382
4.
Establish an SCP connection to the SCP server
192.168.0.1
:
{
Based on the 128-bit Suite B algorithms:
# Specify
server256
as the PKI domain of the server's certificate.
[SwitchB]ssh server pki-domain server256
# Create an SSH user
client001
. Specify the authentication method
publickey
for the user
and specify
client256
as the PKI domain for verifying the client's certificate.
[Switch] ssh user client001 service-type scp authentication-type publickey assign
pki-domain client256
# Establish an SCP connection to the SCP server
192.168.0.1
based on the 128-bit Suite B
algorithms.
<SwitchA> scp 192.168.0.1 get src.cfg suite-b 128-bit pki-domain client256
server-pki
-domain server256
Username: client001
Press CTRL+C to abort.
Connecting to 192.168.0.1 port 22.
src.cfg 100% 4814 4.7KB/s 00:00
<SwitchA>
{
Based on the 192-bit Suite B algorithms:
# Specify
server384
as the PKI domain of the server's certificate.
[SwitchB] ssh server pki-domain server384
# Create an SSH user
client002
. Specify the authentication method
publickey
for the user
and specify
client384
as the PKI domain for verifying the client's certificate.
[Switch] ssh user client002 service-type scp authentication-type publickey assign
pki-domain client384
# Establish an SCP connection to the SCP server
192.168.0.1
based on the 192-bit Suite B
algorithms.
<SwitchA> scp 192.168.0.1 get src.cfg suite-b 192-bit pki-domain client384
server-pki
-domain server384
Username: client002
Press CTRL+C to abort.
Connecting to 192.168.0.1 port 22.
src.cfg 100% 4814 4.7KB/s 00:00
<SwitchA>
NETCONF over SSH configuration example with
password authentication
Unless otherwise noted, the switch in the configuration example is in non-FIPS mode.
When you configure NETCONF-over-SSH on a device that operates in FIPS mode, follow these
restrictions and guidelines:
•
The modulus length of the key pair must be 2048 bits.
•
When the device acts as a NETCONF-over-SSH server, it supports only RSA and ECDSA key
pairs. If both RSA and ECDSA key pairs exist on the server, the server uses the ECDSA key
pair.
