HP 6120XG HP ProCurve Series 6120 Blade Switches IPv6 Configuration Guide - Page 131
Configuring Multiple Station Access, authorized-managers,
View all HP 6120XG manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 131 highlights
IPv6 Management Security Features Authorized IP Managers for IPv6 Notes If you do not enter a value for the ipv6-mask parameter when you configure an authorized IPv6 address, the switch automatically uses FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF as the default mask (see "Configuring Authorized IP Managers for Switch Access" on page 6-5). If you have ten or fewer management and/or operator stations for which you want to authorize access to the switch, it may be more efficient to configure them by entering each IPv6 address with the default mask in a separate ipv6 authorized-managers command. When used in a mask, "FFFF" specifies that each bit in the corresponding 16bit (hexadecimal) block of an authorized station's IPv6 address must be identical to the same "on" or "off" setting in the IPv6 address entered in the ipv6 authorized-managers command. (The binary equivalent of FFFF is 1111 1111 1111 1111, where 1 requires the same "on" or "off" setting in an authorized address.) For example, as shown in Figure 6-1, if you configure a link-local IPv6 address of FE80::202:B3FF:FE1E:8329 with a mask of FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF, only a station having an IPv6 address of FE80::202:B3FF:FE1E:8329 has management access to the switch. 1st 2nd 3rd 4th 5th 6th 7th 8th Manager- or Operator-Level Access Block Block Block Block Block Block Block Block IPv6 Mask FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF The "FFFF" in each hexadecimal block IPv6 Address FE80 0000 0000 0000 202 B3FF FE1E 8329 of the mask specifies that only the exact value of each bit in the corresponding block of the IPv6 address is allowed. This mask allows management access only to a station having an IPv6 address of FE80::202:B3FF:FE1E:8329. Figure 6-1. Mask for Configuring a Single Authorized IPv6 Manager Station Configuring Multiple Station Access To authorize multiple stations to access the switch without having to re-enter the ipv6 authorized-managers command for each station, carefully select the IPv6 address of an authorized IPv6 manager and an associated mask to authorize a range of IPv6 addresses. As shown in Figure 6-2, if a bit in any of the 4-bit binary representations of a hexadecimal value in a mask is "on" (set to 1), then the corresponding bit in the IPv6 address of an authorized station must match the "on" or "off' setting of the same bit in the IPv6 address you enter with the ipv6 authorized-managers command. 6-6