HP 5500 Ei 5500 Si Switch Series Configuration Guide

vi 
Managing public keys ··················\
··················\
··················\
··················\
··················\
················ ··················\
················ 245 
Overview ··················\
··················\
··················\
··················\
··················\
··················\
··················\
···················\
··················\
····  245 
Configuration task list ··················\
··················\
··················\
··················\
··················\...

vii 
Displaying and maintaining IPsec ··················\
··················\
··················\
··················\
··················\
······················\
·············· 281 
IPsec for RIPng configuration example  ··················\
··················\
··················\
··················\
··················\
··················\
···········  281 
Configuring SSH2.0 ··················\
··················\
··················\
··················\
··················\
··················\...

viii 
SSL security mechanism ··················\
··················\
··················\
··················\
··················\
································\
············ 325 
SSL protocol stack ··················\
··················\
··················\
··················\
··················\
··················\
 ··················\
················· 325 
Configuration task list ··················\
··················\
··················\
··················\
··················\
·············...

ix 
Configuring ARP active acknowledgement ··················\
··················\
··················\
··················\
················ ··················\
····· 358 
Introduction ··················\
··················\
··················\
··················\
··················\
··················\
······ ··················\
··················\
···· 358 
Configuration procedure ··················\
··················\
··················\
··················\
··················\
·············...

x 
Blacklist configuration example ··················\
··················\
··················\
··················\
··················\
····· ··················\
················· 389 
Network requirements  ··················\
··················\
··················\
··················\
··················\
··················\
··················\
···········  389 
Configuration procedure ··················\
··················\
··················\
··················\
··················\
·············...

1 
Configuring AAA 
In the HP 5500 Switch Series, only the HP 5500 EI switches support MCE and VPN configurations. 
AAA overview 
Authentication, Authorization, and Accounting (AAA) provides a uniform framework for implementing 
network access management. It can prov ide the following security functions: 
•   Authentication —Identifies users and determines whether a user is valid.  
•   Authorization —Grants different users different rights an d controls their access to resources and 
services. For...

2 
AAA can be implemented through multiple protocols. The switch supports using RADIUS and 
HWTACACS. RADIUS is often used in practice. 
RADIUS 
Remote Authentication Dial-In User Service (RADIUS) is a distributed information interaction protocol that 
uses a client/server model. It can protect networks against unauthorized access and is often used in 
network environments where both high security and remote user access are required.  
RADIUS uses UDP as the transport protocol. It uses UDP port 1812 for...

3 
Figure 3 Basic RADIUS message exchange process 
 
 
RADIUS operates in the following manner: 
1. The host initiates a connection request that ca rries the user’s username and password to the 
RADIUS client. 
2.  Having received the username and password, the  RADIUS client sends an authentication request 
(Access-Request)  to the RADIUS server, with the user password encrypted by using the 
Message-Digest 5 (MD5) algorithm and the shared key.  
3.  The RADIUS server authenticates the username an d...

4 
Figure 4 RADIUS packet format 
 
 
Descriptions of the fields are as follows: 
•  The Code field (1 byte long) indicates the type of the RADIUS packet.  Tabl e  1 gi
ves the possible 
values and their meanings. 
Table 1  Main values of the Code field 
Code Packet type  Description 
1 Access-Request  From the client to the server. A packet of this type carries user 
information for the server to authen
ticate the user. It must contain 
the User-Name attribute and can op tionally contain the attributes...

5 
•  The Attributes field (variable in length) carries the specific authentication, authorization, and 
accounting information that defines the configuration details of the request or response. This field 
may contain multiple attributes, each with three sub-fields: 
{ Ty p e — (1  b y t e  l o n g )  Ty p e  o f  t h e  a t t r i b u t e .  I t  i s  i n  t h e  r a n g e  o f  1  t o  255.  C o m m o n l y  u s e d  R A D I U S  
attributes are defined in RFC 2865, RFC 2866, RFC 2867, and RFC 2868....