HP J9470A manuals
J9470A
Table of contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- product documentation
- Overview
- Introduction
- Types of Static VLANs Available in the Switch
- Terminology
- Static VLAN Operation
- VLAN Environments
- VLAN Operation
- Routing Options for VLANs
- Overlapping (Tagged) VLANs
- Per-Port Static VLAN Configuration Options
- VLAN Operating Rules
- General Steps for Using VLANs
- Multiple VLAN Considerations
- Single Forwarding Database Operation
- Example of an Unsupported Configuration and How To Correct It
- Multiple Forwarding Database Operation
- Configuring VLANs
- To Change VLAN Support Settings
- Adding or Editing VLAN Names
- Adding or Changing a VLAN Port Assignment
- VLAN Parameters
- Customizing the Show VLANs Output
- Creating an Alias for Show VLAN Commands
- Changing the Number of VLANs Allowed on the Switch
- WebAgent: Viewing and Configuring VLAN Parameters
- Q VLAN Tagging
- Special VLAN Types
- The Secure Management VLAN
- Preparation
- Configuration
- Using DHCP to Obtain an IP Address
- Deleting the Management VLAN
- Voice VLANs
- Components of Voice VLAN Operation
- Voice VLAN Access Security
- IP Interfaces
- VLAN Restrictions
- Migrating Layer 3 VLANs Using VLAN MAC Configuration
- Handling Incoming and Outgoing VLAN Traffic
- Sending Heartbeat Packets with a Configured MAC Address
- Configuring a VLAN MAC Address with Heartbeat Interval
- Example
- General Operation
- Per-Port Options for Handling GVRP "Unknown VLANs"
- Per-Port Options for Dynamic VLAN Advertising and Joining
- GVRP and VLAN Access Control
- Planning for GVRP Operation
- Configuring GVRP On a Switch
- CLI: Viewing and Configuring GVRP
- Web: Viewing and Configuring GVRP
- s Multiple Spanning Tree Protocol (MSTP)
- MSTP Structure
- How MSTP Operates
- Common Spanning Tree (CST)
- MSTP Operation with 802.1Q VLANs
- Operating Rules
- MSTP Compatibility with RSTP or STP
- Configuring MSTP
- MSTP Configuration Overview
- Configuring MSTP Operation Mode and Global Settings
- Configuring MSTP Per-Port Parameters
- Configuring Per Port Parameters
- Configuring BPDU Filtering
- Configuring BPDU Protection
- PVST Protection and Filtering
- Configuring MST Instance Parameters
- Configuring MST Instance Per-Port Parameters
- Enabling or Disabling Spanning Tree Operation
- MSTP VLAN Configuration Enhancement
- PreConfiguring VLANs in an MST Instance
- Configuring MSTP Instances with the VLAN Range Option
- Operating Notes for the VLAN Configuration Enhancement
- How to Save Your Current Configuration
- Displaying MSTP Statistics and Configuration
- Displaying Global MSTP Status
- Displaying Detailed Port Information
- Displaying Status for a Specific MST Instance
- Displaying the MSTP Configuration
- Troubleshooting an MSTP Configuration
- Displaying Debug Counters for All MST Instances
- Displaying Debug Counters for One MST Instance
- Displaying Debug Counters for Ports in an MST Instance
- Field Descriptions in MSTP Debug Command Output
- Troubleshooting MSTP Operation
- Loop Protection
- Configuring Loop Protection
- Loop Protection in Port Mode
- Operating Notes
- Displaying Loop Protection Status in VLAN Mode
- STP Loop Guard
- Switch Meshing Fundamentals
- Using a Heterogeneous Switch Mesh
- Bringing Up a Switch Mesh Domain
- Configuring Switch Meshing
- CLI: To Configure and View Switch Meshing
- Viewing Switch Mesh Status
- Operating Notes for Switch Meshing
- Unicast Packets with Unknown Destinations
- Spanning Tree Operation with Switch Meshing
- Filtering/Security in Meshed Switches
- Dynamic VLANs
- Mesh Design Optimization
- Other Requirements and Restrictions
- Using Quality of Service Policies
- QoS Terminology
- QoS Operation
- Globally-Configured QoS
- Classifier-Based QoS
- QoS Packet Classification
- Classifier-Based Match Criteria
- QoS Traffic Marking
- Layer 3 DSCP Marking
- VLAN and Untagged VLAN Environments
- Classifier-Based Traffic Marking
- Viewing a Global QoS Configuration
- Global QoS Restrictions
- Global TCP/UDP Classifier
- Assigning an 802.1p Priority for a Global TCP/UDP Classifier
- Operating Notes on Using TCP/UDP Port Ranges
- Assigning a DSCP Policy for a Global TCP/UDP Classifier
- Displaying Resource Usage for QoS Policies
- Global IP-Device Classifier
- Assigning a Priority for a Global IP-Device Classifier
- Assigning a DSCP Policy For a Global IP-Device Classifier
- Global IP Type-of-Service Classifier
- IPv4 ToS/IPv6 Traffic Class Byte
- IP-Precedence Classifier
- Assigning an 802.1p Priority for a Global IP-Diffserv Classifier
- Assigning a DSCP Policy for a Global IP-Diffserv Classifier
- Comparison of Global IP Type-of-Service Classifiers
- Global Layer-3 Protocol Classifier
- Global VLAN-ID Classifier
- Assigning a DSCP Policy for a Global VLAN-ID Classifier
- Global Source-Port Classifier
- Assigning a DSCP Policy for a Global Source-Port Classifier
- IP Multicast (IGMP) Interaction with QoS
- Advanced Classifier-Based QoS
- Classifier-Based QoS Model
- Configuring QoS Actions in a Policy
- Override of Global QoS Settings
- Viewing a Classifier-Based QoS Configuration
- Classifier-Based QoS Restrictions
- Classifier-Based QoS Configuration Examples
- QoS Policy for Layer 4 TCP/UDP Traffic
- Differentiated Services Codepoint (DSCP) Mapping
- Default Priority Settings for Selected Codepoints
- Displaying Non-Default Codepoint Settings
- Notes on Changing a Priority Setting
- Error Messages for DSCP Policy Changes
- Example of Changing the Priority Setting on a Policy When One or More Classifiers Are Currently Using the Policy
- QoS Queue Configuration
- Mapping of Outbound Port Queues
- Minimum Guaranteed Bandwidth with 8 Queues
- Configuring the Number of Priority Queues
- Viewing the QoS Queue Configuration
- the 3500, 3500yl, 6200yl and 6600 Switches
- Components of HP Stack Management
- Operating Rules for Stacking
- Specific Rules
- Configuring Stack Management
- General Steps for Creating a Stack
- and Configure Stacking
- Using the Menu To Manage a Candidate Switch
- Using the Commander To Manage The Stack
- Using the Commander To Access Member Switches for Configuration Changes and Monitoring Traffic
- of Another Stack
- Monitoring Stack Status
- Using the CLI To View Stack Status and Configure Stacking
- Using the CLI To View Stack Status
- Using the CLI To Configure a Commander Switch
- Adding to a Stack or Moving Switches Between Stacks
- Using the CLI To Remove a Member from a Stack
- Changes and Traffic Monitoring
- SNMP Community Operation in a Stack
- Using the CLI To Disable or Re-Enable Stacking
- Status Messages
- How QinQ Works
- Operating Rules and Guidelines
- QinQ Mixed Vlan Mode
- Operating Notes and Restrictions
- Configuring QinQ
- Enabling QinQ
- Configuring Per-Port S-VLAN Membership
- Configuring Port-Types
- Configuration Example
- Updating QinQ Configurations
- Moving Ports between C-VLANs and S-VLANs (Mixed Vlan Mode)
- Displaying QinQ Config and Status
- Show Commands for VLANs
- Displaying Spanning Tree Status
- Effects of QinQ on Other Switch Features
- Event Log Messages
- Traffic Classes
- Creating a Traffic Class
- Traffic Class Configuration Procedure
- Optional ICMP Match Criteria
- Optional IGMP Match Criteria
- Optional TCP and UDP Match Criteria
- Using CIDR Notation for IPv4/IPv6 Addresses
- Resequencing Match/Ignore Statements
- Creating a Service Policy
- Creating a PBR Policy
- Troubleshooting PBR
- Resequencing Classes in a Policy
- Applying a Service Policy to an Interface
- Displaying Statistics for a Policy
- Where to Go From Here
- Zone Classes
- Zone Class-Based Configuration
- Creating a Zone Class
- Creating a Zone Policy
- Modifying Zones and Policies
- Applying a Zone Policy to a ONE Application
- Troubleshooting Problems
J9470A
Table of contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- Table Of Contents
- product documentation
- security overview
- Access Security Features
- network security features
- physical security
- Quick Start: Using the Management Interface Wizard
- CLI: Management Interface Wizard
- WebAgent: Management Interface Wizard
- SNMP Security Guidelines
- Precedence of Security Options
- HP E-Network Immunity Manager
- Arbitrating Client-Specific Attributes
- HP PMC Identity Driven Manager (IDM)
- configuring username and password security
- configuring local password security
- CLI: Setting Passwords and Usernames
- Setting an Encrypted Password
- WebAgent: Setting Passwords and Usernames
- benefits of saving security credentials
- enabling the storage and display of security credentials
- security settings that can be saved
- No Include-credentials store-in-config Option
- local manager and operator passwords
- password command options
- snmp security credentials
- X Port-Access Credentials
- RADIUS Shared-Secret Key Authentication
- Include-Credentials Radius-Tacacs-Only Option
- SSH Client Public-Key Authentication
- Displaying the Status of Include-Credentials on the Switch
- Storage States When Using Include-Credentials
- Operating Notes
- Restrictions
- Configuration File
- Enabling Encrypt-Credentials
- Displaying the State of Encrypt-Credentials
- Affected Commands
- Important Operating Notes
- when security is important
- Front-Panel Button Functions
- Reset Button
- Configuring Front-Panel Security
- Disabling the Clear Password Function of the Clear Button
- Re-Enabling the Clear Button and Setting or Changing the "Reset-On-Clear" Operation
- Changing the Operation of the Reset+Clear Combination
- password recovery
- password recovery process
- Overview of Connection-Rate Filtering
- features and benefits
- general operation
- Sensitivity to Connection Rate Detection
- operating rules
- Unblocking a Currently Blocked Host
- General Configuration Guidelines
- For a network that appears to be under significant attack:
- Configuring Connection-Rate Filtering
- Sensitivity
- Configuring the Per-Port Filtering Mode
- Example of a Basic Connection-Rate Filtering Configuration
- Viewing and Managing Connection-Rate Status
- Listing Currently-Blocked Hosts
- Configuring and Applying Connection-Rate ACLs
- Connection-Rate ACL Operation
- Source IP Address Criteria
- Configuring a Connection-Rate ACL Using UDP/TCP Criteria
- Applying Connection-Rate ACLs
- Example of Using an ACL in a Connection-Rate Configuration
- Connection-Rate ACL Operating Notes
- Connection-Rate Log and Trap Messages
- web and mac authentication
- web authentication
- concurrent web and mac authentication
- wireless clients
- how web and mac authentication operate
- MAC-based Authentication
- Terminology
- operating rules and notes
- Setup Procedure for Web/MAC Authentication
- configuring the radius server to support mac authentication
- configuring web authentication
- configuration commands for web authentication
- show commands for web authentication
- Customizing Web Authentication HTML Files (Optional)
- Customizing HTML Templates
- Customizable HTML Templates
- configuring mac authentication on the switch
- configuration commands for mac authentication
- Configuring a MAC-based Address Format
- Configuring Custom Messages
- Web Page Display of Access Denied Message
- HTTP Redirect When MAC Address Not Found
- How HTTP Redirect Works
- Diagram of the Registration Process
- Using the Restrictive-Filter Option
- Configuring the Registration Server URL
- Show Commands for MAC-Based Authentication
- client status
- terminology used in tacacs applications
- general system requirements
- before you begin
- cli commands described in this section
- Server Contact Configuration
- Configuring the Switch's Authentication Methods
- authentication parameters
- Configuring the Switch's TACACS+ Server Access
- how authentication operates
- Local Authentication Process
- using the encryption key
- Encryption Options in the Switch
- Using TACACS+ Authentication
- Messages Related to TACACS+ Operation
- authentication services
- Accounting Services
- SNMP Access to the Switch's Authentication Configuration MIB
- switch operating rules for radius
- general radius setup procedure
- configuring the switch for radius authentication
- outline of the steps for configuring radius authentication
- you want radius to protect
- Enable the (Optional) Access Privilege Option
- configure the switch to access a radius server
- Configure the Switch's Global RADIUS Parameters
- Using Multiple RADIUS Server Groups
- Enhanced Commands
- Displaying the RADIUS Server Group Information
- Cached Reauthentication
- Timing Considerations
- using snmp to view and configure switch authentication features
- Changing and Viewing the SNMP Access Configuration
- Controlling WebAgent Access
- commands authorization
- enabling authorization
- displaying authorization information
- example configuration on cisco secure acs for ms windows
- example configuration using freeradius
- vlan assignment in an authentication session
- additional radius attributes
- MAC-Based VLANs
- operating rules for radius accounting
- Acct-Session-ID Options in a Management Session
- Common Acct-Session-ID Operation
- configuring radius accounting
- Optional) Reconfigure the Acct-Session-ID Operation
- reports to the radius server
- updating options
- viewing radius statistics
- radius authentication statistics
- radius accounting statistics
- Changing RADIUS-Server Access Order
- Creating Local Privilege Levels
- Configuring Groups for Local Authorization
- Configuring a Local User for a Group
- Displaying Command Authorization Information
- Limits
- Displaying the Port-access Information
- messages related to radius operation
- Management Applications
- p Priority) and Rate-Limiting
- Applied Rates for RADIUS-Assigned Rate Limits
- Viewing the Currently Active Per-Port CoS and Rate-Limiting Configuration Specified by a RADIUS Server
- Configuring and Using Dynamic RADIUS-Assigned) Access Control Lists
- Overview of RADIUS-Assigned, Dynamic ACLs
- Contrasting RADIUS-Assigned and Static ACLs
- to a Client on a Switch Port
- General ACL Features, Planning, and Configuration
- The Packet-filtering Process
- configuring an acl in a radius server
- Nas-Filter-Rule-Options
- ACE Syntax in RADIUS Servers
- Example Using the Standard Attribute (92) In an IPv4 ACL
- Example Using HP VSA 63 To Assign IPv6 and/or IPv4 ACLs
- Example Using HP VSA 61 To Assign IPv4 ACLs
- configuration notes
- ACLs
- on the Switch
- event log messages
- prerequisite for using ssh
- for Switch and Client Authentication
- General Operating Rules and Notes
- configuring the switch for ssh operation
- Enable (Manager) Password
- Configuring Key Lengths
- Providing the Switch's Public Key to Clients
- client contact behavior
- configuring the switch for ssh authentication
- use an ssh client to access the switch
- Further Information on SSH Client Public-Key Authentication
- SSH Client and Secure Sessions
- Opening a Secure Session to an HP Switch
- Copying Client Key Files
- Copying the SSH-Client-Known-Hosts File
- Another Location
- Copying the Host Public Key
- Removing the SSH Client Known Hosts File
- messages related to ssh operation
- logging messages
- prerequisite for using ssl
- configuring the switch for ssl operation
- with the CLI
- Comments on Certificate Fields
- Generate a Self-Signed Host Certificate with the WebAgent
- WebAgent
- Browser Contact Behavior
- Using the CLI Interface to Enable SSL
- common errors in ssl setup
- Overview of Options for Applying IPv4 ACLs on the Switch
- Command Summary for Standard IPv4 ACLs
- Command Summary for IPv4 Extended ACLs
- Displaying ACLs
- RACL Applications
- VACL Applications
- RADIUS-Assigned (Dynamic) Port ACL Applications
- Multiple ACLs on an Interface
- Features Common to All ACL Applications
- general steps for planning and configuring acls
- IPv4 Static ACL Operation
- planning an acl application
- Security
- IPv4 ACL Configuration and Operating Rules
- how an ace uses a mask to screen packets for matches
- Access Control Entry (ACE)
- Configuring and Assigning an IPv4 ACL
- acl configuration structure
- Standard ACL Structure
- Extended ACL Configuration Structure
- acl configuration factors
- Allowing for the Implied Deny Function
- using the cli to create an acl
- Using CIDR Notation To Enter the IPv4 ACL Mask
- Configuring Standard ACLs
- Configuring Named, Standard ACLs
- Creating Numbered, Standard ACLs
- Configuring Extended ACLs
- Configuring Named, Extended ACLs
- Configuring Numbered, Extended ACLs
- Adding or Removing an ACL Assignment On an Interface
- Filtering IPv4 Traffic Inbound on a VLAN
- Filtering Inbound IPv4 Traffic Per Port
- Classifier-Based Rate-Limiting with RL-PACLs
- deleting an acl
- using the cli to edit acls
- Sequence Numbering in ACLs
- Inserting an ACE in an Existing ACL
- Deleting an ACE from an Existing ACL
- Resequencing the ACEs in an ACL
- Attaching a Remark to an ACE
- Operating Notes for Remarks
- Displaying ACL Configuration Data
- display an acl summary
- display the content of all acls on the switch
- Display the RACL and VACL Assignments for a VLAN
- Display Static Port (and Trunk) ACL Assignments
- displaying the content of a specific acl
- Display All ACLs and Their Assignments in the Routing Switch Startup-Config File and Running-Config File
- Creating or Editing ACLs Offline
- Example of Using the Offline Process
- requirements for using acl logging
- acl logging operation
- enabling acl logging on the switch
- Configuring the Logging Timer
- Monitoring Static ACL Performance
- Example of ACL Performance Monitoring
- Example of Resetting ACE Hit Counters to Zero
- Assignments
- general acl operating notes
- dhcp snooping
- enabling dhcp snooping
- enabling dhcp snooping on vlans
- configuring authorized server addresses
- using dhcp snooping with option 82
- Changing the Remote-id from a MAC to an IP Address
- the dhcp binding database
- Operational Notes
- log messages
- dynamic arp protection
- configuring trusted ports
- Adding an IP-to-MAC Binding to the DHCP Database
- Configuring Additional Validation Checks on ARP Packets
- Displaying ARP Packet Statistics
- dynamic ip lockdown
- Protection Against IP Source Address Spoofing
- Filtering IP and MAC Addresses Per-Port and Per-VLAN
- Enabling Dynamic IP Lockdown
- Adding an IP-to-MAC Binding to the DHCP Binding Database
- Adding a Static Binding
- Displaying the Static Configuration of IP-to-MAC Bindings
- Debugging Dynamic IP Lockdown
- Differences Between Switch Platforms
- Using the Instrumentation Monitor
- Configuring Instrumentation Monitor
- Examples
- Viewing the Current Instrumentation Monitor Configuration
- filter limits
- filter types and operation
- Example
- Named Source-Port Filters
- Operating Rules for Named Source-Port Filters
- Viewing a Named Source-Port Filter
- static multicast filters
- protocol filters
- Configuring Traffic/Security Filters
- Configuring a Source-Port Traffic Filter
- Example of Creating a Source-Port Filter
- Editing a Source-Port Filter
- configuring a multicast or protocol traffic filter
- filter indexing
- Displaying Traffic/Security Filters
- general features
- user authentication methods
- X User-Based Access Control
- Alternative To Using a RADIUS Server
- example of the authentication process
- vlan membership priority
- General Setup Procedure for 802.1X Access Control
- Overview: Configuring 802.1X Authentication on the Switch
- Configuring Switch Ports as 802.1X Authenticators
- Enable 802.1X Authentication on Selected Ports
- Port-Based Authentication
- Example: Configuring User-Based 802.1X Authentication
- Reconfigure Settings for Port-Access
- Configure the 802.1X Authentication Method
- Enter the RADIUS Host IP Address(es)
- Enable 802.1X Authentication on the Switch
- Optional: Reset Authenticator Operation
- Wake-on-LAN Traffic
- Characteristics of Mixed Port Access Mode
- Configuring Mixed Port Access Mode
- x open vlan mode
- vlan membership priorities
- Use Models for 802.1X Open VLAN Modes
- Unauthorized-Client VLANs
- Setting Up and Configuring 802.1X Open VLAN Mode
- x open vlan operating notes
- Option For Authenticator Ports: Configure Port-Security To Allow Only 802.1X-Authenticated Devices
- Port-Security
- Configuring Switch Ports To Operate As Supplicants for 802.1X Connections to Other Switches
- supplicant port configuration
- Displaying 802.1X Configuration, Statistics, and Counters
- Viewing 802.1X Open VLAN Mode Status
- Show Commands for Port-Access Supplicant
- How RADIUS/802.1X Authentication Affects VLAN Operation
- vlan assignment on a port
- Authentication Session
- in Authentication Sessions
- Messages Related to 802.1X Operation
- configuring and monitoring port security
- port security
- eavesdrop prevention
- Feature Interactions When Eavesdrop Prevention is Disabled
- mib support
- trunk group exclusion
- planning port security
- Port Security Command Options and Operation
- configuring port security
- retention of static addresses
- clear mac address table
- Configuring Clearing of Learned MAC Addresses
- mac lockdown
- differences between mac lockdown and port security
- MAC Lockdown Operating Notes
- deploying mac lockdown
- mac lockout
- port security and mac lockout
- reading intrusion alerts and resetting alert flags
- how the intrusion log operates
- Resetting Alert Flags
- and Resetting Alert Flags
- using the event log to find intrusion alerts
- operating notes for port security
- using authorized ip managers
- access levels
- defining authorized management stations
- Menu: Viewing and Configuring IP Authorized Managers
- CLI: Viewing and Configuring Authorized IP Managers
- configuring ip authorized managers for the switch
- WebAgent: Configuring IP Authorized Managers
- web proxy servers
- building ip masks
- additional examples for authorizing multiple stations
- Creating and Deleting Key Chain Entries
- Assigning a Time-Independent Key to a Chain
- Assigning Time-Dependent Keys to a Chain