Ruckus FastIron Ethernet Switch Security Configuration Guide, 08.0.20c Fast Iron 08.0.20 Guide 08020c Securityguide

2017-12-14

• Contents
• Preface
  • Document conventions
    • Text formatting conventions
    • Command syntax conventions
    • Notes, cautions, and warnings
  • Brocade resources
  • Contacting Brocade Technical Support
  • Document feedback
• About This Document
  • What’s new in this document
  • Supported hardware
  • How command information is presented in this guide
• Security Access
  • Supported security access features
  • Securing access methods
  • Remote access to management function restrictions
    • ACL usage to restrict remote access
      • Using an ACL to restrict Telnet access
      • Using an ACL to restrict SSH access
      • Using an ACL to restrict Web management access
      • Using ACLs to restrict SNMP access
    • Defining the console idle time
    • Remote access restrictions
      • Restricting Telnet access to a specific IP address
      • Restricting SSH access to a specific IP address
      • Restricting Web management access to a specific IP address
      • Restricting SNMP access to a specific IP address
      • Restricting all remote management access to a specific IP address
    • Restricting access to the device based on IP orMAC address
      • Restricting Telnet connection
      • Restricting SSH connection
    • Defining the Telnet idle time
    • Changing the login timeout period for Telnet sessions
    • Specifying the maximum number of login attemptsfor Telnet access
    • Restricting remote access to the device to specific VLAN IDs
      • Restricting Telnet access to a specific VLAN
      • Restricting Web management access to a specific VLAN
      • Restricting SNMP access to a specific VLAN
      • Restricting TFTP access to a specific VLAN
    • Designated VLAN for Telnet management sessions to a Layer 2 Switch
    • Device management security
      • Allowing SSHv2 access to the Brocade device
      • Allowing SNMP access to the Brocade device
      • Allowing Web management through HTTP for the Brocade device
      • Allowing Web management through HTTPS
    • Disabling specific access methods
      • Disabling Telnet access
      • Disabling Web management access
      • Disabling Web management access by HP ProCurve Manager
      • Disabling SNMP access
      • Disabling TFTP access
  • Passwords used to secure access
    • Setting a Telnet password
      • Suppressing Telnet connection rejection messages
    • Setting passwords for management privilege levels
      • Augmenting management privilege levels
    • Recovering from a lost password
    • Displaying the SNMP community string
    • Specifying a minimum password length
  • Local user accounts
    • Enhancements to username and password
      • Enabling enhanced user password combination requirements
      • Enabling user password masking
      • Enabling user password aging
      • Configuring password history
      • Enhanced login lockout
      • Setting passwords to expire
      • Requirement to accept the message of the day
    • Local user account configuration
      • Local user accounts with no passwords
      • Local user accounts with unencrypted passwords
    • Changing a local user password
    • Changing the SSL server certificate key size
  • TACACS and TACACS+ security
    • How TACACS+ differs from TACACS
    • TACACS/TACACS+ authentication, authorization,and accounting
      • Configuring TACACS/TACACS+ for devices in a Brocade traditional stack
    • TACACS authentication
      • TACACS+ authentication
      • TACACS+ authorization
      • TACACS+ accounting
      • AAA operations for TACACS/TACACS+
      • AAA security for commands pasted into the running-config
    • TACACS/TACACS+ configuration considerations
      • Configuring TACACS
      • Configuring TACACS+
    • Enabling TACACS
    • Identifying the TACACS/TACACS+ servers
    • Specifying different servers for individual AAA functions
    • Setting optional TACACS and TACACS+ parameters
      • Setting the TACACS+ key
      • Setting the retransmission limit
      • Setting the timeout parameter
    • Configuring authentication-method lists forTACACS and TACACS+
      • Entering privileged EXEC mode after a Telnet or SSH login
      • Configuring enable authentication to prompt for password only
      • Telnet and SSH prompts when the TACACS+ Server is unavailable
    • Configuring TACACS+ authorization
      • Configuring exec authorization
      • Configuring command authorization
    • TACACS+ accounting configuration
      • Configuring TACACS+ accounting for Telnet/SSH (Shell) access
      • Configuring TACACS+ accounting for CLI commands
      • Configuring TACACS+ accounting for system events
    • Configuring an interface as the source for allTACACS and TACACS+ packets
    • Displaying TACACS/TACACS+ statistics andconfiguration information
  • RADIUS security
    • RADIUS authentication, authorization, and accounting
      • RADIUS authentication
      • RADIUS authorization
      • RADIUS accounting
      • AAA operations for RADIUS
      • AAA security for commands pasted Into the running-config
    • RADIUS configuration considerations
    • Configuring RADIUS
    • Brocade-specific attributes on the RADIUS server
    • Enabling SNMP to configure RADIUS
    • Identifying the RADIUS server to the Brocade device
    • Specifying different servers for individual AAA functions
    • RADIUS server per port
      • RADIUS server per port configuration notes
      • RADIUS configuration example and command syntax
    • RADIUS server to individual ports mapping
      • RADIUS server-to-ports configuration notes
      • RADIUS server-to-ports configuration example and command syntax
    • RADIUS parameters
      • Setting the RADIUS key
      • Setting the retransmission limit
      • Setting the timeout parameter
      • Setting RADIUS over IPv6
    • Setting authentication-method lists for RADIUS
      • Entering privileged EXEC mode after a Telnet or SSH login
      • Configuring enable authentication to prompt for password only
    • RADIUS authorization
      • Configuring exec authorization
      • Configuring command authorization
      • Command authorization and accounting for console commands
    • RADIUS accounting
      • Configuring RADIUS accounting for Telnet/SSH (Shell) access
      • Configuring RADIUS accounting for CLI commands
      • Configuring RADIUS accounting for system events
    • Configuring an interface as the source for all RADIUS packets
    • Displaying RADIUS configuration information
    • RADIUS dynamic authorizations
    • RADIUS Disconnect Message and CoA events
    • Enabling RADIUS CoA and Disconnect Message handling
    • Supported IETF attributes in RFC 5176
  • SSL security
    • Enabling the SSL server on the Brocade device
    • Specifying a port for SSL communication
    • Changing the SSL server certificate key size
    • Support for SSL digital certificates larger than 2048 bits
    • Importing digital certificates and RSA private key files
    • Generating an SSL certificate
    • Deleting the SSL certificate
  • TLS support
  • Authentication-method lists
    • Configuration considerations for authentication-method lists
    • Examples of authentication-method lists
  • TCP Flags - edge port security
    • Using TCP Flags in combination with other ACL features
• SSH2 and SCP
  • Supported SSH2 and Secure Copy features
  • SSH version 2 overview
    • Tested SSH2 clients
    • SSH2 supported features
    • SSH2 unsupported features
  • SSH2 authentication types
    • Configuring SSH2
    • Enabling and disabling SSH by generating and deleting host keys
      • Generating and deleting a DSA key pair
      • Generating and deleting an RSA key pair
      • Deleting DSA and RSA key pairs
      • Providing the public key to clients
    • Configuring DSA or RSA challenge-response authentication
      • Importing authorized public keys into the Brocade device
      • Enabling DSA or RSA challenge-response authentication
  • Optional SSH parameters
    • Setting the number of SSH authentication retries
    • Deactivating user authentication
    • Enabling empty password logins
    • Setting the SSH port number
    • Setting the SSH login timeout value
    • Designating an interface as the source for all SSH packets
    • Configuring the maximum idle time for SSH sessions
  • Filtering SSH access using ACLs
  • Terminating an active SSH connection
  • Displaying SSH information
    • Displaying SSH connection information
    • Displaying SSH configuration information
    • Displaying additional SSH connection information
  • Secure copy with SSH2
    • Enabling and disabling SCP
    • Secure copy configuration notes
    • Example file transfers using SCP
      • Copying a file to the running config
      • Copying a file to the startup config
      • Copying the running config file to an SCP-enabled client
      • Copying the startup config file to an SCP-enabled client
      • Copying a software image file to flash memory
      • Copying a Software Image file from flash memory
      • Importing a digital certificate using SCP
      • Importing an RSA private key
      • Importing a DSA or RSA public key
      • Copying license files
  • SSH2 client
    • Enabling SSH2 client
    • Configuring SSH2 client public key authentication
      • Generating and deleting a client DSA key pair
      • Generating and deleting a client RSA key pair
      • Exporting client public keys
    • Using SSH2 client
    • Displaying SSH2 client information
• SCP client support
  • SCP Client Support features
  • SCP client
  • SCP client support limitations
  • Supported SCP client configurations
  • Downloading an image from an SCP server
  • Uploading an image to an SCP server
  • Uploading configuration files to an SCP server
  • Downloading configuration files from an SCP server
  • Copying an image between devices
• Rule-Based IP ACLs
  • Supported Rule-Based IP ACL Features
  • ACL overview
    • Types of IP ACLs
    • ACL IDs and entries
    • Numbered and named ACLs
    • Default ACL action
  • How hardware-based ACLs work
    • How fragmented packets are processed
    • Hardware aging of Layer 4 CAM entries
  • ACL configuration considerations
  • Configuring standard numbered ACLs
    • Standard numbered ACL syntax
    • Configuration example for standard numbered ACLs
  • Standard named ACL configuration
    • Standard named ACL syntax
    • Configuration example for standard named ACLs
  • Extended numbered ACL configuration
    • Extended numbered ACL syntax
  • Extended named ACL configuration
  • Applying egress ACLs to Control (CPU) traffic
  • Preserving user input for ACL TCP/UDP port numbers
  • ACL comment text management
    • Adding a comment to an entry in a numbered ACL
    • Adding a comment to an entry in a named ACL
    • Deleting a comment from an ACL entry
    • Viewing comments in an ACL
  • Applying an ACL to a virtual interface in a protocol-or subnet-based VLAN
  • ACL logging
    • Configuration notes for ACL logging
    • Configuration tasks for ACL logging
    • Example ACL logging configuration
    • Displaying ACL Log Entries
  • Enabling strict control of ACL filtering of fragmented packets
  • Enabling ACL support for switched traffic in the router image
  • Enabling ACL filtering based on VLAN membership or VE port membership
    • Configuration notes for ACL filtering
    • Applying an IPv4 ACL to specific VLAN members on a port (Layer 2 devices only)
    • Applying an IPv4 ACL to a subset of ports on a virtual interface (Layer 3 devices only)
  • ACLs to filter ARP packets
    • Configuration considerations for filtering ARP packets
    • Configuring ACLs for ARP filtering
    • Displaying ACL filters for ARP
    • Clearing the filter count
  • Filtering on IP precedence and ToS values
    • TCP flags - edge port security
  • QoS options for IP ACLs
    • Configuration notes for QoS options on FCX and ICX devices
    • Using an ACL to map the DSCP value (DSCP CoS mapping)
    • Using an IP ACL to mark DSCP values (DSCP marking)
      • Combined ACL for 802.1p marking
      • Using an ACL to change the forwarding queue
    • DSCP matching
  • ACL-based rate limiting
  • ACL statistics
  • ACL accounting
    • Configuring IPv4 ACL accounting
  • ACLs to control multicast features
  • Enabling and viewing hardware usage statistics for an ACL
  • Displaying ACL information
  • Troubleshooting ACLs
  • Policy-based routing (PBR)
    • Configuration considerations for policy-based routing
    • Configuring a PBR policy
    • Configuring the ACLs
    • Configuring the route map
    • Enabling PBR
    • Configuration examples for policy based routing
    • Basic example of policy based routing
    • Setting the next hop
    • Setting the output interface to the null interface
    • Trunk formation with PBR policy
• IPv6 ACLs
  • Supported IPv6 ACL features
  • IPv6 ACL overview
    • IPv6 ACL traffic filtering criteria
    • IPv6 protocol names and numbers
  • IPv6 ACL configuration notes
  • Configuring an IPv6 ACL
    • Example IPv6 configurations
    • Default and implicit IPv6 ACL action
  • Creating an IPv6 ACL
    • Syntax for creating an IPv6 ACL
      • For IPv6 and supported protocols other than ICMP, TCP, or UDP
      • For ICMP
      • For TCP
      • For UDP
      • ICMP message configurations
  • Enabling IPv6 on an interface to which an ACL will be applied
    • Syntax for enabling IPv6 on an interface
  • Applying an IPv6 ACL to an interface
    • Syntax for applying an IPv6 ACL
    • Applying an IPv6 ACL to a trunk group
    • Applying an IPv6 ACL to a virtual interface in a protocol-based or subnet-based VLAN
  • Adding a comment to an IPv6 ACL entry
  • Deleting a comment from an IPv6 ACL entry
  • Support for ACL logging
  • Configuring IPv6 ACL accounting
  • Displaying IPv6 ACLs
• MACsec Key-based Security
  • FastIron MACsec overview
    • Supported MACsec hardware configurations
    • MACsec RFCs and Standards
    • MACsec considerations
  • How MACsec works
    • MACsec authenticated security
    • MACsec message exchange between two switches
    • Secure channels
    • MACsec frame format
    • Processing incoming frames
    • Processing outgoing frames
  • Configuring MACsec
  • Enabling MACsec and configuring a group
    • Configuring MACsec key-server priority
    • Configuring MACsec integrity and encryption
    • Configuring MACsec frame validation
    • Configuring replay protection
  • Enabling and configuring group interfaces for MACsec
    • Configuring the pre-shared key
  • Sample MACsec configuration
  • Displaying MACsec information
    • Displaying MACsec configuration details
    • Displaying information on current MACsec sessions
    • Displaying MKA protocol statistics for an interface
    • Displaying MACsec secure channel activity for an interface
• MAC Port Security
  • Supported MAC port security features
  • MAC port security overview
    • Local and global resources used for MAC port security
    • Configuration notes and feature limitations for MAC port security
    • Secure MAC movement
  • MAC port security configuration
    • Enabling the MAC port security feature
    • Setting the maximum number of secure MAC addresses for an interface
    • Setting the port security age timer
    • Specifying secure MAC addresses
      • On an untagged interface
      • On a tagged interface
    • Autosaving secure MAC addresses to the startup configuration
    • Specifying the action taken when a security violation occurs
      • Dropping packets from a violating address
      • Disabling the port for a specified amount of time
  • Clearing port security statistics
    • Clearing restricted MAC addresses
    • Clearing violation statistics
  • Displaying port security information
    • Displaying port security settings
    • Displaying the secure MAC addresses
    • Displaying port security statistics
    • Displaying restricted MAC addresses on a port
• MAC-based VLANs
  • Supported MAC-based VLAN features
  • MAC-based VLAN overview
    • Static and dynamic hosts
    • MAC-based VLAN feature structure
      • Source MAC address authentication
      • Policy-based classification and forwarding
      • MAC-based VLAN and port up or down events
  • Dynamic MAC-based VLAN
    • Configuration notes and feature limitations for dynamic MAC-based VLAN
    • Dynamic MAC-based VLAN CLI commands
    • Dynamic MAC-based VLAN configuration example
  • MAC-based VLAN configuration
    • Using MAC-based VLANs and 802.1X securityon the same port
    • Configuring generic and Brocade vendor-specificattributes on the RADIUS server
    • Aging for MAC-based VLAN
    • Disabling aging for MAC-based VLAN sessions
      • Globally disabling aging
      • Disabling the aging on interfaces
    • Configuring the maximum MAC addresses per port
    • Configuring a MAC-based VLAN for a static host
    • Configuring MAC-based VLAN for a dynamic host
    • Configuring dynamic MAC-based VLAN
  • Configuring MAC-based VLANs using SNMP
  • Displaying Information about MAC-based VLANs
    • Displaying the MAC-VLAN table
    • Displaying the MAC-VLAN table for a specific MAC address
    • Displaying allowed MAC addresses
    • Displaying denied MAC addresses
    • Displaying detailed MAC-VLAN data
    • Displaying MAC-VLAN information for a specific interface
    • Displaying MAC addresses in a MAC-based VLAN
    • Displaying MAC-based VLAN logging
  • Clearing MAC-VLAN information
  • Sample MAC-based VLAN application
• Defining MAC Address Filters
  • Supported MAC address filter features
  • MAC address filters configuration notes and limitations
  • MAC address filters command syntax
  • Enabling logging of management traffic permitted by MAC address filters
    • MAC address filter logging command syntax
  • Configuring MAC filter accounting
  • MAC address filter override for 802.1X-enabled ports
    • MAC address filter override configuration notes
    • Configuring MAC address filter override
• 802.1X Port Security for ICX 6650 and FSX Devices
  • Supported 802.1X port security features
  • IETF RFC support
  • How 802.1X port security works
    • Device roles in an 802.1X configuration
    • Communication between the devices
    • Controlled and uncontrolled ports
    • Message exchange during authentication
      • Setting the IP MTU size
      • EAP pass-through support
      • Support for RADIUS user-name attribute in access-accept messages
    • Authenticating multiple hosts connected to the same port
      • How 802.1X host authentication works
      • How 802.1x host authentication works for multiple clients
      • Configurable hardware aging period for denied client dot1x-mac-sessions
    • 802.1X port security and sFlow
    • 802.1X accounting
  • 802.1X port security configuration
    • Configuring an authentication method list for 802.1x
    • Setting RADIUS parameters
      • Supported RADIUS attributes
      • Allow user access to a restricted VLAN after a RADIUS timeout
    • Dynamic VLAN assignment for 802.1X port configuration
      • Automatic removal of dynamic VLAN assignments for 802.1X ports
      • Dynamic multiple VLAN assignment for 802.1X ports
      • Saving dynamic VLAN assignments to the running-config file
      • Considerations for dynamic VLAN assignment in an 802.1X multiple-host configuration
    • Dynamically applying IP ACLs and MAC address filters to 802.1X ports
      • Configuration considerations for applying IP ACLs and MAC address filters to 802.1x ports
      • Disabling and enabling strict security mode for dynamic filter assignment
      • Disabled strict security mode
      • Disabling strict security mode globally
      • Dynamically applying existing ACLs or MAC address filters
      • Notes for dynamically applying ACLs or MAC address filters
      • Configuring per-user IP ACLs or MAC address filters
    • Enabling 802.1X port security
    • Setting the port control
    • Configuring periodic re-authentication
    • Re-authenticating a port manually
    • Setting the quiet period
    • Specifying the wait interval and number of EAP-request/identity frame retransmissions from the Brocade device
      • Setting the wait interval for EAP frame retransmissions
      • Setting the maximum number of EAP frame retransmissions
    • Wait interval and number of EAP-request/identity frame retransmissions from the RADIUS server
      • Setting the wait interval for EAP frame retransmissions
      • Setting the maximum number of EAP frame retransmissions
    • Specifying a timeout for retransmission of messages to the authentication server
    • Initializing 802.1X on a port
    • Allowing access to multiple hosts
      • Configuring 802.1X multiple-host authentication
    • MAC address filters for EAP frames
      • Creating MAC address filters for EAPS on most devices
    • Configuring VLAN access for non-EAP-capable clients
  • 802.1X accounting configuration
    • 802.1X Accounting attributes for RADIUS
    • Enabling 802.1X accounting
  • Displaying 802.1X information
    • Displaying 802.1X configuration information
    • Displaying 802.1X statistics
    • Clearing 802.1X statistics
    • Displaying dynamically-assigned VLAN information
    • Displaying information about dynamically appliedMAC address filters and IP ACLs
      • Displaying user-defined MAC address filters and IP ACLs
      • Displaying dynamically applied MAC address filters and IP ACLs
      • Displaying the status of strict security mode
    • Displaying 802.1X multiple-host authentication information
      • Displaying information about the dot1x MAC sessions on each port
      • Displaying information about the ports in an 802.1X multiple-host configuration
  • Sample 802.1X configurations
    • Point-to-point configuration
      • Sample 802.1x configuration
    • Hub configuration
      • Sample 802.1x configuration using a hub
    • 802.1X Authentication with dynamic VLAN assignment
  • Multi-device port authentication and 802.1Xsecurity on the same port
• Multi-Device Port Authentication for ICX 6650 and FSX Devices
  • Supported Multi-device port authentication (MDPA) features
  • How multi-device port authentication works
    • RADIUS authentication
    • Authentication-failure actions
    • Unauthenticated port behavior
    • Supported RADIUS attributes
    • Support for dynamic VLAN assignment
    • Support for dynamic ACLs
    • Support for authenticating multiple MAC addresses on an interface
    • Support for dynamic ARP inspection with dynamic ACLs
    • Support for DHCP snooping with dynamic ACLs
    • Support for source guard protection
  • Multi-device port authentication and 802.1X security on the same port
    • Configuring Brocade-specific attributes on the RADIUS server
  • Multi-device port authentication configuration
    • Enabling multi-device port authentication
      • Globally enabling multi-device port authentication
      • Enabling multi-device port authentication on an interface
    • Specifying the format of the MAC addresses sent to theRADIUS server
    • Specifying the authentication-failure action
    • Generating traps for multi-device port authentication
    • Defining MAC address filters
    • Configuring dynamic VLAN assignment
      • Configuring a port to remain in the restricted VLAN after a successful authentication attempt
      • Configuration notes for configuring a port to remain in the restricted VLAN
      • Configuring the RADIUS server to support dynamic VLAN assignment
      • Enabling dynamic VLAN support for tagged packets on non-member VLAN ports
      • Specifying to which VLAN a port is moved after its RADIUS-specified VLAN assignment expires
      • Automatic removal of dynamic VLAN assignments for MAC authenticated ports
      • Saving dynamic VLAN assignments to the running-config file
    • Dynamically applying IP ACLs to authenticated MAC addresses
      • Multi-device port authentication with dynamic IP ACLs and ACL-per-port-per-VLAN
      • Configuration considerations and guidelines for multi-device port authentication
      • Configuring the RADIUS server to support dynamic IP ACLs
    • Enabling denial of service attack protection
    • Enabling source guard protection
      • Viewing the assigned ACL for ports on which source guard protection is enabled
    • Clearing authenticated MAC addresses
    • Disabling aging for authenticated MAC addresses
      • Globally disabling aging of MAC addresses
      • Disabling the aging of MAC addresses on interfaces
    • Changing the hardware aging period for blockedMAC addresses
    • Specifying the aging time for blocked MAC addresses
    • Specifying the RADIUS timeout action
      • Permit User access to the network after a RADIUS timeout
      • Deny User access to the network after a RADIUS timeout
      • Allow user access to a restricted VLAN after a RADIUS timeout
    • Multi-device port authentication password override
    • Limiting the number of authenticated MAC addresses
  • Displaying multi-device port authentication information
    • Displaying authenticated MAC address information
    • Displaying multi-device port authenticationconfiguration information
    • Displaying multi-device port authentication informationfor a specific MAC address or port
    • Displaying the authenticated MAC addresses
    • Displaying the non-authenticated MAC addresses
    • Displaying multi-device port authentication information for a port
    • Displaying multi-device port authentication settingsand authenticated MAC addresses
    • Displaying the MAC authentication table for FCX and ICX devices
  • Example port authentication configurations
    • Multi-device port authentication with dynamic VLAN assignment
      • Example 2 -- multi-device port authentication with dynamic VLAN assignment
    • Examples of multi-device port authentication and 802.1X authentication configuration on the same port
      • Example 1 -- Multi-device port authentication and 802.1x authentication on the same port
      • Example 2 -- Creating a profile on the RADIUS server for each MAC address
• Flexible Authentication
  • Flexible Authentication Feature Support
  • Flexible authentication
  • How flexible authentication works
  • Authentication failure and timeout options
    • MAC-based VLANs and ACLs
    • Enabling flexible authentication order
      • Multi-device port authentication and 802.1X security on the same port
    • Specifying the auth-default VLAN
    • Specifying the restricted VLAN
    • Specifying the critical VLAN
  • Authentication flow
  • Flexible authentication assumptions
  • 802.1x Port Security
    • IETF RFC support
    • How 802.1X port security works
      • Device roles in an 802.1X configuration
      • Communication between the devices
      • Controlled and uncontrolled ports
      • Message exchange during authentication
        • EAP pass-through support
        • Support for RADIUS user-name attribute in access-accept messages
      • Authenticating multiple hosts connected to the same port
        • How 802.1X host authentication works
        • How 802.1x host authentication works for multiple clients
        • Configurable hardware aging period for denied client dot1x-mac-sessions
      • 802.1X port security and sFlow
      • 802.1X accounting
    • 802.1X port security configuration
      • Configuring an authentication method list
        • Setting RADIUS parameters
          • Supported RADIUS attributes
        • Enabling 802.1X port security
        • Specifying the RADIUS timeout action
        • Specifying the authentication timeout action
        • Dynamic VLAN assignment for 802.1X port configuration
          • Dynamic multiple VLAN assignment for 802.1X ports
          • Considerations for dynamic VLAN assignment in an 802.1X multiple-host configuration
        • Dynamically applying IP ACLs and MAC address filters to 802.1X ports
          • Configuration considerations for applying IP ACLs and MAC address filters to 802.1x ports
          • Disabling and enabling strict security mode for dynamic filter assignment
          • Disabled strict security mode
          • Disabling strict filter security
          • Dynamically applying existing ACLs or MAC address filters
          • Configuring per-user IP ACLs or MAC address filters using vendor specific attributes
        • Setting the port control
        • Configuring periodic re-authentication
        • Initializing 802.1X on a port
        • Specifying the authentication failure action
        • MAC address filters for EAP frames
          • Creating MAC address filters for EAPS on most devices
    • 802.1X accounting configuration
      • 802.1X Accounting attributes for RADIUS
      • Enabling 802.1X accounting
    • Displaying 802.1X information
      • Displaying 802.1X statistics
      • Clearing 802.1X statistics
      • Displaying dynamically-assigned VLAN information
      • Displaying information about dynamically appliedMAC address filters and IP ACLs
        • Displaying user-defined MAC address filters and IP ACLs
        • Displaying dynamically applied MAC address filters and IP ACLs
        • Displaying the status of strict security mode
    • Sample 802.1X configurations
      • 802.1x configuration
        • Sample 802.1x configuration
      • Hub configuration
        • Sample 802.1x configuration using a hub
      • 802.1X Authentication with dynamic VLAN assignment
  • Multi-Device Port Authentication
    • How multi-device port authentication works
      • RADIUS authentication
      • Authentication-failure actions
      • Unauthenticated port behavior
      • Support for dynamic VLAN assignment
      • Support for dynamic ACLs
      • Support for authenticating multiple MAC addresses on an interface
      • Support for source guard protection
      • Configuring Brocade-specific attributes on the RADIUS server
    • Multi-device port authentication configuration
      • Enabling multi-device port authentication
      • Specifying the format of the MAC addresses sent to the RADIUS server
      • Generating traps for multi-device port authentication
      • Defining MAC address filters
      • Configuring dynamic VLAN assignment
        • Configuration notes for configuring a port to remain in the restricted VLAN
        • Configuring the RADIUS server to support dynamic VLAN assignment
        • Automatic removal of dynamic VLAN assignments for MAC authenticated ports
      • Dynamically applying IP ACLs to authenticated MAC addresses
        • Multi-device port authentication with dynamic IP ACLs
        • Configuration considerations and guidelines for multi-device port authentication
      • Enabling denial of service protection
      • Enabling source guard protection
      • Clearing authenticated MAC addresses
        • Disabling aging for authenticated MAC addresses
          • Disabling aging of MAC addresses
        • Changing the hardware aging period for blocked MAC addresses
        • Specifying the aging time for blocked MAC addresses
        • Overriding the multi-device port authentication password
        • Limiting the number of authenticated MAC addresses
    • Displaying multi-device port authentication information
      • Displaying the MAC authentication sessions
    • Example port authentication configurations
      • Multi-device port authentication with dynamic VLAN assignment
        • Example 2 -- multi-device port authentication with dynamic VLAN assignment
      • Examples of multi-device port authentication and 802.1X authentication configuration on the same port
        • Multi-device port authentication and 802.1x authentication on the same port
• Web Authentication
  • Supported Web Authentication features
  • Web authentication overview
  • Web authentication configuration considerations
  • Web authentication configuration tasks
  • Enabling and disabling web authentication
  • Web authentication mode configuration
    • Using local user databases
      • Configuring a local user database
      • Creating a local user database
      • Adding a user record to a local user database
      • Deleting a user record from a local user database
      • Deleting All user records from a local user database
      • Creating a text file of user records
      • Importing a text file of user records from a TFTP server
      • Using a RADIUS server as the web authentication method
      • Setting the local user database authentication method
      • Setting the web authentication failover sequence
      • Assigning a local user database to a web authentication VLAN
    • Passcodes for user authentication
      • Configuring passcode authentication
      • Creating static passcodes
      • Enabling passcode authentication
      • Configuring the length of dynamically-generated passcodes
      • Configuring the passcode refresh method
      • Configuring a grace period for an expired passcode
      • Flushing all expired passcodes that are in the grace period
      • Disabling and re-enabling passcode logging
      • Re-sending the passcode log message
      • Manually refreshing the passcode
    • Automatic authentication
  • Web authentication options configuration
    • Enabling RADIUS accounting for web authentication
    • Changing the login mode (HTTPS or HTTP)
    • Specifying trusted ports
    • Specifying hosts that are permanently authenticated
    • Configuring the re-authentication period
    • Defining the web authentication cycle
    • Limiting the number of web authentication attempts
    • Clearing authenticated hosts from the webauthentication table
    • Setting and clearing the block duration for webauthentication attempts
    • Manually blocking and unblocking a specific host
    • Limiting the number of authenticated hosts
    • Filtering DNS queries
    • Forcing reauthentication when ports are down
    • Forcing re-authentication after an inactive period
    • Defining the web authorization redirect address
    • Deleting a web authentication VLAN
    • Web authentication pages
      • Displaying text for web authentication pages
      • Customizing web authentication pages
  • Displaying web authentication information
    • Displaying the web authentication configuration
    • Displaying a list of authenticated hosts
    • Displaying a list of hosts attempting to authenticate
    • Displaying a list of blocked hosts
    • Displaying a list of local user databases
    • Displaying a list of users in a local user database
    • Displaying passcodes
• DoS Attack Protection
  • Supported DoS protection features
  • Smurf attacks
    • Avoiding being an intermediary in a Smurf attack
    • Avoiding being a victim in a Smurf attack
  • TCP SYN attacks
    • TCP security enhancement
      • Protecting against a blind TCP reset attack using the RST bit
      • Protecting against a blind TCP reset attack using the SYN bit
      • Protecting against a blind injection attack
    • Displaying statistics about packets dropped because of DoS attacks
• DHCP
  • Supported DHCP packet inspection and tracking features
  • Dynamic ARP inspection
    • ARP poisoning
    • About Dynamic ARP Inspection
      • ARP entries
    • Configuration notes and feature limitations for DAI
    • Dynamic ARP inspection configuration
      • Configuring an inspection ARP entry
      • Enabling DAI on a VLAN
      • Enabling trust on a port
    • Displaying ARP inspection status and ports
    • Displaying the ARP table
    • Multi-VRF support
      • Enabling trust on a port for a specific VRF
  • DHCP snooping
    • How DHCP snooping works
      • DHCP binding database
      • About client IP-to-MAC address mappings
    • System reboot and the binding database
    • Configuration notes and feature limitations for DHCP snooping
    • Configuring DHCP snooping
      • Enabling DHCP snooping on a VLAN
      • Enabling trust on a port connected to a DHCP server
      • Disabling the learning of DHCP clients on a port
    • Clearing the DHCP binding database
    • Displaying DHCP snooping status and ports
    • Displaying the DHCP snooping binding database
    • Displaying DHCP binding entry and status
    • DHCP snooping configuration example
    • Multi-VRF support
  • DHCP relay agent information
    • Configuration notes for DHCP option 82
    • DHCP Option 82 sub-options
      • Sub-option 1 - circuit id
      • Sub-option 2 - Remote ID
      • Sub-option 6 - subscriber id
    • DHCP option 82 configuration
      • Disabling and re-enabling DHCP option 82 processing on an individual interface
      • Changing the forwarding policy
      • Enabling and disabling subscriber ID processing
    • Viewing information about DHCP option 82 processing
      • Viewing the circuit Id, remote id, and forwarding policy
      • Viewing the ports on which DHCP option 82 is disabled
      • Viewing the status of DHCP option 82 and the subscriber id
    • Configuring the source IP address of a DHCP-client packet on the DHCP relay agent
  • IP source guard
    • Configuration notes and feature limitations for IP source guard
    • Enabling IP source guard on a port
    • Defining static IP source bindings
    • Enabling IP source guard per-port-per-VLAN
    • Enabling IP source guard on a VE
    • Enabling IP Source Guard to support a Multi-VRF instance
    • Displaying learned IP addresses
• DHCPv6
  • Supported DHCPv6 packet inspection and tracking features
  • Securing IPv6 address configuration
  • DHCPv6 snooping
    • How DHCPv6 snooping works
      • DHCPv6 binding database
    • Configuration notes and feature limitations for DHCPv6 snooping
    • Configuring DHCPv6 snooping
      • Enabling DHCPv6 snooping on a VLAN
      • Enabling trust on a port connected to a DHCPv6 server
      • Disabling the learning of DHCPv6 clients on a port
    • Clearing the DHCPv6 binding database
    • Displaying DHCPv6 snooping status and ports
    • Displaying the DHCPv6 snooping binding database
    • DHCPv6 snooping configuration example
    • Multi-VRF support for DHCPv6 snooping
• IPv6 Neighbor Discovery Inspection
  • IPv6 Neighbor Discovery Inspection Feature Support
  • IPv6 neighbor discovery inspection
  • Neighbor discovery inspection configuration
  • Syslog message for ND inspection
• IPv6 RA Guard
  • Supported platforms for the IPv6 RA guard feature
  • Securing IPv6 address configuration
  • IPv6 RA guard overview
    • RA guard policy
    • Whitelist
    • Prefix list
    • Maximum preference
    • Trusted, untrusted, and host ports
  • Configuration notes and feature limitations for IPv6 RA guard
  • Configuring IPv6 RA guard
  • Example of configuring IPv6 RA guard
    • Example: Configuring IPv6 RA guard on a device
    • Example: Configuring IPv6 RA guard in a network
    • Example: Verifying the RA guard configuration