UCF STIG Viewer Logo

HP FlexFabric Switch must authenticate all endpoint devices before establishing a network connection using bidirectional authentication that is cryptographically based.


Finding ID Version Rule ID IA Controls Severity
V-66053 HFFS-L2-000003 SV-80543r1_rule Medium
Controlling LAN access via 802.1x authentication can assist in preventing a malicious user from connecting an unauthorized PC to a switch port to inject or receive data from the network without detection.
HP FlexFabric Switch L2S Security Technical Implementation Guide 2018-12-21


Check Text ( C-66697r1_chk )
Verify all access switch ports connecting to LAN outlets are configured for 802.1x or MAC authentication as shown in this configuration example.

802.1x example:

interface Ten-GigabitEthernet1/0/4
port link-mode bridge
port access vlan 200

If all access switch ports connecting to LAN outlets are not configured for 802.1x, this is a finding.
Fix Text (F-72129r1_fix)
Configure 802.1 x authentications on all host-facing access switch ports. To authenticate those devices that do not support 802.1x, MAC Authentication Bypass must be configured.

[HP] dot1x
[HP] dot1x authentication-method eap
[HP] domain radius jitc
[HP] radius scheme jitc
[HP-radius-jitc]radius scheme jitc
[HP-radius-jitc]primary authentication
[HP-radius-jitc]primary accounting
[HP-radius-jitc]accounting-on enable
[HP-radius-jitc]key authentication simple test123
[HP-radius-jitc]user-name-format without-domain
[HP]domain jitc
[HP-isp-jitc]domain jitc
[HP-isp-jitc]authentication lan-access radius-scheme jitc
[HP-isp-jitc]authorization lan-access radius-scheme jitc
[HP] interface gigbitethernet 1/0/1
[HP-Gigabitethernet1/0/1] undo dot1x handshake
[HP-Ten-GigabitEthernet1/0/7]dot1x mandatory-domain jitc
[HP-Ten-GigabitEthernet1/0/7]undo dot1x multicast-trigger
[HP-Ten-GigabitEthernet1/0/7]dot1x re-authenticate