HP 6120XG HP ProCurve Series 6120 Blade Switches IPv6 Configuration Guide - Page 36

IP Authorized Managers, Caution

Get HP 6120XG PDF manuals and user guides View all HP 6120XG manuals
Add to My Manuals
Save this manual to your list of manuals

Page 36 highlights

Introduction to IPv6 Configurable IPv6 Security Caution The switch supports up to six inbound sessions of the following types in any combination at any given time: ■ SSHv2 ■ SSHv2 IPv6 ■ Telnet-server ■ Telnet6-server ■ SFTP/SCP (One SFTP or SCP session allowed at a given time.) ■ Console (serial RS-232 connection) For more information, refer to "Secure Shell (SSH) for IPv6" on page 6-15. IP Authorized Managers The IPv6 Authorized IP Managers feature, like the IPv4 version, uses IP addresses and masks to determine which stations (PCs and workstations) can access the switch through the network, and includes these access methods: ■ Telnet, SSH, and other terminal emulation applications ■ the switch's web browser interface ■ SNMP (with a correct community name) Also, when configured in the switch, the access control imposed by the Authorized IP Manager feature takes precedence over the other forms of access control configurable on the switch, such as local passwords, RADIUS, and both Port-Based and Client-Based Access Control (802.1X). This means that the IP address of a networked management device must be authorized before the switch will attempt to authenticate the device by invoking any other access security features. Thus, with Authorized IP Managers configured, having the correct passwords or MAC address is not sufficient for accessing the switch through the network unless an IPv6 address configured on the station attempting the access is also included in the switch's Authorized IP Managers configuration. This presents the opportunity to combine the Autho­ rized IP Managers feature with other access control features to enhance the security fabric protecting the switch. The Authorized IP Managers feature does not protect against unauthorized station access through a modem or direct connection to the Console (RS-232) port. Also, if an unauthorized station "spoofs" an authorized IP address, then the unauthorized station cannot be blocked by the Authorized IP Managers feature, even if a duplicate IP address condition exists. To configure authorized IPv6 managers, refer to "Authorized IP Managers for IPv6" on page 6-3. For related information, refer to RFC 4864, "Local Network Protection for IPv6". 2-12

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
Introduction to IPv6
Configurable IPv6 Security
Caution
The switch supports up to six inbound sessions of the following types in any
combination at any given time:
■
SSHv2
■
SSHv2 IPv6
■
Telnet-server
■
Telnet6-server
■
SFTP/SCP (One SFTP or SCP session allowed at a given time.)
■
Console (serial RS-232 connection)±
For more information, refer to “Secure Shell (SSH) for IPv6” on page 6-15.±
IP Authorized Managers
The IPv6 Authorized IP Managers feature, like the IPv4 version, uses IP
addresses and masks to determine which stations (PCs and workstations) can
access the switch through the network, and includes these access methods:
■
Telnet, SSH, and other terminal emulation applications
■
the switch's web browser interface
■
SNMP (with a correct community name)
Also, when configured in the switch, the access control imposed by the
Authorized IP Manager feature takes precedence over the other forms of
access control configurable on the switch, such as local passwords, RADIUS,
and both Port-Based and Client-Based Access Control (802.1X). This means
that the IP address of a networked management device must be authorized
before the switch will attempt to authenticate the device by invoking any other
access security features. Thus, with Authorized IP Managers configured,
having the correct passwords or MAC address is not sufficient for accessing
the switch through the network unless an IPv6 address configured on the
station attempting the access is also included in the switch's Authorized IP
Managers configuration. This presents the opportunity to combine the Autho-
rized IP Managers feature with other access control features to enhance the
security fabric protecting the switch.
The Authorized IP Managers feature does not protect against unauthorized
station access through a modem or direct connection to the Console (RS-232)
port. Also, if an unauthorized station “spoofs” an authorized IP address, then
the unauthorized station cannot be blocked by the Authorized IP Managers
feature, even if a duplicate IP address condition exists.
To configure authorized IPv6 managers, refer to “Authorized IP Managers for
IPv6” on page 6-3.
For related information, refer to RFC 4864, “Local Network Protection for
IPv6”.
2-12