preventing Management and unauthorized SNMP access should be a key element of Configuration Guide, your network security strategy. Chapter 14, refer to the section "Using SNMP Tools To Manage the Switch" none This feature uses IP addresses and masks to determine Chapter 15, "Using whether to allow management access to the switch Authorized IP Managers" across the network through the following : • Telnet and other terminal emulation applications • The switch's Web browser interface • SNMP (with a correct community name) disabled This feature creates an isolated network for managing Advanced Traffic the ProCurve switches that offer this feature. When a Management Guide, refer to secure management VLAN is enabled, CLI, Menu the chapter "Static Virtual interface, and Web browser interface access is LANs (VLANs)" restricted to ports configured as members of the VLAN. disabled This application uses a central server to allow or deny access to TACACS-aware devices in your network. TACACS+ uses username/password sets with associated privilege levels to grant or deny access through either the switch's serial (console) port or remotely, with Telnet. Chapter 5, "TACACS+ Authentication" If the switch fails to connect to a TACACS+ server for the necessary authentication service, it defaults to its own locally configured passwords for authentication control. TACACS+ allows both login (read-only) and enable (read/write) privilege level access. disabled For each authorized client, RADIUS can be used to Chapter 6, "RADIUS authenticate operator or manager access privileges on Authentication and the switch via the serial port (CLI and Menu interface), Accounting" Telnet, SSH, and Secure FTP/Secure Copy (SFTP/SCP) access methods. 1-5