Security

The HPE Aruba Networking CX 6300 Switch Series comes with an integrated trusted platform module (TPM) for platform integrity. This ensures the boot process started from a trusted combination of HPE Aruba Networking AOS-CX switches. Other security features include:

• AOS-CX uses FIPS 140-2 validated cryptography for protection of sensitive information.
• Access control list (ACL) support for both IPv4 and IPv6; allows for filtering traffic to prevent unauthorized users from accessing the network, or for controlling network traffic to save resources; rules can either deny or permit traffic to be forwarded; rules can be based on a Layer 2 header or a Layer 3 protocol header
• ACLs also provide filtering based on the IP field, source/ destination IP address/subnet, and source/ destination TCP/UDP port number on a per-VLAN or per-port basis.
• Enrollment over Secure Transport (EST) enables secure certificate enrollment, allowing for easier enterprise management of PKI.
• Remote Authentication Dial-In User Service (RADIUS).
• Terminal Access Controller Access-Control System (TACACS+) delivers an authentication tool using TCP with encryption of the full authentication request, providing additional security.
• Management access security for both on- and off- box authentication for administrative access. RADIUS or TACACS+ can be used to provide encrypted user authentication. Additionally, TACACS+ can also provide admin authorization services.
• Control Plane Policing sets rate limit on control protocols to protect CPU overload from DOS attacks.
• Supports multiple user authentication methods. Uses an IEEE 802.1X supplicant on the client in conjunction with a RADIUS server to authenticate in accordance with industry standards
• Supports MAC-based client authentication Concurrent IEEE 802.1X, Web, and MAC authentication schemes per switch port accepts up to 32 sessions of IEEE 802.1X, Web, and MAC authentications DHCP protection blocks DHCP packets from unauthorized DHCP servers, preventing denial-of-service attacks
• Secure management access delivers secure encryption of all access methods (CLI, GUI, or MIB) through SSHv2, SSL, and/or SNMPv3
• Switch CPU protection provides automatic protection against malicious network traffic trying to shut down the switch
• ICMP throttling defeats ICMP denial-of-service attacks by enabling any switch port to automatically throttle ICMP traffic Identity-driven ACL enables implementation of a highly granular and flexible access security policy and VLAN assignment specific to each authenticated network user
• STP BPDU port protection blocks Bridge Protocol Data Units (BPDUs) on ports that do not require BPDUs, preventing forged BPDU attacks
• Dynamic IP lockdown works with DHCP protection to block traffic from unauthorized hosts, preventing IP source address spoofing