Configuring an HWTACACS Server Template

CloudEngine 12800 and 12800E V200R005C10 Configuration Guide - Security

This document describes the configurations of Security, including AAA, 802.1x Authentication, ACL, TCAM ACL Customization, local attack defense, Microsegmentation, MFF, attack defense, traffic suppression and storm control, ARP security, Port security, MACsec, DHCP snooping, IPSG, URPF, SSL, Keychain and FIPS.

About This Document
AAA Configuration
- Overview of AAA
- Understanding AAA
- Application Scenarios for AAA
- Licensing Requirements and Limitations for AAA
- Summary of AAA Configuration Tasks
- Configuring Local Authentication and Authorization
- Configuring RADIUS AAA
- Configuring HWTACACS AAA
- Clearing AAA Statistics
- Configuration Examples for AAA
  - Example for Configuring RADIUS Authentication and Accounting
  - Example for Configuring HWTACACS Authentication, Accounting, and Authorization
- Troubleshooting AAA
  - An AAA Local User Cannot Be Created Due to Incorrect Password Setting
802.1x Authentication Configuration
- Understanding 802.1x Authentication
- Application Scenarios for 802.1x Authentication
- Licensing Requirements and Limitations for 802.1x Authentication
- Default Settings for 802.1x Authentication
- Configuring 802.1x Authentication
- Maintaining 802.1x Authentication
  - Clearing Statistics on 802.1x Authentication Packets
  - Forcing Users Offline
- Configuration Examples for 802.1x Authentication
  - Example for Configuring 802.1x Authentication to Control Users' Internal Access
ACL Configuration
- Overview of ACLs
- Understanding ACLs
- Application Scenarios for ACLs
- Licensing Requirements and Limitations for ACLs
- Default Settings for ACLs
- Configuring a Basic ACL
- Configuring an Advanced ACL
- Configuring a Layer 2 ACL
- Configuring a User-defined ACL
- Configuring an ARP-based ACL
- Configuring a Basic ACL6
- Configuring an Advanced ACL6
- Maintaining an ACL
  - Clearing ACL Statistics
  - Checking ACL Resource Usages
- Configuration Examples for ACLs
- ACL FAQ
  - Which Packets Cannot Be Filtered by the ACL Used by a Traffic Policy?
TCAM ACL Customization Configuration
- Overview of TCAM ACL Customization
- Licensing Requirements and Limitations for TCAM ACL Customization
- Configuring TCAM ACL Customization
  - Enabling TCAM ACL Customization
  - Configuring the TCAM ACL Customization Function for Services
- Displaying Information about a TCAM ACL Customization Profile or Preset Profile
- Configuration Examples for TCAM ACL Customization
  - Example for Configuring TCAM ACL Customization
Microsegmentation Configuration
- Overview of Microsegmentation
- Understanding Microsegmentation
- Application Scenarios for Microsegmentation
- Licensing Requirements and Limitations for Microsegmentation
- Configuring Microsegmentation
- Maintaining Microsegmentation
  - Checking Microsegmentation Statistics
  - Clearing Microsegmentation Statistics
- Configuration Examples for Microsegmentation
  - Example for Configuring IP Address-based Microsegmentation
Local Attack Defense Configuration
- Overview of Local Attack Defense
- Licensing Requirements and Limitations for Local Attack Defense
- Default Settings for Local Attack Defense
- Configuring CPU Attack Defense
- Configuring Attack Source Tracing
- Maintaining Local Attack Defense
- Configuration Examples for Local Attack Defense
  - Example for Configuring Local Attack Defense
- Troubleshooting Local Attack Defense
MFF Configuration
- Overview of MFF
- Understanding MFF
- Application Scenarios for MFF
- Licensing Requirements and Limitations for MFF
- Configuring MFF
- Configuration Examples for MFF
  - Example for Configuring MFF to Implement Layer 2 Isolation and Layer 3 Connection
- Troubleshooting MFF
  - Users Fail to Access the Internet After MFF Is Configured
Attack Defense Configuration
- Overview of Attack Defense
- Understanding Attack Defense
- Application Scenarios for Attack Defense
- Licensing Requirements and Limitations for Attack Defense
- Default Settings for Attack Defense
- Configuring Defense Against Malformed Packet Attacks
- Configuring Defense Against Packet Fragment Attacks
- Configuring Defense Against Flood Attacks
- Clearing Attack Defense Statistics
- Configuration Examples for Attack Defense
  - Example for Configuring Attack Defense
Traffic Suppression and Storm Control Configuration
- Overview of Traffic Suppression and Storm Control
- Understanding Traffic Suppression and Storm Control
  - Traffic Suppression
  - Storm Control
- Application Scenarios for Traffic Suppression and Storm Control
  - Traffic Suppression
  - Storm Control
- Licensing Requirements and Limitations for Traffic Suppression and Storm Control
- Default Settings for Traffic Suppression and Storm Control
- Configuring Traffic Suppression
- Configuring Storm Control
- Configuration Examples for Traffic Suppression and Storm Control
  - Example for Configuring Traffic Suppression
  - Example for Configuring Storm Control
ARP Security Configuration
- Overview of ARP Security
- Understanding ARP Security
- Application Scenarios for ARP Security
  - Defense Against ARP Flood Attacks
  - Defense Against ARP Spoofing Attacks
- Licensing Requirements and Limitations for ARP Security
- Default Settings for ARP Security
- Configuring Defense Against ARP Flood Attacks
- Configuring Defense Against ARP Spoofing Attacks
- Maintaining ARP Security
- Configuration Examples for ARP Security
  - Example for Configuring ARP Security Functions
  - Example for Configuring Defense Against ARP MITM Attacks
Port Security Configuration
- Overview of Port Security
- Understanding Port Security
- Application Scenarios for Port Security
- Licensing Requirements and Limitations for Port Security
- Default Settings for Port Security
- Configuring Port Security
- Configuration Examples for Port Security
  - Example for Configuring Port Security
MACsec Configuration
- Overview of MACsec
- Understanding MACsec
- Application Scenarios for MACsec
- Default Configuration
- Licensing Requirements and Limitations for MACsec
- Configuring MACsec
- Maintaining MACsec
  - Displaying MACsec Statistics
  - Clearing MACsec Statistics
- Configuration Examples for MACsec
  - Example for Configuring Point-to-Point MACsec
DHCP Snooping Configuration
- Overview of DHCP Snooping
- Understanding DHCP Snooping
  - DHCP Snooping Fundamentals
  - Option 82 Supported by DHCP Snooping
- Application Scenarios for DHCP Snooping
- Licensing Requirements and Limitations for DHCP Snooping
- Default Settings for DHCP Snooping
- Configuring Basic Functions of DHCP Snooping
- Configuring DHCP Snooping Attack Defense
- Inserting the Option 82 Field in a DHCP Message
- Maintaining DHCP Snooping
- Configuration Examples for DHCP Snooping
  - Example for Configuring DHCP Snooping Attack Defense
- Troubleshooting DHCP Snooping
  - DHCP Clients Cannot Go Online Due to DHCP Snooping
IPSG Configuration
- Overview of IPSG
- Licensing Requirements and Limitations for IPSG
- Default Settings for IPSG
- Configuring IPSG
- Maintaining IPSG
  - Checking Statistics on Discarded IP Packets
  - Clearing Statistics on Discarded IP Packets
- Configuration Examples for IPSG
  - Example for Configuring IPSG to Check Interface + IP + MAC Binding Entries
URPF Configuration
- Overview of URPF
- Understanding URPF
- Application Scenarios for URPF
- Licensing Requirements and Limitations for URPF
- Default Settings for URPF
- Configuring URPF
- Configuration Examples for URPF
  - Example for Configuring URPF (CE12800)
  - Example for Configuring URPF (CE12800E)
SSL Configuration
- Overview of SSL
- Understanding SSL
- Application Scenarios for SSL
  - Application of SSL in Information Center
- Licensing Requirements and Limitations for SSL
- Configuring SSL
  - Configuring an SSL Policy
  - Applying an SSL Policy
- Configuration Examples for SSL
  - Example for Outputting SSL-Encrypted Logs to a Log Host
Keychain Configuration
- Overview of Keychains
- Understanding Keychains
- Application Scenarios for Keychains
- Licensing Requirements and Limitations for Keychain
- Configuring a Keychain
- Configuration Examples for Keychains
  - Example for Applying the Keychain to RIP
  - Example for Applying the Keychain to BGP
FIPS Configuration
- Overview of FIPS
- Configuring the FIPS Mode
Separating the Management Port from the Service Plane
Checking Security Risks
Setting the System Master Key

Rate and give feedback:

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

Configuring an HWTACACS Server Template

Context

In an HWTACACS server template, you must specify the IP address, port number, and shared key of a specified HWTACACS server. Other settings, such as the HWTACACS user name format and traffic unit, have default values and can be changed based on network requirements.

The HWTACACS server template settings such as the HWTACACS user name format and shared key must be the same as those on the HWTACACS server.

The device supports the following methods of configuring HWTACACS servers:

If one server provides authentication, authorization, and accounting, configure only one HWTACACS server.
If different servers provide authentication, authorization, and accounting, configure the HWTACACS authentication, authorization, and accounting servers separately.

Procedure

Run system-view
The system view is displayed.
Run hwtacacs enable
The HWTACACS function is enabled.

By default, the HWTACACS function is disabled.
Run hwtacacs server template template-name
An HWTACACS server template is created and the HWTACACS server template view is displayed.
Run hwtacacs server shared-key { cipher cipher-string | key-string }
The HWTACACS shared key is configured.

By default, no HWTACACS shared key is configured.
You can use either of the following methods to configure the primary and secondary HWTACACS servers.

The priority of an HWTACACS common server is higher than that of an HWTACACS authentication, accounting, or authorization server. If you configure a common server as the primary server, configurations of other servers (authentication, accounting, and authorization servers) cannot take effect.
- Configure HWTACACS common servers.
  In a single HWTACACS server template, only one primary HWTACACS common server and a maximum of 29 secondary HWTACACS common servers can be configured.
  - Run any of the following commands to configure the primary HWTACACS common server.
    - hwtacacs server ip-address [ port ] [ { vpn-instance vpn-instance-name | public-net } | shared-key { key-string | cipher cipher-string } | mux-mode ]^*
    - hwtacacs server ipv6-address [ port ] [ shared-key { key-string | cipher cipher-string } | mux-mode | vpn-instance vpn-instance-name ]^*
    - hwtacacs server host host-name [ port ] [ shared-key { key-string | cipher cipher-string } | mux-mode | { vpn-instance vpn-instance-name | public-net } ]^*
    By default, no primary HWTACACS common server is configured.
  - (Optional) Run any of the following commands to configure the secondary HWTACACS common server.
    - hwtacacs server ip-address [ port ] [ { vpn-instance vpn-instance-name | public-net } | shared-key { key-string | cipher cipher-string } | mux-mode ]^* secondary
    - hwtacacs server ipv6-address [ port ] [ shared-key { key-string | cipher cipher-string } | mux-mode | vpn-instance vpn-instance-name ]^* secondary
    - hwtacacs server host host-name [ port ] [ shared-key { key-string | cipher cipher-string } | mux-mode | { vpn-instance vpn-instance-name | public-net } ]^* secondary
    By default, no secondary HWTACACS common server is configured.
- Configure HWTACACS authentication, authorization, and accounting servers.
  In a single HWTACACS server template, only one primary server can be configured for each of the three types (authentication, authorization, and accounting) of servers, and a maximum of 29 servers can be configured for the three types of servers in total.
  1. Run any of the following commands to configure the primary HWTACACS authentication server.
    - hwtacacs server authentication ip-address [ port ] [ { vpn-instance vpn-instance-name | public-net } | shared-key { key-string | cipher cipher-string } | mux-mode ]^*
    - hwtacacs server authentication ipv6-address [ port ] [ shared-key { key-string | cipher cipher-string } | mux-mode | vpn-instance vpn-instance-name ] ^*
    - hwtacacs server authentication host host-name [ port ] [ shared-key { key-string | cipher cipher-string } | mux-mode | { vpn-instance vpn-instance-name | public-net } ] ^*
    By default, no primary HWTACACS authentication server is configured.
  2. (Optional) Run any of the following commands to configure the secondary HWTACACS authentication server.
    - hwtacacs server authentication ip-address [ port ] [ { vpn-instance vpn-instance-name | public-net } | shared-key { key-string | cipher cipher-string } | mux-mode ]^* secondary
    - hwtacacs server authentication ipv6-address [ port ] [ shared-key { key-string | cipher cipher-string } | mux-mode | vpn-instance vpn-instance-name ] ^* secondary
    - hwtacacs server authentication host host-name [ port ] [ shared-key { key-string | cipher cipher-string } | mux-mode | { vpn-instance vpn-instance-name | public-net } ] ^* secondary
    By default, no secondary HWTACACS authentication server is configured.
  3. Run any of the following commands to configure the primary HWTACACS authorization server.
    - hwtacacs server authorization ip-address [ port ] [ { vpn-instance vpn-instance-name | public-net } | shared-key { key-string | cipher cipher-string } | mux-mode ]^*
    - hwtacacs server authorization ipv6-address [ port ] [ shared-key { key-string | cipher cipher-string } | mux-mode | vpn-instance vpn-instance-name ] ^*
    - hwtacacs server authorization host host-name [ port ] [ shared-key { key-string | cipher cipher-string } | mux-mode | { vpn-instance vpn-instance-name | public-net } ] ^*
    By default, no primary HWTACACS authorization server is configured.
  4. (Optional) Run any of the following commands to configure the secondary HWTACACS authorization server.
    - hwtacacs server authorization ip-address [ port ] [ { vpn-instance vpn-instance-name | public-net } | shared-key { key-string | cipher cipher-string } | mux-mode ]^* secondary
    - hwtacacs server authorization ipv6-address [ port ] [ shared-key { key-string | cipher cipher-string } | mux-mode | vpn-instance vpn-instance-name ] ^* secondary
    - hwtacacs server authorization host host-name [ port ] [ shared-key { key-string | cipher cipher-string } | mux-mode | { vpn-instance vpn-instance-name | public-net } ] ^* secondary
    By default, no secondary HWTACACS authorization server is configured.
  5. Run any of the following commands to configure the primary HWTACACS accounting server.
    - hwtacacs server accounting ip-address [ port ] [ { vpn-instance vpn-instance-name | public-net } | shared-key { key-string | cipher cipher-string } | mux-mode ] ^*
    - hwtacacs server accounting ipv6-address [ port ] [ shared-key { key-string | cipher cipher-string } | mux-mode | vpn-instance vpn-instance-name ] ^*
    - hwtacacs server accounting host host-name [ port ] [ shared-key { key-string | cipher cipher-string } | mux-mode | { vpn-instance vpn-instance-name | public-net } ] ^*
    By default, no primary HWTACACS accounting server is configured.
  6. (Optional) Run any of the following commands to configure the secondary HWTACACS accounting server.
    - hwtacacs server accounting ip-address [ port ] [ { vpn-instance vpn-instance-name | public-net } | shared-key { key-string | cipher cipher-string } | mux-mode ] ^* secondary
    - hwtacacs server accounting ipv6-address [ port ] [ shared-key { key-string | cipher cipher-string } | mux-mode | vpn-instance vpn-instance-name ] ^* secondary
    - hwtacacs server accounting host host-name [ port ] [ shared-key { key-string | cipher cipher-string } | mux-mode | { vpn-instance vpn-instance-name | public-net } ] ^* secondary
    By default, no secondary HWTACACS accounting server is configured.
(Optional) Run hwtacacs server user-name domain-excluded
The device is configured not to encapsulate the domain name in the user name when sending HWTACACS packets to an HWTACACS server.

By default, the device encapsulates the domain name in the user name when sending HWTACACS packets to an HWTACACS server.
(Optional) Run hwtacacs server source-ip ip-address
The source IP address in HWTACACS packets is set.

By default, the source IP address in HWTACACS packets is not set. The device uses the IP address of the actual outbound interface as the source IP address in HWTACACS packets.

After you specify the source IP address in HWTACACS packets on the device, the device uses this IP address to communicate with the HWTACACS server. The HWTACACS server also uses the specified IP address to communicate with the device.
(Optional) Run hwtacacs server timer response-timeout interval
The response timeout interval for the HWTACACS server is set.

The default response timeout interval for an HWTACACS server is 5 seconds.

If the device does not receive a response packet from the HWTACACS server within the timeout interval, it considers that the HWTACACS server is unreachable and then tries other authentication and authorization methods.
(Optional) Run hwtacacs server timer quiet interval
The interval for the primary HWTACACS server to restore to the active state is set.

The default interval for the primary HWTACACS server to restore to the active state is 5 minutes.
Run commit
The configuration is committed.
Run return
The user view is displayed.
(Optional) Run hwtacacs-user change-password hwtacacs server template-name
The password saved on the HWTACACS server is changed.

To ensure device security, you are advised to frequently change the password.

Translation

简体中文

Download

Updated: 2021-09-17

Document ID: EDOC1100075347

Downloads: 100

Average rating:

This Document Applies to these Products

Related Version

Digital Signature File

Digital Signature Authentication Mode

Enterprise

Huawei Cloud

Carrier

Consumer

Corporate

Context

Procedure

Related Version

Related Documents

Digital Signature File