Index

Symbols

802.1X access control
authenticate users, 802.1X Port-based access control
authentication: local, Alternative to using a RADIUS server
authentication: methods, User authentication methods
authentication: user-based, 802.1X User-based access control
authenticator:operation, General 802.1X authenticator operation
authenticator:unblock port, 802.1X Port-based access control
client, effect of disconnect, Operating rules for Authorized-Client and Unauthorized-Client VLANs
control all clients, General operating rules and notes
delay move to unauthorized-client VLAN;802.1X access control:unauth-period command, 802.1X Open VLAN mode options
DHCP server, Operating rules for Authorized-Client and Unauthorized-Client VLANs
display all 802.1X, MAC authentication configuration;authentication:display all 802.1X, MAC configurations, Preparation for configuring MAC authentication
EAP;802.1X access control:CHAP, General features
features, General features
force authorized;, Displaying 802.1X Open VLAN mode status
force unauthorized, Displaying 802.1X Open VLAN mode status
guest VLAN;guest VLAN, 802.1X Open VLAN mode
GVRP:effect, IPv4 Counter Operation with Multiple Interface Assignments, Operating notes
GVRP;GVRP:effect on client authentication, Static VLAN requirement
hierarchy of precedence in authentication session, Precedence of Client-based authentication: Dynamic Configuration Arbiter
LACP not allowed;LACP:802.1X not allowed;, 802.1X Operating Messages
meshing, not supported, General operating rules and notes
multiple clients, Operating rules for Authorized-Client and Unauthorized-Client VLANs
multiple clients, same VLAN, 802.1X User-based access control
open port;802.1X access control:user-based:limit, User authentication methods
open VLAN: operating notes, 802.1X Open VLAN operating notes
open VLAN: security breach, 802.1X Open VLAN operating notes
open VLAN:mode, 802.1X Open VLAN mode options
open VLAN:VLAN, tagged, 802.1X Open VLAN mode options, 802.1X Open VLAN operating notes
open VLAN:VLAN, tagged;802.1X access control:open VLAN:VLAN, after authentication;, Operating rules for Authorized-Client and Unauthorized-Client VLANs, 802.1X Open VLAN operating notes
password for port access, Restrictions to enabling security credentials
password for port-access, Security settings that can be saved
port-based:access;802.1X access control:port-based:open port, General features
port-based:client without authentication, 802.1X Port-based access control
port-based:effect of Web/MAC auth operation;802.1X access control:Web/MAC auth effect, Applying Web Authentication or MAC Authentication Concurrently with Port- Based 802.1X Authentication
port-based:latest client, effect, 802.1X Port-based access control
port-based:multiple client access, 802.1X Port-based access control
port-based:multiple clients authenticating, 802.1X Port-based access control
port-based:no client limit, General features
port-based:not recommended;ACL, IPv4:802.1X port-based not recommended;ACL, IPv6:802.1X port-based not recommended, 802.1X User-Based and Port-Based applications
port-based:operation, 802.1X Port-based access control
port-based:recommended use, 802.1X Port-based access control
port-based:single client authenticates, 802.1X Port-based access control
port-based:tagged VLAN membership, 802.1X Port-based access control
port-based:unauthorized client risk, 802.1X Port-based access control
port-based:untagged VLAN membership, 802.1X Port-based access control
port-based:untagged VLAN membership;802.1X access control:VLAN:untagged, 802.1X Open VLAN mode
port-based:with Web/MAC authentication, 802.1X Port-based access control
port-security use, 802.1X Port-based access control
PVID, Displaying 802.1X Open VLAN mode status
RADIUS:effect on VLAN operation, Static VLAN requirement, VLAN assignment on a port
rules of operation, General operating rules and notes
security credentials saved to configuration file, Restrictions to enabling security credentials, Storing 802.1X port-access credentials
supplicant statistics, note, Note on supplicant statistics
supplicant:client not using, 802.1X Open VLAN mode options
troubleshooting, gvrp, Static VLAN requirement, Operating notes
trunked port blocked;802.1X access control:blocked port, trunked, General operating rules and notes
unauthorized-Client VLAN, multiple clients, Operating rules for Authorized-Client and Unauthorized-Client VLANs
use model, open VLAN mode;802.1X access control:open VLAN:use model, Use models for 802.1X Open VLAN modes
used with port-security;802.1X access control:port-security, with 802.1X, Option for authenticator ports: configure port-security to allow only 802.1X-authenticated devices
user-based:access, 802.1X User-based access control
user-based:authentication, Example of the authentication process
user-based:client authentication, 802.1X User-based access control
user-based:client limit, 802.1X User-based access control, Port-security
user-based:client limit;, General features
user-based:clients use same VLAN, 802.1X Open VLAN mode
user-based:tagged VLAN, 802.1X User-based access control
user-based:VLAN, Operating rules for Authorized-Client and Unauthorized-Client VLANs
user-based:Web/MAC authenticated clients, 802.1X User-based access control
VLAN operation;VLAN:802.1X, How RADIUS/802.1X authentication affects VLAN operation
VLAN, assignment conflict, VLAN assignment in an authentication session, General operating rules and notes
VLAN, membership priority;802.1X access control:priority of VLAN, per-port, VLAN membership priority, VLAN membership priorities
VLAN, priority, RADIUS, 802.1X Open VLAN mode options
VLAN, tagged membership, 802.1X Open VLAN mode options
VLAN:authorized-client, Operating rules for Authorized-Client and Unauthorized-Client VLANs
VLAN:authorized-client;802.1X access control:VLAN:RADIUS override, 802.1X Open VLAN mode options
VLAN:RADIUS assigned, effect, Operating rules for Authorized-Client and Unauthorized-Client VLANs
VLAN:RADIUS-assigned;802.1X access control:RADIUS:VLAN assignment, Operating rules for Authorized-Client and Unauthorized-Client VLANs
VLAN:tagged, 802.1X Open VLAN mode options
VLAN:unauthorized-client, best use, Operating rules for Authorized-Client and Unauthorized-Client VLANs
VLAN:unauthorized-client, on different ports, Operating rules for Authorized-Client and Unauthorized-Client VLANs
VLAN:untagged, 802.1X Open VLAN mode, 802.1X Open VLAN mode options

A

aaa
port-access gvrp-vlans; aaa: gvrp-vlans, IPv4 Counter Operation with Multiple Interface Assignments
aaa authentication
chap-radius, Configuring authentication for access methods RADIUS is to protect
peap-mschapv2, Configuring authentication for access methods RADIUS is to protect
privilege-mode
privilege-mode single sign-on, Using the privilege-mode option for login
accessing
updates, Accessing updates
ACL
CIDR:mask, Using CIDR notation to enter the ACE mask
extended:configure, Configuring numbered, extended ACLs
extended:numbered, configure, Creating or adding to an extended, numbered ACL
mask:CIDR, Using CIDR notation to enter the ACE mask
sys-debug, Overview
ACL debug
overview, Overview
ACL grouping
error messages, Error messages
features, ACL Grouping
overview, Overview
ACL Log timer
Warning, access-list logtimer
ACL match log
configuration, Overview
ACL, IPv4
802.1X client limit, 802.1X User-Based and Port-Based applications
802.1X, effect on;802.1X:ACL, effect on;ACL, IPv4:user-based 802.1X;ACL, IPv4:port-based 802.1X, 802.1X User-Based and Port-Based applications
ACE, order in list, Guidelines for planning the structure of a static ACL
ACE:after match not used, Guidelines for planning the structure of a static ACL, The sequence of entries in an ACL is significant
ACE:insert in list;ACL, IPv4:sequence number:use to insert ACE, Inserting an ACE in an existing ACL
ACE:limit, IPv4 ACL configuration and operating rules
ACE:not used, Example
application methods, IPv4 traffic management and improved network performance
application points, General steps for planning and configuring ACLs, IPv4 traffic management and improved network performance
applications, Static ACLs, RADIUS-assigned ACLs, General steps for planning and configuring ACLs, General steps for implementing ACLs
assign nonexistent i.d., You can assign an ACL name or number to an interface even if the ACL does not exist in the switch configuration
assigning to a VLAN;ACL, IPv4:removing from a VLAN, Filtering IPv4 traffic inbound on a VLAN, Filtering inbound IPv4 traffic per port
assigning to a VLAN;ACL:removing from a VLAN, Filtering routed IPv4 traffic
assignment not deleted, Deleting an ACL
basic structure, ACL configuration structure
CIDR:mask, Using CIDR notation to enter the IPv4 ACL mask
CIDR:mask bits, IP address, Configuring ACEs in a named, standard ACL, Creating or adding to a standard, numbered ACL
clear statistics, Monitoring static ACL performance
command syntax, Entering the IPv4 named ACL context
configured but not used, A configured ACL has no effect until you apply it to an interface
configured but not used;ACL, IPv4:assigning to a VLAN, A configured ACL has no effect until you apply it to an interface
configuring: offline, Features common to all ACL applications
connection-rate ACL, Connection Rate ACL, ACL Mirroring, Per-interface multiple ACL assignments
copy operation appends, Creating or editing an ACL offline
counter on multiple interfaces, Using IPv4 counters with multiple interface assignments
create, CLI method, Creating ACLs
defined, Introduction
deleting from config, Deleting an ACL
deny any
implicit, Features common to all ACL applications
implicit, IPv6, RADIUS-assigned (dynamic) port ACL applications
deny any, implicit, Example
deny any, implicit, supersede;supersede implicit deny any, ACL configuration structure
deny any: implicit, Introduction, IPv4 traffic management and improved network performance, Guidelines for planning the structure of a static ACL, IPv4 ACL configuration and operating rules, ACL configuration structure
display:ACLs and assignments, Viewing all ACLs and their assignments in the routing switch startup-config and running-config files
display:assignments, Viewing the RACL and VACL assignments for a VLAN
display:configuration details, Viewing the content of all ACLs on the switch
display:summary, configured ACLs, Viewing an ACL summary
dynamic port join, IPv4 ACL configuration and operating rules
dynamic port joins to a VLAN, IPv4 ACL configuration and operating rules
dynamic VLAN;VLAN:dynamic, IPv4 ACL configuration and operating rules
editing, Editing an existing ACL
effect of replacing;ACL, IPv4:replacing active ACEs, You can assign an ACL name or number to an interface even if the ACL does not exist in the switch configuration
established, Including options for TCP and UDP traffic in extended ACLs
established;ACL, IPv4:TCP, established, Options for permit/deny policies
exception for connection-rate filtering;connection-rate filtering:exception for, configuring, Exception for Connection-Rate filtering
exit statement;ACL, IPv4:end, Effect of the above ACL on inbound IPv4 traffic in the assigned VLAN
extended:configure, Configuring extended ACLs
extended:numeric I.D. range, Options for permit/deny policies
extended:protocol options, Options for permit/deny policies
extended:structure, Extended ACL configuration structure
extended:use, Extended ACL
features, common to all, Features common to all ACL applications
filter rule when RACL, VACL, and/or port ACL all apply, Multiple ACLs on an interface
filtering methods;ACL, IPv4:applications, ACL applications
filtering process, Example
hit count, Monitoring static ACL performance
host option, Example of allowing only one IPv4 address ("host" option)
ICMP:configure, Controlling ICMP traffic flow
ICMP:options, Controlling ICMP traffic flow
ICMP:traffic, General steps for planning and configuring ACLs
ICMP:type;ACL, IPv4:ICMP:code, Controlling ICMP traffic flow
IGMP:configure, Controlling IGMP traffic in extended ACLs
IGMP:traffic, General steps for planning and configuring ACLs
IGMP:type, Controlling IGMP traffic flow
implicit deny, Features common to all ACL applications
interface assignment, options, Introduction
IPv4 routing requirement for RACL, General steps for planning and configuring ACLs
limit, Monitoring shared resources, Configuring extended ACLs
log message, ACL logging operation
logging, Configuring ACEs in a named, standard ACL, Features common to all ACL applications
logging:described, Enabling ACL "Deny" logging
logging:session, Features common to all ACL applications
mask, Configuring ACEs in a named, standard ACL, Features common to all ACL applications, Rules for defining a match between a packet and an access control entry (ACE)
mask:CIDR, Using CIDR notation to enter the IPv4 ACL mask
mask:one IP address, Example of allowing only one IPv4 address ("host" option)
match: always;ACL, IPv4:deny any: implicit;, Allowing for the Implied Deny function
match: criteria, Rules for defining a match between a packet and an access control entry (ACE)
match: example, Example of how the mask bit settings define a match
match: ignored;ACL, IPv4:filtering process, Guidelines for planning the structure of a static ACL
maximum allowed, IPv4 ACL configuration and operating rules
maximum allowed: IPv4 and IPv6, Configuring standard ACLs
mirroring;mirroring;port monitoring, ACL, ACL Mirroring
multiple ACLs on interface;ACL, IPv4:permit: with multiple ACLs, Multiple ACLs on an interface
multiple applications;ACL, IPv4:applications, Multiple ACLs on an interface
multiple lists on an interface;ACL, IPv4:packet screened by multiple lists, For a packet to be permitted, it must have a match with a "permit" ACE in all applicable ACLs assigned to an interface
multiple on same interface, Multiple ACLs on an interface
name or number assignment;, You can assign an ACL name or number to an interface even if the ACL does not exist in the switch configuration
name string, maximum characters, Options for permit/deny policies
named: character limit;ACL:character limit, Configuring standard ACLs
named: rule, Inserting or adding an ACE to an ACL
non-IPv4 traffic;ACL, IPv4:AppleTalk;ACL:IPX;ACL, IPv4:traffic: not filtered, Security
nonexistent i.d., assign, You can assign an ACL name or number to an interface even if the ACL does not exist in the switch configuration
number of entries, Features common to all ACL applications
numbered:manage as named, Configuring standard ACLs
numbered:rule, Inserting or adding an ACE to an ACL
operator, comparison; , Including options for TCP and UDP traffic in extended ACLs
override implicit deny, Example
permit/deny policies: defined;ACL, IPv4:standard:defined;ACL, IPv4:extended:defined;ACL, IPv4:policy, permit/deny, Options for permit/deny policies
permit: any forwarding, Guidelines for planning the structure of a static ACL
planning; ACL, IPv4:policies, Planning an ACL application
planning;ACL, IPv4:configuration planning, General steps for planning and configuring ACLs
policy application points, Introduction
policy type, ACL configuration structure
port ACL operation defined, ACL applications
port;ACL, IPv4:trunk;ACL, IPv4:port added to trunk;ACL, IPv4:port removed from trunk;trunk:port added or removed, ACL, IPv4 ACL configuration and operating rules
ports affected, IPv4 ACL configuration and operating rules
precedence, Creating or adding to an extended, numbered ACL
precedence, numbers and names, Configuring ACEs in named, extended ACLs
precedence;ACL, IPv4:ToS: setting, General steps for planning and configuring ACLs
purpose, Introduction
RACL:defined;RACL defined, Static ACLs
RACL:operation defined, ACL applications
RACL:RACL applications, RACL applications
RACL:screening switched traffic, Multiple ACLs on an interface
RADIUS server support, RADIUS services supported on the switch
RADIUS-assigned, RADIUS-assigned ACLs
RADIUS-assigned ACL operation defined, ACL applications
RADIUS-assigned, implicit deny, How a RADIUS server applies a RADIUS-assigned ACL to a client on a switch port
RADIUS-assigned, limit, Monitoring shared resources
RADIUS-assigned;, RADIUS-assigned ACLs
RADIUS-assigned;ACL, IPv4:RADIUS-assigned, IPv4 and IPv6;, RADIUS-assigned (dynamic) port ACL applications, Per-interface multiple ACL assignments
remark:remove from an ACE, Removing a remark from an existing ACE
replacing, IPv4 ACL configuration and operating rules
resequence, Creating or adding to an extended, numbered ACL
routing requirement, IPv4 ACL configuration and operating rules
rules: configuration;ACL, IPv4:rules:operation, IPv4 ACL configuration and operating rules
SA or DA on the switch;ACL, IPv4:traffic: to/from the switch, IPv4 ACL configuration and operating rules
scalability, Monitoring shared resources
security use, Introduction, Security
security use: caution, Security
sequence number, Sequence numbering in ACLs
sequence number: interval, Creating or adding to an extended, numbered ACL
sequence number:out-of-range, Inserting an ACE in an existing ACL
sequence number:use to delete ACE, Deleting an ACE from an existing ACL
source routing, caution;source-routing, caution;routing:source-routing, caution, General steps for planning and configuring ACLs, General steps for implementing ACLs
standard:configure, Configuring standard ACLs
standard:example;, Creating and viewing a standard ACL
standard:numbered, configure, Creating or adding to a standard, numbered ACL
standard:numeric I.D. range, Options for permit/deny policies
standard:structure, Standard ACL structure
standard:use, Standard ACL, Configuring standard ACLs
static port ACL: application;ACL, IPv4:RADIUS-assigned ACL application, Static port ACL and RADIUS-assigned ACL applications
static VLAN requirement, IPv4 ACL configuration and operating rules
static VLAN requirement;ACL, IPv4:VLANs , IPv4 ACL configuration and operating rules
static, defined;static ACL, Static ACLs
statistics counters: RACL counter operation, Using IPv4 counters with multiple interface assignments
supernetting; supernetting, Rules for defining a match between a packet and an access control entry (ACE)
switched packets , IPv4 ACL configuration and operating rules
Syslog, Features common to all ACL applications
TCP control bits, Configuring extended ACLs, Including options for TCP and UDP traffic in extended ACLs, Options for permit/deny policies
TCP control bits;ACL, IPv4:control bits, TCP;TCP control bits;control bits, TCP, Including options for TCP and UDP traffic in extended ACLs
TCP or UDP port number, IANA;IANA, Including options for TCP and UDP traffic in extended ACLs
TCP/UDP operators , Including options for TCP and UDP traffic in extended ACLs
TCP/UDP, port names, Including options for TCP and UDP traffic in extended ACLs
ToS: numbers and names, Configuring ACEs in named, extended ACLs
traffic types filtered, IPv4 traffic management and improved network performance
traffic: types filtered, Introduction
troubleshooting, Monitoring static ACL performance
troubleshooting client authentication, Operating rules for RADIUS-assigned ACLs
trunk: adding port;, IPv4 ACL configuration and operating rules
type, Viewing the RACL and VACL assignments for a VLAN, Inserting an ACE in an existing ACL, Configuring standard ACLs, Effect of the above ACL on inbound IPv4 traffic in the assigned VLAN
user-based security;ACL, IPv4:port-based security, 802.1X User-Based and Port-Based applications
VACL, Static ACLs
VACL:operation defined, ACL applications
VACL:VACL applications, VACL applications
VLAN ACL, IPv4, Static ACLs
where applied to traffic;ACL, IPv4:routed traffic, IPv4 ACL configuration and operating rules
wildcard, Rules for defining a match between a packet and an access control entry (ACE), How the mask defines a match
ACL, IPv6
display:assignments, Viewing static port (and trunk) ACL assignments
display:content of an ACL, Viewing specific ACL configuration details
dual stack;ACL, IPv4:dual stack, Operating notes
hit count, ACL logging operation
implicit IPv6 deny, IPv4-only rule, How a RADIUS server applies a RADIUS-assigned ACL to a client on a switch port
IPv6 traffic implicitly denied, How a RADIUS server applies a RADIUS-assigned ACL to a client on a switch port
limit, Monitoring shared resources
limit;ACL, IPv6:RADIUS-assigned, limit;ACL, IPv4:limit;ACL, IPv4:RADIUS-assigned, limit;ACL, IPv4:scalability;ACL, IPv6:scalability, You can assign an ACL name or number to an interface even if the ACL does not exist in the switch configuration
loggong:timer;ACL, IPv6:logging:timer, Configuring logging timer
RADIUS server support, RADIUS services supported on the switch
RADIUS-assigned ACL, RADIUS-assigned (dynamic) port ACL applications
RADIUS-assigned, implicit deny, How a RADIUS server applies a RADIUS-assigned ACL to a client on a switch port
RADIUS-assigned, limit, Monitoring shared resources
scalability, Monitoring shared resources
statistics counters, ACE, IPv4;ACL, IPv6:monitoring;ACL, IPv4 statistics counters, ACE;ACL, IPv4:monitoring, Monitoring static ACL performance
troubleshooting client authentication, Operating rules for RADIUS-assigned ACLs
type, Viewing static port (and trunk) ACL assignments, Viewing specific ACL configuration details
user-based security;ACL, IPv6:port-based security, Per-interface multiple ACL assignments
ACLs
TCAM resources, Show access-list resources
address
authorized for port security, General operation for port security
applying
connection-rate ACLs, Configuring and applying connection-rate ACLs, Applying connection-rate ACLs, Applying connection-rate ACLs
authentication
DCA-applied parameters to non-authenticated client sessions, Precedence of Client-based authentication: Dynamic Configuration Arbiter
MAC, Web-based and MAC authentication
NIM override, HPE E-Network Immunity Manager
RADIUS override, Show active per-port CoS and rate-limiting configuration, Arbitrating client-specific attributes
web-based, Web-based and MAC authentication
authentication session
client-specific configuration applied with DCA, Precedence of Client-based authentication: Dynamic Configuration Arbiter
Authority-signed certificate, Authority-signed certificate
authorized
option for authentication, Configuring authentication for access methods RADIUS is to protect
authorized addresses
for IP management security, Defining authorized management stations
for port security, General operation for port security
authorized IP managers
access-method, Configuring IP Authorized Managers for the switch (CLI)
building IP masks, Building IP Masks: Configuring one station per Authorized Manager IP entry, Building IP Masks: Configuring multiple stations per Authorized Manager IP entry
configuring in console, Viewing and configuring IP Authorized Managers (Menu)
definitions of single and multiple, Defining authorized management stations
effect of duplicate IP addresses;duplicate IP address:effect on authorized IP managers, Operating notes
IP mask for single station, Building IP Masks: Configuring one station per Authorized Manager IP entry
IP mask operation, Overview of IP mask operation
manager, operator;, Configuring IP Authorized Managers for the switch (CLI)
operating notes, Operating notes
overview, Authorized IP Managers
troubleshooting, Operating notes

C

CAC
access, Overview
cached reauthentication
client session termination, Determining the maximum amount of time before client session termination
timing considerations, Timing considerations
chap-radius
CHAP, Configuring authentication for access methods RADIUS is to protect
Clear button
to delete password protection, Recovering from a lost manager password
Command syntax
aaa accounting, Command to enable accounting, Command to enable accounting, Configure accounting types and controls for sending reports to the RADIUS server, Enhanced commands, Setting accounting type, and how data is sent
aaa accounting network, Command to enable accounting
aaa accounting session-id, Reconfiguring the Acct-Session-ID operation (Optional)
aaa accounting suppress null-username, Configuring session blocking and interim updating options (Optional)
aaa accounting update periodic, Configuring session blocking and interim updating options (Optional)
aaa authentication, Configuring the switch authentication method, Configuring authentication for access methods RADIUS is to protect, Configuring the primary password authentication method for console, Telnet, SSH and WebAgent, Enhanced commands, Allowing reauthentication when RADIUS server is unavailable
aaa authentication local-user, Configuring a local user for a group, aaa authentication local-user
aaa authentication login privilege-mode, Enabling manager access privilege (optional)
aaa authentication num-attempts, Configuring the switch authentication method, Configuring the switch global RADIUS parameters
aaa authentication ssh, aaa authentication ssh
aaa authentication ssh two-factor, aaa authentication ssh two-factor
aaa authentication ssh two-factor two-factor-type, aaa authentication ssh two-factor two-factor-type
aaa authentication ssh two-factor two-factor-type certificate-password, aaa authentication ssh two-factor two-factor-type certificate-password
aaa authentication ssh two-factor two-factor-type publickey-password, aaa authentication ssh two-factor two-factor-type publickey-password
aaa authorization, Enabling authorization to control access to CLI commands
aaa authorization commands, Command to enable authorization, Command to enable authorization
aaa authorization commands access-level, Command to enable authorization, Command to enable authorization
aaa authorization group, Configuring Groups for Local Authorization, aaa authorization group
aaa port-access, Controlled directions, Setting the time period to allow cached reauthentication
aaa port-access mac-based
addr-limit, Specifying the maximum authenticated MACs allowed on a port
addr-moves, Allowing addresses to move without re-authentication
auth-vid, Specifying the VLAN for an authorized client
logoff-period, Specifying the time period enforced for implicit logoff
max-requests, Specifying how many authentication attempts can time-out before failure
quiet-period, Specifying how long the switch waits before processing a request from a MAC address that failed authentication
reauth-period, Specifying time period enforced on a client to re-authenticate
reauthenticate, Forcing re-authentication of clients
server-timeout, Specifying the period to wait for a server response to an authentication request
unauth-vid, Specifying the VLAN to use when authentication fails
aaa port-access mac-based addr-format, Configuring a MAC address format
aaa port-access mac-based password, Commands to configure the global MAC authentication password
aaa port-access mac-based unauth-redirect, How HTTP redirect works
aaa port-access mbv, Enabling/disabling MAC authentication
aaa port-access web-based, Disable web-based authentication
auth-vid, Specifying the VLAN
clear-statisics, Clearing statistics
client-limit, Maximum authenticated clients
dhcp-addr, Specifies base address
dhcp-lease, Specifies lease length
ewa-server, Configures web server connection
logoff-period, Specifying the period
max-requests, Specifying the number of authentication attempts
max-retries, Specifying maximum retries
quiet-period, Specifying the time period
reauth-period, Specifying the re-authentication period
reauthenticate, Specifying a forced reauthentication
redirect-url, Specifying the URL
server-timeout, Specifying the timeout
aaa port-access web-based access-denied-message, Configuring custom messages for failed logins
aaa server-group radius, Connecting a RADIUS server with a server group
access-list, Show RADIUS-assigned ACL activity, Deleting an ACE, Creating or adding to a standard, numbered ACL
access-list logtimer, access-list logtimer
accounting, Viewing RADIUS accounting statistics
acl-name-str, Deleting an ACE
aclv4, ACL logging operation
All, Setting passwords and user names in the CLI
arp-protect trust, Configuring Trusted Ports for Dynamic ARP Protection
arp-protect vlan, Enabling Dynamic ARP protection
arp=protect validate, Configuring Additional Validation Checks on ARP Packets
authentication, Viewing RADIUS authentication statistics
authentication port-access, Configuring General 802.1X Operation
authenticator, Procedure to support RADIUS-assigned ACLs, Show RADIUS-assigned ACL activity
authenticator clients, Show active per-port CoS and rate-limiting configuration
authorization, Viewing authorization information
authorization group, Displaying Command Authorization Information
clear crypto client-public-key, Remove the client public keys from configuration
clear security-log , Security user commands
clear statistics mac, clear statistics
clear statistics mka ethernet port-list, Clearing MKA statistics on ports
confidentiality, MACsec policy: configuring confidentiality (policy context)
config, Local certificate enrollment — manual mode, Removal of certificates/CSRs
connection-rate-filter, Enabling global connection-rate filtering and sensitivity
connection-rate-filter sensitivity, Enabling global connection-rate filtering and sensitivity
connection-rate-filter unblock, Unblocking currently-blocked hosts
console max-sessions, For non-stackable switches, For HPE 5400R switches, For stackable switches, For non-stackable switches, For HPE 5400R switches, For stackable switches, Configuring concurrent sessions per
copy, File transfer, Loading a local certificate
copy security-log , Security user commands
crypto key generate autorun-key, Install authentication files
crypto key generate ssh, Install authentication files
crypto key zeroize , Remove authentication files
crypto pki clear certificate-name, Removal of certificates/CSRs
crypto pki clear crl, Clear CRL
crypto pki create-csr certificate-name, Create a certificate signing request
crypto pki create-csr local-certificate, Local certificate enrollment – manual mode
crypto pki create-self-signed certificate-name, Self-Signed certificate
crypto pki enroll-self-signed certificate-name, Create and enroll a self-signed certificate
crypto pki identity-profile, Switch identity profile, Certificate details
crypto pki install-signed-certificate, Local certificate enrollment — manual mode
crypto pki local-certificate, Certificate specific
crypto pki ta-profile, Trust anchor profile, Show profile specific
crypto pki ta-profile crl-root-profile ta-profile-name, Set TA profile to validate CRL and OCSP
crypto pki ta-profile ocsp-root-profile ta-profile-name, Set TA profile to validate CRL and OCSP
crypto pki ta-profile retrieve-crl, Retrieve CRL
crypto pki ta-profile revocation-check crl, Configure CRL for revocation check
crypto pki ta-profile revocation-check ocsp, Configure OCSP for revocation check
crypto pki zeroize, Zeroization
crypto SuiteB-MinLoS tls, Configure or remove the minimum levels of security minLos for TLS
debug acl, debug acl
debug destination, debug destination
debug dynamic-ip-lockdown, Debugging dynamic IP lockdown
debug security crypto, Debug logging
debug security dhcp-snooping, Enabling DHCPv4 debug logging
destination-port-list, Configuring a source-port traffic filter
dhcp-snooping, Configuring DHCPv4 snooping, Using DHCPv4 snooping with option 82, Setting the DHCPv4 binding database location, DHCPv4 Snooping Max Binding
diagnostic-level, Setting the diagnostic level
display pki certificate, Display PKI certificate
drop, Configuring a source-port traffic filter
encrypt-credentials, Enabling Encrypt-Credentials
encrypted-password, Setting an encrypted password
extended, Creating or adding to an extended, numbered ACL
filter, Displaying traffic/security filters
filter connection-rate, Configuring per-port filtering
filter source-port, Viewing a named source-port filer
filter source-port named-filter, Defining and configuring named source-port filters
forward 1 drop, Configuring a multicast or protocol traffic filter
forward port-list, Configuring a source-port traffic filter
front-panel-security factory-reset, Changing what the Reset+Clear button combination does
front-panel-security password-clear, Disabling the clear password function of the Clear button
front-panel-security password-clear reset-on-clear, Setting the Clear button functionality
front-panel-security password-recovery, Enabling and disabling password recovery
icmp-type, Controlling ICMP traffic in extended ACLs, Controlling IGMP traffic in extended ACLs, Controlling ICMP traffic flow
icmp-type-name, Controlling ICMP traffic in extended ACLs
igmp, Controlling IGMP traffic in extended ACLs, Controlling IGMP traffic flow
include-credentials, include-credentials radius-tacacs-only option, Enabling the storage and display of security credentials
include-sci-tag, Configuring include-sci-tag
instrumentation monitor, Configuring instrumentation monitor
interfaces brief, Checking for intrusions, listing intrusion alerts, and resetting alert flags (CLI)
ip access list, Controlling ICMP traffic flow
ip access-group, Filtering routed IPv4 traffic, Filtering IPv4 traffic inbound on a VLAN, Filtering inbound IPv4 traffic per port, RACL applications, VACL applications
ip access-group name in, Mac-access-list application syntax (PACL), Mac-access-list application syntax (VACL)
ip access-group shared, IPv4 access-group (PACL), IPv4 access-group (VACL)
ip access-list, Mac-access-list creation syntax, Entering the IPv4 named ACL context, Configuring ACEs in a named, standard ACL, Creating and configuring a named, extended ACL, Configuring ACEs in named, extended ACLs, Including options for TCP and UDP traffic in extended ACLs, Controlling ICMP traffic in extended ACLs, Creating or adding to an extended, numbered ACL, Controlling TCP and UDP traffic flow, Controlling IGMP traffic flow, Configuring logging timer, Viewing an ACL summary, Viewing the content of all ACLs on the switch, Viewing the RACL and VACL assignments for a VLAN, Viewing static port (and trunk) ACL assignments, Viewing specific ACL configuration details, Deleting an ACL, Inserting an ACE in an existing ACL, Deleting an ACE from an existing ACL, Resequencing the ACEs in an ACL, Attaching a remark to an ACE, Rules for defining a match between a packet and an access control entry (ACE)
ip access-list connection-rate-filter, Configuring a connection-rate ACL using source IP address criteria, Configuring a connection-rate ACL using UDP/TCP criteria
ip access-list extended 100, Mac-access-list extended configuration context
ip access-list standard 1, Mac-access-list standard configuration context
ip authoized managers, Listing the switch current Authorized IP Manager (CLI)
ip authorized-managers, Configuring IP Authorized Managers for the switch (CLI)
ip source-binding, For IPv4
ip source-lockdown, For IPv4, For IPv4
ip source-locksown, For IPv4
ip ssh public-key, SSH client public-key authentication
ip statistics ACL, Monitoring static ACL performance
ip-protocol-nbr, Configuring ACEs in named, extended ACLs
ipv6 access-group shared, IPv6 access-group (PACL), IPv6 access-group (VACL)
ipv6 authorized managers, Configuring IP Authorized Managers for the switch (CLI)
key, Optional, global encryption key, Enter the RADIUS Host IP Addresses
key chain, Assigning a time-independent key to a chain, Assigning time-dependent keys to a chain
lockout-mac, Configuring MAC Lockout
log, Using the event log to find intrusion alerts CLI
logoff-period, Reconfigure Settings for Port-Access
logtimer, Configuring logging timer
mac-access-group, Mac-access-list application syntax (PACL), Mac-access-list application syntax (VACL)
mac-access-group name in, Mac-access-list application syntax (PACL)
mac-access-group shared, MAC access-group (PACL), MAC access-group (VACL)
mac-access-list extended, Mac-access-list creation syntax
mac-access-list resequence, Mac-access-list creation syntax
mac-access-list standard, Mac-access-list creation syntax
mac-address, Listing authorized and detected MAC addresses
mac-based, Procedure to support RADIUS-assigned ACLs, Show RADIUS-assigned ACL activity
macsec apply policy port-list, Apply policy on a port-list
macsec policy, Create, modify or delete a MACsec policy
manager, Setting passwords and user names in the CLI
max-bindings, DHCPv4 Snooping Max Binding
mode pre-shared-key ckn cak, Configuring mode of MACsec policy
mode pre-shared-key ckn encrypted-cak, Encrypted-credentials mode
multicast, Configuring a multicast or protocol traffic filter
nacl, Configuring ACEs in a named, standard ACL
no, Using the CLI interface to enable web management over SSL/TLS, Filtering routed IPv4 traffic, Filtering IPv4 traffic inbound on a VLAN, Filtering inbound IPv4 traffic per port, Deleting an ACL, Eavesdrop Prevention is Disabled, Configuring Trusted Ports for Dynamic ARP Protection, Configuring Additional Validation Checks on ARP Packets, Configuring MAC Lockdown, Configuring MAC Lockout, Configuring instrumentation monitor, Enabling port security eavesdrop-prevention, Configuring DHCPv4 snooping, Using DHCPv4 snooping with option 82, Setting the DHCPv4 binding database location, Enabling DHCPv4 debug logging, Enabling Dynamic ARP protection, For IPv4, For IPv4, Configuring IP Authorized Managers for the switch (CLI), Assigning a time-independent key to a chain, Assigning time-dependent keys to a chain, Defining and configuring named source-port filters, Configuring a source-port traffic filter, Enabling 802.1X authentication on selected ports, Port-Based 802.1X Authentication., Configure the port access type., Enabling a Switch Port as a Supplicant., Configuring Mixed Port Access Mode, Opacity shields command, Trust anchor profile, Switch identity profile, Self-Signed certificate, Debug logging
no crypto pki install-signed certificate-name, Self-signed certificate enrollment
no crypto SuiteB-MinLoS tls, Configure or remove the minimum levels of security minLos for TLS
no password, Removing password protection using the CLI
no password all, Removing password protection using the CLI
opacity-sheilds, Opacity shields command
Operator, Setting passwords and user names in the CLI
password, Setting passwords and user names in the CLI, Password command options, password, Additional password command option
password complexity, password complexity
password composition, password composition
password configuration, password configuration
password configuration-control, password configuration-control
password minimum-length, password minimum-length
password port-access, General Setup Procedure for 802.1X Access Control
port security, Configuring port security
Port-Access, Setting passwords and user names in the CLI
port-access, Procedure to support RADIUS-assigned ACLs, Show RADIUS-assigned ACL activity, Show active per-port CoS and rate-limiting configuration, Configuring Mixed Port Access Mode
port-access authenticator, Enabling 802.1X authentication on selected ports, User-Based 802.1X Authentication, Port-Based 802.1X Authentication., Reconfigure Settings for Port-Access, Enable 802.1X Authentication on the Switch, Optional: Reset Authenticator Operation, Configuring General 802.1X Operation, Configuring 802.1X Open VLAN Mode, Option For Authenticator Ports: Configure Port-Security To Allow Only 802.1X-Authenticated Devices, Configure the port access type., Show Commands for Port-Access Authenticator
port-access gvrp-vlans, Enabling the Use of GVRP-Learned Dynamic VLANs in Authentication Sessions
port-access supplicant, Show Commands for Port-Access Supplicant, Enabling a Switch Port as a Supplicant., Configuring a Supplicant Switch Port
port-access-authenticator, Option For Authenticator Ports: Configure Port-Security To Allow Only 802.1X-Authenticated Devices
port-list, Viewing static port (and trunk) ACL assignments, Configuring port security
port-security, Eavesdrop Prevention is Disabled, Displaying port security settings, Enabling port security eavesdrop-prevention
protocol, Configuring a multicast or protocol traffic filter
radius, Show RADIUS-assigned ACL activity
radius accounting, Viewing RADIUS accounting statistics
radius authentication, Viewing RADIUS authentication statistics
radius host, Enter the RADIUS Host IP Addresses, Configuring General 802.1X Operation
radius-server, Configuring the switch to access a RADIUS server, Configuring the switch to access a RADIUS server, Connecting a RADIUS server with a server group
radius-server host, Adding and deleting servers to the RADIUS configuration, Procedure to support RADIUS-assigned ACLs
key, Configuring the switch to access a RADIUS server
radius-server key, Enter the RADIUS Host IP Addresses, Configuring General 802.1X Operation
radius-server tracking, radius-server tracking
radius-server tracking user-name, radius-server tracking user-name
rate-limit, Show rate-limiting and port priority for ports
remark, Remark command
replay-protection, Configuring replay protection
resequence, Resequencing the ACEs in an ACL
secure-mode, Configuring secure mode
sftp local-certificate, Loading a local certificate
sftp ta-certificate, File transfer
Show, DHCPv4 Snooping Max Binding
show, Viewing and changing the SNMP access configuration, Viewing authorization information, Viewing RADIUS authentication statistics, Viewing RADIUS accounting statistics, Displaying Command Authorization Information, Show RADIUS-assigned ACL activity, Show active per-port CoS and rate-limiting configuration, Show rate-limiting and port priority for ports, Deleting an ACE, Viewing an ACL summary, Viewing the content of all ACLs on the switch, Viewing static port (and trunk) ACL assignments, Viewing specific ACL configuration details, Monitoring static ACL performance, ACL logging operation, Displaying port security settings, Listing authorized and detected MAC addresses, Setting the DHCPv4 binding database location, For IPv4, For IPv4, Checking for intrusions, listing intrusion alerts, and resetting alert flags (CLI), Listing the switch current Authorized IP Manager (CLI), Assigning time-dependent keys to a chain, Viewing a named source-port filer, Displaying traffic/security filters, Option For Authenticator Ports: Configure Port-Security To Allow Only 802.1X-Authenticated Devices, Viewing 802.1X Open VLAN Mode Status, Show Commands for Port-Access Supplicant, Show Commands for Port-Access Authenticator, Certificate specific, Show profile specific, Certificate details
show access-list, Show access-list
show access-list config, Show access-list by name, Show access-list config
show access-list port, Show access-list port
show access-list ports, show access-list ports
show access-list resource, Show access-list resources
show access-list vlan, Show access-list vlan, show access-list vlan
show accounting sessions, Show all accounting configurations, Show accounting sessions
show authentication, Show current authentication configurations
show authorization group, Show all authorization configurations
show connection-rate-filter, Viewing the connection-rate configuration, Listing currently-blocked hosts
show crypto client-public-key, show crypto client-public-key
show crypto pki ta-profile, Show details of TA profile
show front-panel-security, Configuring front panel security
show include-credentials, Displaying the status of include-credentials on the switch
show macsec policy, Show command for MACsec policies
show macsec statistics, Show command for MACsec statistics
show macsec statistics detail, Show command for detailed MACsec statistics on a port
show macsec status, Show command for MACsec status
show password-configuration, show password-configuration
show port-access mac-based, Viewing the show commands for MAC authentication
show port-access mac-based clients, Viewing session information for MAC authenticated clients on a switch
show port-access mac-based clients detailed, Viewing detail on status of MAC authenticated client sessions
show port-access mac-based config, Viewing MAC authentication settings on ports
show port-access mac-based config auth-server, Viewing MAC Authentication settings including RADIUS server-specific
show port-access mac-based config detailed, Viewing details of MAC Authentication settings on ports
show port-access mka statistics, Show command for MKA statistics
show port-access mka status, Show command for MKA status
show port-access summary, Viewing port-access information
show port-access web-based, Viewing status of ports enabled for web-based authentication
show port-access web-based clients, Viewing session details for web-Auth clients
show port-access web-based clients detailed, Viewing status details of web-based authentication sessions on specified ports
show port-access web-based config, Viewing web-based authentication settings for ports
show port-access web-based config auth-server, Viewing web-based authentication settings for ports, including RADIUS server specific
show port-access web-based config detailed, Viewing details of web-based authentication settings for ports
show port-access web-based config web-server, Viewing web-based authentication settings for ports, including web specific settings
show radius, Viewing RADIUS Statistics
show running-config, show configuration, Show command (running configuration) (for ACLs)
show security-log , Security user commands
show server-group radius, Viewing RADIUS server group information
show statistics mac, Show statistics
show tacacs host, Show TACACS+, Show TACACS+ host details
show tech macsec, Show tech command
snmp-server, Viewing and changing the SNMP access configuration
source-port, Configuring a source-port traffic filter
static mac, Configuring MAC Lockdown
sys-debug <FILTER-TYPE> <FILTER-OPTIONS>, sys-debug <FILTER-TYPE> <FILTER-OPTIONS>
sys-debug acl, sys-debug acl
sys-debug destination [logging | buffer], sys-debug destination
tacacs, Optional, global encryption key
tacacs-server, Server specific encryption key
tacacs-server dead-time, Command to configure dead time
tacacs-server host, Command to configure the TACACS+ server, Configuring the switch TACACS+ server access
tcp, Including options for TCP and UDP traffic in extended ACLs, Controlling TCP and UDP traffic flow
tftp local-certificate, File transfer, Loading a local certificate
tftp ta-certificate, File transfer
UDP, Including options for TCP and UDP traffic in extended ACLs
udp, Controlling TCP and UDP traffic flow
verify signature flash, Verifying the flash is signed
vlan, Viewing the RACL and VACL assignments for a VLAN, Viewing 802.1X Open VLAN Mode Status
vlan ip access-group connection-rate-filter, Applying connection-rate ACLs
web-based, Procedure to support RADIUS-assigned ACLs, Show active per-port CoS and rate-limiting configuration
web-management ssl, Using the CLI interface to enable web management over SSL/TLS
config file, Security credentials
configuration
access method, Configuring the switch authentication method
password security, Configuring Username and Password Security
saving security credentials in multiple files, Operating Notes
user name and password security, Configuring Username and Password Security
user name security, Configuring Username and Password Security
Configuration support
Suite B, Configuration support
configuring
connection-rate ACL, Configuring a connection-rate ACL using UDP/TCP criteria
connection-rate ACLs, Configuring and applying connection-rate ACLs
connection-rate filtering, Configuring connection-rate filtering, Configuring connection-rate filtering for low risk networks, Configuring connection-rate filtering for high risk networks
local password security, Setting a new console password
MAC authentication
on switch, Configuring MAC authentication on the switch
per-port filtering, Configuring per-port filtering
RADIUS server, Configuring the switch to access a RADIUS server
TACACS server
single login, Configuring the TACACS+ server for single login
web-based authentication, Configuring web-based authentication
Configuring ACEs
named standard ACL, Configuring ACEs in a named, standard ACL
connection-rate
log, Connection-rate log and trap messages
trap messages, Connection-rate log and trap messages
connection-rate ACL, Connection-rate Access Control Lists (ACLs)
operating notes, Connection-Rate ACL operating notes
connection-rate filtering, Connection-rate filtering
access-control list, Application options
ACL
UDP/TCP options, Configuring a connection-rate ACL using UDP/TCP criteria
ACL:ACE mask, Using CIDR notation to enter the ACE mask
ACL:application to port, Connection-rate ACL operation
ACL:applying, Applying connection-rate ACLs
ACL:CIDR notation, Using CIDR notation to enter the ACE mask
ACL:filter, Configuring a connection-rate ACL using source IP address criteria, Configuring a connection-rate ACL using UDP/TCP criteria, Connection-rate ACL operation, Connection-Rate ACL operating notes
ACL:ignore, Configuring a connection-rate ACL using source IP address criteria, Configuring a connection-rate ACL using UDP/TCP criteria, Connection-rate ACL operation, Connection-Rate ACL operating notes
ACL:implicit filter, Connection-rate ACL operation, Connection-Rate ACL operating notes
ACL:operation, Connection-rate ACL operation
ACL:source IP, Configuring a connection-rate ACL using source IP address criteria
ACL:UDP/TCP, Configuring a connection-rate ACL using UDP/TCP criteria
ACL:UDP/TCP port data, Configuring a connection-rate ACL using UDP/TCP criteria
ACL:VLAN effect, Connection-rate ACL operation
activation, Operating rules
benefits, Features and benefits
block, Configuring per-port filtering
blocked host, Unblocking currently-blocked hosts, Filtering options
blocked host, re-enable, Filtering options, Configuring connection-rate filtering for low risk networks
blocked host;connection-rate filtering:host, unblocking, Unblocking currently-blocked hosts
blocked host;connection-rate filtering:re-enable blocked host, Unblocking a currently blocked host
blocked host;connection-rate filtering:unblocking a host, Unblocking a currently blocked host
configuring per-port, Configuring per-port filtering
enabling, commands, Enabling global connection-rate filtering and sensitivity
false positive, Application options
guidelines, Configuring connection-rate filtering for low risk networks
high rate, legitimate;connection-rate filtering:sensitivity level, changing, Unblocking currently-blocked hosts
high risk networks, Configuring connection-rate filtering for high risk networks
host, trusted, Unblocking currently-blocked hosts
ICMP ping message, Overview
IPv6 not supported, Operating rules
low risk networks, Configuring connection-rate filtering for low risk networks
notify and reduce, Filtering options
notify only, Filtering options
notify-only, Configuring per-port filtering
operating rules, Operating rules
operation, General operation
options, Filtering options
penalty period, throttling, Configuring per-port filtering
port setting change, effect, Unblocking a currently blocked host
reboot, effect, Unblocking a currently blocked host
recommended application;connection-rate filtering:edge of network, Overview
sensitivity level, Sensitivity to connection rate detection, Configuring connection-rate filtering for low risk networks
sensitivity level, command, Enabling global connection-rate filtering and sensitivity
show, command, Viewing the connection-rate configuration
signature recognition, Features and benefits, Overview
SNMP trap;connection-rate filtering:event log notice, Filtering options
throttle, Configuring per-port filtering, Filtering options, Connection-rate Access Control Lists (ACLs)
trigger, Operating rules
trigger;connection-rate filtering:activation, Features and benefits
unblock command, Unblocking currently-blocked hosts, Configuring connection-rate filtering for low risk networks
VLAN delete, effect, Unblocking a currently blocked host
worm, Features and benefits, Overview
connection-rate-configuration, Using an ACL in a connection-rate configuration example
connnection-rate filtering
configuration, Configuring connection-rate filtering
console
access, Console access
authorized IP managers, configuring, Viewing and configuring IP Authorized Managers (Menu)
console access
manager, Console access
operator, Console access
contacting Hewlett Packard Enterprise, Accessing Hewlett Packard Enterprise Support
CoS
configuring for a RADIUS server
Class of Service, RADIUS services supported on the switch
override
(CoS) Priority assignments per-user on traffic inbound to the switch, CoS and rate-limiting services
RADIUS client, Show active per-port CoS and rate-limiting configuration
viewing per-port config, Show active per-port CoS and rate-limiting configuration
creating
password security, Creating password security
credentials
manager and operator, Local manager and operator credentials
currently-blocked hosts
listing, Listing currently-blocked hosts
customer self repair, Customer self repair
customizing
HTML templates, Customizing HTML templates
user login web pages, Customizing user login web pages

D

default configuration and security, Configuring security settings using the CLI wizard
default settings
802.1X:access control, none, Access Security and Switch Authentication Features
aaa port-access mac-based, Specifying the VLAN to use when authentication fails
ACLs, none, Access Security and Switch Authentication Features
authorized ip managers, none, Access Security and Switch Authentication Features
cached-reauth-limit, <i>no limit<i>, Setting the time period to allow cached reauthentication
connection-rate filtering, none, Network Security—Default Settings and Security Guidelines
DHCP snooping, none;default settings:dynamic arp protection, none;default settings:dynamic IP lockdown, none, Network Security—Default Settings and Security Guidelines
dyn-authorization, <i> disabled <i>, Configuring the switch to access a RADIUS server
dyn-autz-port <i> 3799 <i>, Configuring the switch global RADIUS parameters
factory reset, enabled, Configuring front panel security
front panel security, Configuring front panel security
front-panel-security, Configuring front panel security
ICMP rate-liming, none, Network Security—Default Settings and Security Guidelines
key management system, none, Network Security—Default Settings and Security Guidelines
MAC authentication, disabled, Access Security and Switch Authentication Features
MAC lockdown and lockout, none, Network Security—Default Settings and Security Guidelines
manager password, no password, Access Security and Switch Authentication Features
passwords
password recovery, enabled, Configuring front panel security
password-clear, enabled, Disabling the clear password function of the Clear button
passwords:password recovery, enabled, Enabling and disabling password recovery
passwords:reset-on-clear, disabled, Configuring front panel security
port security, none, Network Security—Default Settings and Security Guidelines
port security, off or 'continuous', Default port security operation
RADIUS authentication, disabled, Access Security and Switch Authentication Features
RADIUS:global parameters, Configuring the switch for RADIUS authentication
RADIUS:radius-server dead-time, 0 minutes, Configuring the switch global RADIUS parameters
RADIUS:radius-server retransmit, 3 seconds, Configuring the switch global RADIUS parameters
RADIUS:radius-server timeout, 5 seconds, Configuring the switch global RADIUS parameters
RADIUS:server key, null, Configuring the switch for RADIUS authentication
secure management vlan, disabled, Access Security and Switch Authentication Features
security:access security and authentication, Access Security and Switch Authentication Features
security:network security, Network Security—Default Settings and Security Guidelines
SNMP access, SNMP security guidelines
SNMP access to the security MIB, open, Using SNMP to view and configure switch authentication features
SNMP, public, unrestricted, Access Security and Switch Authentication Features
spanning tree: bpdu protection, none;default settings:spanning tree: bpdu filtering, none, Network Security—Default Settings and Security Guidelines
SSH, disabled, Access Security and Switch Authentication Features
SSL, disabled, Access Security and Switch Authentication Features
TACACS+
login attempts, 3, TACACS+ authentication setup
TACACS+:authentication, disabled, Access Security and Switch Authentication Features
TACACS+:tacacs-server-timeout, 5 seconds, Configuring the Timeout period
Telnet access, enabled, Access Security and Switch Authentication Features
time-window, 300 seconds, Configuring the switch to access a RADIUS server
traffic/security filters, none, Network Security—Default Settings and Security Guidelines
UDP destination port for authentication, 1812;default settings:UDP destination port for accounting, 1813, Preparation procedures for RADIUS
usb autorun, disabled(if password), Network Security—Default Settings and Security Guidelines
usb autorun, enabled (if no password);, Network Security—Default Settings and Security Guidelines
virus throttling, none, Network Security—Default Settings and Security Guidelines
web and MAC authentication, Specifying the VLAN to use when authentication fails
Web authentication, disabled, Access Security and Switch Authentication Features
Web-browser access, enabled, Access Security and Switch Authentication Features
defined
VACL defined, Static ACLs
deleting
password protection, Deleting password protection
DHCP-snooping max-bindings
max-bindings, DHCPv4 Snooping Max Binding
DHCPv4
DHCP Snooping, DHCPv4 Snooping Max Binding
documentation
providing feedback on, Documentation feedback
Dynamic Configuration Arbiter (DCA)
applying settings to non-authenticated clients, Precedence of Client-based authentication: Dynamic Configuration Arbiter
hierarchy of precedence in authentication sessions, Arbitrating client-specific attributes
overview, Precedence of Client-based authentication: Dynamic Configuration Arbiter

K

KMS
accept key time, Assigning time-dependent keys to a chain
key chain entry; KMS:generating a key chain, Creating and deleting key chain entries
key chain generation, Configuring key chain management
overview, Overview
send key time, Assigning time-dependent keys to a chain
time protocol; KMS:time-dependent key, Assigning time-dependent keys to a chain
time-dependent key, Assigning time-dependent keys to a chain
time-independent key; KMS: generating a time-independent key; KMS:assigning a time-independent key, Assigning a time-independent key to a chain

M

MAC ACLs, MAC ACLs
event log, Event Log messages
overview, Overview
Mac ACLs
standard configuration, Mac-access-list standard configuration context
MAC authentication
configuring on switch, Configuring MAC authentication on the switch
configuring: on the switch, Configuring a global MAC authentication password
display all 802.1X, MAC authentication configuration, Preparation for configuring MAC authentication
hierarchy of precedence in authentication session, Precedence of Client-based authentication: Dynamic Configuration Arbiter
overview, Access Security and Switch Authentication Features
prerequisites, Prerequisites for web-based or MAC authentication
rules of operation, Operating notes and guidelines
show status and configuration, Viewing the show commands for MAC authentication
MAC Classes, Overview
MAC Lockdown, About port security
MAC lockout, About port security
number of vlans, How MAC Lockout works
manager password, Console access, Setting a new console password, Deleting password protection
saving to configuration file, Saving local manager and operator passwords
MIB
SNMP access, SNMP security guidelines
SNMP access to authentication MIB, SNMP access to the authentication configuration MIB
mirroring
ACL, classifier-based; rate-limiting:ACL, static, classifier-based, ACL Mirroring
ACL, classifier-based;rate-limiting:ACL, static, classifier-based, Classifier-based rate-limiting with RL-PACLs, Multiple ACLs on an interface
ACL, deprecated;rate-limiting:ACL, static, deprecated, Classifier-based rate-limiting with RL-PACLs, ACL Mirroring, Multiple ACLs on an interface

P

password
802.1X port access, Restrictions to enabling security credentials
802.1X port-access, Security settings that can be saved
browser/console access, Creating password security
case-sensitive, Setting a new console password
caution, Creating password security
configuring manager and operator, Setting passwords and user names in the CLI
delete, Deleting password protection
deleting with the Clear button, Recovering from a lost manager password
downgrading software, Upgrading or downgrading software versions implications for passwords
if you lose the password, Recovering from a lost manager password
included with security credentials, Security settings that can be saved
length, Setting a new console password
locally configured, hierarchy of precedence in authentication session;, Precedence of Client-based authentication: Dynamic Configuration Arbiter
manager, Operating notes for passwords in enhanced secure mode
no switch access, Unable to use previous password
operator, Operating notes for passwords in enhanced secure mode
operator only, caution, Creating password security
SNMP configuration, Console access
upgrading software, Upgrading or downgrading software versions implications for passwords
password complexity, Password complexity overview
aaa authentication local-user, aaa authentication local-user
configuration commands, password configuration commands
configuring, Configuring Password Complexity
configuring parameters, Configure the Password Complexity parameters
display messages, Display messages
enabling, Enable Password Complexity
expiration periods, Password expiration periods
limitations, Limitations
password, password
password composition, password composition
password configuration, password configuration
password configuration-control, password configuration-control
password minimum-length, password minimum-length
requirements, Requirements
show password-configuration, show password-configuration
troubleshooting, Troubleshooting
validation rules, Validation rules
viewing configuration, Viewing the password configuration
password security
saved to configuration file, Saving local manager and operator passwords
passwords
clear password, enabled, Configuring front panel security
PCM, Optional HPE PCM and IDM network management applications
peap-mschapv2
MSCHAPv2, Configuring authentication for access methods RADIUS is to protect
port access
Web authentication; port access: MAC authentication; Web authentication: port access; MAC authentication: port access, General features
port ACL
ACL, IPv4, Static ACLs
port security
802.1X, learn mode requirement;port-based access control:port-security learn mode, Configuring port security
authorized address definition, General operation for port security
basic operation, Basic operation
configuring;configuration:port security, Planning port security
event log, Using the event log to find intrusion alerts CLI
notice of security violations, Notice of security violations
operating notes, Operating notes for port security
overview, Network Security—Default Settings and Security Guidelines
overview;security:per port;port:security configuration, Port Security
port-based access control
password, Restrictions to enabling security credentials, Security settings that can be saved
VLAN, tagged member, VLAN membership priorities
prior to;Intrusion Log
prior to, Checking for intrusions, listing intrusion alerts, and resetting alert flags (CLI), Checking for intrusions, listing intrusion alerts, and resetting alert flags (Menu)
prior to;port security
prior to;intrusion alarms:prior to, "Prior To" entries in the intrusion log
privilege-mode option
login, Using the privilege-mode option for login
ProCurve Manager
IDM as a plug-in to, HPE PCM+ Identity-Driven Manager (IDM)
port security alerts, General operation for port security
proxy
web server, Proxy Web servers

R

RADIUS
accounting, Configuring RADIUS accounting
accounting, configure server access, Configuring a switch to access a RADIUS server
accounting, configure types on switch, Configure accounting types and controls for sending reports to the RADIUS server
accounting, exec, Accounting service types to track, Accounting service types
accounting, network, Accounting service types to track
accounting, operating rules, Operating rules for RADIUS accounting
accounting, server failure, Operating rules for RADIUS accounting
accounting, session-blocking;RADIUS:accounting, interim updating, Configuring session blocking and interim updating options (Optional)
accounting, start-stop method, Accounting Controls
accounting, statistics terms, Values for show radius host output
accounting, stop-only method, Accounting Controls
accounting, system, Accounting service types to track, Accounting service types
administrative-user service-type value, Service-type value
authentication, authorized, Configuring authentication for access methods RADIUS is to protect
authentication, local, Local authentication process
authentication, web, Overview
authentication, webagent, Configuring authentication for access methods RADIUS is to protect, Enabling manager access privilege (optional)
authorization; RADIUS: commands authorization, Commands authorization
cached reauthentication; 802.1X: cached reauthentication; cached reauthentication, Cached reauthentication
cached-reauth-period command, Setting the time period to allow cached reauthentication
change of authorization, Additional RADIUS attributes
change-of-authorization attribute, Additional RADIUS attributes
client CoS, Show active per-port CoS and rate-limiting configuration
client Rate-Limiting, Show active per-port CoS and rate-limiting configuration
commands, switch, Configuring the switch for RADIUS authentication
configuring commands authorization, Configuring commands authorization on a RADIUS server
configuring switch global parameters, Configuring the switch global RADIUS parameters
CoS override, CoS and rate-limiting services
displaying group information, Viewing RADIUS server group information
dyn-autz-port; dyn-autz-port, Configuring the switch global RADIUS parameters
dynamic port access changes; RADIUS: authentication limits; RADIUS: VSAs; VSA: with RADIUS, Dynamic removal of authentication limits
Egress-VLAN ID attribute, Tagged and untagged VLAN attributes
Egress-VLAN-Name attribute, Tagged and untagged VLAN attributes
HP-acct-terminate-cause attribute, Additional RADIUS attributes
HP-Command-Exception, Using Vendor Specific Attributes (VSAs)
IPv4 ACL, RADIUS services supported on the switch
IPv6 ACL, RADIUS services supported on the switch
login privilege-mode, application options, Enabling manager access privilege (optional)
manager access denied, Service-type value
manager access privilege, service type value;RADIUS:service type value, Preparation procedures for RADIUS
manager access privilege;RADIUS:login-privilege mode, Enabling manager access privilege (optional)
MD5, Switch operating rules for RADIUS
messages, Messages related to RADIUS operation
MS-RAS-Vendor attribute, Additional RADIUS attributes
multiple ACL application types in use, Effect of multiple ACL application types on an interface
multiple server groups, Using multiple RADIUS server groups
NAS-Prompt-User service-type value, Service-type value
network accounting, Accounting service types
operating rules, switch, Switch operating rules for RADIUS
override, precedence, multiple clients, Show active per-port CoS and rate-limiting configuration
rate-limiting configuration, Show active per-port CoS and rate-limiting configuration
security log access, Authentication and Authorization through RADIUS
security note, Operating notes
server access order, Operating rules for RADIUS accounting
server access order, changing, Changing RADIUS-server access order
server-group command, Configuring the primary password authentication method for console, Telnet, SSH and WebAgent, Setting accounting type, and how data is sent
servers, multiple, Configuring the switch global RADIUS parameters
service-type value, Enabling manager access privilege (optional)
service-type value, null, Enabling manager access privilege (optional)
shared secret key, saving to configuration file, Security settings that can be saved
show accounting, Viewing RADIUS accounting statistics
show authentication
authentication statistics, Viewing RADIUS authentication statistics
statistics, viewing, Viewing RADIUS Statistics
TLS, Switch operating rules for RADIUS
Tunnel-Type attribute, Tagged and untagged VLAN attributes
vendor specific attributes;, Additional RADIUS attributes
vendor-specific attributes; RADIUS: HP-command-string, Using Vendor Specific Attributes (VSAs)
VSAs, Using Vendor Specific Attributes (VSAs)
VSAs for client limit, Configuring the RADIUS VSAs
web browser security not supported, Preparation procedures for RADIUS
web-browser security not supported;RADIUS:SNMP access security not supported, Operating notes
webagent security not supported;RADIUS:webagent access controls, Controlling webagent access when using TACACS+ authentication
RADIUS hosts, Using multiple RADIUS server groups
RADIUS server groups
authentication, Using multiple RADIUS server groups
default settings, Using multiple RADIUS server groups
RADIUS-assigned ACLs, RADIUS-assigned ACLs
contrasting dynamic and static dynamic (RADIUS-assigned) Contrasting, Contrasting dynamic (RADIUS-assigned) and static ACLs
contrasting dynamic and staticdynamic (RADIUS-assigned) and static ACLs, Contrasting dynamic (RADIUS-assigned) and static ACLs
deny any, implicit, switched packets, The packet-filtering process
deny in any ACL on an interface, Operating rules for RADIUS-assigned ACLs
filters; enhancing network security, Traffic applications
implicit deny, How a RADIUS server applies a RADIUS-assigned ACL to a client on a switch port
multiple application types in use, Effect of multiple ACL application types on an interface
multiple clients, access restriction, How a RADIUS server applies a RADIUS-assigned ACL to a client on a switch port
multiple, on an interface, Operating rules for RADIUS-assigned ACLs
resource monitor, Monitoring shared resources
source routing, caution;source-routing, caution, Contrasting RADIUS-assigned and static ACLs
standard attribute, Nas-Filter-Rule Attribute Options
switched packets, The packet-filtering process
vendor-specific attribute, Nas-Filter-Rule Attribute Options
RADIUS-assigned ACLs;RADIUS
ACL, Traffic applications
rate-limiting
RADIUS and CLI option, Per-port bandwidth override
RADIUS egress, Egress (outbound) traffic
RADIUS ingress, Ingress (inbound) traffic
RADIUS server specified, Show active per-port CoS and rate-limiting configuration
RADIUS server support; RADIUS: rate-limiting, RADIUS services supported on the switch
RADIUS-assigned vs. applied, RADIUS-assigned rate-limit increments
RADIUS-assigned,increments, RADIUS-assigned rate-limit increments
RADIUS-assigned., Show active per-port CoS and rate-limiting configuration
RBAC
aaa authorization group, aaa authorization group
assigning rules, Creating roles and assigning rules
command rules, Command rules
configuring command rules, Configuring command rules
configuring feature policy, Configuring feature policy
configuring interface policy, Configuring interface policy
configuring VLAN policy, Configuring VLAN policy
creating a role, Creating a role
creating roles, Creating roles and assigning rules
displaying feature, Displaying predefined features
displaying rules for role, Displaying rules for predefined roles
enabling authorization, Enabling authorization
feature rules, Feature rules
interface policy rules, Interface policy rules
limitations, Limitations
overview, RBAC Overview
predefined features, Predefined features
roles, Roles
rules, Rules
troubleshooting, Troubleshooting
VLAN policy rules, VLAN policy rules
remote support, Remote support
removing
password protection, Removing password protection using the CLI
Reset-on-clear
disabled when saving security credentials to configuration file, Operating Notes
RFCs
RFC 2548, Additional RADIUS attributes
RFC 3580, Tagged and untagged VLAN attributes
RFC 4675, Tagged and untagged VLAN attributes
routing
source-routing, caution, Contrasting RADIUS-assigned and static ACLs

S

secret keys
enhanced secure mode, Secret keys
secure mode
enabling enhanced, Commands affected when enhanced secure mode is enabled
enhanced, Configuring secure mode
standard, Configuring secure mode
Secure web management, Secure web management
Assigning local login and enabling password, Assigning a local login (operator) and enabling (manager) password
Configuration, Configuration summary
security
authorized IP managers, Authorized IP Managers
security credentials, Security credentials
802.1X credentials saved to configuration file, Restrictions to enabling security credentials, Storing 802.1X port-access credentials
copying startup configuration, Operating Notes
disabling Reset-on-clear option, Operating Notes
downloading a configuration file, Operating Notes
downloading from a server, Benefits of saving security credentials
manager user name and password, Saving local manager and operator passwords
operator user name and password, Saving local manager and operator passwords
SNMPv3, Saving SNMP security credentials
SSH private keys not saved, Restrictions to enabling security credentials
viewing in startup configuration, Operating Notes
when SNMPv3 credentials in downloaded file are not supported, Restrictions to enabling security credentials
Security event log
JITC, Security event log
Security logs
configuring concurrent sessions, Configuring concurrent sessions
configuring concurrent sessions per user, Configuring concurrent sessions per
configuring HPE 5400R switches, For HPE 5400R switches
configuring HPE-5400R switches, For HPE 5400R switches
configuring non-stackable switches, For non-stackable switches, For non-stackable switches
configuring stackable switches, For stackable switches, For stackable switches
event-log wraps, Event log wrap
failed login attempts delay, Failed login attempts delay
restrictions, Restrictions
security settings, Security credentials
Security user
commands, Security user commands
creating, Creating a security user
Security user log
access, Security user log access
security violations
notices of, Notice of security violations
Self-signed certificate, Self-signed certificate
Self-signed certificate browser compatibility
Browser compatibility self-signed certificate, Self-signed certificate browser compatibility
setting
inactivity timer, Setting an inactivity timer
shared secret key
RADIUS, Security settings that can be saved
TACACS, Security settings that can be saved
SNMP
password and user name configuration, Console access
SNMPv3
saving security credentials to configuration file, Security settings that can be saved, Saving SNMP security credentials
security credentials not supported in downloaded file, Restrictions to enabling security credentials
SSH
private keys not saved to configuration file, Restrictions to enabling security credentials
public key, saving to configuration file, Security settings that can be saved
SSL
version;SSL:SSLv3;, Overview
version;SSL:TLSv1;, Overview
Standby Management Module
password, Operating notes for passwords in enhanced secure mode
start range default settings
port-access, Specifying the maximum authenticated MACs allowed on a port
Suite B, Conformance to Suite-B Cryptography requirements
error messages, Error messages
minimum levels of security support, Conformance to Suite-B Cryptography requirements
support
Hewlett Packard Enterprise, Accessing Hewlett Packard Enterprise Support

T

TA profile
validation rules, Validation rules
TACACS
aaa parameters, AAA Authentication Parameters
authentication process, General authentication process using a TACACS+ server
authentication request
timeout, Specifying switch response
authentication, local, Local authentication process
authorized IP managers, effect, Operating notes
configuration
on switch, Before you begin
configuration, authentication, Selecting the access method for configuration
configuration, server access;TACACS:server access;, Configuring the switch TACACS+ server access
configuration, timeout, Configuring the Timeout period
encryption key, TACACS+ authentication setup, Configuring the switch TACACS+ server access
encryption key, general operation, Encryption options in the switch
encryption key, global, Deleting a per-server encryption key
encryption key, saving to configuration file, Security settings that can be saved
encryption key;TACACS:configuration, encryption key, Configuring an encryption key
general operation, Overview
IP address, server, Configuring the switch TACACS+ server access
local manager password requirement, Operating notes
messages, Messages related to TACACS+ operation
preventing switch lockout;test;troubleshooting:authentication via Telnet, Configuring the switch TACACS+ server access
privilege level code, TACACS+ authentication setup
server priority, Adding, removing, or changing the priority of a TACACS+ server
server specific encryption key, Server specific encryption key
setup, general, TACACS+ authentication setup
single login; TACACS: single sign-on, Configuring the TACACS+ server for single login
TFTP, configuration;TACACS:encryption key exclusion, Operating notes
timeout;, Configuring the switch TACACS+ server access
troubleshooting, TACACS+ authentication setup
unauthorized access, preventing
manager password recommended, TACACS+ authentication setup
TACACS+
authentication and accounting, TACACS+ Authentication and Accounting
key string with tilde character, Optional, global encryption key
security log access, Authentication and Authorization through TACACS+
troubleshooting
authorized IP managers, Operating notes
diagnostic level, Setting the diagnostic level
error messages, Error messages
flash, Verifying the flash is signed
zeroizing, Zeroizing from the ROM console
Tsecurity credentials
copying configurations on the switch, Operating Notes
Two-factor authentication
event log, Two-factor authentication event log messages
validation rules, Two-factor authentication validation rules
type="Index" text="port-based access control, General features
(see also 802.1X access control)

W

Web authentication
hierarchy of precedence in authentication session;, Precedence of Client-based authentication: Dynamic Configuration Arbiter
overview, Access Security and Switch Authentication Features
web authentication
authenticator operation; MAC authentication:authenticator operation, How web-based and MAC authentication operate
blocked traffic;MAC authentication:blocked traffic, Overview
CHAP:usage;MAC authentication:CHAP:usage, Overview
client status;MAC authentication:client status, Client status
concurrent with MAC; MAC authentication: concurrent with web; authentication: concurrent web-based/MAC, Concurrent web-based and MAC authentication
configuring:the CEI server, Configuring a DNS Server for Enhanced web authentication
general setup;MAC authentication:general setup, Preparation for configuring MAC authentication
LACP not allowed;MAC authentication:LACP not allowed, Operating notes and guidelines
rules of operation, Operating notes and guidelines
show status and configuration, Viewing status of ports enabled for web-based authentication
using customized login pages, Customizing HTML templates
web browser interface
authorized IP managers, configuring;authorized IP managers:configuring, Configuring IP Authorized Managers for the switch (CLI)
Web host certificate
installing, Installing the switch's server web host certificate
web server, proxy
port security:proxy web server;, Proxy Web servers
web-based authentication
configuring, Configuring web-based authentication
configuring commands, Configuration commands for web-based authentication
MAC authentication, Web-based and MAC authentication
preparation, Preparation for web-based authentication
prerequisites, Prerequisites for web-based or MAC authentication
websites, Websites
customer self repair, Customer self repair