HP E3800 Series, Access Security Manual

Page: 708 / 732

16-6
Key Management System
Configuring Key Chain Management
N o t e
Using time-dependent keys requires that all the switches have accurate,
synchronized time settings. You can manually set the time or use the Time
protocol feature included in the switches. For more information, refer to the
chapter covering time protocols in the
Management and Configuration
Guide for your switch.
For example, to add a number of keys to the key chain entry HP Switch2:
Figure 16-3. Adding Time-Dependent Keys to a Key Chain Entry
N o t e
Given transmission delays and the variations in the time value from switch to
switch, it is advisable to include some flexibility in the Accept lifetime of the
keys you configure. Otherwise, the switch can disregard some packets
because either their key has expired while in transport or there are significant
time variations between switches.
To list the result of the commands in figure 16-3:
HP Switch(config)# key-chain HP Switch2 key 1 accept-lifetime 01/17/03 8:00:00
01/18/11 8:10:00 send-lifetime 01/17/03 8:00:00 01/18/11 8:00:00
HP Switch(config)# key-chain HP Switch2 key 2 accept-lifetime 01/18/03 8:00:00
duration 87000 send-lifetime 01/18/03 8:00:00 duration 86400
HP Switch(config)# key-chain HP Switch2 key 3 accept-lifetime 01/19/03 8:00:00
duration 87000 send-lifetime 01/19/03 8:00:00 duration 86400
HP Switch(config)# key-chain HP Switch2 key 4 accept-lifetime 01/20/03 8:00:00
duration 87000 send-lifetime 01/20/03 8:00:00 duration 86400
HP Switch(config)# key-chain HP Switch2 key 5 accept-lifetime 01/21/03 8:00:00
duration 87000 send-lifetime 01/21/03 8:00:00 duration 86400
Adds a key with
full time and date
Adds a key with
duration
expressed in
seconds.