HP Fabric OS v7.0.1, Руководство администратора

Страница: 356 / 584

318 Fabric OS Administrator’s Guide
53-1002446-01
Encryption and compression example
14
Example of enabling encryption and compression on a port
This example configures and enables encryption and compression on a given port. Authentication
and secret key must also be configured as these are required before configuring encryption. The
commands in this example are shown entered on the Brocade 6510 named myswitch. The same
commands must also be entered on the peer switch.
This first part of the example shows a command sequence that sets up authentication in
preparation for in-flight encryption. Specifically, it configures the DH-CHAP protocol for
authentication, sets the DH group to group 4, and activates authentication:
myswitch:root> authutil --show
AUTH TYPE HASH TYPE GROUP TYPE
--------------------------------------
fcap,dhchap sha1,md5 0,1,2,3,4
Switch Authentication Policy: PASSIVE
Device Authentication Policy: OFF
myswitch:root> authutil --set -a dhchap
myswitch:root> authutil --set -g “*”
myswitch:root> authutil --policy -sw active
Warning: Activating the authentication policy requires either DH-CHAP secrets
or PKI certificates depending on the protocol selected. Otherwise, ISLs will
be segmented during next E-port bring-up.
ARE YOU SURE (yes, y, no, n): [no]
y
Auth Policy is set to ON
myswitch:root>
authutil --show
AUTH TYPE HASH TYPE GROUP TYPE
--------------------------------------
dhchap md5 4
Switch Authentication Policy: ON
Device Authentication Policy: OFF
myswitch:root>
Next, you set a secret key. For this you need to get the WWN of the peer switch.
myswitch:root> secauthsecret
Usage: secAuthSecret <args>
--show: displays the secret key database
--set: sets up (add or modify) secret keys
--remove [wwn | domain | <sw name>]: removes an entry from secret key database
--remove --all: deletes secret key database
myswitch:root>
secauthsecret --set
This command is used to set up secret keys for the DH-CHAP authentication.
The minimum length of a secret key is 8 characters and maximum 40
characters. Setting up secret keys does not initiate DH-CHAP
authentication. If switch is configured to do DH-CHAP, it is performed
whenever a port or a switch is enabled.
Warning: Please use a secure channel for setting secrets. Using
an insecure channel is not safe and may compromise secrets.
Following inputs should be specified for each entry.
1. WWN for which secret is being set up.