HP J4813A Manual de usuario

ProCurve

Identity Driven Manager

User’s Guide

Software Release 2.0

Hewlett-Packard Company

8000 Foothills Boulevard, m/s 5551

Roseville, California 95747-5551

http://www.procurve.com

This document contains information which is protected by

prior permission is prohibited, except as allowed under the

Publication Number

5990-8851

November, 2005

Trademark Credits

Microsoft, Windows, Windows 95, and Microsoft Windows

NT are registered trademarks of Microsoft Corporation.

Internet Explorer is a trademark of Microsoft Corporation.

Ethernet is a registered trademark of Xerox Corporation.

Netscape is a registered trademark of Netscape Corporation.

Disclaimer

The information contained in this document is subject to

change without notice.

HEWLETT-PACKARD COMPANY MAKES NO WARRANTY

OF ANY KIND WITH REGARD TO THIS MATERIAL,

INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

WARRANTIES OF MERCHANTABILITY AND FITNESS

FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not

be liable for errors contained herein or for incidental or

consequential damages in connection with the furnishing,

performance, or use of this material.

Hewlett-Packard assumes no responsibility for the use or

reliability of its software on equipment that is not furnished

by Hewlett-Packard.

Warranty

See the Customer Support/Warranty booklet included with

the product.

A copy of the specific warranty terms applicable to your

Hewlett-Packard products and replacement parts can be

obtained from your HP Sales and Service Office or

authorized dealer.

iii

Contents

1About ProCurve Identity Driven Manager

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2

Why IDM? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3

IDM Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5

Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7

IDM Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-9

Supported Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-9

Operating Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-9

Additional Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-10

Upgrading from Previous Versions of PCM and IDM . . . . . . . . . . . . . . . 1-10

Registering Your IDM Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-12

Learning to Use ProCurve IDM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-15

ProCurve Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-15

2Getting Started

Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2

Installing the IDM Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2

Using the IDM Auto-Discover Feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3

IDM Configuration Process Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3

IDM Usage Strategies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4

Understanding the IDM Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-5

IDM GUI Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-6

IDM Dashboard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-8

Using the Navigation Tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-9

Toolbars and Menus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-13

Using IDM as a Monitoring Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-14

IDM Preferences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-15

Using IDM Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-18

Scheduling a Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-21

IDM Session Cleanup Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-27

User Session Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-29

Contents

3Using Identity Driven Manager

IDM Configuration Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2

Configuration Process Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2

Configuring Identity Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3

Configuring Locations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-5

Configuring Times . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-10

Configuring Network Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-16

Configuring Access Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-21

Defining Access Policy Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-31

Configuring User Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-37

Using Global Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-39

Deploying Configurations to the Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-42

Using Manual Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-43

Defining New Realms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-43

Modifying and Deleting Realms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-44

Defining RADIUS Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-45

Modifying and Deleting RADIUS Servers . . . . . . . . . . . . . . . . . . . . . . . . 3-46

Adding New Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-47

Adding users in IDM: Manual Process . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-47

Modifying and Deleting Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-49

Using the User Import Wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-50

Importing Users from Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . 3-51

Importing Users from an LDAP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-57

Importing Users from XML files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-68

4Troubleshooting IDM

IDM Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2

Using Event Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-4

Using Activity Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-8

Using Decision Manager Tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-9

Miscellaneous . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-10

AIDM Technical Reference

Device Support for IDM Functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-1

Best Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-2

Types of User Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-5

Index

1-1

About ProCurve Identity Driven Manager

Chapter Contents

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2

Why IDM? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3

IDM Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5

Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7

IDM Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-9

Supported Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-9

Operating Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-9

Additional Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-10

Upgrading from Previous Versions of PCM and IDM . . . . . 1-10

Learning to Use ProCurve IDM . . . . . . . . . . . . . . . . . . . . . . . 1-15

Getting ProCurve Documentation From the Web . . . . . . . . 1-15

ProCurve Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-15

1-2

About ProCurve Identity Driven Manager

Introduction

Network usage has skyrocketed with the expansion of the Internet, wireless,

and convergence technologies. This increases the burden on network manag-

ers working to control network usage. Also, the complexity of large networks

makes it difficult to control network access and usage by individual users.

ProCurve Identity Driven Manager (IDM) is an add-on module to the ProCurve

Manager plus (PCM+) application that extends the functionality of PCM+ to

include authorization control features for edge devices in networks using

RADIUS servers and Web-Authentication, MAC-Authentication, or 802.1x

security protocols.

Using IDM simplifies user access configuration by automatically discovering

Microsoft IAS RADIUS Servers, Realms, and users. You can use IDM to

monitor users on the network, and to create and assign "access policies" that

work to dynamically configure edge switches and manage network resources

available to individual users. Using IDM, access rights, quality of service

(QoS), and VLAN enrollment are associated with a user and applied at the

point of entry or "edge" of the network.

Figure 1-1. ProCurve Identity Driven Manager, Client Interface

1-3

About ProCurve Identity Driven Manager

Introduction

Why IDM?

Today, access control using a RADIUS system and ProCurve devices (switches

or wireless access points) is typically made up of several steps.

Figure 1-2. Current Access Control process

1. A client (user) attempts to connect to the network.

2. The edge device recognizes a connection state change, and requests

identifying information about the client. This can include MAC address,

username and password, or more complex information.

3. The switch forwards an access request, including the client information

to the authentication server (RADIUS).

4. The RADIUS server validates the user’s identity in the user directory,

which can be an Active Directory, database or flat file. Based on the

validation result received from the user directory, the authentication

server returns an accept or deny response to the switch.

5. If the user is authenticated, the ProCurve device grants the user access to

the network. If the user is not authenticated, access is denied.

For networks using IDM, access control is enhanced to include authorization

parameters along with the authentication response. IDM enhances existing

network security by adding network authorization information, with access

and resource usage parameters, to the existing authentication process. Using

IDM you can assign access rights and connection attributes at the network

switch, with dynamic configuration based on the time, place, and client that

is generating the access request.

1-4

About ProCurve Identity Driven Manager

Introduction

When using IDM, the authentication process proceeds as described in the first

three steps, but from that point the process changes as follows:

4. The RADIUS server validates the user’s identity in the user directory.

Based on the validation result received from the user directory, the

authentication server returns an accept or deny response to the switch. If

the user is accepted (authenticated), the IDM Agent on the RADIUS server

processes the user information. IDM then inserts the network access

rights configured for the user into the Authentication response sent to the

switch.

5. If the user is authenticated, the switch grants the user access to the

network. The (IDM) authorization information included in the authenti-

cation response is used to configure VLAN access, QoS and Bandwidth

parameters for the user, and what network resources the user can access

based on time and location of the user’s login.

If the user is authenticated by the RADIUS server, but IDM’s authorization

data indicates that the user is attempting to access the network at the

wrong time, or from the wrong location or system, the user’s access

request is denied by IDM.

Figure 1-3. Access Control using IDM

If a user is authenticated in RADIUS, but is unknown to IDM, IDM will not

override RADIUS authentication and default switch settings, unless you

configure it to do so. You can create a "guest" profile in IDM to provide

limited access for unknown users.

1-5

About ProCurve Identity Driven Manager

Introduction

IDM Architecture

In IDM, when a user attempts to connect to the network through an edge

switch, the user is authenticated via the RADIUS Server and user directory.

Then, IDM is used to return the user’s "access profile" along with the authen-

tication response from RADIUS to the switch. The IDM information is used to

dynamically configure the edge switch to provide the appropriate authoriza-

tions to the user, that is, what VLAN the user can access, and what resources

(QoS, bandwidth) the user gets.

The following figure illustrates the IDM architecture and how it fits in with

RADIUS.

Figure 1-4. IDM Architecture

IDM consists of an IDM Agent that is co-resident on the RADIUS server, and

an IDM Server that is co-resident with PCM+. Configuration and access

management tasks are handled via the IDM GUI on the PCM+ management

workstation.

The IDM agent includes:

• A RADIUS interface that captures user authentication information

from the RADIUS server and passes the applicable user data (user-

name, location, time of request) to the IDM Decision Manager. The

interface also passes user access parameters from IDM to the RADIUS

server.

1-6

About ProCurve Identity Driven Manager

Introduction

• A Decision Manager that receives the user data and checks it against

user data in the local IDM data store. Based on the parameters defined

in the data store for the user data received, the Decision Manager

outputs access parameters for VLAN, QoS, bandwidth, and network

resource access to the RADIUS interface component.

• A Local Data Store that contains information on Users and the Access

Policy Groups to which the user belongs. The Access Policy Group

defines the rules that determine the user’s access rights.

The IDM Server provides configuration and monitoring of Identity Driven

Manager. It operates as an add-on module to PCM+, using the PCM model

database to store IDM data, and a Windows GUI (client) to provide access to

configuration and monitoring tools for IDM.

You use the IDM GUI to monitor IDM Agent status and users logged into the

network, and to manage IDM configuration, including:

• Defining access parameters for the network, such as locations, times,

network resources, and access profiles.

• Creating access profiles that define the network resources and

attributes (VLAN, QoS, bandwidth) assigned to users in an Access

Policy Group.

• Creating Access Policy Groups with rules (access policies) that will

be assigned to users in that Group.

• Assigning users to Access Policy Groups.

• Deploying IDM configuration data to the IDM Agent on the RADIUS

server.

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Software de HP

HP Data Protector A.06.11 Manual de usuario

HP ProCurve 3500yl Series Cómo utilizar

HP B6191-90015a Manual de usuario

HP Configuring Arrays Manual de usuario

HP NonStop Pathway/iTS Manual del propietario

HP StorageWorks 1510i - Modular Smart Array Manual de usuario

HP Quality Center Synchronizer 1.2 Manual de usuario

HP 500 G2 Manual de usuario

HP Data Protector A.06.11 Guía de configuración rápida

HP StorageWorks 8/8 - SAN Switch Manual de instrucciones

HP StorageWorks 2/16 - SAN Switch Manual de usuario

HP AJ878A - StorageWorks 320 GB Hard Drive Manual de instrucciones

HP Data Protector A.06.11 Guía de configuración rápida

HP PCL 5 Manual de usuario

HP Designjet T1300 Manual de usuario

HP ProLiant BL280c G6 Manual de usuario

HP VL400 - Vectra - 64 MB RAM Manual de servicio

HP TACL Instrucciones de funcionamiento

HP D6030A - NetServer - E50 Manual de usuario

HP Bc1500 - BladeSystem - Blade PC Manual de usuario

HP T5725 - Compaq Thin Client Manual de instrucciones

HP e-Diagtools 3.02 Manual

HP Integrity BL860c Guía de referencia rápida

HP BB118BV - StorageWorks Data Protector Express... Manual de usuario

Manuales populares de Software de otras marcas

COMPRO

COMPRO COMPROFM Manual de usuario

Muratec

Muratec OFFICEBRIDGE ONLINE Manual de usuario

Oracle

Oracle Contact Center Anywhere 8.1 Manual de usuario

Adobe

Adobe 65007312 - Photoshop Lightroom Manual

Avaya

Avaya NULL One-X for RIM Blackberry Manual de usuario

PS Audio

PS Audio PowerPlay Manual del propietario

Brady

Brady LOCKOUT PRO 3.0 Manual de servicio

Avaya

Avaya Interaction Center Manual de usuario

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manual

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manual de usuario

Oracle

Oracle Application 9i Manual de usuario

Acer

Acer RDM Manual de usuario

Canon

Canon Vixia HF21 Manual de usuario

Canon

Canon ZR950 Manual de usuario

Samsung

Samsung Auto Backup Manual de usuario

Polycom

Polycom Vortex EF2201 Instrucciones de instalación y funcionamiento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manual de usuario

Novell

Novell SP2 - S Manual de instrucciones