HP Fabric OS 7.1.0, Administrator'S Manual

Page: 208 / 666

208 Fabric OS Administrator’s Guide
53-1002745-02
Authentication policy for fabric elements
7
FIGURE 13
DH-CHAP authentication
If you use DH-CHAP authentication, then a secret key pair must be installed only in connected
fabric elements. However, as connections are changed, new secret key pairs must be installed
between newly connected elements. Alternatively, a secret key pair for all possible connections
may be initially installed, enabling links to be arbitrarily changed while still maintaining a valid
secret key pair for any new connection.
The switch authentication (AUTH) policy initiates DH-CHAP/FCAP authentication on all E_Ports. This
policy is persistent across reboots, which means authentication will be initiated automatically on
ports or switches brought online if the policy is set to activate authentication. The AUTH policy is
distributed by command; automatic distribution of the AUTH policy is not supported.
The default configuration directs the switch to attempt FCAP authentication first, DH-CHAP second.
The switch may be configured to negotiate FCAP, DH-CHAP, or both.
The DH group is used in the DH-CHAP protocol only. The FCAP protocol exchanges the DH group
information, but does not use it.
Virtual Fabrics considerations
If Virtual Fabrics is enabled, all AUTH module parameters such as shared secrets, and shared
switch and device policies, are logical switch-wide. That means you must configure shared secrets
and policies separately on each logical switch and the shared secrets and policies must be set on
each switch prior to authentication. On logical switch creation, authentication takes default values
for policies and other parameters. FCAP certificates are installed on a chassis, but are configured
on each logical switch.
E_Port authentication
The authentication (AUTH) policy allows you to configure DH-CHAP authentication on switches with
Fabric OS v5.3.0 and later. By default the policy is set to PASSIVE and you can change the policy. All
changes to the AUTH policy take effect during the next authentication request. This includes
starting authentication on all E_Ports on the local switch if the policy is changed to ON or ACTIVE,
and clearing the authentication if the policy is changed to OFF. The authentication configurations
will be effective only on subsequent E_ and F_Port initialization.
ATTENTION
A secret key pair has to be installed prior to changing the policy. For more information on setting up
secret key pairs, refer to “Setting a secret key pair” on page 214.
Switch A
Switch B
Key database on switch
Local secret A
Peer secret B
Key database on switch
Local secret B
Peer secret A