The switch supports a flag called high secure (hsecure). hsecure introduces the following behaviors for passwords:
10-character enforcement
aging time
limitation of failed logon attempts
protection mechanism to filter certain IP addresses
After you enable the hsecure flag, the software enforces the 10-character rule for all passwords. This password must contain a minimum of two uppercase characters, two lowercase characters, two numbers, and two special characters.
After you enable hsecure, the system requires you to save the configuration file and reboot the system for hsecure to take effect. If the existing password does not meet the minimum requirements for hsecure, the system prompts you to change the password during the first login.
The default username is rwa and the default password is rwa. In hsecure, the system prompts you to change these during first login because they do not meet the minimum requirements for hsecure.
When you enable hsecure, the system disables Simple Network Management Protocol (SNMP) v1, SNMPv2 and SNMPv3. If you want to use SNMP, you must re-enable SNMP, using the command no boot config flag block-snmp.
After you enable the hsecure flag, you can configure a duration after which you must change your password. You configure the duration by using the aging parameter.
For SNMP and File Transfer Protocol (FTP), after a password expires, access is denied. Before you access the system, you must change a community string to a new string consisting of more than eight characters.
Important
Consider the following after you enable the hsecure flag:
You cannot enable the web server for Enterprise Device Manager (EDM) access.
You cannot enable the Secure Shell (SSH) password authentication.
Incorrect IP source addresses as network or broadcast addresses are filtered at the virtual router interface. Source addresses 192.168.168.0 and 192.168.168.255 are discarded.
This change is valid for all IP subnets, not only for /24.
You can filter addresses only if you enable the hsecure mode.