162
Configuring Switch-Based Authentication
Information About Configuring Switch-Based Authentication
The switch supports an SSHv1 client.
SSH supports the Data Encryption Standard (DES) encryption algorithm, the Triple DES (3DES) encryption algorithm, and
password-based user authentication.
SSH also supports these user authentication methods:
(for more information, see
RADIUS (for more information, see
Configuring Radius Server Communication, page 172
)
Local authentication and authorization (for more information, see
Configuring the Switch for Local Authentication and
)
Note:
This software release does not support IP Security (IPSec).
Limitations
These limitations apply to SSH:
The switch supports Rivest, Shamir, and Adelman (RSA) authentication.
SSH supports only the execution-shell application.
The SSH server and the SSH client are supported only on DES (56-bit) and 3DES (168-bit) data encryption software.
The switch supports the Advanced Encryption Standard (AES) encryption algorithm with a 128-bit key, 192-bit key,
or 256-bit key. However, symmetric cipher AES to encrypt the keys is not supported.
SSH Configuration Guidelines
Follow these guidelines when configuring the switch as an SSH server or SSH client:
An RSA key pair generated by a SSHv1 server can be used by an SSHv2 server, and the reverse.
If you get CLI error messages after entering the
crypto key generate rsa
global configuration command, an RSA key
pair has not been generated. Reconfigure the hostname and domain, and then enter the
crypto key generate rsa
command. For more information, see
Setting Up the Switch to Run SSH, page 179
When generating the RSA key pair, the message
No host name specified
might appear. If it does, you must
configure a hostname by using the
hostname
global configuration command.
When generating the RSA key pair, the message
No domain specified
might appear. If it does, you must configure
an IP domain name by using the
ip domain-name
global configuration command.
When configuring the local authentication and authorization authentication method, make sure that AAA is disabled
on the console.
Switch for Secure Socket Layer HTTP
Secure Socket Layer (SSL) version 3.0 supports the HTTP 1.1 server and client. SSL provides server authentication,
encryption, and message integrity, as well as HTTP client authentication, to allow secure HTTP communications. To use
this feature, the cryptographic (encrypted) software image must be installed on your switch. You must obtain
authorization to use this feature and to download the cryptographic software files from Cisco.com. For more information
about the crypto image, see the release notes for this release.
Содержание IE 4000
Страница 12: ...8 Configuration Overview Default Settings After Initial Switch Configuration ...
Страница 52: ...48 Configuring Interfaces Monitoring and Maintaining the Interfaces ...
Страница 108: ...104 Configuring Switch Clusters Additional References ...
Страница 128: ...124 Performing Switch Administration Additional References ...
Страница 130: ...126 Configuring PTP ...
Страница 140: ...136 Configuring CIP Additional References ...
Страница 146: ...142 Configuring SDM Templates Configuration Examples for Configuring SDM Templates ...
Страница 192: ...188 Configuring Switch Based Authentication Additional References ...
Страница 244: ...240 Configuring IEEE 802 1x Port Based Authentication Additional References ...
Страница 274: ...270 Configuring SGT Exchange Protocol over TCP SXP and Layer 3 Transport Configuring Cisco TrustSec Caching ...
Страница 298: ...294 Configuring VLANs Additional References ...
Страница 336: ...332 Configuring STP Additional References ...
Страница 408: ...404 Configuring DHCP Additional References ...
Страница 450: ...446 Configuring IGMP Snooping and MVR Additional References ...
Страница 490: ...486 Configuring SPAN and RSPAN Additional References ...
Страница 502: ...498 Configuring Layer 2 NAT ...
Страница 559: ...555 Configuring Network Security with ACLs How to Configure Network Security with ACLs Creating a Numbered Extended ACL ...
Страница 770: ...766 Configuring IPv6 MLD Snooping Related Documents ...
Страница 930: ...926 Configuring IP Unicast Routing Related Documents ...
Страница 956: ...952 Configuring IPv6 Unicast Routing Configuring IPv6 network 2010 AB8 2 48 network 2010 AB8 3 48 exit address family ...
Страница 976: ...972 Configuring Cisco IOS IP SLAs Operations Additional References ...
Страница 978: ...974 Dying Gasp ...
Страница 990: ...986 Configuring Enhanced Object Tracking Monitoring Enhanced Object Tracking ...
Страница 994: ...990 Configuring MODBUS TCP Displaying MODBUS TCP Information ...
Страница 996: ...992 Ethernet CFM ...
Страница 1030: ...1026 Working with the Cisco IOS File System Configuration Files and Software Images Working with Software Images ...
Страница 1066: ...1062 Using an SD Card SD Card Alarms ...