HP 10500 series, Security Configuration Manual, Page: 406 / 596

392
[SwitchB] interface vlan-interface 2
[SwitchB-Vlan-interface2] ip address 192.168.1.40 255.255.255.0
[SwitchB-Vlan-interface2] quit
# Set the authentication mode to AAA for the user lines.
[SwitchB] line vty 0 15
[SwitchB-line-vty0-15] authentication-mode scheme
[SwitchB-line-vty0-15] quit
# Import the peer public key from the file key.pub , and name it switchkey .
[SwitchB] public-key peer switchkey import sshkey key.pub
# Create an SSH user client002 . Specify the authentication method as publickey for the user.
Assign the public key switchkey to the user.
[SwitchB] ssh user client002 service-type stelnet authentication-type publickey
assign publickey switchkey
# Create a local device management user client002 .
[SwitchB] local-user client002 class manage
# Authorize the local user client002 to use the SSH service.
[SwitchB-luser-manage-client002] service-type ssh
# Assign the user role network-admin to the local user client002 .
[SwitchB-luser-manage-client002] authorization-attribute user-role network-admin
[SwitchB-luser-manage-client002] quit
3. Establish an SSH connection to the Stelnet server 192.168.1.40 .
<SwitchA> ssh2 192.168.1.40
Username: client002
The server is not authenticated. Continue? [Y/N]:y
Do you want to save the server public key? [Y/N]:n
Select Yes to access the server and download the server's host public key. At the next
connection attempt, the client authenticates the server by using the saved server's host public
key on the client.
Stelnet configuration example based on 128-bit Suite B
algorithms
Network requirements
As shown in Figure 110 :
•
Switch A acts as an Stelnet client (SSH2).
•
Switch B acts as the Stelnet server (SSH2), and it uses publickey authentication.
•
Switch B uses the following algorithms for the algorithm negotiation with the Stelnet client:
{
Key exchange algorithm ecdh-sha2-nistp256 .
{
Encryption algorithm aes128-gcm .
{
Public key algorithms x509v3-ecdsa-sha2-nistp256 and x509v3-ecdsa-sha2-nistp384 .
Configure Switch A to establish an Stelnet connection to Switch B based on the 128-bit Suite B
algorithms. After the connection is established, you can log in to Switch B to configure and manage
Switch B.