Security Measures
151
Instruction Manual - NXA-ENET8-POE+
Replacing the Default Secure-site Certificate
Use the Security > HTTPS (Copy Certificate) page to replace the default secure-site certificate.
When you log onto the web interface using HTTPS (for secure access), a Secure Sockets Layer (SSL) certificate appears for the
switch. By default, the certificate that the web browser displays will be associated with a warning that the site is not recognized as
a secure site. This is because the certificate has not been signed by an approved certification authority. If you want this warning to
be replaced by a message confirming that the connection to the switch is secure, you must obtain a unique certificate and a private
key and password from a recognized certification authority.
CAUTION:
For maximum security, we recommend you obtain a unique Secure Sockets Layer certificate at the earliest opportunity.
This is because the default certificate for the switch is not unique to the hardware you have purchased.
When you have obtained these, place them on your TFTP server and transfer them to the switch to replace the default
(unrecognized) certificate with an authorized one.
NOTE:
The switch must be reset for the new certificate to be activated. To reset the switch, see the Resetting the System
or type reload at the command prompt: Console#reload
The following table lists the options on this page:
Perform these steps to replace the default secure-site certificate:
1.
Click
Security
>
HTTPS
.
2.
Select
Copy Certificate
from the Step list.
3.
Fill in the TFTP server, certificate and private key file name, and private password.
4.
Click
Apply
.
Configuring the Secure Shell
The Berkeley-standard includes remote access tools originally designed for Unix systems. Some of these tools have also been
implemented for Microsoft Windows and other environments. These tools, including commands such as rlogin (remote login), rsh
(remote shell), and rcp (remote copy), are not secure from hostile attacks.
Secure Shell (SSH) includes server/client applications intended as a secure replacement for the older Berkeley remote access tools.
SSH can also provide remote management access to this switch as a secure replacement for Telnet. When the client contacts the
switch via the SSH protocol, the switch generates a public- key that the client uses along with a local user name and password for
access authentication. SSH also encrypts all data transfers passing between the switch and SSH-enabled management station
clients, and ensures that data traveling over the network arrives unaltered.
NOTE:
You need to install an SSH client on the management station to access the switch for management via the SSH protocol.
NOTE:
The switch supports both SSH Version 1.5 and 2.0 clients.
Security - HTTPS Options
TFTP Server IP Address
IP address of TFTP server which contains the certificate file.
Certificate Source File Name
Name of certificate file stored on the TFTP server.
Private Key Source File Name
Name of private key file stored on the TFTP server.
Private Password
Password stored in the private key file. This password is used to verify authorization for certificate
use, and is verified when downloading the certificate to the switch.
Confirm Password
Re-type the string entered in the previous field to ensure no errors were made. The switch will not
download the certificate if these two fields do not match.
FIG. 179
Downloading the Secure-Site Certificate