Security on vlan51

ACL / Access Lists on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

How to create extended ACLs on HPE Aruba ArubaOS-Switch and apply them to a VLAN interface. This example restricts a guest wireless network from accessing any internal address space while allowing internet access.

Scenario #

Guest network subnet: 192.168.0.0/23. Guests must reach the internet but must not reach any RFC1918 internal ranges.

Create the ACL #

cli

ip access-list extended "GUEST-ACL"
 10 permit ip 192.168.0.0 0.0.1.255 192.168.0.0 0.0.1.255
 20 deny ip 192.168.0.0 0.0.1.255 10.0.0.0 0.255.255.255 log
 30 deny ip 192.168.0.0 0.0.1.255 172.16.0.0 0.15.255.255 log
 40 deny ip 192.168.0.0 0.0.1.255 192.168.0.0 0.0.255.255 log
 50 permit ip 192.168.0.0 0.0.1.255 0.0.0.0 255.255.255.255 log
 exit

Line 10 — permits intra-subnet traffic (required for hosts on the /23 to communicate with each other)
Lines 20, 30, 40 — deny RFC1918 ranges
Line 50 — permit all other destinations (internet)

Apply to the VLAN interface #

cli

vlan 10
 name "Guest Network"
 ip access-group "GUEST-ACL" in
 ip address 192.168.0.1 255.255.254.0
exit

The ACL is applied inbound (in) — it inspects traffic as it arrives from guest clients.

Hardening HPE Comware v5 Switches

Mon, 01 Jan 2024 00:00:00 +0000

How to harden HPE Comware v5 switches by restricting remote access to SSH and HTTPS only and using ACLs to limit management connections to specific hosts.

Note: HPE Comware v5 is end-of-sale on most platforms. These commands remain relevant for H3C and older HPE A/E-series switches still in service.

Disable insecure protocols #

cli

undo ip http server enable
undo telnet server enable

Enable SSH and HTTPS #

cli

ip https enable
ssh server enable

Restrict VTY to SSH only #

cli

user-interface vty 0 4
 protocol inbound ssh

Restrict management access with an ACL #

cli

acl number 2050
 rule 5 permit source 1.2.3.4 0
 rule 10 permit source 10.0.0.0 0.255.255.255
 rule 15 permit source 192.168.0.0 0.0.255.255

Apply to HTTPS and SSH:

Port Security on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

Port security is a form of MAC lockdown (layer 2 control). It lets you limit, restrict or fix the MAC addresses allowed on an individual switch port, and decide what the switch does when that rule is broken. This applies to the HPE Aruba 2920, 2930, 3800, 5400 and 8200 series running ArubaOS-Switch.

I wrote this after a reader asked how to set it up. These are the scenarios I use most.

Secure Remote Access on HPE Comware v5 Switches

Mon, 01 Jan 2024 00:00:00 +0000

By default, HPE Comware v5 has no remote access authentication configured. This guide covers local user setup, SSH, HTTPS, and console port protection.

Security note: Use 2048-bit RSA minimum. The 1024-bit size shown below is cryptographically weak and should not be used on switches still in active service.

Create a local user #

cli

system-view
 local-user admin
 password simple PASSWORD
 authorization-attribute level 3
 service-type web terminal
 service-type ssh

Use password cipher rather than password simple in production to store a hashed value.

Restricting SMTP Access with ACLs on Citrix NetScaler

Thu, 01 Oct 2015 00:00:00 +0000

I had to configure a Citrix NetScaler (version 10.5) to load balance SMTP for an organisation that relayed mail through Microsoft’s smart host. Only specific source IP addresses should be able to reach port 25.

This is all done from the CLI. In the GUI, the same settings are under Configuration → System → Network → ACLs.

In this example, the permitted senders are 1.1.1.1 and 2.2.2.2.

Create the ACLs #

cli

> add ns acl ALLOW-SMTP-1.1.1.1 ALLOW -srcIP = 1.1.1.1 -destPort = 25 -protocol TCP -priority 10
 Done
> add ns acl ALLOW-SMTP-2.2.2.2 ALLOW -srcIP = 2.2.2.2 -destPort = 25 -protocol TCP -priority 20
 Done
> add ns acl RESTRICT-SMTP-ALL DENY -srcIP = 0.0.0.0-* -destPort = 25 -protocol TCP -priority 50
 Done

There’s no implicit deny or permit at the end of a NetScaler ACL list, so you need the explicit DENY rule to block everyone else. Lower priority numbers are evaluated first.