HP AA979A - StorageWorks SAN Switch 2/8V, Administrator'S Manual, Page: 131 / 465

Fabric OS 5.3.0 administrator guide 133
Selecting authentication protocols
Use the
authUtil
command to perform the following tasks:
• Display the current authentication parameters
• Select the authentication protocol used between switches
• Select the Diffie-Hellman (DH) group for a switch
Run the
authUtil
command on the switch you want to view or change. Below are the different options to
specify which DH group you want to use.
• 00 – Dh Null option
• 01 – 1024 bit key
• 02 – 1280 bit key
• 03 - 1536 bit key
• 04 – 2048 bit key
This section illustrates using the
authUtil
command to display the current authentication parameters and
to set the authentication protocol to DH-CHAP. See the Fabric OS Command Reference for more details on
the
authUtil
command.
To view the current authentication parameter settings for a switch:
1. Log in to the switch as admin.
2. On a switch running Fabric OS 5.3.0, type
authUtil --show
.
Output similar to the following is displayed:
AUTH TYPE HASH TYPE GROUP TYPE
--------------------------------------
fcap,dhchap sha1,md5 0, 1, 2, 3, 4
Switch Authentication Policy: PASSIVE
Device Authentication Policy: OFF
To set the authentication protocol used by the switch to DH-CHAP:
1. Log in to the switch as admin.
2. On a switch running Fabric OS v4.x or v5.x, type
authUtil --set -a dhchap
; on a switch
running Fabric OS v3.x, type
authUtil "
--
set -a dhchap"
.
Output similar to the following is displayed:
Authentication is set to dhchap.
When using DH-CHAP, make sure that you configure the switches at both ends of a link.
If you set the authentication protocol to DH-CHAP, have not yet configured shared secrets, and
authentication is checked (for example, you enable the switch), switch authentication fails.
Re-authenticating ports
Use the command
authutil
to re-initiate the authentication on selected ports. It provides flexibility to
initiate authentication for specified E_Ports, set of E_Ports, and all E_Ports on the switch. This command will
not work on Private, Loop, NPIV and FICON devices. The command
authutil
can re-initiate
authentication only if the device was previously authenticated. If the authentication fails because shared
secrets do not match, the port is disabled.
This command works independently of the authentication policy; this means you can initiate the
authentication even if the switch is in PASSIVE mode. This command is used to restart authentication after
changing the DH-CHAP group, hash type, and shared secret between a pair of switches.
CAUTION: This command may bring down the E_Port(s) if the DH-CHAP shared secrets are not installed
correctly.