Click Security > RADIUS Server > RADIUS Server Global Settings.

Enter the following parameters:

• RADIUS Server Status—Check to enable the RADIUS server feature status.

• Authentication Port—Enter the UDP port number of the RADIUS server port for authentication requests.

• Accounting Port—Enter the UDP port number of the RADIUS server port for accounting requests.

  Trap Settings

• RADIUS Accounting Traps—Check to generate traps for RADIUS accounting events.

• RADIUS Authentication Failure Traps—Check to generate traps for logins that failed.

• RADIUS Authentication Success Traps—Check to generate traps for logins that succeeded.

Click Apply. The RADIUS default settings for the device are updated in the Running Configuration file.

Click Security > RADIUS Server > RADIUS Server Keys.

Enter the default RADIUS keys if required. Values entered in the Default Key are applied to all servers configured (in the Add RADIUS Server page) to use the default key.

• Default Key—Enter the default key string used for authenticating and encrypting between the device and the RADIUS client. Select one of the following options:

  • Keep existing default key—For specified servers, the device attempts to authenticate the RADIUS client by using the existing, default Key String.

  • Encrypted—To encrypt communications by using MD5, enter the key in encrypted form.

  • Plaintext—Enter the key string in plaintext mode.

• MD5 Digest—Displays the MD5 digest of the user-entered password.

Click Apply. The RADIUS default settings for the device are updated in the Running Configuration file.

To add a secret key, click Add and enter the following fields:

• NAS Address—Address of switch containing RADIUS client.

• Secret Key—Address of switch containing RADIUS client.

  • Use default Key—For specified servers, the device attempts to authenticate the RADIUS client by using the existing, default Key String.

  • Encrypted—To encrypt communications by using MD5, enter the key in encrypted form.

  • Plaintext—Enter the key string in plaintext mode.

Click Apply. The key for the device is updated in the Running Configuration file.

Click Security > RADIUS Server > RADIUS Server Groups.

Click Add and enter the following fields:

• Group Name—Enter a name for the group.

• Privilege Level—Enter the management access privilege level of the group.

• Time Range—Check to enable applying a time range to this group.

• Time Range Name—If Time Range is selected, select the time range to be used. Click Edit to define a time range. This field is only displayed if a Time Range was previously created.

• VLAN—Select the VLAN for the users:

  • None—No VLAN ID is sent.

  • VLAN ID—VLAN ID sent.

  • VLAN Name—VLAN name sent

Click Apply. The RADIUS group definition is added to the Running Configuration file of the device.

Click Security > RADIUS Server > RADIUS Server Users.

Click Add.

• User Name—Enter the name of a user.

• Group Name—Select a previously defined group.

• Password—Enter one of the following options:

  • Encrypted—A key string is used to encrypt communications by using MD5. To use encryption, enter the key in encrypted form.

  • Plaintext—If you don’t have an encrypted key string (from another device), enter the key string in plaintext mode. The encrypted key string is generated and displayed.

Click Apply. The user definition is added to the Running Configuration file of the device.

Click Security > RADIUS Server > RADIUS Server Accounting.

• User Name—Name of a user.

• Event Type—One of the following values:

  • Start—Session was started.

  • Stop—Session was stopped.

  • Date/Time Change—Date/time on the device was changed.

  • Reset—Device has reset at the specified time.

• Authentication Method—Authentication method used by the user. Displays N/A if the Event Type is Date/Time Change or Reset.

• NAS Address—Address of switch containing RADIUS client. Displays N/A if the Event Type is Date/Time Change or Reset.

• User Address—If the authenticated user is the network administrator, this is its IP address; if the user is a station, this is its MAC address. Displays N/A if the Event Type is Date/Time Change or Reset.

• Event Time—Time of event.

To see additional details for a user/event, select the user/event and click Details.

Click Security > RADIUS Server > RADIUS Rejected Users.

• Event Type—Displays one of the following options:

  • Rejected—User was rejected.

  • Time Change—Clock on device was changed by the administrator.

  • Reset—Device was reset by the administrator.

• User Name—Name of the rejected user.

• User Type—Displays one of the following authentication options relevant to the user:

  • Login—Management access user

  • 802.1x—802.1x network access user

  • N/A—For Reset event

• Reason—Reason that the user was rejected.

• Time—Time that the user was rejected.

To see additional details for the rejected user, select the user and click Details.

Click Security > RADIUS Server > RADIUS Server Unknown NAS Entries.

• Event Type

  • Unknown NAS—An unknown NAS event occurred.

  • Time Change—Clock on device was changed by the administrator.

  • Reset—Device was reset by the administrator.

• IP Address—IP address of the unknown NAS.

• Time—Timestamp of event

Click Clear to delete an entry.

Click Security > RADIUS Server > RADIUS Server Statistics.

Select the Statistics Source from the following options:

• • Global—Statistics for all users

  • Specific NAS—Statistics for specific NAS

Select the Refresh Rate.

The following statistics will be displayed.

To clear the counters, click Clear Counters.

To refresh the counters, click Refresh.

Click Security > Key Management > Key Chain Settings.

To add a new key chain, click Add to open the Add Key Chain page and enter the following fields:

• Key Chain-Name for the key chain.

• Key Identifier-Integer identifier for the key chain.

• Key String-Value of the key chain string. Enter one of the following options:

  • User Defined (Encrypted)-Enter an encrypted version.

  • User Defined (Plaintext)-Enter a plaintext version

    Note	Both the Accept Life Time and the Send LifeTime values can be entered. The Accept Life Time indicates when the key-identifier for receiving packets is valid. The Send Life Time indicates when the key-identifier for sending packets is valid.

• Accept Life Time/Send Life Time-Specifies when packets with this key are accepted. Select one of the following options.

  • Always Valid-No limit to the life of the key-identifier

  • User Defined-Life of the key-chain is limited. If this option, is selected enter values in the following fields.

    Note	If you select User Defined, the system time must be set either manually or from SNTP. Otherwise, Accept Life Time and Send Life Times always fail. The following fields are relevant for the Accept Life Time and Send Life Time fields:

• Start Date-Enter the earliest date that the key-identifier is valid.

• Start Time-Enter the earliest time that the key-identifier is valid on the Start Date.

• End Time-Specifies the last date that the key-identifier is valid. Select one of the following options.

  • Infinite-No limit to the life of the key-identifier

  • Duration-Life of the key-identifier is limited. If this option, is selected enter values in the following fields.

• Duration-Length of time that the key identifier is valid. Enter the following fields:

  • Days-Number of days that the key-identifier is valid.

  • Hours-Number of hours that the key-identifier is valid.

  • Minutes-Number of minutes that the key-identifier is valid.

  • Seconds-Number of seconds that the key-identifier is valid.

Click Apply. The settings are written to the Running Configuration file.

Click Security > Key Management > Key Settings.

To add a new key string, click Add.

Enter the following fields:

• Key Chain-Name for the key chain.

• Key Identifier-Integer identifier for the key chain.

• Key String-Value of the key chain string. Enter one of the following options:

  • User Defined (Encrypted)-Enter an encrypted version.

  • User Defined (Plaintext)-Enter a plaintext version.

    Note

    Both the Accept Life Time and the Send LifeTime values can be entered. The Accept Life Time indicates when the key-identifier for receiving packets is valid. The Send Life Time indicates when the key-chain for sending packets is valid. The fields are only described for the Accept Life Time. The Send Life Time has the same fields.

• Accept Life Time-Specifies when packets with this key are accepted. Select one of the following options.

  • Always Valid-No limit to the life of the key-identifier

  • User Defined-Life of the key-chain is limited. If this option, is selected enter values in the following fields.

• Start Date-Enter the earliest date that the key-identifier is valid.

• Start Time-Enter the earliest time that the key-identifier is valid on the Start Date.

• End Time-Specifies the latest time that the key-identifier is valid. Select one of the following options.

  • Infinite-No limit to the life of the key-identifier

  • Duration-Life of the key-identifier is limited. If this option, is selected enter values in the following fields.

• Duration-Length of time that the key identifier is valid. Enter the following fields:

  • Days-Number of days that the key-identifier is valid.

  • Hours-Number of hours that the key-identifier is valid.

  • Minutes-Number of minutes that the key-identifier is valid.

  • Seconds-Number of seconds that the key-identifier is valid.

Click Apply. The settings are written to the Running Configuration file.

To always display sensitive data as plaintext (and not in encrypted form), click Display Sensitive Data as Plaintext.

Click Security > Mgmt Access Method > Access Profiles.

To change the active access profile, select a profile from the Active Access Profile drop down menu and click Apply. This makes the chosen profile the active access profile.

Click OK to select the active access profile or click Cancel to discontinue the action.

Click Add to open the Add Access Profile page. The page allows you to configure a new profile and one rule.

Enter the Access Profile Name. This name can contain up to 32 characters.

Enter the parameters.

• Rule Priority—Enter the rule priority. When the packet is matched to a rule, user groups are either granted or denied access to the device. The rule priority is essential to matching packets to rules, as packets are matched on a first-match basis. The highest priority is ‘1’.

• Management Method—Select the management method for which the rule is defined. The options are:

  • All—Assigns all management methods to the rule

  • Telnet—Users requesting access to the device that meets the Telnet access profile criteria are permitted or denied access.

  • Secure Telnet (SSH)—Users requesting access to the device that meets the SSH access profile criteria, are permitted or denied access.

  • HTTP— Users requesting access to the device that meets the HTTP access profile criteria, are permitted or denied.

  • Secure HTTP (HTTPS)—Users requesting access to the device that meets the HTTPS access profile criteria, are permitted or denied.

  • SNMP—Users requesting access to the device that meets the SNMP access profile criteria are permitted or denied.

• Action—Select the action attached to the rule. The options are:

  • Permit—Permits access to the device if the user matches the settings in the profile.

  • Deny—Denies access to the device if the user matches the settings in the profile

• Applies to Interface—Select the interface attached to the rule. The options are:

  • All—Applies to all ports, VLANs, and LAGs

  • User Defined—Applies to selected interface.

• Interface—Enter the interface number if User Defined was selected.

• Applies to Source IP Address—Select the type of source IP address to which the access profile applies. The Source IP Address field is valid for a subnetwork. Select one of the following values:

  • All—Applies to all types of IP addresses

  • User Defined—Applies to only those types of IP addresses defined in the fields.

• IP Version—Enter the version of the source IP address: Version 6 or Version 4.

• IP Address—Enter the source IP address.

• Mask—Select the format for the subnet mask for the source IP address, and enter a value in one of the fields:

  • Network Mask—Select the subnet to which the source IP address belongs and enter the subnet mask in dotted decimal format.

  • Prefix Length—Select the Prefix Length and enter the number of bits that comprise the source IP address prefix.

Click Apply. The access profile is written to the Running Configuration file. You can now select this access profile as the active access profile.

Click Security > Mgmt Access Method > Profile Rules.

Select the Filter field, and an access profile. Click Go.

Click Add to add a rule.

Enter the parameters.

• Access Profile Name—Select an access profile.

• Rule Priority—Enter the rule priority. When the packet is matched to a rule, user groups are either granted or denied access to the device. The rule priority is essential to matching packets to rules, as packets are matched on a first-fit basis.

• Management Method—Select the management method for which the rule is defined. The options are:

  • All—Assigns all management methods to the rule

  • Telnet—Users requesting access to the device that meets the Telnet access profile criteria are permitted or denied access.

  • Secure Telnet (SSH)—Users requesting access to the device that meets the Telnet access profile criteria, are permitted or denied access.

  • HTTP—Assigns HTTP access to the rule Users requesting access to the device that meets the HTTP access profile criteria, are permitted or denied.

  • Secure HTTP (HTTPS)—Users requesting access to the device that meets the HTTPS access profile criteria, are permitted or denied.

  • SNMP—Users requesting access to the device that meets the SNMP access profile criteria are permitted or denied.

• Action—Select one of the following options.

  • Permit—Allow device access to users coming from the interface and IP source defined in this rule.

  • Deny—Deny device access to users coming from the interface and IP source defined in this rule.

• Applies to Interface—Select the interface attached to the rule. The options are:

  • All—Applies to all ports, VLANs, and LAGs

  • User Defined—Applies only to the port, VLAN, or LAG selected.

• Interface—Enter the interface number if the User Defined option is selected for the field above.

• Applies to Source IP Address—Select the type of source IP address to which the access profile applies. The Source IP Address field is valid for a subnetwork. Select one of the following values:

  • All—Applies to all types of IP addresses

  • User Defined—Applies to only those types of IP addresses defined in the fields.

• IP Version—Select the supported IP version of the source address: IPv6 or IPv4.

• IP Address—Enter the source IP address.

• Mask—Select the format for the subnet mask for the source IP address, and enter a value in one of the fields:

  • Network Mask—Select the subnet to which the source IP address belongs and enter the subnet mask in dotted decimal format.

  • Prefix Length—Select the Prefix Length and enter the number of bits that comprise the source IP address prefix.

Click Apply, and the rule is added to the access profile.

Click Security > Secure Sensitive Data Management > Properties.

• Current Local Passphrase Type—Displays whether the default passphrase or a user-defined passphrase is currently being used.

In the Configuration File Passphrase Control—Select an option from the following:

Next, select to enable the Configuration File Integrity Control.

Select a Read Mode for the current session

• Plaintext —Users are permitted to access sensitive data in plaintext only. Users will also have read and write permission to SSD parameters.

• Encrypted —Users are permitted to access sensitive data as encrypted only.

Click Change Local Passphrase, and enter a new Local Passphrase:

• Default—Use the devices default passphrase.

• User Defined (Plaintext)—Enter a new passphrase.

• Confirm Passphrase—Confirm the new passphrase.

Click Apply. The settings are saved to the Running Configuration file.

Click Security > Secure Sensitive Data Management > SSD Rules.

To add a new rule, click Add. Enter the following fields:

• User—This defines the user(s) to which the rule applies: Select one of the following options:

  • Specific User—Select and enter the specific user name to which this rule applies (this user does not necessarily have to be defined).

  • Default User (cisco)—Indicates that this rule applies to the default user.

  • Level 15—Indicates that this rule applies to all users with privilege level 15.

  • All—Indicates that this rule applies to all users.

• Channel—This defines the security level of the input channel to which the rule applies: Select one of the following options:

  • Secure—Indicates that this rule applies only to secure channels (console, SCP, SSH and HTTPS), not including the SNMP and XML channels.

  • Insecure—Indicates that this rule applies only to insecure channels (Telnet, TFTP and HTTP), not including the SNMP and XML channels.

  • Secure XML SNMP—Indicates that this rule applies only to XML over HTTPS and SNMPv3 with privacy.

  • Insecure XML SNMP—Indicates that this rule applies only to XML over HTTP or and SNMPv1/v2and SNMPv3 without privacy.

• Read Permission—The read permissions associated with the rule. These can be the following:

  • Exclude—Lowest read permission. Users are not permitted to get sensitive data in any form.

  • Plaintext Only—Higher read permission than above ones. Users are permitted to get sensitive data in plaintext only.

  • Encrypted Only—Middle read permission. Users are permitted to get sensitive data as encrypted only.

  • Both (Plaintext and Encrypted)—Highest read permission. Users have both encrypted and plaintext permissions and are permitted to get sensitive data as encrypted and in plaintext

• Default Read Mode—All default read modes are subjected to the read permission of the rule. The following options exist, but some might be rejected, depending on the rule’s read permission.

  • Exclude—Do not allow reading the sensitive data.

  • Encrypted—Sensitive data is presented encrypted.

  • Plaintext—Sensitive data is presented as plaintext.

Click Apply. The settings are saved to the Running Configuration file.

The following actions can be performed on selected rules:

• Add, Edit or Delete rules or Restore To Default.

• Restore All Rules to Default—Restore a user-modified default rule to the default rule.

Click Security > SSL Server > SSL Server Authentication Settings.

• Valid From—Specifies the date from which the certificate is valid.

• Valid To—Specifies the date up to which the certificate is valid.

• Certificate Source—Specifies whether the certificate was generated by the system (Auto Generated) or the user (User Defined).

Select an active certificate.

Click Generate Certificate Request. Select a certificate and click Details to view the following:

Enter the following fields:

• Certificate ID—Select the active certificate.

• Common Name—Specifies the fully-qualified device URL or IP address. If unspecified, defaults to the lowest IP address of the device (when the certificate is generated).

• Organization Unit—Specifies the organization-unit or department name.

• Organization Name—Specifies the organization name.

• Location—Specifies the location or city name.

• State—Specifies the state or province name.

• Country—Specifies the country name.

• Certificate Request—Displays the key created when the Generate Certificate Request button is pressed.

Click Generate Certificate Request. This creates a key that must be entered on the Certification Authority (CA). Copy the certificate key from the Certificate Request field.

Click Security > SSL Server > SSL Server Authentication Settings.

Click Import Certificate.

Enter the following fields:

• Certificate ID—Select the active certificate.

• Certificate Source—Displays that the certificate is user-defined.

• Certificate—Copy in the received certificate.

• Import RSA Key—Pair-Select to enable copying in the new RSA key-pair.

• Public Key—Copy in the RSA public key.

• Private Key (Encrypted)—Select and copy in the RSA private key in encrypted form.

• Private Key (Plaintext)—Select and copy in the RSA private key in plain text form.

Click Apply to apply the changes to the Running Configuration.

Click Display Sensitive Data as Encrypted to display this key as encrypted. When this button is clicked, the private keys are written to the configuration file in encrypted form (when Apply is clicked). When the text is displayed in encrypted form, the button becomes Display Sensitive Data as Plaintext enabling you to view the text in plaintext again.

Click Security > SSL Server > SSL Server Authentication Settings.

Select a certificate and click Edit.

Enter the following fields as required:

• Regenerate RSA Key—Select to regenerate the RSA key.

• Key Length—Select the required key length from the options.

• Common Name—Enter a common name.

• Organization Unit—Enter the name of the organization unit for the certificate.

• Organization Name—Enter the name of the organization for the certificate.

• Location—Enter the location of the organization unit for the certificate.

• State—Enter the state of the organization unit for the certificate.

• County—Enter the county of the organization unit for the certificate.

• Duration—Enter the length of time that the certificate will be valid.

Click Generate to apply the changes to the Running Configuration.

Click Security > SSH Server > SSH User Authentication.

Select the following fields:

• SSH User Authentication by Password—Select to perform authentication of the SSH client user using the username/password configured in the local database (see User Accounts).

• SSH User Authentication by Public Key—Select to perform authentication of the SSH client user using the public key.

• Automatic Login—This field can be enabled if the SSH User Authentication by Public Key feature was selected.

Click Apply. The settings are saved to the Running Configuration file.

• SSH User Name—User name of user.

• Key Type—Whether this is an RSA or DSA key.

• Fingerprint—Fingerprint generated from the public keys.

Click Add to add a new user and enter the fields:

• SSH User Name—Enter a user name.

• Key Type—Select either RSA or DSA.

• Public Key—Copy the public key generated by an external SSH client application (like PuTTY) into this text box.

Click Apply to save the new user.

• IP Address—IP address of the active user.

• SSH User Name—User name of the active user.

• SSH Version—Version of SSH used by the active user.

• Cipher—Cipher of the active user.

• Authentication Code—Authentication code of the active user.

Click Security > SSH Server > SSH Server Authentication.

• Key Type—RSA or DSA.

• Key Source—Auto Generated or User Defined.

• Fingerprint—Fingerprint generated from the key.

Select either an RSA or DSA key.

You can perform any of the following actions:

• Generate—Generates a key of the selected type.

• Edit—Enables you to copy in a key from another device. Enter the following fields:

  • Key Type—As described above

  • Public Key—Enter the public key.

  • Private Key—Select either Encrypted or Plaintext and enter the private key.

    Display Sensitive Data as Encrypted or Display Sensitive Data as Plaintext—Sets how sensitive data will be displayed.

• Delete—Enables you to delete a key.

• Details—Enables you to view the generated key. The Details window also enables you to click Display Sensitive Data as Plaintext. If this is clicked, the keys are displayed as plaintext and not in encrypted form. If the key is already being displayed as plaintext, you can click Display Sensitive Data as Encrypted. To display the text in encrypted form.

Click Security > SSH Client > SSH User Authentication.

Select an SSH User Authentication Method. This is the global method defined for the secure copy (SCP). Select one of the options:

• By Password—This is the default setting. If this is selected, enter a password or retain the default one.

• By RSA Public Key—If this is selected, create an RSA public and Private key in the SSH User Key Table block.

• By DSA Public Key—If this is selected, create a DSA public/private key in the SSH User Key Table block.

Enter the Username (no matter what method was selected) or user the default username. This must match the username defined on the SSH server.

If the By Password method was selected, enter a password (Encrypted or Plaintext) or leave the default encrypted password.

Perform one of the following actions:

• Apply—The selected authentication methods are associated with the access method.

• Restore Default Credentials—The default username and password (anonymous) are restored.

• Display Sensitive Data As Plaintext—Sensitive data for the current page appears as plaintext.

  The SSH User Key Table contains the following fields for each key:

• Key Type—RSA or DSA.

• Key Source—Auto Generated or User Defined.

• Fingerprint—Fingerprint generated from the key.

To handle an RSA or DSA key, select either RSA or DSA and perform one of the following actions:

• Generate—Generate a new key.

• Edit—Display the keys for copying/pasting to another device.

• Delete—Delete the key.

• Details—Display the keys.

Click Security > SSH Client > SSH Server Authentication.

Select Enable to enable SSH server authentication.

• IPv4 Source Interface—Select the source interface whose IPv4 address will be used as the source IPv4 address for messages used in communication with IPv4 SSH servers.

• IPv6 Source Interface—Select the source interface whose IPv6 address will be used as the source IPv6 address for messages used in communication with IPv6 SSH servers.

  Note	If the Auto option is selected, the system takes the source IP address from the IP address defined on the outgoing interface.

Click Apply.

Click Add and enter the following fields for the Trusted SSH Server:

• Server Definition—Select one of the following ways to identify the SSH server:

  • By IP address—If this is selected enter the IP address of the server in the fields below.

  • By name—If this is selected enter the name of the server in the Server IP Address/Name field.

• IP Version—If you selected to specify the SSH server by IP address, select whether that IP address is an IPv4 or IPv6 address.

• IPv6 Address Type—If the SSH server IP address is an IPv6 address, select the IPv6 address type. The options are:

  • Link Local—The IPv6 address uniquely identifies hosts on a single network link. A link local address has a prefix of FE80, isn’t routable, and can be used for communication only on the local network. Only one link local address is supported. If a link local address exists on the interface, this entry replaces the address in the configuration.

  • Global—The IPv6 address is a global Unicast IPV6 type that is visible and reachable from other networks.

• Link Local Interface—Select the link local interface from the list of interfaces.

• Server IP Address/Name—Enter either the IP address of the SSH server or its name, depending on what was selected in Server Definition.

• Fingerprint—Enter the fingerprint of the SSH server (copied from that server).

Click Apply. The trusted server definition is stored in the Running Configuration file.

Click Security > SSH Client > Change User Password on SSH Server.

Enter the following fields:

• Server Definition—Define the SSH server by selecting either By IP Address or By Name. Enter the server name or IP address of the server in the Server IP Address/Name field.

• IP Version—If you selected to specify the SSH server by IP address, select whether that IP address is an IPv4 or IPv6 address.

• IPv6 Address Type—If the SSH server IP address is an IPv6 address, select the IPv6 address type. The options are:

  • Link Local—The IPv6 address uniquely identifies hosts on a single network link. A link local address has a prefix of FE80, isn’t routable, and can be used for communication only on the local network. Only one link local address is supported. If a link local address exists on the interface, this entry replaces the address in the configuration.

  • Global—The IPv6 address is a global Unicast IPV6 type that is visible and reachable from other networks.

• Link Local Interface—Select the link local interface from the list of interfaces.

• Server IP Address/Name—Enter either the IP address of the SSH server or its name, depending on what was selected in Server Definition.

• Username—This must match the username on the server.

• Old Password—This must match the password on the server.

• New Password—Enter the new password and confirm it in the Confirm Password field.

Click Apply. The password on the SSH server is modified.

Click Security > Storm Control > Storm Control Settings.

Select a port and click Edit.

Enter the parameters.

• Interface—Select the port for which storm control is enabled.

  Unknown Unicast Storm Control

• Storm Control State—Select to enable Storm Control for Unicast packets.

• Rate Threshold—Enter the maximum rate at which unknown packets can be forwarded. This value can be entered By kbits/sec or By percentage of the total available bandwidth.

• Trap on Storm—Select to send a trap when a storm occurs on a port. If this isn’t selected, the trap isn’t sent.

• Shutdown on Storm—Select to shut down a port when a storm occurs on the port. If this isn’t selected extra traffic is discarded.

  Multicast Storm Control

• Storm Control State—Select to enable Storm Control for Multicast packets.

• Multicast Type—Select one of the following types of Multicast packets on which to implement storm control:

  • All—Enables storm control on all Multicast packets on the port

  • Registered Multicast—Enables storm control only on registered Multicast addresses on the port

  • Unregistered Multicast—Enables only unregistered Multicast storm control on the port

• Rate Threshold—Enter the maximum rate at which unknown packets can be forwarded. This value can be entered By kbits/sec or By percentage of the total available bandwidth.

• Trap on Storm—Select to send a trap when a storm occurs on a port. If this isn’t selected, the trap isn’t sent.

• Shutdown on Storm—Select to shut down a port when a storm occurs on the port. If this isn’t selected extra traffic is discarded.

  Broadcast Storm Control

• Storm Control State—Select to enable Storm Control for Broadcast packets.

• Rate Threshold—Enter the maximum rate at which unknown packets can be forwarded. This value can be entered By kbits/sec or By percentage of the total available bandwidth.

• Trap on Storm—Select to send a trap when a storm occurs on a port. If this isn’t selected, the trap isn’t sent.

• Shutdown on Storm—Select to shut down a port when a storm occurs on the port. If this isn’t selected extra traffic is discarded.

Click Apply. Storm control is modified, and the Running Configuration file is updated.

Click Security > Storm Control > Storm Control Statistics.

Select an interface.

Enter the Refresh Rate—Select the how often the statistics should be refreshed. The available options are:

To clear all counters on all interfaces, click Clear All Interfaces Counters. To clear all counters on an interface, select it and click Clear Interface Counters.

Click Security > 802.1X Authentication > Properties.

Enter the parameters.

• Port-Based Authentication—Enable or disable port-based authentication.

• Authentication Method—Select the user authentication methods. The options are:

  • RADIUS, None—Perform port authentication first by using the RADIUS server. If no response is received from RADIUS, then no authentication is performed, and the session is permitted.

  • RADIUS—Authenticate the user on the RADIUS server. If no authentication is performed, the session isn’t permitted.

  • None—Don’t authenticate the user. Permit the session.

• Guest VLAN—Select to enable the use of a guest VLAN for unauthorized ports. If a guest VLAN is enabled, all unauthorized ports automatically join the VLAN selected in the Guest VLAN ID field. If a port is later authorized, it’s removed from the guest VLAN.

  The guest VLAN can be defined as a layer 3 interface (assigned an IP address) like any other VLAN. However, device management isn’t available via the guest VLAN IP address.

• Guest VLAN ID—Select the guest VLAN from the list of VLANs.

• Guest VLAN Timeout—Define a time period as either Immediate or enter a value in User Defined. This value is used as follows:

  After linkup, if the software doesn’t detect the 802.1X supplicant, or the authentication has failed, the port is added to the guest VLAN, only after the Guest VLAN timeout period has expired.

  If the port state changes from Authorized to Not Authorized, the port is added to the guest VLAN only after the Guest VLAN timeout has expired.

• Trap Settings—To enable traps, select one of more of the following options:

  • 802.1x Authentication Failure Traps—Select to generate a trap if 802.1x authentication fails.

  • 802.1x Authentication Success Traps—Select to generate a trap if 802.1x authentication succeeds.

  • MAC Authentication Failure Traps—Select to generate a trap if MAC authentication fails.

  • MAC Authentication Success Traps—Select to generate a trap if MAC authentication succeeds.

  • Supplicant Authentication Failure Traps—Select to generate a trap if supplicant authentication fails.

  • Supplicant Authentication Success Traps—Select to generate a trap if supplicant authentication succeeds.

  • Web Authentication Failure Traps—Select to generate a trap if Web authentication fails.

  • Web Authentication Success Traps—Select to generate a trap if Web authentication succeeds.

  • Web Authentication Quiet Traps—Select to generate a trap if a quiet period commences.

    The VLAN Authentication Table displays all VLANs, and indicates whether authentication has been enabled on them.

Click Apply. The 802.1X properties are written to the Running Configuration file.

Click Security > 802.1X Authentication > Port Authentication.

• Supplicant Status—Either Authorized or Unauthorized for an interface on which 802.1x supplicant has been enabled.

• Supplicant Credentials—Name of the credential structure used for the supplicant interface, so the possible value is any name or N/A if the supplicant isn’t enabled. If a port has a configured supplicant credential name, the value for the port control parameters is Supplicant. This value overrides any other port control information received from the port.

Select a port and click Edit.

Enter the parameters.

• Interface—Select a port.

• Current Port Control—Displays the current port authorization state. If the state is Authorized, the port is either authenticated or the Administrative Port Control is Force Authorized. Conversely, if the state is Unauthorized, then the port is either not authenticated or the Administrative Port Control is Force Unauthorized. If supplicant is enabled on an interface, the current port control is Supplicant.

• Administrative Port Control—Select the Administrative Port Authorization state. The options are:

  • Force Unauthorized—Denies the interface access by moving the interface into the unauthorized state. The device doesn’t provide authentication services to the client through the interface.

  • Auto—Enables port-based authentication and authorization on the device. The interface moves between an authorized or unauthorized state based on the authentication exchange between the device and the client.

  • Force Authorized—Authorizes the interface without authentication.

• RADIUS VLAN Assignment—Select to enable Dynamic VLAN assignment on the selected port.

  • Disable—Feature is not enabled.

  • Reject—If the RADIUS server authorized the supplicant, but didn’t provide a supplicant VLAN, the supplicant is rejected.

  • Static—If the RADIUS server authorized the supplicant, but didn’t provide a supplicant VLAN, the supplicant is accepted.

• Guest VLAN—Select to enable using a guest VLAN for unauthorized ports.

• Open Access—Select to successfully authenticate the port even though authentication fails.

• 802.1X Based Authentication—Select to enable 802.1X authentication on the port.

• MAC-Based Authentication—Select to enable port authentication based on the supplicant MAC address. Only 8 MAC-based authentications can be used on the port.

  Note	For MAC authentication to succeed, the RADIUS server supplicant username and password must be the supplicant MAC address. The MAC address must be in lower case letters and entered without the. Or - separators; for example: 0020aa00bbcc.

• Web-Based Authentication—Select to enable web-based authentication based on the supplicant MAC address.

• Periodic Reauthentication—Select to enable port reauthentication attempts after the specified Reauthentication Period.

• Reauthentication Period—Enter the number of seconds after which the selected port is reauthenticated.

• Reauthenticate Now—Select to enable immediate port reauthentication.

• Authenticator State—Displays the defined port authorization state. The options are:

  • Initialize—In process of coming up.

  • Force-Authorized—Controlled port state is set to Force-Authorized (forward traffic).

  • Force-Unauthorized—Controlled port state is set to Force-Unauthorized (discard traffic).

    Note	If the port isn’t in Force-Authorized or Force-Unauthorized, it’s in Auto Mode and the authenticator displays the state of the authentication in progress. After the port is authenticated, the state is shown as Authenticated.

• Time Range—Select to enable limiting authentication to a specific time range.

• Time Range Name—If Time Range is selected, click the Edit button to be redirected to the time range page and select the time range name to be used.

• Maximum WBA Login Attempts—Enter the maximum number of login attempts allowed for web-based authentication. Select either Infinite for no limit or User Defined to set a limit.

• Maximum WBA Silence Period—Enter the maximum length of the silent period for web-based authentication allowed on the interface. Select either Infinite for no limit or User Defined to set a limit.

• Max Hosts—Enter the maximum number of authorized hosts allowed on the interface.

  Select either Infinite for no limit, or User Defined to set a limit.

  Note	Set this value to 1 to simulate single-host mode for web-based authentication in multi-sessions mode.

• Quiet Period—Enter the length of the quiet period.

• Resending EAP—Enter the number of seconds that the device waits for a response to an Extensible Authentication Protocol (EAP) request/identity frame from the supplicant (client) before resending the request.

• Max EAP Requests—Enter the maximum number of EAP requests that will be sent. If a response isn’t received after the defined period (supplicant timeout), the authentication process is restarted.

• EAP Max Retries—Enter the maximum number of EAP retries that can be sent.

• EAP Timeout—Enter the maximum time that is waited for EAP responses before timeout occurs.

• Supplicant Timeout—Enter the number of seconds that lapses before EAP requests are resent to the supplicant.

• Server Timeout—Enter the number of seconds that lapses before the device resends a request to the authentication server.

• Supplicant—Select to enable 802.1X.

• Credentials—Select credentials from the drop-down list to use for this supplicant. This parameter is available only if supplicant is enabled on the interface. Edit links to the Supplicant Credentials page where credentials can be configured.

• Supplicant Held Timeout—Enter the time period during which the supplicant waits before restarting authentication after receiving the FAIL response from the RADIUS server.

Click Apply. The port settings are written to the Running Configuration file.

Click Security > 802.1X Authentication > Host and Session Authentication.

• Number of Violations—Displays the number of packets that arrive on the interface in single-host mode, from a host whose MAC address isn’t the supplicant MAC address.

Select a port, and click Edit.

Enter the parameters.

• Interface—Enter a port number for which host authentication is enabled.

• Host Authentication—Select from one of the following modes.

  • Single Host—A port is authorized if there is an authorized client. Only one host can be authorized on a port.

  • Multiple Host (802.1x)—A port is authorized if there is if there is at least one authorized client.

  • Multiple Sessions—Unlike the single-host and multi-host modes, a port in the multi-session mode does not have an authentication status. This status is assigned to each client connected to the port.

  Single Host Violation Settings—Can only be chosen if host authentication is Single Host.

• Action on Violation—Select the action to be applied to packets arriving in Single Session/Single Host mode, from a host whose MAC address isn’t the supplicant MAC address. The options are:

  • Protect (Discard)—Discards the packets.

  • Restrict (Forward)—Forwards the packets.

  • Shutdown—Discards the packets and shuts down the port. The ports remain shut down until reactivated, or until the device is rebooted.

• Traps—Select to enable traps.

• Trap Frequency—Defines how often traps are sent to the host. This field can be defined only if multiple hosts are disabled.

Click Apply. The settings are written to the Running Configuration file.

Click Security > 802.1X Authentication > Supplicant Credentials.

Click Add.

Enter the following fields:

• Credential Name—Name by which to identify the credential.

• User Name—Enter the user name associated with the credential name.

• Description—Enter text describing the user.

• Password—Select the type of password: Encrypted or Plaintext and add the password.

Click Apply and the settings are saved to the Running Configuration file.

Click Security 802.1X Authentication > MAC-Based Authentication Settings

Enter the following fields:

• MAC Authentication Type—Select one of the following options:

  • EAP—Use RADIUS with EAP encapsulation for the traffic between the switch (RADIUS client) and the RADIUS server, which authenticates a MAC-based supplicant.

  • RADIUS—Use RADIUS without EAP encapsulation for the traffic between the switch (RADIUS client) and the RADIUS server, which authenticates a MAC-based supplicant.

  Username Format

  In MAC-based authentication, the supplicant's username is based on the supplicant device MAC address. The following defines the format of this MAC-based username, which is sent from the switch to the RADIUS server, as part of the authentication process.

• Group Size—Number of ASCII characters between delimiters of the MAC address sent as a user name.

• Group Separator—Character used as a delimiter between the defined groups of characters in the MAC address.

• Case—Send user name in lower or upper case.

  MAC Authentication Password

• Password—Defines the password that the switch uses for authentication via the RADIUS server. Select one of the following options:

  • Use default (Username)—Select this to use the defined username as the password.

  • Encrypted—Define a password in encrypted format.

  • Plaintext—Define a password in plaintext format.

• Password MD5 Digest—Displays the MD5 Digest password.

Click Apply and the settings are saved to the Running Configuration file. Click Display Sensitive Data as Plaintext to display the password if it is encrypted.

Click Security > 802.1X Authentication > Locked Client.

• Interface—Port that is locked.

• MAC Address—Displays the MAC address of locked station

• Remaining Time (Sec)—The time remaining for the port to be locked.

Select a port.

Click Unlock.

Click Security > 802.1X Authentication > Web Authentication Customization.

Click Add.

Select a language from the Language drop-down list.

Select Set as Default Display Language if this language is the default language. the default language pages are displayed if the end user does not select a language.

Click Apply and the settings are saved to the Running Configuration file.

Click Security > 802.1X Authentication > Web Authentication Customization.

Click Edit Login Page.

Click Edit labeled 1. The following fields are displayed:

• Language—Displays the page’s language.

• Color Scheme—Select one of the contrast options.

  If the Custom color scheme is selected, the following options are available:

  • Page Background Color—Enter the ASCII code of the background color. The selected color is shown in the Text field.

  • Page Text Color—Enter the ASCII code of the text color. The selected color is shown in the Text field.

  • Header and Footer Background Color—Enter the ASCII code of the header and footer background color. The selected color is shown in the Text field.

  • Header and Footer Text Color—Enter the ASCII code of the header and footer text color. The selected color is shown in the Text field.

  • Hyperlink Color—Enter the ASCII code of the hyperlink color. The selected color is shown in the Text field.

• Current Logo Image—Displays the name of the file containing the current logo image.

• Logo Image—Select one of the following options:

  • None—No logo

  • Default—Use the default logo.

  • Other—Select to enter a customized logo.

    If the Other logo option is selected, the following options are available:

  • Logo Image Filename—Enter the logo file name or Browse to the image.

  • Application Text—Enter text to accompany the logo.

  • Window Title Text—Enter a title for the Login page.

Click Apply and the settings are saved to the Running Configuration file.

Click Edit labeled 2. The following fields are displayed:

• Invalid User Credentials—Enter the text of the message to be displayed when the end user enters an invalid username or password.

• Service Not Available—Enter the text of the message to be displayed when the authentication service isn’t available.

Click Apply and the settings are saved to the Running Configuration file.

Click Edit labeled 3. The following fields are displayed:

• Welcome Message—Enter the text of the message to be displayed when the end user logs on.

• Instructional Message—Enter the instructions to be displayed to the end user.

• RADIUS Authentication—Displays whether RADIUS authentication is enabled. If so, the username and password must be included in the login page.

• Username Textbox—Select for a username textbox to be displayed.

• Username Textbox Label—Select the label to be displayed before the username textbox.

• Password Textbox—Select for a password textbox to be displayed.

• Password Textbox Label—Select the label to be displayed before the password textbox.

• Language Selection—Select to enable the end user to select a language.

• Language Dropdown Label—Enter the label of the language selection dropdown.

• Login Button Label—Enter the label of the login button.

• Login Progress Label—Enter the text that will be displayed during the login process.

Click Apply and the settings are saved to the Running Configuration file.

Click Edit labeled 4. The following fields are displayed:

• Terms and Conditions—Select to enable a terms and conditions text box.

• Terms and Conditions Warning—Enter the text of the message to be displayed as instructions to enter the terms and conditions.

• Terms and Conditions Content—Enter the text of the message to be displayed as terms and conditions.

Click Apply and the settings are saved to the Running Configuration file.

Edit labeled 5. The following fields are displayed:

• Copyright—Select to enable displaying copyright text.

• Copyright Text—Enter the copyright text.

Click Apply and the settings are saved to the Running Configuration file.

Click Edit Success Page.

Click the Edit button on the right side of the page.

Enter the Success Message, which is the text that will be displayed if the end user successfully logs in.

Click Apply and the settings are saved to the Running Configuration file.

Click Security > Denial of Service Prevention > Security Suite Settings.

Click Details beside CPU Utilization to go to the  CPU Utilization page and view CPU resource utilization information.

Click Edit beside TCP SYN Protection to set the feature.

Configure the DoS Prevention settings:

• Disable-Disable all types of Denial of Service features (except device level TCP SYN protection).

• System-Level Prevention-Enable preventing attacks from Stacheldraht Distribution, Invasor Trojan, Back Orifice Trojan and Martian Addresses.

• System-Level and Interface-Level Prevention-In addition to the system-level prevention, you can enable and configure the following interface-level settings: Syn Filtering, Syn Rate Protection, ICMP Filtering and IP Fragmented.

If System-Level Prevention or System-Level and Interface-Level Prevention is selected, enable one or more of the following Denial of Service Protection options:

• Stacheldraht Distribution-Discards TCP packets with source TCP port equal to 16660.

• Invasor Trojan-Discards TCP packets with destination TCP port equal to 2140 and source TCP port equal to 1024.

• Back Orifice Trojan-Discards UDP packets with destination UDP port equal to 31337 and source UDP port equal to 1024.

Click the following as required:

• Martian Addresses-Click Edit to go to the Martian Addresses page.

• SYN Filtering-Click Edit to go to the SYN Filtering page.

• SYN Rate Protection-(In Layer 2 only) Click Edit to go to the SYN Rate Protection page.

• ICMP Filtering-Click Edit to go to the  ICMP Filtering page.

• IP Fragmented-Click Edit to go to the IP Fragments Filtering page.

Click Apply. The Denial of Service prevention Security Suite settings are written to the Running Configuration file.

Click Security > Denial of Service Prevention > SYN Protection.

Enter the parameters.

• Block SYN-FIN Packets-Select to enable the feature. All TCP packets with both SYN and FIN flags are dropped on all ports.

• SYN Protection Mode-Select between three modes:

  • Disable-The feature is disabled on a specific interface.

  • Report-Generates a SYSLOG message. The status of the port is changed to Attacked when the threshold is passed

  • Block and Report-When a TCP SYN attack is identified, TCP SYN packets destined for the system are dropped and the status of the port is changed to Blocked.

• SYN Protection Threshold-Number of SYN packets per second before SYN packets will be blocked (deny SYN with MAC-to-me rule will be applied on the port).

• SYN Protection Period-Time in seconds before unblocking the SYN packets (the deny SYN with MAC-to-me rule is unbound from the port).

Click Apply. SYN protection is defined, and the Running Configuration file is updated.

• Current Status-Interface status. The possible values are:

  • Normal-No attack was identified on this interface.

  • Blocked-Traffic isn’t forwarded on this interface.

  • Attacked-Attack was identified on this interface.

• Last Attack-Date of last SYN-FIN attack identified by the system and the system action.

Click Security > Denial of Service Prevention > Martian Addresses.

Select Reserved Martian Addresses and click Apply to include the reserved Martian Addresses in the System Level Prevention list.

To add a Martian address click Add.

Enter the parameters.

• IP Version-Indicates the supported IP version. Currently, support is only offered for IPv4.

• IP Address-Enter an IP address to reject. The possible values are:

  • From Reserved List-Select a well-known IP address from the reserved list.

  • New IP Address-Enter an IP address.

• Mask-Enter the mask of the IP address to define a range of IP addresses to reject. The values are:

  • Network Mask-Network mask in dotted decimal format

  • Prefix Length-Enter the prefix of the IP address to define the range of IP addresses for which Denial of Service prevention is enabled.

Click Apply.

Click Security > Denial of Service Prevention > SYN Filtering.

Click Add.

Enter the parameters.

• Interface—Select the interface on which the filter is defined.

• IPv4 Address—Enter the IP address for which the filter is defined, or select All addresses.

• Network Mask—Enter the network mask for which the filter is enabled in IP address format. Enter one of the following:

  • Mask—Network mask in dotted decimal format

  • Prefix length—Enter the Prefix length of the IP address to define the range of IP addresses for which Denial of Service prevention is enabled.

• TCP Port—Select the destination TCP port being filtered:

  • Known ports—Select a port from the list.

  • User Defined—Enter a port number.

  • All ports—Select to indicate that all ports are filtered.

Click Apply. The SYN filter is defined, and the Running Configuration file is updated.

Click Security > Denial of Service Prevention > SYN Rate Protection.

Click Add.

Enter the parameters.

• Interface—Select the interface on which the rate protection is being defined.

• IP Address—Enter the IP address for which the SYN rate protection is defined or select All addresses. If you enter the IP address, enter either the mask or prefix length.

• Network Mask—Select the format for the subnet mask for the source IP address, and enter a value in one of the fields:

  • Mask—Select the subnet to which the source IP address belongs and enter the subnet mask in dotted decimal format.

  • Prefix length—Select the Prefix length and enter the number of bits that comprise the source IP address prefix.

• SYN Rate Limit—Enter the number of SYN packets that be received.

Click Apply. The SYN rate protection is defined, and the Running Configuration is updated.

Click Security > Denial of Service Prevention > ICMP Filtering.

Click Add.

Enter the parameters.

• Interface—Select the interface on which the ICMP filtering is being defined.

• IP Address—Enter the IPv4 address for which the ICMP packet filtering is activated or select All addresses to block ICMP packets from all source addresses. If you enter the IP address, enter either the mask or prefix length.

• Network Mask—Select the format for the subnet mask for the source IP address, and enter a value in one of the field:

  • Mask—Select the subnet to which the source IP address belongs and enter the subnet mask in dotted decimal format.

  • Prefix length—Select the Prefix length and enter the number of bits that comprise the source IP address prefix.

Click Apply. The ICMP filtering is defined, and the Running Configuration is updated.

Click Security > Denial of Service Prevention > IP Fragments Filtering.

Click Add.

Enter the parameters.

• Interface—Select the interface on which the IP fragmentation is being defined.

• IP Address—Enter an IP network from which the fragmented IP packets is filtered or select All addresses to block IP fragmented packets from all addresses. If you enter the IP address, enter either the mask or prefix length.

• Network Mask—Select the format for the subnet mask for the source IP address, and enter a value in one of the fields:

  • Mask—Select the subnet to which the source IP address belongs and enter the subnet mask in dotted decimal format.

  • Prefix length—Select the Prefix length and enter the number of bits that comprise the source IP address prefix.

Click Apply. The IP fragmentation is defined, and the Running Configuration file is updated.

Click Security > IP Source Guard > Properties.

Select Enable to enable IP Source Guard globally.

Click Apply to enable IP Source Guard.

Click Security > IP Source Guard > Interface Settings.

Select port/LAG from the Filter field and click Go. The ports/LAGs on this unit are displayed along with the following:

• IP Source Guard—Indicates whether IP Source Guard is enabled on the port.

• DHCP Snooping Trusted Interface—Indicates whether this is a DHCP trusted interface.

Select the port/LAG and click Edit. Select Enable in the IP Source Guard field to enable IP Source Guard on the interface.

Click Apply to copy the setting to the Running Configuration file.

Click Security > IP Source Guard > Binding Database.

The DHCP Snooping uses TCAM resources for managing the database. Complete the Insert Inactive field to select how frequently the device should attempt to activate inactive entries. It has the following options:

• Retry Frequency—The frequency with which the TCAM resources are checked.

• Never-Never try to reactivate inactive addresses.

Click Apply to save the above changes to the Running Configuration and/or Retry Now to check TCAM resources.

• VLAN ID—VLAN on which packet is expected.

• MAC Address—MAC address to be matched.

• IP Address—IP address to be matched.

• Interface—Interface on which packet is expected.

• Status—Displays whether interface is active.

• Type—Displays whether entry is dynamic or static.

• Reason—If the interface isn’t active, displays the reason. The following reasons are possible:

  • No Problem—Interface is active.

  • No Snoop VLAN—DHCP Snooping isn’t enabled on the VLAN.

  • Trusted Port—Port has become trusted.

  • Resource Problem—TCAM resources are exhausted.

To see a subset of these entries, enter the relevant search criteria and click Go.

Click Security > ARP Inspection > Properties.

• ARP Inspection Status-Select to enable ARP Inspection.

• ARP Packet Validation-Select to enable validation checks.

• Log Buffer Interval-Select one of the following options:

  • Retry Frequency-Enable sending SYSLOG messages for dropped packets. Entered the frequency with which the messages are sent.

  • Never-Disabled SYSLOG dropped packet messages.

Click Apply. The settings are defined, and the Running Configuration file is updated.

Click Security > ARP Inspection > Interface Settings.

To set a port/LAG as trusted or untrusted, select the port/LAG and click Edit.

Select Trusted or Untrusted and click Apply to save the settings to the Running Configuration file.

Click Security > ARP Inspection > ARP Access Control.

To add an entry, click Add.

Enter the fields:

• ARP Access Control Name-Enter a user-created name.

• IP Address-IP address of packet.

• MAC Address-MAC address of packet.

Click Apply. The settings are defined, and the Running Configuration file is updated.

Click Security > ARP Inspection > ARP Access Control Rules.

To add more rules to a group, click Add.

Select an ARP Access Control Name and enter the fields:

• IP Address-IP address of packet.

• MAC Address-MAC address of packet.

Click Apply. The settings are defined, and the Running Configuration file is updated.

Click Security > ARP Inspection > VLAN Settings.

To enable ARP Inspection on a VLAN, move the VLAN from the Available VLANs list to the Enabled VLANs list.

To associate an ARP Access Control group with a VLAN, click Add. Select the VLAN number and select a previously-defined ARP Access Control Name.

Click Apply. The settings are defined, and the Running Configuration file is updated.

Click Security > IPv6 First Hop Security > FHS Settings.

Enter the following global configuration fields:

• FHS VLAN List—Enter one or more VLANs on which IPv6 First Hop Security is enabled.

• Packet Drop Logging—Select to create a SYSLOG when a packet is dropped by a First Hop Security policy. This is the global default value if no policy is defined.

Click Apply to add the settings to the Running Configuration file.

Create a FHS policy if required by clicking Add.

• Policy Name—Enter a user-defined policy name.

• Packet Drop Logging—Select to create a SYSLOG when a packet is dropped as a result of a First Hop Security feature within this policy.

  • Inherited—Use the value from the VLAN or the global configuration.

  • Enable—Create a SYSLOG when a packet is dropped as a result of First Hop Security.

  • Disable—Don’t create a SYSLOG when a packet is dropped as a result of First Hop Security.

Click Apply to add the settings to the Running Configuration file.

To attach this policy to an interface:

• Attach Policy to VLAN—Click to jump to Policy Attachment (VLAN) page where you can attach this policy to a VLAN.

• Attach Policy to Interface—Click to jump to Policy Attachment (Port) page where you can attach this policy to a port.

Click Security > IPv6 First Hop Security > RA Guard Settings.

Enter the following global configuration field:

• RA Guard VLAN List—Enter one or more VLANs on which RA Guard is enabled.

  Enter the other configuration fields that are described below.

To add a policy, click Add and enter the fields:

• Policy Name—Enter a user-defined policy name.

• Device Role—Displays one of the following options to specify the role of the device attached to the port for RA Guard.

  • Inherited—Device role is inherited from either the VLAN or system default (client).

  • Host—Device role is host.

  • Router—Device role is router.

• Managed Configuration Flag—This field specifies verification of the advertised Managed Address Configuration flag within an IPv6 RA Guard policy.

  • Inherited—Feature is inherited from either the VLAN or system default (client).

  • No Verification—Disables verification of the advertised Managed Address Configuration flag.

  • On—Enables verification of the advertised Managed Address Configuration flag.

  • Off—The value of the flag must be 0.

• Other Configuration Flag—This field specifies verification of the advertised Other Configuration flag within an IPv6 RA Guard policy.

  • Inherited—Feature is inherited from either the VLAN or system default (client).

  • No Verification—Disables verification of the advertised Other Configuration flag.

  • On—Enables verification of the advertised Managed Other flag.

  • Off—The value of the flag must be 0.

• RA Address List—Specify the list of addresses to filter:

  • Inherited—Value is inherited from either the VLAN or system default (no verification).

  • No Verification—Advertised addresses aren’t verified.

  • Match List—IPv6 address list to be matched.

• RA Prefix List—Specify the list of addresses to filter:

  • Inherited—Value is inherited from either the VLAN or system default (no verification).

  • No Verification—Advertised prefixes aren’t verified.

  • Match List—Prefix list to be matched.

• Minimal Hop Limit—Indicates if the RA Guard policy checks that the minimum hop limit of the packet received.

  • Inherited—Feature is inherited from either the VLAN or system default (client).

  • No Limit—Disables verification of the lower boundary of the hop count limit.

  • User Defined—Verifies that the hop-count limit is greater than or equal to this value.

• Maximal Hop Limit—Indicates if the RA Guard policy checks that the maximum hop limit of the packet received.

  • Inherited—Feature is inherited from either the VLAN or system default (client).

  • No Limit—Disables verification of the high boundary of the hop-count limit.

  • User Defined—Verifies that the hop-count limit is less than or equal to this value. The value of the high boundary must be equal or greater than the value of the low boundary.

• Minimal Router Preference—This field indicates whether the RA Guard policy verifies the minimum advertised Default Router Preference value in RA messages within an RA Guard policy.

  • Inherited—Feature is inherited from either the VLAN or system default (client).

  • No Verification—Disables verification of the low boundary of Advertised Default Router Preference.

  • Low—Specifies the minimum allowed Advertised Default Router Preference value. The following values are acceptable: low, medium, and high (see RFC4191).

  • Medium—Specifies the minimum allowed Advertised Default Router Preference value. The following values are acceptable: low, medium, and high (see RFC4191).

  • High—Specifies the minimum allowed Advertised Default Router Preference value. The following values are acceptable: low, medium, and high (see RFC4191).

• Maximal Router Preference—This field indicates whether the RA Guard policy verifies the maximum advertised Default Router Preference value in RA messages within an RA Guard policy.

  • Inherited—Feature is inherited from either the VLAN or system default (client).

  • No Verification—Disables verification of the high boundary of Advertised Default Router Preference.

  • Low—Specifies the maximum allowed Advertised Default Router Preference value. The following values are acceptable: low, medium, and high (see RFC4191).

  • Medium—Specifies the maximum allowed Advertised Default Router Preference value. The following values are acceptable: low, medium, and high (see RFC4191).

  • High—Specifies the maximum allowed Advertised Default Router Preference value. The following values are acceptable: low, medium, and high (see RFC4191).

Click Apply to add the settings to the Running Configuration file.

To configure system-defined default policies or existing user defined policy select the policy in the policy table and click Edit.

To attach this policy to an interface:

• Attach Policy to VLAN—Click to jump to Policy Attachment (VLAN) page where you can attach this policy to a VLAN.

• Attach Policy to Interface—Click to jump to Policy Attachment (Port) page where you can attach this policy to a port.

Click Security > IPv6 First Hop Security > DHCPv6 Guard Settings.

Enter the following global configuration fields:

• DHCPv6 Guard VLAN List—Enter one or more VLANs on which DHCPv6 Guard is enabled.

• Device Role—Displays the device role. See definition in the Add page.

• Minimal Preference—This field indicates whether the DHCPv6 Guard policy checks the minimum advertised preference value of the packet received.

  • No Verification—Disables verification of the minimum advertised preference value of the packet received.

  • User Defined—Verifies that the advertised preference value is greater than or equal to this value. This value must be less than the Maximal Preference value.

• Maximal Preference—This field indicates whether the DHCPv6 Guard policy checks the maximum advertised preference value of the packet received. This value must be greater than the Minimal Preference value.

  • No Verification—Disables verification of the lower boundary of the hop count limit.

  • User Defined—Verifies that the advertised preference value is less than or equal to this value.

Click Apply to add the settings to the Running Configuration file.

If required, click Add to create a DHCPv6 policy.

Enter the following fields:

• Policy Name—Enter a user-defined policy name.

• Device Role—Select either Server or Client to specify the role of the device attached to the port for DHCPv6 Guard.

  • Inherited—Role of device is inherited from either the VLAN or system default (client).

  • Client—Role of device is client.

  • Server—Role of device is server.

• Match Reply Prefixes—Select to enable verification of the advertised prefixes in received DHCP reply messages within a DHCPv6 Guard policy.

  • Inherited—Value is inherited from either the VLAN or system default (no verification).

  • No Verification—Advertised prefixes aren’t verified.

  • Match List—IPv6 prefix list to be matched.

• Match Server Address—Select to enable verification of the DHCP server's and relay’s IPv6 address in received DHCP reply messages within a DHCPv6 Guard policy.

  • Inherited—Value is inherited from either the VLAN or system default (no verification).

  • No Verification—Disables verification of the DHCP server's and relay’s IPv6 address.

  • Match List— IPv6 prefix list to be matched.

• Minimal Preference—This field indicates whether the DHCPv6 Guard policy checks the minimum advertised preference value of the packet received.

  • Inherited—Minimal preference is inherited from either the VLAN or system default (client).

  • No Verification—Disables verification of the minimum advertised preference value of the packet received.

  • User Defined—Verifies that the advertised preference value is greater than or equal to this value. This value must be less than the Maximal Preference value.

• Maximal Preference—This field indicates whether the DHCPv6 Guard policy checks the maximum advertised preference value of the packet received. This value must be greater than the Minimal Preference value.

  • Inherited—Minimal preference is inherited from either the VLAN or system default (client).

  • No Verification—Disables verification of the lower boundary of the hop count limit.

  • User Defined—Verifies that the advertised preference value is less than or equal to this value.

Click Apply to add the settings to the Running Configuration file.

To attach this policy to an interface:

• Attach Policy to VLAN—Click to jump to Policy Attachment (VLAN) page where you can attach this policy to a VLAN.

• Attach Policy to Interface—Click to jump to Policy Attachment (Port) page where you can attach this policy to a port.

Click Security > IPv6 First Hop Security > ND Inspection Settings.

Enter the following global configuration fields:

• ND Inspection VLAN List—Enter one or more VLANs on which ND Inspection is enabled.

• Device Role—Displays the device role that is explained below.

• Drop Unsecure—Select to enable dropping messages with no CGA or RSA Signature option within an IPv6 ND Inspection policy.

• Minimal Security Level—If unsecure messages aren’t dropped, select the security level below which messages aren’t forwarded.

  • No Verification—Disables verification of the security level.

  • User Defined—Specify the security level of the message to be forwarded.

• Validate Source MAC—Select to globally enable checking source MAC address against the link-layer address.

Click Apply to add the settings to the Running Configuration file.

If required, click Add to create an ND Inspection policy.

Enter the following fields:

• Policy Name—Enter a user-defined policy name.

• Device Role—Select one of the following to specify the role of the device attached to the port for ND Inspection.

  • Inherited—Role of device is inherited from either the VLAN or system default (client).

  • Host—Role of device is host.

  • Router—Role of device is router.

• Drop Unsecure—Select one of following options:

  • Inherited—Inherit value from VLAN or system default (disabled).

  • Enable—Enable dropping messages with no CGA or RSA Signature option within an IPv6 ND Inspection policy.

  • Disable—Disable dropping messages with no CGA or RSA Signature option within an IPv6 ND Inspection policy.

• Minimal Security Level—If unsecure messages aren’t dropped, select the security level below which messages aren’t forwarded.

  • Inherited—Inherit value from VLAN or system default (disabled).

  • No Verification—Disables verification of the security level.

  • User Defined—Specify the security level of the message to be forwarded.

• Validate Source MAC—Specify whether to globally enable checking source MAC address against the link-layer address:

  • Inherited—Inherit value from VLAN or system default (disabled).

  • Enable—Enable checking source MAC address against the link-layer address.

  • Disable—Disable checking source MAC address against the link-layer address.

Click Apply to add the settings to the Running Configuration file.

To attach this policy to an interface:

• Attach Policy to VLAN— To attach this policy to a VLAN, jump to Policy Attachment (VLAN) .

• Attach Policy to Interface—To attach this policy to an interface, jump to Policy Attachment (Port)

Click Security > IPv6 First Hop Security > Neighbor Binding Settings.

Enter the following global configuration fields:

Click Apply to add the settings to the Running Configuration file.

If required, click Add to create a Neighbor Binding policy.

Enter the following fields:

Click Apply to add the settings to the Running Configuration file.

To attach this policy to an interface:

Click Security > IPv6 First Hop Security > IPv6 Source Guard Settings.

Enter the following global configuration fields:

• IPv6 Source Guard VLAN List—Enter one or more VLANs on which IPv6 Source Guard is enabled.

• Port Trust—Displays that by default the policies are for untrusted ports. This can be changed per policy.

If required, click Add to create a First Hop Security policy.

Enter the following fields:

• Policy Name—Enter a user-defined policy name.

• Port Trust—Select the port trust status of the policy:

  • Inherited—When policy is attached to a port it’s untrusted).

  • Trusted—When policy is attached to a port it’s trusted.

Click Apply to attach the policy.

To attach this policy to an interface click Attach Policy to Interface.

Click Security > IPv6 First Hop Security > Policy Attachment (VLAN).

To attach a policy to a VLAN, click Add and enter the following fields:

• Policy Type—Select the policy type to attach to the interface.

• Policy Name—Select the name of the policy to attach to the interface.

• VLAN List—Select the VLANs to which the policy is attached.

Click Apply to add the settings to the Running Configuration file.

Click Security > IPv6 First Hop Security > Policy Attachment (Port).

To attach a policy to a port or LAG, click Add and enter the following fields:

• Interface—Select the interface on which the policy will be attached.

• Policy Type—Select the policy type to attach to the interface.

• Policy Name—Select the name of the policy to attach to the interface.

• VLAN List—Select the VLANs to which the policy is attached.

Click Apply to add the settings to the Running Configuration file.

Click Security > IPv6 First Hop Security > Neighbor Binding Table

Select one of the following clear table options:

• Static Only—Clear all static entries in the table.

• Dynamic Only—Clear all dynamic entries in the table.

• All Dynamic & Static—Clear all dynamic and static entries in the table.

  The following fields are displayed for each policy (only fields not on Add page are displayed:

• Origin—Protocol that added the IPv6 address (only available for dynamic entries):

  • Static—Added manually.

  • NDP—Learnt from Neighbor Discovery Protocol messages

  • DHCP—Learnt from DHCPv6 protocol messages

• State—State of the entry:

  • Tentative—The new host IPv6 address is under validation. Since its lifetime is less than 1 sec its expiration time isn’t displayed.

  • Valid—The host IPv6 address was bound.

• Expiry Time (Sec.)—Remaining time in seconds until the entry will be removed, if it’s not confirmed.

• TCAM Overflow—Entries marked as No don’t have a TCAM overflow.

To add a policy, click Add and enter the following fields:

• VLAN ID—VLAN ID of the entry.

• IPv6 Address—Source IPv6 address of the entry.

• Interface—Port on which packet is received.

• MAC Address—Neighbor MAC address of the packet.

Click Apply to add the settings to the Running Configuration file.

Click Security > IPv6 First Hop Security > Neighbor Prefix Table.

Select one of the following options in the Clear Table field to clear the Neighbor Prefix table:

• Static Only—Clear only static entries.

• Dynamic Only—Clear only dynamic entries.

• All Dynamic & Static—Clear static and dynamic entries.

The following fields are displayed for the exiting entries:

• VLAN ID—VLAN on which the prefixes are relevant.

• IPv6 Prefix—IPv6 prefix.

• Prefix Length—IPv6 prefix length.

• Origin—Entry is dynamic (learned) or static (manually configured).

• Autoconfig—The prefix can be used for stateless configuration.

• Expiry Time (Sec)—Length of time entry remains before being deleted.

Click Add to add a new entry to the table and enter the above fields for the new entry.

Click Security > IPv6 First Hop Security > FHS Status.

Select a port, LAG or VLAN for which the FHS state is reported.

The following fields are displayed for the selected interface:

Click Security > IPv6 First Hop Security > FHS Statistics.

Select the Refresh Rate, the time period that passes before the statistics are refreshed.

The following global overflow counters are displayed:

Select an interface and the following fields are displayed:

Click Clear Interface Counters or Clear All Interface Counters or Clear Global Counters to clear the counters.

Click Refresh to refresh the counters.

Click Security > Certificate Settings > CA Certificate Settings.

To import a new certificate, click Add and complete the following:

Click Apply to apply the new settings.

To view the details of an existing certificate, select the certificate from the list and click Details. The following will be displayed:

You can use the following filters to find a specific certificate.

To remove one or more certificates select the certificate(s) and press Delete. Only Static certificates can be deleted.

Click Security > Certificate Settings > CA Certificate Revocation List.

Click Add to open the Add Revoked Certificate dialog box

Provide the following details:

Click Apply to add the certificate.

To delete an existing certificate, select the certificate from the Revoked CA Certificate Table and click Delete. Next, click Apply to apply the new settings.