Handbook

Error! Use the Home tab to apply 見出し 1 to the text that you want to appear here. 17
Secure access to the switch
Secure switch management is needed for environments that perform significant management functions
across the Internet. The following are some of the functions for secured management:
Limiting management users to a specific IP address range. See the ―Setting allowable source IP
address ranges‖ section in this chapter.
Authentication and authorization of remote administrators. See the ―RADIUS authentication and
authorization‖ section or the ―TACACS+ authentication‖ section, both later in this chapter.
Encryption of management information exchanged between the remote administrator and the
switch. See the ―Secure Shell and Secure Copy‖ section later in this chapter.
Setting allowable source IP address ranges
To limit access to the switch without having to configure filters for each switch port, you can set a source
IP address (or range) that will be allowed to connect to the switch IP interface through Telnet, SSH, SNMP,
or the switch browser-based interface (BBI).
When an IP packet reaches the application switch, the source IP address is checked against the range of
addresses defined by the management network and management mask. If the source IP address of the
host or hosts is within this range, it is allowed to attempt to log in. Any packet addressed to a switch IP
interface with a source IP address outside this range is discarded.
Configuring an IP address range for the management network
Configure the management network IP address and mask from the System Menu in the CLI. For example:
>> Main# /cfg/sys/access/mgmt/add
Enter Management Network Address: 192.192.192.0
Enter Management Network Mask: 255.255.255.128
In this example, the management network is set to 192.192.192.0 and management mask is set to
255.255.255.128. This defines the following range of allowed IP addresses: 192.192.192.1 to 192.192.192.127.
The following source IP addresses are granted or not granted access to the switch:
A host with a source IP address of 192.192.192.21 falls within the defined range and would be
allowed to access the switch.
A host with a source IP address of 192.192.192.192 falls outside the defined range and is not granted
access. To make this source IP address valid, you would need to shift the host to an IP address within
the valid range specified by the mnet and mmask or modify the mnet to be 192.192.192.128 and the
mmask to be 255.255.255.128. This would put the 192.192.192.192 host within the valid range allowed
by the mnet and mmask (192.192.192.128-255).
RADIUS authentication and authorization
The switch supports the Remote Authentication Dial-in User Service (RADIUS) method to authenticate and
authorize remote administrators for managing the switch. This method is based on a client/server model.
The Remote Access Server (RAS) — the switch — is a client to the back-end database server. A remote
user (the remote administrator) interacts only with the RAS, not the back-end server and database.
RADIUS authentication consists of the following components:
A protocol with a frame format that utilizes User Datagram Protocol (UDP) over IP, based on Request
For Comments (RFC) 2138 and 2866
A centralized server that stores all the user authorization information
A client, in this case, the switch
The switch, acting as the RADIUS client, communicates to the RADIUS server to authenticate and
authorize a remote administrator using the protocol definitions specified in RFC 2138 and 2866.
Transactions between the client and the RADIUS server are authenticated using a shared key that is not
sent over the network. In addition, the remote administrator passwords are sent encrypted between the
RADIUS client (the switch) and the back-end RADIUS server.