HP A7533A - Brocade 4Gb SAN Switch Base, Administrator'S Manual

Page: 134 / 576

132 Configuring advanced security features
•
00
for the DH Null option
•
01
for the1024 bit key
•
02
for the 1280 bit key
•
03
for the 1536 bit key
•
04
for the 2048 bit key
This section illustrates using the
authUtil
command to display the current authentication parameters and
to set the authentication protocol to DH-CHAP.
Viewing the current authentication parameter settings for a switch
1. Log in to the switch using an account assigned to the admin role.
2. On a switch running Fabric OS 6.0.0 or later, enter
authUtil
--
show
.
Output similar to the following is displayed:
AUTH TYPE HASH TYPE GROUP TYPE
--------------------------------------
fcap,dhchap sha1,md5 0, 1, 2, 3, 4
Switch Authentication Policy: PASSIVE
Device Authentication Policy: OFF
Setting the authentication protocol used by the switch to DH-CHAP
1. Log in to the switch using an account assigned to the admin role.
2. On a switch running Fabric OS 4.x or 5.x, enter
authUtil
--
set -a dhchap
; on a switch running
Fabric OS 3.x, enter
authUtil "
--
set -a dhchap"
.
Output similar to the following is displayed:
Authentication is set to dhchap.
When using DH-CHAP, make sure that you configure the switches at both ends of a link.
NOTE: If you set the authentication protocol to DH-CHAP, have not yet configured shared secrets,
and authentication is checked (for example, you enable the switch), switch authentication fails.
Re-authenticating E_Ports
Use the command
authUtil
to re-initiate the authentication on selected ports. The command provides
flexibility to initiate authentication for specified E_Ports, a set of E_Ports, or all E_Ports on the switch. This
command, however, does not work on private, loop, NPIV and FICON devices. The command can
re-initiate authentication only if the device was previously authenticated. If the authentication fails because
shared secrets do not match, the port is disabled.
This command works independently of the authentication policy; this means you can initiate the
authentication even if the switch is in PASSIVE mode. The command is used to restart authentication after
changing the DH-CHAP group, hash type, or shared secret between a pair of switches.
IMPORTANT: This command may bring down E_Ports if the DH-CHAP shared secrets are not installed
correctly.
1. Log in to the switch using an account assigned to the admin role.
2. On a switch running Fabric OS 5.3.0 and later, enter the following command:
switch:admin> authutil –-authinit <slot/port_number(s)|allE>
Example: Specific ports on the switch
switch:admin> authutil –-authinit 2,3,4