Cisco DS-C9216I-K9, Руководство по настройке

Страница: 223 / 436

19-5
Cisco MDS 9000 Fabric Manager Switch Configuration Guide
OL-7753-01
Chapter 19 Configuring Fabric Security
Configuring Passwords for Other Devices
•
Approach 2—Use a different password for each switch and maintain that password list in each
switch in the fabric--when you add a new switch, you create a new password list and update all
switches with the new list. Accessing one switch yields the password list for all switches in that
fabric.
• Approach 3—Use different passwords for different switches in the fabric--when you add a new
switch, multiple new passwords corresponding to each switch in the fabric must be generated and
configured in each switch. Even if one switch is compromised, the password of other switches are
still protected. This approach requires considerable password maintenance by the user.
We recommend using RADIUS or for fabrics with more than five switches. If you need to
use local password database, you can continue to do so using Approach 3 and using the Cisco MDS 9000
Family Fabric Manager to manage the password database. Refer to the Cisco MDS 9000 Family Fabric
Manager User Guide for further information.
All passwords are restricted to 64 alphanumeric characters and can be changed, but not deleted.
Configuring Passwords for Other Devices
You can configure passwords in the local authentication database for other devices in a fabric. The other
devices are identified by their device name, which is also know as the switch WWN or device WWN.
The password is restricted to 64 characters and can be specified in clear text (0) or in encrypted text (7).
The switch WWN identifies the physical switch. This WWN is used to authenticate the switch and is
different from the VSAN node WWN.
Configuring the DHCHAP Timeout Value
During the DHCHAP protocol exchange if the MDS switch does not receive the expected DHCHAP
message within a specified time interval, authentication failure is assumed. The time ranges from 20 (no
authentication is performed) to 1000 seconds. The default is 30 seconds.
When changing the timeout value consider the following factors:
•
The existing RADIUS and timeout values.
• The same value must also be configured all switches in the fabric.
Default Fabric Security Settings
Table 19-2 lists the default settings for all fabric security features in any switch.
Table 19-2 Default Fabric Security Settings
Parameters Default
DHCHAP feature Disabled.
DHCHAP hash algorithm A priority list of MD-5 followed by SHA-1 for
DHCHAP authentication
DHCHAP authentication mode auto-passive.