Page 3 - iii; Contents
iii Contents Software Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Software Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Download Switch Docume...
Page 4 - iv
iv Connection-Rate Filtering Based On Virus-Throttling Technology . . . . . . . . . . . . . . . . . . . . . . . 19 Identity-Driven Management (IDM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Clarifications and Updates . . . . . . . . . . . . ...
Page 7 - vii
vii Release M.10.65 Enhancements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 MSTP VLAN Configuration Enhancement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Release M...
Page 8 - viii
viii Release M.08.76 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 Release M.08.77 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ....
Page 9 - ix
ix Release M.10.10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161 Release M.10.11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ....
Page 11 - Software Updates; Software Updates; View or Download the Software Manual Set
1 Software Management Software Updates Software Management Software Updates Check the ProCurve Networking Web site frequently for free software updates for the various ProCurve switches you may have in your network. Download Switch Documentation and Software from the Web You can download software up...
Page 12 - N o t e; Downloading Software to the Switch; copy xmodem; N o t e; Management and
2 Software Management Downloading Software to the Switch N o t e Downloading new software does not change the current switch configuration. The switch configu-ration is contained in a separate file that can also be transferred, for example, for archive purposes or to be used in another switch of the...
Page 13 - TFTP Download from a Server; Figure 1; Logon Default; Xmodem Download From a PC or Unix Workstation
3 Software Management Downloading Software to the Switch TFTP Download from a Server Syntax: copy tftp flash < ip-address > < remote-os-file > [ < primary | secondary > ] Note that if you do not specify the flash destination, the TFTP download defaults to the primary flash. For exa...
Page 14 - Transfer; Send
4 Software Management Downloading Software to the Switch ■ The terminal emulator you are using includes the Xmodem binary transfer feature. (For example, in the HyperTerminal application included with Windows NT, you would use the Send File option in the Transfer dropdown menu.) Using Xmodem and a t...
Page 15 - Saving Configurations While Using the CLI; The switch operates with two configuration files:; write memory; When exiting from the CLI to the Main Menu, press
5 Software Management Saving Configurations While Using the CLI Saving Configurations While Using the CLI The switch operates with two configuration files: ■ Running-Config File: Exists in volatile memory and controls switch operation. Rebooting the switch erases the current running-config file and ...
Page 16 - Install Recommendations for I.08.12 Boot ROM Update; Rebooting the System
6 Software Management Install Recommendations for I.08.12 Boot ROM Update Install Recommendations for I.08.12 Boot ROM Update When installing the M.10.17 software to load the I.08.12 ROM version, ProCurve recommends that you use the “fastboot” feature and the “reload” command after updating to M.10....
Page 17 - ProCurve Switch, Routing Switch, and Router Software Keys; ProCurve Access Point 530
7 Software Management ProCurve Switch, Routing Switch, and Router Software Keys ProCurve Switch, Routing Switch, and Router Software Keys Software Letter ProCurve Networking Products C 1600M, 2400M, 2424M, 4000M, and 8000M CY Switch 8100fl Series (8108fl and 8116fl) E Switch 5300xl Series (5304xl, 5...
Page 18 - Software
8 Software Management ProCurve Switch, Routing Switch, and Router Software Keys numeric Switch 9408sl, Switch 9300 Series (9304M, 9308M, and 9315M), Switch 6208M-SX and Switch 6308M-SX (Uses software version number only; no alphabetic prefix. For example 07.6.04.) Software Letter ProCurve Networking...
Page 19 - Minimum Software Versions for Series 3400cl Switch Features; For Software Features.; minimum software version each feature requires:; Minimum Software Version Required by Feature; ProCurve Device; J8435A ProCurve 10-GbE Media Flex Module; Operating System
9 Software Management Minimum Software Versions for Series 3400cl Switch Features Minimum Software Versions for Series 3400cl Switch Features For Software Features. To view a tabular listing of major switch software features and the minimum software version each feature requires: 1. Visit the ProCur...
Page 20 - Switch Management Access Security; Switch Management Access Security; Default Settings Affecting Security; Telnet
10 Enforcing Switch Security Switch Management Access Security Enforcing Switch Security ProCurve switches are designed as “plug and play” devices, allowing quick and easy installation in your network. However, when preparing the switch for network operation, ProCurve strongly recommends that you en...
Page 21 - Local Manager Password; password manager; Inbound Telnet Access and Web Browser Access; Advanced Traffic; Secure File Transfers; Management and Configuration Guide
11 Enforcing Switch Security Switch Management Access Security It is important to evaluate the level of management access vulnerability existing in your network and take steps to ensure that all reasonable security precautions are in place. This includes both configurable security options and physic...
Page 22 - SNMP Access; General SNMP Access to the Switch.; configuring for access authentication and privacy; SNMP Access to the Switch’s Authentication Configuration MIB .; A management station; snmp-server mib hpswitchauthmib excluded
12 Enforcing Switch Security Switch Management Access Security SNMP Access (Simple Network Management Protocol) In the default configuration, the switch is open to access by management stations running SNMP management applications capable of viewing and changing the settings and status data in the s...
Page 23 - Disable SNMP version 2c on the switch.; Physical Access to the Switch; Physical access to the switch allows the following:
13 Enforcing Switch Security Switch Management Access Security C a u t i o n : Downloading and booting from the M.08.89 or greater software version for the first time enables SNMP access to the authentication configuration MIB (the default action). If SNMPv3 and other security safeguards are not in ...
Page 24 - Other Provisions for Management Access Security; Authorized IP Managers.; Access Security Guide; Secure Management VLAN.; Advanced Traffic Management Guide; RADIUS Authentication.; Access Security Guide; Access Control Lists (ACLs) for Management Access Protection.
14 Enforcing Switch Security Switch Management Access Security For the commands to implement the above actions, refer to “Front-Panel Security” in the chapter titled “Configuring Usernames and Passwords” in the Access Security Guide for your switch. Other Provisions for Management Access Security Au...
Page 25 - Network Access Security; Web and MAC Authentication
15 Enforcing Switch Security Network Access Security Network Access Security This section outlines provisions for protecting access through the switch to the network. For more detailed information on these features, refer to the indicated manuals. Access Control Lists (ACLs) ACLs enable the switch t...
Page 26 - switch SSH and user password authentication:; Traffic/Security Filters
16 Enforcing Switch Security Network Access Security Secure Shell (SSH) SSH provides Telnet-like functions through encrypted, authenticated transactions of the following types: ■ client public-key authentication: uses one or more public keys (from clients) that must be stored on the switch. Only a c...
Page 27 - Inbound traffic from a designated, physical source-port will be
17 Enforcing Switch Security Network Access Security ■ source-port filters: Inbound traffic from a designated, physical source-port will be forwarded or dropped on a per-port (destination) basis. ■ multicast filters: Inbound traffic having a specified multicast MAC address will be forwarded to outbo...
Page 28 - Access; switch operation as a supplicant
18 Enforcing Switch Security Network Access Security Refer to the chapter titled “Configuring Port-Based and Client-Based Access Control” in the Access Security Guide for your switch model. Port Security, MAC Lockdown, MAC Lockout, and IP Lockdown These features provide device-based access security ...
Page 29 - Connection-Rate Filtering Based On Virus-Throttling Technology; Products and Solutions
19 Enforcing Switch Security Network Access Security keys.) KMS provides specific instances of routing protocols with one or more Send or Accept keys that must be active at the time of a request. Refer to the chapter titled “Key Management System” in the Access Security Guide for your switch model. ...
Page 30 - Operating Notes for Jumbo Traffic-Handling; Operating Notes for Jumbo Traffic-Handling; Table 1 lists updates to the manual set dated January, 2005.; Table 1. Publication Updates for Manual Set Dated January, 2005; Edition; The; show lldp info stats; is an invalid command.; show lldp stats
20 Clarifications and Updates Operating Notes for Jumbo Traffic-Handling Clarifications and Updates Operating Notes for Jumbo Traffic-Handling In the Management and Configuration Guide, (Oct., 2005 version) on page 14-33 ( page 347 of the .pdf file) where it states: When a port is not a member of an...
Page 31 - IGMP Command Update; Using Delayed Group Flush.; Syntax
21 Clarifications and Updates IGMP Command Update IGMP Command Update The following information updates and clarifies information in Chapter 4, “Multimedia Traffic Control with IP Multicast (IGMP)” in the Advanced Traffic Management Guide —part number 5990-6051, September 2004 edition. Please refer ...
Page 32 - setmib; IGMP Operating Notes.; General Switch Traffic Security Guideline
22 Clarifications and Updates General Switch Traffic Security Guideline Setting Fast-Leave and Forced Fast-Leave from the CLI. In earlier switch models, including the 5300xl switches, fast-leave and forced fast-leave options for a port were configured with a lengthy setmib command. The following com...
Page 33 - Port security; The Management VLAN IP Address
23 Clarifications and Updates The Management VLAN IP Address 4. Port security 5. Authorized IP Managers 6. Application features at higher levels in the OSI model, such as SSH. (The above list does not address the mutually exclusive relationship that exists among some security features.) The Manageme...
Page 34 - Known Issues; This switch needs replacement during next scheduled downtime ?
24 Known Issues Rate-Limiting Known Issues Release M.10.17 The following is a known issue related to installation of Release M.10.17 software, which includes a required update to ROM version I.08.12. When there is an active 10-GbE link in port 26 of the ProCurve 3400cl-24G switch, or port 50 of the ...
Page 35 - Enhancements; “Release
25 Enhancements Release M.08.69 Enhancements Enhancements Enhancments are listed in chronological order, oldest to newest software release. To review the list of enhancements included since the last general release that was published, begin with “Release M.10.21 Enhancements” on page 95 . Release M....
Page 36 - Using Fastboot To Reduce Boot Time; in a faster boot time.; CLI Port Rate Display; show interface port-utilization; to display; fastboot; show fastboot
26 Enhancements Release M.08.78 Enhancements Release M.08.78 Enhancements Using Fastboot To Reduce Boot Time The fastboot command allows a boot sequence that skips the internal power-on self-tests, resulting in a faster boot time. For example: Release M.08.79 Enhancements CLI Port Rate Display Begin...
Page 37 - Figure 2. Example rate display output for ports; Operating Notes; As in previous software versions, the; show interfaces; Software fixes only no new enhancements.
27 Enhancements Release M.08.80 through M.08.83 Enhancements The following shows a sample output from this new command. Figure 2. Example rate display output for ports Operating Notes ■ For each port on the switch, the command provides a real-time display of the rate at which data is received (Rx) a...
Page 38 - DNS Resolver; ping; Terminology; Domain Suffix —
28 Enhancements Release M.08.84 Enhancements Release M.08.84 Enhancements Release M.08.84 includes the following enhancement: Added the show tech transceivers command to allow removable transceiver serial numbers to be read without removal of the transceivers from the switch. : Release M.08.85 throu...
Page 39 - Basic Operation; must
29 Enhancements Release M.08.89 Enhancements IP address of 10.10.100.27 is assigned a host name of accounts015 and another IP address of 10.10.100.33 is assigned a host name of sales021 , then the switch configured with the domain suffix evergreen.trees.org and a DNS server that resolves addresses i...
Page 41 - Configuring a DNS Entry; Figure 5
31 Enhancements Release M.08.89 Enhancements Configuring a DNS Entry The switch allows one DNS server entry, which includes the DNS server IP address and the chosen domain name suffix. Configuring the entry enables the use of ping and traceroute with a target’s host name instead of the target’s IP a...
Page 42 - DNS Server IP Address; DNS Server; Switch IP Address
32 Enhancements Release M.08.89 Enhancements Figure 5. Example Network Domain Configuring switch “A” with the domain name and the IP address of a DNS server for the domain enables the switch to use host names assigned to IP addresses in the domain to perform ping and traceroute actions on the device...
Page 43 - As mentioned under; and; traceroute; . For example, using the document server in; Viewing the Current DNS Configuration; show ip; ProCurve# ping docservr
33 Enhancements Release M.08.89 Enhancements Figure 7. Example of Ping and Traceroute Execution for the Network in Figure 5 on Page 32 As mentioned under “Basic Operation” on page 29 , if the DNS entry configured in the switch includes only the DNS server’s IP address, you must use the target host’s...
Page 44 - Figure 9. Example of Viewing the Current DNS Configuration; or; requests is also limited.; command output shows only IP addresses.
34 Enhancements Release M.08.89 Enhancements Figure 9. Example of Viewing the Current DNS Configuration Operating Notes ■ The DNS server must be accessible to the switch, but it is not necessary for any intermediate devices between the switch and the DNS server to be configured to support DNS operat...
Page 45 - Event Log Messages; Using SNMP To View and Configure Switch Authentication Features; including; Message; DNS server address not configured
35 Enhancements Release M.08.89 Enhancements Event Log Messages Using SNMP To View and Configure Switch Authentication Features In earlier software releases, SNMP MIB object access has not been available for switch authentication configuration (hpSwitchAuth) features. Beginning with software release...
Page 46 - S e c u r i t y N o t e s; “Enforcing Switch Security” on page 10; command to disable this access, as; Changing and Viewing the SNMP Access Configuration; included
36 Enhancements Release M.08.89 Enhancements S e c u r i t y N o t e s Passwords and keys configured in the hpSwitchAuth MIB are not returned via SNMP, and the response to SNMP queries for such information is a null string. However, SNMP sets can be used to configure password and key MIB objects. To...
Page 47 - show
37 Enhancements Release M.08.89 Enhancements For example, to disable SNMP access to the switch’s authentication MIB and then display the result in the Excluded MIB field, you would execute the following two commands. Figure 10. Disabling SNMP Access to the Authentication MIB and Displaying the Resul...
Page 48 - MSTP Default Path Cost Controls; Running configuration:
38 Enhancements Releases M.08.90 and M.08.91 Enhancements Figure 11. Using the show run Command to View the Current Authentication MIB Access State Releases M.08.90 and M.08.91 Enhancements ■ The MSTP enhancement implementing the CLI command for spanning-tree legacy-path-cost was included in release...
Page 49 - QoS Pass-Through Mode; Table 2; All queues are the same size.; optimized; Most traffic is not prioritized.
39 Enhancements Releases M.08.90 and M.08.91 Enhancements The “legacy-path-cost” CLI command does not affect or replace functionality of the “spanning-tree force-version” command. The “spanning-tree force-version” controls whether MSTP will send and process 802.1w RSTP, or 802.1D STP BPDUs. Regardle...
Page 50 - Configuring QoS Pass-Through Mode Through the CLI.; The following example changes the; Qos passthrough mode : balanced
40 Enhancements Releases M.08.90 and M.08.91 Enhancements N o t e Changing the QoS Pass-Through Mode can be done without rebooting the switch. However, the switch ports are toggled down and back up, allowing the QoS queues to be reconfigured. This may affect routing and spanning tree operation. ProC...
Page 51 - The following example changes the QoS Pass-Through Mode to; command verifies; Displaying the Current QoS Pass-Through Mode on the Switch; typical
41 Enhancements Releases M.08.90 and M.08.91 Enhancements QoS Pass-Through Mode SNMP MIB Object. A read-write MIB object, 1.3.6.1.4.1.11.2.14.11.5.1.7.1.24.1, has been added to the ProCurve switch MIB. The QoS Pass-Through Mode can be changed using either an SNMP network management application or th...
Page 52 - balanced; mode matches the QoS Pass-through mode on the ProCurve Series 2800
42 Enhancements Release M.08.94 Enhancements The current QoS Pass-Through Mode also is displayed in the show running-config command output. Operating Notes ■ To use the same QoS queue structure used in pre-M.08.78 software, set the QoS Pass-Through Mode to balanced . ■ The optimized mode matches the...
Page 53 - Example; Table 3; mac
43 Enhancements Release M.08.94 Enhancements Example In the routing switch shown below, option 82 has been configured with mgmt-vlan for the Remote ID. ProCurve(config)# dhcp-relay option 82 append mgmt-vlan The resulting effect on DHCP operation for clients X, Y, and Z is shown in Table 3 . Figure ...
Page 54 - Table 3. DHCP Operation for the Topology in Figure; If the Management VLAN IP address configuration changes after; UDP Broadcast Forwarding; A only
44 Enhancements Release M.08.94 Enhancements Table 3. DHCP Operation for the Topology in Figure 12 Operating Notes ■ Routing is not allowed between the Management VLAN and other VLANs. Thus, a DHCP server must be available in the Management VLAN if there are clients in the Management VLAN that requi...
Page 56 - Table 4
46 Enhancements Release M.10.02 Enhancements ■ An ACL must be configured on the RADIUS server (instead of the switch) by creating and assigning one or more Access Control Entries to the username/password pair or MAC address of the client for which you want ACL support. ■ Where 802.1X is used for cli...
Page 57 - Table 4. Contrasting Dynamic and Static ACLs
47 Enhancements Release M.10.02 Enhancements Table 4. Contrasting Dynamic and Static ACLs RADIUS-Based (Dynamic) ACLs Port-Based (Static) ACLs Operates on the 3400cl switches. Operates on both the 3400cl and 6400cl switches. Configured in client accounts on a RADIUS server. Configured in the switch ...
Page 58 - permit; Destination IP Address; deny in ip from any to any
48 Enhancements Release M.10.02 Enhancements Terminology ACE: See Access Control Entry, below. Access Control Entry (ACE): An ACE is a policy consisting of a packet-handling action and criteria to define the packets on which to apply the action. For RADIUS-based ACLs, the elements composing the ACE ...
Page 59 - permit in ip from any to any; from the authenticated source; ACL Mask; Caution Regarding the Use of Source Routing; route; General Operation; How a RADIUS Server Applies a RADIUS-Based ACL to a Switch Port.
49 Enhancements Release M.10.02 Enhancements packet (from the authenticated client) that is not explicitly permitted or denied by other ACEs configured sequentially earlier in the ACL. Unless otherwise noted, “implicit deny IP any” refers to the “deny” action enforced by both standard and extended A...
Page 60 - (“deny any any”) ACE that denies IP traffic not specifically; N o t e s; On any ACL assigned to a port, there is an implicit; The Packet-filtering Process; Sequential Comparison and Action.; When an ACL filters a packet from an authenticated client,
50 Enhancements Release M.10.02 Enhancements the client MAC address is the selection criteria, only the client having that MAC address can use the corresponding ACL. When a RADIUS server authenticates a client, it also assigns the ACL configured with that client’s credentials to the port. The ACL th...
Page 61 - Figure 3. Example of Sequential Comparison; Because of this; Compares the packet to this ACE first.; Deny in tcp from any to any 23
51 Enhancements Release M.10.02 Enhancements Example. Suppose the ACL in Figure 3 is assigned to filter the traffic from an authenticated client on a given port in the switch: Figure 3. Example of Sequential Comparison As shown above, the ACL tries to apply the first ACE in the list. If there is not...
Page 62 - Figure 4. The Packet-Filtering Process in an ACL with
52 Enhancements Release M.10.02 Enhancements Figure 4. The Packet-Filtering Process in an ACL with N Entries (ACEs) N o t e The order in which an ACE occurs in an ACL is significant. For example, if an ACL contains six ACEs, but the first ACE is a “permit IP any”, then the ACL permits all IP traffic...
Page 63 - Figure 5. Example of How a RADIUS-Based ACL Filters Packets; RADIUS-based ACLs include an implicit “deny IP; (“permit any any”) as the last explicit; implicit deny in ip any to any
53 Enhancements Release M.10.02 Enhancements For example, suppose you want to configure a RADIUS-based ACL to invoke these policies in the 11.11.11.0 network: 1. Permit inbound client traffic with a DA of 11.11.11.42. 2. Permit inbound Telnet traffic for DA 11.11.11.101. 3. Deny inbound Telnet traff...
Page 64 - General Steps; Plan ACLs to execute traffic policies:; Determining Traffic Policies; permit in ip from; What traffic can be blocked simply by relying on the implicit; that is
54 Enhancements Release M.10.02 Enhancements General Steps These steps suggest a process for using ACLs to establish client access policies. The topics following this section provide details. 1. Determine the polices you want to enforce for client traffic inbound on the switch. 2. Plan ACLs to execu...
Page 65 - cnt; (counter) feature in ACEs where you want to know this; C a u t i o n; Planning the ACLs Needed To Enforce Traffic Policies; Guidelines for Structuring a RADIUS-Based ACL.; RADIUS-based ACLs filter only the inbound IP traffic from an
55 Enhancements Release M.10.02 Enhancements ■ Is it important to keep track of the number of matches for a particular client or ACE? If so, you can use the optional cnt (counter) feature in ACEs where you want to know this information. This is especially useful if you want to verify that the switch...
Page 66 - Explicitly Denying Any IP Traffic:; Operating Rules for RADIUS-Based ACLs; Port Trunks Excluded:; “Configuring an ACL in a RADIUS Server” on page 58; Multiple Clients Using the Same Username/Password Pair:
56 Enhancements Release M.10.02 Enhancements ■ Explicitly Denying Any IP Traffic: Entering a deny in ip from any to any ACE in an ACL denies all IP traffic not previously permitted or denied by that ACL. Any ACEs listed after that point have no effect. ■ Implicitly Denying Any IP Traffic: For any pa...
Page 67 - Table 5. Limits Affecting RADIUS-Based ACL Applications; Item; Limit Notes; Up to
57 Enhancements Release M.10.02 Enhancements Limits for RADIUS-Based ACLs, Associated ACEs, and Counters Table 5 describes limits the switch supports in ACLs applied by a RADIUS server. Exceeding a limit causes the related client authentication to fail. Table 5. Limits Affecting RADIUS-Based ACL App...
Page 68 - Configuring an ACL in a RADIUS Server; Elements in a RADIUS-Based ACL Configuration.
58 Enhancements Release M.10.02 Enhancements Configuring an ACL in a RADIUS Server This section provides general guidelines for configuring a RADIUS server to specify RADIUS-based ACLs. Also included is an example configuration for a FreeRADIUS server application. However, to configure support for t...
Page 69 - “Guidelines for; users; “Format Details for ACEs Configured in a
59 Enhancements Release M.10.02 Enhancements Figure 6. Example of Configuring the VSA for RADIUS-Based ACLs in a FreeRADIUS Server 2. Enter the switch IP address, NAS (Network Attached Server) type, and the key in the FreeRA-DIUS clients.conf file. For example, if the switch IP address is 10.10.10.1...
Page 70 - Format Details for ACEs Configured in a RADIUS-Based ACL.; Has one of the following destination types:
60 Enhancements Release M.10.02 Enhancements Figure 8. Example of Configuring the FreeRADIUS Server To Support ACLs for the Indicated Clients Format Details for ACEs Configured in a RADIUS-Based ACL. Any instance of a RADIUS-Based ACL is structured to filter authenticated client traffic as follows: ...
Page 71 - mask; tcp
61 Enhancements Release M.10.02 Enhancements The following syntax and operating information refers to ACLs configured in a RADIUS server. ACE Syntax: < permit | deny > in < ip | ip-protocol-value > from any to < ip-addr > [/< mask > ] | any > [ tcp/udp-ports ] [cnt ] < ...
Page 72 - Configuring the Switch To Support RADIUS-Based ACLs; the chapter titled “RADIUS Authentication and; networking accounting is configured on the switch.
62 Enhancements Release M.10.02 Enhancements Configuring the Switch To Support RADIUS-Based ACLs An ACL configured in a RADIUS server is identified by the authentication credentials of the client or group of clients the ACL is designed to support. When a client authenticates with credentials associa...
Page 73 - MAC Authentication Option; Web Authentication Option
63 Enhancements Release M.10.02 Enhancements 3. Configure an authentication method. Options include 802.1X, Web authentication, and MAC authentication. (You can configure 802.1X and either Web or MAC authentication to operate simultaneously on the same ports.) 802.1X Option : Syntax: aaa port-access...
Page 74 - Displaying the Current RADIUS-Based ACL Activity on the Switch; (counter) is included in an ACE, then the output includes the current; Packet Hit Counter : 0
64 Enhancements Release M.10.02 Enhancements Displaying the Current RADIUS-Based ACL Activity on the Switch These commands output data indicating the current ACL activity imposed per-port by RADIUS server responses to client authentication. For example, the following output shows that a RADIUS serve...
Page 75 - Open; = active connection with an external device; Closed; = no active connection with an external device
65 Enhancements Release M.10.02 Enhancements Syntax: show port-access authenticator < port-list > For ports,in < port-list > that are configured for authentication, this command indicates whether there are any RADIUS-assigned features active on the port(s). (Any ports in < port-list &...
Page 76 - Port Access Authenticator Status
66 Enhancements Release M.10.02 Enhancements Figure 10. Example of Output Showing Current RADIUS-Applied Features Event Log Messages Message Meaning ACE parsing error, permit/deny keyword < ace-# > client < mac-address > port < port-# > . Notifies of a problem with the permit / den...
Page 77 - Appears in response to the CLI; show access-list radius; command when there is not currently a RADIUS
67 Enhancements Release M.10.02 Enhancements Causes of Client Deauthentication Immediately After Authenticating ■ ACE formatted incorrectly in the RADIUS server • “from”, “any”, or “to” keyword missing • An IP protocol number in the ACE exceeds 255. • An optional UDP or TCP port number is invalid. ■...
Page 78 - SFlow Show Commands; sFlow —; Viewing SFlow Configuration; show sflow agent
68 Enhancements Release M.10.02 Enhancements • An ACE in the ACL for a given authenticated client exceeds 80 characters. • An ACL assigned to an authenticated client causes the number of optional counters needed on the ACL to exceed the per-ACL maximum (32). SFlow Show Commands In earlier software r...
Page 79 - Figure 13. Viewing sFlow Agent Information; show sflow destination; Note the following details:; Destination Address; remains blank unless it has been configured on the switch via SNMP.; Datagrams Sent; ment station since the switch agent was last enabled.; Timeout; show sflow sampling-polling
69 Enhancements Release M.10.02 Enhancements Figure 13. Viewing sFlow Agent Information The show sflow destination command includes information about the management-station’s destina- tion address, receiver port, and owner. Figure 14. Example of Viewing sFlow Destination Information Note the followi...
Page 80 - show sflow all; sFlow status information for all the ports on the switch.; Instrumentation Monitor; Parameter Name
70 Enhancements Release M.10.04 Enhancements Figure 15. Example of Viewing sFlow Sampling and Polling Information The show sflow all command combines the outputs of the preceding three show commands including sFlow status information for all the ports on the switch. Release M.10.04 Enhancements Rele...
Page 81 - “Configuring Instrumentation Monitor” on page 73
71 Enhancements Release M.10.04 Enhancements Operating Notes ■ To generate alerts for monitored events, you must enable the instrumentation monitoring log and/or SNMP trap. The threshold for each monitored parameter is configurable and can be adjusted to minimize false alarms (see “Configuring Instr...
Page 82 - K n o w n L i m i t a t i o n s
72 Enhancements Release M.10.04 Enhancements ■ Alerts are automatically rate limited to prevent filling the log file with redundant information. The following is an example of alerts that occur when the device is continually subject to the same attack (too many MAC addresses in this instance): Figur...
Page 83 - Configuring Instrumentation Monitor; instrumentation monitor; you wish to modify, and revise the threshold limits as needed.; enabled
73 Enhancements Release M.10.04 Enhancements Configuring Instrumentation Monitor The following commands and parameters are used to configure the operational thresholds that are monitored on the switch. By default, the instrumentation monitor is disabled. To enable instrumentation monitor using the d...
Page 84 - Examples; show instrumentation monitor configuration
74 Enhancements Release M.10.04 Enhancements Examples To turn on monitoring and event log messaging with the default medium values: ProCurve(config)# instrumentation monitor To turn off monitoring of the system delay parameter: ProCurve(config)# no instrumentation monitor system-delay To adjust the ...
Page 85 - Figure 18. Viewing the Instrumentation Monitor Configuration; TCP/UDP Port Closure; The following ports and services are affected by this change:; TFTP; ProCurve# show instrumentation monitor configuration
75 Enhancements Release M.10.04 Enhancements Figure 18. Viewing the Instrumentation Monitor Configuration TCP/UDP Port Closure In earlier software releases, certain UDP ports were always open. Beginning with software release M.10.04, all TCP/UDP ports on the 3400cl switches will remain closed until ...
Page 86 - Enabling/Disabling TFTP; snmp-server enable traps; Enabling/Disabling RIP; Enables or disables the TFTP client.; tftp; command can be used to enable
76 Enhancements Release M.10.04 Enhancements Enabling/Disabling TFTP The TFTP server and client can be enabled and/or disabled independently. Enabling/Disabling SNMP To enable/disable SNMP, use the following commands. N o t e s ■ The SNMP port (161) will be opened if either SNMP v1/2 or SNMP v3 are ...
Page 87 - router rip; must be enabled in order to open the port on the switch.; Enabling/Disabling Stacking; stack; Spanning Tree Show Commands; show spanning-tree detail
77 Enhancements Release M.10.04 Enhancements N o t e The router rip command exists in previous software versions. In this implementation, however, RIP must be enabled in order to open the port on the switch. Enabling/Disabling Stacking To enable/disable stacking, use the following command. N o t e T...
Page 88 - Figure 19. Example of Show Spanning-Tree Detail; TC Detected; counter shows the number of TC notifications sent out of the port.
78 Enhancements Release M.10.04 Enhancements The following shows RSTP sample output from the enhanced command. Figure 19. Example of Show Spanning-Tree Detail Operating Notes ■ TC refers to a Topology Change detected on the given port. Note the following details: • TC Detected counter shows when a p...
Page 91 - Figure 20. UDLD Example
81 Enhancements Release M.10.09 Enhancements Figure 20. UDLD Example Similarly, UDLD is effective for monitoring fiber optic links that use two uni-direction fibers to transmit and receive packets. Without UDLD, if a fiber breaks in one direction, a fiber port may assume the link is still good (beca...
Page 92 - Configuration Considerations; Configuring UDLD; The following commands allow you to configure UDLD via the CLI.
82 Enhancements Release M.10.09 Enhancements Configuration Considerations ■ UDLD is configured on a per-port basis and must be enabled at both ends of the link. See the note below for a list of ProCurve switches that support UDLD. ■ To configure UDLD on a trunk group, you must configure the feature ...
Page 93 - Changing the Keepalive Interval.; By default, ports enabled for UDLD send a link health-check; Changing the Keepalive Retries.; By default, a port waits five seconds to receive a health-check; Configuring UDLD for Tagged Ports.; The default implementation of UDLD sends the UDLD
83 Enhancements Release M.10.09 Enhancements Enabling UDLD. UDLD is enabled on a per port basis. For example, to enable UDLD on port a1, enter: To enable the feature on a trunk group, enter the appropriate port range. For example: N o t e When at least one port is UDLD-enabled, the switch will forwa...
Page 94 - Viewing UDLD Information; show link-keepalive
84 Enhancements Release M.10.09 Enhancements N o t e s ■ You must configure the same VLANs that will be used for UDLD on all devices across the network; otherwise, the UDLD link cannot be maintained. ■ If a VLAN ID is not specified, then UDLD control packets are sent out of the port as untagged pack...
Page 95 - Displaying Summary UDLD Information.; To display summary information on all UDLD-enabled
85 Enhancements Release M.10.09 Enhancements Displaying Summary UDLD Information. To display summary information on all UDLD-enabled ports, enter the show link-keepalive command. For example: Figure 21. Example of UDLD Information displayed using Show Link-Keepalive Command Port 5 has been disabled ...
Page 96 - Displaying Detailed UDLDP Status Information.; To display detailed UDLD information for; show link-keepalive statistics; To clear UDLD statistics, enter the following command:; show link
86 Enhancements Release M.10.09 Enhancements Displaying Detailed UDLDP Status Information. To display detailed UDLD information for specific ports, enter enter the show link-keepalive statistics command. For example: Figure 22. Example of Detailed UDLD Information displayed using Show Link-Keepalive...
Page 97 - Configuration Warnings and Event Log Messages; possible causes, when UDLD is configured for tagged ports.; Table 7. UDLD Event Log Messages; warning messages will also be logged in the switch’s event log.
87 Enhancements Release M.10.09 Enhancements Configuration Warnings and Event Log Messages Warning Messages. The following table shows the warning messages that may be issued and their possible causes, when UDLD is configured for tagged ports. Table 6. Warning Messages caused by configuring UDLD for...
Page 98 - Spanning Tree Per-Port BPDU Filtering; Here are some sample scenarios in which this feature may be used:; for details). BPDU protection will take; Configuring STP BPDU Filters
88 Enhancements Release M.10.10 Enhancements Release M.10.10 Enhancements Release M.10.10 includes the following enhancement: Spanning Tree Per-Port BPDU Filtering The STP BPDU filter feature allows control of spanning-tree participation on a per-port basis. It can be used to exclude specific ports ...
Page 99 - Viewing Status of BPDU Filtering; detail; command has been extended to show per-port BPDU filter
89 Enhancements Release M.10.10 Enhancements C a u t i o n Ports configured with the BPDU filter mode remain active (learning and forward frames); however, spanning-tree cannot receive or transmit BPDUs on the port. The port remains in a forwarding state, permitting all broadcast traffic. This can c...
Page 100 - Viewing Configuration of BPDU Filtering; configuration; command displays the BPDU’s filter state.; Multiple Spanning Tree (MST) Information
90 Enhancements Release M.10.10 Enhancements The show spanning-tree command has also been extended to display BPDU filtered ports. Figure 24. Example of BPDU Filtered Ports Field in Show Spanning Tree Command Viewing Configuration of BPDU Filtering The BPDU filter mode adds an entry to the spanning ...
Page 101 - RSTP/MSTP BPDU Protection; . When this feature is enabled on a port, the switch will; Spanning Tree BPDU Protection
91 Enhancements Releases M.10.11 through M.10.12 Enhancements Releases M.10.11 through M.10.12 Enhancements Software fixes only, no new enhancements. Release M.10.13 Enhancements Release M.10.13 includes the following enhancement: ■ Enhancement (PR_1000354065) - Added DHCP protection feature. No add...
Page 102 - Figure 27. Example of BPDU Protection Enabled at the Network Edge; BPDU —; transmitting BPDU frames on a specific port.; BPDU Protection —
92 Enhancements Release M.10.17 Enhancements Figure 27. Example of BPDU Protection Enabled at the Network Edge Terminology BPDU — Acronym for bridge protocol data unit. BPDUs are data messages that are exchanged between the switches within an extended LAN that use a spanning tree protocol topology. ...
Page 103 - STP —; Multiple Instance Spanning-Tree Operation; Configuring STP BPDU Protection; For example, to configure BPDU protection on ports 1 to 10, enter:; Enables/disables the BPDU protection feature on a port
93 Enhancements Release M.10.17 Enhancements STP — Spanning Tree Protocol, part of the original IEEE 802.1D specification. The 2004 edition completely deprecates STP. Both RSTP and MSTP have fallback modes to handle STP. SNMP — Simple Network Management Protocol, used to remotely manage network devi...
Page 104 - Viewing BPDU Protection Status
94 Enhancements Release M.10.17 Enhancements Viewing BPDU Protection Status The show spanning-tree command has additional information on BPDU protection as shown below. Example of BPDU Protection Additions to Show Spanning Tree Command ProCurve# show spanning-tree 1-10 Multiple Spanning Tree (MST) I...
Page 105 - Configuring Loop Protection; “Spanning Tree BPDU
95 Enhancements Release M.10.21 Enhancements Release M.10.21 Enhancements Software fixes only, no new enhancements. Release M.10.22 Enhancements Release M.10.22 includes the following enhancement: ■ Enhancement (PR_1000376406) — Loop Protection feature additions, including packet authentication, loo...
Page 106 - Figure 28. Example of Show Loop Protect Display; Status and Counters - Loop Protection Information
96 Enhancements Release M.10.22 Enhancements To display information about ports with loop protection, enter this command. Figure 28. Example of Show Loop Protect Display [trap <loop-detected>] Allows you to configure loop protection traps The “loop-detected” trap indicates that a loop was dete...
Page 108 - both
98 Enhancements Release M.10.27 Enhancements Release M.10.27 Enhancements Release M.10.27 includes the following enhancement: ■ Enhancement (PR_1000374085) — This enhancement expands the use of the Controlled Directions parameter to also support MAC/Web authentication. Syntax: aaa port-access < p...
Page 109 - controlled-direction both; controlled-directions in
99 Enhancements Release M.10.27 Enhancements Notes : ■ The aaa port-access controlled-direction in command allows Wake-on-LAN traffic to be transmitted on a MAC-authenticated outbound port that has not yet transitioned to the authenticated state; the controlled-direction both setting prevents transm...
Page 110 - Password Command; password; manager
100 Enhancements Release M.10.28 Enhancements Release M.10.28 Enhancements Software fixes only, no new enhancements. Release M.10.29 Enhancements Release M.10.29 includes the following enhancement: ■ Enhancement (PR_1000376626) — Enhance CLI " qos dscp-map he " help and " show dscp- map ...
Page 111 - plaintext; Scheduled Reload; dd
101 Enhancements Release M.10.32 Enhancements ■ The <hash-type> parameter specifies the type of algorithm (if any) used to hash the password. Valid values are plaintext or sha-1 . ■ The <password> parameter is the clear ASCII text string or SHA-1 hash of the password. You can enter a man...
Page 112 - How RADIUS-Based Authentication Affects VLAN Operation; VLAN Assignment on a ProCurve Port
102 Enhancements Release M.10.33 Enhancements To schedule a reload in 3 hours: ProCurve# reload after 03:00 To schedule a reload for the same time the following day: ProCurve# reload after 01:00:00 To schedule a reload for the same day at 12:05: ProCurve# reload at 12:05 To schedule a reload on some...
Page 113 - If the port is assigned as a member of an untagged
103 Enhancements Release M.10.33 Enhancements ■ The port is temporarily assigned as a member of an untagged (static or dynamic) VLAN for use during the client session according to the following order of options. a. The port joins the VLAN to which it has been assigned by a RADIUS server during clien...
Page 115 - Example of an Active VLAN Configuration; Figure 8; show vlan; Figure 9
105 Enhancements Release M.10.33 Enhancements Figure 8. Example of an Active VLAN Configuration In Figure Figure 8 , if RADIUS authorizes an 802.1X client on port A2 with the requirement that the client use VLAN 22, then: ■ VLAN 22 becomes available as Untagged on port A2 for the duration of the ses...
Page 117 - interface
107 Enhancements Release M.10.33 Enhancements Enabling the Use of GVRP-Learned Dynamic VLANs in Authentication Sessions Syntax: aaa port-access gvrp-vlans Enables the use of dynamic VLANs (learned through GVRP) in the temporary untagged VLAN assigned by a RADIUS server on an authenticated port in an...
Page 118 - Concurrent TACAS+ and SFTP; aaa authentication login privilege-mode; aaa authentication
108 Enhancements Release M.10.34 Enhancements Release M.10.34 Enhancements Release M.10.34 includes the following enhancement: ■ Enhancement (PR_1000412747) — TACACS+ Single Sign-on for Administrators Concurrent TACAS+ and SFTP It is now possible to have SFTP/SCP sessions run concurrently with TACAC...
Page 119 - Dynamic ARP Protection; Introduction; Multicast and Routing Guide
109 Enhancements Release M.10.35 Enhancements Release M.10.35 Enhancements Release M.10.35 includes the following enhancement: ■ Enhancement (PR_1000419928) — The Dynamic ARP Protection feature was added. Dynamic ARP Protection Introduction On the VLAN interfaces of a routing switch, dynamic ARP pro...
Page 120 - Enabling Dynamic ARP Protection; command at the global configuration level.; arp protect; command is shown here:
110 Enhancements Release M.10.35 Enhancements • If a binding is invalid, the switch drops the packet, preventing other network devices from receiving the invalid IP-to-MAC information. DHCP snooping intercepts and examines DHCP packets received on switch ports before forwarding the packets. DHCP pac...
Page 121 - Configuring Trusted Ports; The switch intercepts all ARP requests and responses on the port.; Figure 12. Configuring Trusted Ports for Dynamic ARP Protection
111 Enhancements Release M.10.35 Enhancements Configuring Trusted Ports In a similar way to DHCP snooping, dynamic ARP protection allows you to configure VLAN interfaces in two categories: trusted and untrusted ports. ARP packets received on trusted ports are forwarded without validation. By default...
Page 122 - Adding an IP-to-MAC Binding to the DHCP Database
112 Enhancements Release M.10.35 Enhancements To configure one or more Ethernet interfaces that handle VLAN traffic as trusted ports, enter the arp protect trust command at the global configuration level. The switch does not check ARP requests and responses received on a trusted port. An example of ...
Page 124 - Verifying the Configuration of Dynamic ARP Protection; show arp protect; Displaying ARP Packet Statistics; show arp protect statistics; ARP Protection Information
114 Enhancements Release M.10.35 Enhancements Verifying the Configuration of Dynamic ARP Protection To display the current configuration of dynamic ARP protection, including the additional validation checks and the trusted ports that are configured, enter the show arp protect command: Figure 13. The...
Page 125 - Monitoring Dynamic ARP Protection; debug arp protect; Software fixes only, no new enhancements.
115 Enhancements Release M.10.36 Enhancements Monitoring Dynamic ARP Protection When dynamic ARP protection is enabled, you can monitor and troubleshoot the validation of ARP packets with the debug arp protect command. Use this command when you want to debug the following conditions: ■ The switch is...
Page 126 - Configuring MSTP Port Connectivity Parameters; option has been removed. This section describes selected; show spanning-tree config; Yes
116 Enhancements Release M.10.37 Enhancements Configuring MSTP Port Connectivity Parameters With release K.12.04, all ports are configured as auto-edge-ports by default, and the spanning tree edge-port option has been removed. This section describes selected spanning-tree < port-list > com- ma...
Page 127 - global
117 Enhancements Release M.10.37 Enhancements [root-guard] MSTP only. When a port is enabled as root-guard , it cannot be selected as the root port even if it receives superior STP BPDUs. The port is assigned an “alternate” port role and enters a blocking state if it receives superior STP BPDUs. The...
Page 128 - True; spanning-tree B2 priority 3
118 Enhancements Release M.10.38 Enhancements Release M.10.38 Enhancements Release M.10.38 includes the following enhancement: ■ Enhancement (PR_1000428642) — SNMP v2c describes two different notification-type PDUs: traps and informs. Prior to this software release, only the traps sub-type was suppo...
Page 129 - Send SNMP v2c Informs; Enabling and Configuring SNMP Informs; Maximum number of informs waiting for acknowledgement at any one
119 Enhancements Release M.10.38 Enhancements Send SNMP v2c Informs Enabling and Configuring SNMP Informs You can use the snmp-server informs command (SNMPv2c and SNMPv3 versions) to send notifications when certain events occur. When an SNMP Manager receives an informs request, it can send an SNMP r...
Page 130 - Figure 11. Example Showing SNMP Informs Option Enabled; includes the following enhancement:
120 Enhancements Release M.10.39 Enhancements You can see if informs are enabled or disabled with the show snmp-server command as shown in Figure 11. Figure 11. Example Showing SNMP Informs Option Enabled Release M.10.39 Enhancements Release M.10.39 includes the following enhancement: Select whether...
Page 131 - RADIUS Server Unavailable; Overview; radius
121 Enhancements Release M.10.39 Enhancements ■ Enhancement (PR_1000428213) — This software enhancement adds the ability to configure a secondary authentication method to be used when the RADIUS server is unavailable for the primary port-access method. RADIUS Server Unavailable Overview In certain s...
Page 133 - Specifying the MAC Address Format; — specifies an aabbccddeeff format.
123 Enhancements Release M.10.39 Enhancements Figure 12. Example of AAA Authentication Using Authorized for the Secondary Authentication Method Specifying the MAC Address Format The MAC address format command has been enhanced to allow upper-case letters to be used for the hexadecimal numbers when i...
Page 134 - ARP Age Timer Increase; To view the value of Arp Age timer, enter the; IP Routing : Disabled
124 Enhancements Release M.10.39 Enhancements ■ Enhancement (PR_1000415155) — The ARP age timer was enhanced from the previous limit of 240 minutes to allow for configuration of values up to 1440 minutes (24 hours) or "infinite" (99,999,999 seconds or 3.2 years). ARP Age Timer Increase The A...
Page 135 - Menu > Switch Configuration
125 Enhancements Release M.10.39 Enhancements You can also view the value of the Arp Age timer in the configuration file. Figure 15. Example Showing ip arp-age Value in the Running Config File You can set or display the arp-age value using the menu interface ( Menu > Switch Configuration > IP ...
Page 136 - clear arp; command to remove all non-permanent entries in the ARP cache.; Dynamic IP Lockdown; Allows removal of any dynamic entry in the ARP cache.
126 Enhancements Release M.10.40 Enhancements If the ARP cache should become full because entries are not cleared (due to increased timeout limits) you can use the clear arp command to remove all non-permanent entries in the ARP cache. To remove a specific entry in the ARP cache, enter this command:...
Page 137 - Protection Against IP Source Address Spoofing; Switch
127 Enhancements Release M.10.43 Enhancements Protection Against IP Source Address Spoofing Many network attacks occur when an attacker injects packets with forged IP source addresses into the network. Also, some network services use the IP source address as a component in their authentication schem...
Page 138 - Prerequisite: DHCP Snooping
128 Enhancements Release M.10.43 Enhancements Prerequisite: DHCP Snooping Dynamic IP lockdown requires that you enable DHCP snooping as a prerequisite for its operation on ports and VLAN traffic: ■ Dynamic IP lockdown only enables traffic for clients whose leased IP addresses are already stored in t...
Page 139 - Note that the; statement is applied only to all other VLANs.; permit any
129 Enhancements Release M.10.43 Enhancements In this example, the following DHCP leases have been learned by DHCP snooping on port 5. VLANs 2 and 5 are enabled for DHCP snooping. Figure 17. Sample DHCP Snooping Entries The following example shows an IP-to-MAC address and VLAN binding that have been...
Page 140 - Enabling Dynamic IP Lockdown; no dhcp-snooping trust
130 Enhancements Release M.10.43 Enhancements Enabling Dynamic IP Lockdown To enable dynamic IP lockdown on all ports or specified ports, enter the ip source-lockdown command at the global configuration level. Use the no form of the command to disable dynamic IP lockdown. Operating Notes ■ Dynamic I...
Page 141 - Adding an IP-to-MAC Binding to the DHCP Binding Database; Dynamic IP lockdown supports; Potential Issues with Bindings
131 Enhancements Release M.10.43 Enhancements • Remove the trusted-port configuration. ■ You can configure dynamic IP lockdown only from the CLI; this feature cannot be configured from the Web management or menu interface. ■ If you enable dynamic IP lockdown on a port, you cannot add the port to a t...
Page 142 - Adding a Static Binding; ip; command at the global configuration level. Use the; no; form of the command to remove; Verifying the Dynamic IP Lockdown Configuration
132 Enhancements Release M.10.43 Enhancements Adding a Static Binding To add the static configuration of an IP-to-MAC binding for a port to the lease database, enter the ip source-binding command at the global configuration level. Use the no form of the command to remove the IP-to-MAC binding from t...
Page 143 - show ip source-lockdown status; command output is shown in Figure 20. Note that; Example of show ip source-lockdown status Command Output; An example of the; show ip source-lockdown bindings; command output is shown in; Global State: Enabled
133 Enhancements Release M.10.43 Enhancements An example of the show ip source-lockdown status command output is shown in Figure 20. Note that the operational status of all switch ports is displayed. This information indicates whether or not dynamic IP lockdown is supported on a port. Figure 20. Exa...
Page 144 - Example of show ip source-lockdown bindings Command Output; In the; command output, the “Not in HW” column specifies whether; Debugging Dynamic IP Lockdown; To send command output to the active CLI session, enter the; debug destination session; Counters for denied packets are displayed in the
134 Enhancements Release M.10.43 Enhancements Figure 21. Example of show ip source-lockdown bindings Command Output In the show ip source-lockdown bindings command output, the “Not in HW” column specifies whether or not (YES or NO) a statically configured IP-to-MAC and VLAN binding on a specified po...
Page 145 - Example of debug dynamic-ip-lockdown Command Output
135 Enhancements Release M.10.44 through M.10.64 Enhancements Figure 22. Example of debug dynamic-ip-lockdown Command Output Release M.10.44 through M.10.64 Enhancements Software fixes only, no new enhancements. ProCurve(config)# debug dynamic-ip-lockdown DIPLD 01/01/90 00:01:25 : denied ip 192.168....
Page 146 - MSTP VLAN Configuration Enhancement; where; The default behavior of the; spanning-tree instance vlan; command changes so that, before a static VLAN
136 Enhancements Release M.10.65 Enhancements Release M.10.65 Enhancements Release M.10.65 includes the following enhancement: ■ Enhancement (PR_0000001316) — The MSTP VLAN Assignment is enhanced. MSTP VLAN Configuration Enhancement C a u t i o n When this software version is installed, the prior VL...
Page 147 - Enabling MSTP on the Switch; Enter the command to enable MSTP:; PreConfiguring VLANs in an MST Instance; Region revision number (
137 Enhancements Release M.10.65 Enhancements All switches in a region must be configured with the same VLAN ID-to-MSTI mappings and the same MSTP configuration identifiers (region name and revision number). ■ Flexibility: By preconfiguring identical VLAN ID-to-MSTI mappings on all switches in an MS...
Page 148 - command to map VLANs; Configuring MSTP Instances with the VLAN Range Option; If you use the; spanning-tree instance; command with the VLAN range option, even if the range includes
138 Enhancements Release M.10.65 Enhancements Each MST instance supports a different set of VLANs. A VLAN that is mapped to an MST instance cannot be a member of another MST instance. The MSTP VLAN Configuration enhancement allows you to ensure that the same VLAN ID-to-MSTI assignments exist on each...
Page 149 - MST Configuration Identifier Information
139 Enhancements Release M.10.65 Enhancements Figure 23. Example of Mapping VLANs with the Range Option where all VLANs are Included N o t e If you want all switches to be in the same MST region, they should all have a software version that supports this enhancement installed, or have the same VLANS...
Page 150 - Configure Logging via SNMP
140 Enhancements Release M.10.66 Enhancements ■ If you enter the spanning-tree instance vlan command before a static or dynamic VLAN is configured on the switch to preconfigure VLAN ID-to-MSTI mappings, no error message is displayed. Later, each newly configured VLAN that has already been associated...
Page 151 - Adding a Description for a Syslog Server; Entering the; no logging; Adding a Priority Description; form of the command to remove the; severity; system module; white space, use quotes around the string. Use the
141 Enhancements Release M.10.66 Enhancements Adding a Description for a Syslog Server You can associate a user-friendly description with each of the IP addresses (IPv4 only) configured for syslog using the CLI or SNMP. The CLI command is: Figure 29. Example of the Logging Command with a Control Des...
Page 152 - CLI logging commands:; logging severity; following SNMP objects:
142 Enhancements Release M.10.66 Enhancements Figure 30. Example of the Logging Command with a Priority Description N o t e A notification is sent to the SNMP agent if there are any changes to the syslog parameters either through the CLI or with SNMP. Command Differences for the ProCurve Series 2600...
Page 153 - LACP and Link Traps Global Disable; no int all lacp; The new SNMP OIDs are:
143 Enhancements Release M.10.67 Enhancements Release M.10.67 Enhancements Software fixes only, no new enhancements. Release M.10.68 Enhancements Release M.10.68 includes the following enhancement: ■ Enhancement (PR_0000003127) — A Link Trap and LACP Global enable/disable feature has been added. LAC...
Page 154 - show tech transceivers; command has been enhanced to be consistent with other platforms.
144 Enhancements Release M.10.69 Enhancements hpSwitchLinkUpDownTrapAllPortsStatus OBJECT-TYPE SYNTAX INTEGER { enable (1), disable (2) } ACCESS read-write STATUS current DESCRIPTION “Used to either enable/disable the Link Up/Link Down traps for all the ports.” ::= { hpSwitchPortConfig 3 } Release M...
Page 155 - LLDP refresh interval
145 Software Fixes in Release M.08.51 - M.10.72 Release M.08.52 Software Fixes in Release M.08.51 - M.10.72 Software fixes are listed in chronological order, oldest to newest. To review the list of fixes included since the last general release that was published, go to “Release M.10.21” on page 165 ...
Page 156 - show CDP; show QOS resources
146 Software Fixes in Release M.08.51 - M.10.72 Release M.08.61 2. In show CDP the Yes is changed to Yes,(Receive Only) . ■ CLI (PR_1000192677) — Show access-list ports <tab> does not list the all keyword. The command only shows [PORT-LIST] as input for the command. ■ Console/TELNET (PR_100019...
Page 157 - null; Rcvd a pkt with version number 2, expected 1; mSnmpCtrl
147 Software Fixes in Release M.08.51 - M.10.72 Release M.08.62 ■ Web UI (PR_1000177915) — Device View from the Web user interface is missing. ■ Web UI/Port Security (PR_1000195894) — The Web user interface does not allow the user to select multiple ports when configuring port-security. Release M.08...
Page 158 - vid
148 Software Fixes in Release M.08.51 - M.10.72 Release M.08.64 Release M.08.64 Problems Resolved in Release M.08.64 (Not a general release) ■ IP Routing (PR_1000220668) — Fatal exception when routing with more than 8 trunks configured and IP routing enabled. Release M.08.65 Problems Resolved in Rel...
Page 160 - Duplicate access control entry.
150 Software Fixes in Release M.08.51 - M.10.72 Release M.08.70 ■ Port Security (PR_1000203984) — CLI port-security "mac-address" command will save address above the limit. ■ SNMP (PR_1000212170) — The Switch transmits Warm and Cold Start traps with an agent address of 0.0.0.0. ■ Spanning Tr...
Page 161 - System reboot due to power failure.; Boot ROM
151 Software Fixes in Release M.08.51 - M.10.72 Release M.08.72 ■ LLDP (PR_1000241315) — CLI command "show LLDP" does not display information correctly. ■ Web Auth (PR_1000230444) — Using port-based web authentication on the Switch will cause some users to never receive the web authenticatio...
Page 164 - RSTP
154 Software Fixes in Release M.08.51 - M.10.72 Release M.08.83 ■ RSTP (PR_1000300623) — Under some circumstances, the switch may allow packets to loop for an extended period of time. Release M.08.83 Problems Resolved in Release M.08.83 (Not a general release) ■ Crash (PR_1000297510) — When using th...
Page 168 - Note
158 Software Fixes in Release M.08.51 - M.10.72 Release M.08.97 Release M.08.97 Problems Resolved in Release M.08.97 (Never released) ■ OSPF (PR_1000319678) — Switch does not accept IP fragmented OSPF packets. Release M.10.01 Note: The M.10.xx software releases run only on the ProCurve 3400cl series...
Page 172 - show int config
162 Software Fixes in Release M.08.51 - M.10.72 Release M.10.11 Release M.10.11 Problems Resolved in Release M.10.11 ■ Crash (PR_1000336436) — A “get/put” operation on config file via SCP crashes the box with an error message similar to: Software exception at ssh_alarm.c:304 -- in 'mSshAlrm', task I...
Page 173 - show lldp
163 Software Fixes in Release M.08.51 - M.10.72 Release M.10.14 Release M.10.14 Problems Resolved in Release M.10.14 ■ CLI (PR_1000342461) — Command “ show lldp info remote <port number> " reports incorrect information for remote management address. ■ LACP (PR_1000352012) — LACP state chan...
Page 182 - IP Connectivi; ty
172 Software Fixes in Release M.08.51 - M.10.72 Release M.10.36 ■ BPDU Protection (PR_1000395569) — BPDU-protection fails after module hot-swap. ■ Enhancement (PR_1000419928) — The Dynamic ARP Protection feature was added. ■ IP Connectivi ty (PR_1000418378) — The switch incorrectly updates its ARP t...
Page 185 - show ip ssh
175 Software Fixes in Release M.08.51 - M.10.72 Release M.10.45 Release M.10.45 Problems Resolved in Release M.10.45 (Not a Public Release) ■ Web-UI (PR_1000416955) — Inserting an LH GBIC into dual personality ports results in the LH ports not appearing in the device view. ■ Meshing (PR_1000453201) ...
Page 186 - Fatal error: Server unexpectedly closed connection.; show flash
176 Software Fixes in Release M.08.51 - M.10.72 Release M.10.48 • The switch does not send an appropriate exit status message to the client. This corrects the symptom that occurs in some applications, which reports a message similar to: Fatal error: Server unexpectedly closed connection. • The SSH c...
Page 187 - file; erase start
177 Software Fixes in Release M.08.51 - M.10.72 Release M.10.50 through M.10.64 Routed traffic is off by a factor of 1000Switched traffic is not sampled at all ■ Security (PR_1000388616) — Possible cross-site scripting vulnerability in Web Manage- ment Interface. ■ Config (PR_1000763386) — An SNMPv3...
Page 189 - show name
179 Software Fixes in Release M.08.51 - M.10.72 Release M.10.67 ■ CLI (1000415243) — Output from the CLI command show name still lists 10-GbE trans- ceiver names, even after the transceivers are removed and replaced with another type of transceiver. ■ CLI (PR_1000430534) — Output from the show port-...
Page 191 - port
181 Software Fixes in Release M.08.51 - M.10.72 Release M.10.70 ■ PC Phone/Authentication (PR_0000007209) — When an IP phone is used in tandem with a PC connected to the phone, if the phone is moved to a tagged VLAN, some phone manufactures send some traffic to the switch untagged. This may result i...
Page 193 - interface all
183 Software Fixes in Release M.08.51 - M.10.72 Release M.10.71 Release M.10.71 Problems Resolved in Release M.10.71 (Not a Public Release) ■ 802.1X (PR_0000014842) — If an invalid number of characters are used at the CLI for the command aaa port-access supplicant < port number > secret , the ...
Page 194 - radius authorized
184 Software Fixes in Release M.08.51 - M.10.72 Release M.10.72 ■ Config (PR_0000005002) — If a friendly port name uses the characters TRUNK=, then after a reload, all the trunking configuration will have been removed from the configuration. ■ GVRP (PR_0000012224) — Changing the GVRP unknown-vlan st...
Page 195 - aaa port-access authenticator; aaa; Existing configurations will be altered by this fix
185 Software Fixes in Release M.08.51 - M.10.72 Release M.10.72 Drop offer from <DHCP server IP address> of <DHCP address offer> because the address is assigned to some other client Drop request from <MAC address of client requesting an IP address that is already in use> for <IP...
