Home » D-Link Manuals » Hubs & Switches » D-Link DWS-3160-24TC » Manual Viewer

D-Link DWS-3160-24TC DWS-3160 Series CLI Reference Guide - Page 981

Certification Overview and Usage In the Wireless System, Certificate Generation on the Access Point

View all D-Link DWS-3160-24TC manuals

Add to My Manuals
Save this manual to your list of manuals

Page 981 highlights

DWS-3160 Series Gigabit Ethernet Unified Switch CLI Reference Guide which the AP may establish a connection. The certificates are distributed when the mutual authentication feature is enabled, during AP and Switch provisioning, and triggered by an administrator command. The X.509 mutual certificate exchange is the only mechanism for peer Switches to authenticate with each other because Switches don't support pass-phrase authentication. Note that if the wireless Switch is currently managed by a cluster controller, then any provisioning request toward this Switch will fail. When the X.509 mutual authentication is enabled the AP and peer Switch discovery is slower than when this feature is disabled because certificates are exchanged during the TLS connection setup. Certification Overview and Usage In the Wireless System: The TLS connection has two sides: a client side initiates the connection and the server side accepts the connection. In a Wireless System, the APs act only as TLS clients, and Switches act as either TLS clients or TLS servers. The Switch acts as a TLS client when it establishes a connection to a peer Switch. The TLS protocol supports client verification of server certificates and mutual certificate verification. The Wireless System configures the TLS session to use mutual certificate verification when the mutual authentication mode is enabled. When the mutual authentication mode is disabled, the Wireless System uses anonymous cipher and disables certificate exchange and verification. In order to verify the certificate each device generates a private key and an X.509 certificate. The private key is kept on the device and is not given out to other Switches or APs. The certificate contains a matching public key. The device certificate is given out to other devices in the wireless system. Data encrypted with the public key using the device's certificate can be decrypted with the device's private key. The certificates are encoded using PEM format, which is a Base64 encoded file. The Base64 encoding uses printable ASCII characters to represent binary data. Before the certificate files can be used for certificate validation they are loaded into the OpenSSL library. Each wireless device has a copy of a certificate of the device with which it needs to communicate. During TLS connection establishment the Wireless devices compare the certificate received on the connection setup with all available loaded certificates for other wireless devices. If a matching certificate is found then the certificate verification succeeds. The verification function does not attempt to correlate the IP address of the device with the certificate and it does not check the certificate expiration date. The TLS connections are configured to validate the certificates only on the initial connection setup. The connection reauthentications don't trigger new certificate validation attempts. Certificate Generation on the Access Point: 977

Section	Page
Chapter 1 Using Command Line Interface	5
1-1 Accessing the Switch via the Serial Port	5
1-2 Setting the Switch’s IP Address	7
1-3 Command Syntax Symbols	10
1-4 Line Editing Keys	11
Chapter 2 Basic Command List	14
2-1 show session	14
Description	14
Format	14
Parameters	14
Restrictions	14
Example	14
2-2 show serial_port	15
Description	15
Format	15
Parameters	15
Restrictions	15
Example	15
2-3 config serial_port	15
Description	15
Format	16
Parameters	16
Restrictions	16
Example	16
2-4 enable clipaging	16
Description	16
Format	16
Parameters	16
Restrictions	17
Example	17
2-5 disable clipaging	17
Description	17
Format	17
Parameters	17
Restrictions	17
Example	17
2-6 login	17
Description	17
Format	18
Parameters	18
Restrictions	18
Example	18
2-7 logout	18
Description	18
Format	18
Parameters	18
Restrictions	18
Example	18
2-8 ?	19
Description	19
Format	19
Parameters	19
Restrictions	19
Example	19
2-9 clear	20
Description	20
Format	20
Parameters	20
Restrictions	20
Example	20
2-10 show command_history	20
Description	20
Format	20
Parameters	20
Restrictions	20
Example	20
2-11 config command_history	21
Description	21
Format	21
Parameters	21
Restrictions	21
Example	21
2-12 config greeting_message	21
Description	21
Format	22
Parameters	22
Restrictions	22
Example	22
2-13 show greeting_message	22
Description	22
Format	22
Parameters	23
Restrictions	23
Example	23
2-14 config command_prompt	23
Description	23
Format	23
Parameters	23
Restrictions	23
Example	24
2-15 config terminal width	24
Description	24
Format	24
Parameters	24
Restrictions	24
Example	24
2-16 show terminal width	25
Description	25
Format	25
Parameters	25
Restrictions	25
Example	25
2-17 config ports	25
Description	25
Format	25
Parameters	25
Restrictions	26
Example	26
2-18 show ports	26
Description	26
Format	27
Parameters	27
Restrictions	27
Example	27
Chapter 3 802.1Q VLAN Command List	28
3-1 create vlan	28
Description	28
Format	28
Parameters	28
Restrictions	29
Example	29
3-2 create vlan vlanid	29
Description	29
Format	29
Parameters	29
Restrictions	29
Example	29
3-3 delete vlan	30
Description	30
Format	30
Parameters	30
Restrictions	30
Example	30
3-4 delete vlan vlanid	30
Description	30
Format	30
Parameters	30
Restrictions	31
Example	31
3-5 config vlan	31
Description	31
Format	31
Parameters	31
Restrictions	31
Example	31
3-6 config vlan vlanid	32
Description	32
Format	32
Parameters	32
Restrictions	32
Example	32
3-7 config port_vlan	33
Description	33
Format	33
Parameters	33
Restrictions	33
Example	33
3-8 show vlan	34
Description	34
Format	34
Parameters	34
Restrictions	34
Example	34
3-9 show vlan ports	35
Description	35
Format	35
Parameters	35
Restrictions	35
Example	35
3-10 show vlan vlanid	36
Description	36
Format	36
Parameters	36
Restrictions	36
Example	36
3-11 show port_vlan	36
Description	36
Format	36
Parameters	37
Restrictions	37
Example	37
3-12 enable pvid auto assign	37
Description	37
Format	38
Parameters	38
Restrictions	38
Example	38
3-13 disable pvid auto assign	38
Description	38
Format	38
Parameters	38
Restrictions	38
Example	38
3-14 show pvid auto_assign	39
Description	39
Format	39
Parameters	39
Restrictions	39
Example	39
3-15 config gvrp	39
Description	39
Format	39
Parameters	39
Restrictions	40
Example	40
3-16 show gvrp	40
Description	40
Format	40
Parameters	40
Restrictions	40
Example	40
3-17 enable gvrp	41
Description	41
Format	41
Parameters	41
Restrictions	41
Example	41
3-18 disable gvrp	41
Description	41
Format	41
Parameters	42
Restrictions	42
Example	42
3-19 config private_vlan	42
Description	42
Format	42
Parameters	42
Restrictions	42
Example	42
3-20 show private vlan	43
Description	43
Format	43
Parameters	43
Restrictions	43
Example	43
Chapter 4 802.1X Command List	44
4-1 enable 802.1x	44
Description	44
Format	44
Parameters	45
Restrictions	45
Example	45
4-2 disable 802.1x	45
Description	45
Format	45
Parameters	45
Restrictions	45
Example	45
4-3 create 802.1x user	46
Description	46
Format	46
Parameters	46
Restrictions	46
Example	46
4-4 delete 802.1x user	46
Description	46
Format	46
Parameters	46
Restrictions	46
Example	47
4-5 show 802.1x user	47
Description	47
Format	47
Parameters	47
Restrictions	47
Example	47
4-6 config 802.1x auth_protocol	47
Description	47
Format	47
Parameters	48
Restrictions	48
Example	48
4-7 config 802.1x fwd_pdu system	48
Description	48
Format	48
Parameters	48
Restrictions	48
Example	48
4-8 config 802.1x fwd_pdu ports	49
Description	49
Format	49
Parameters	49
Restrictions	49
Example	49
4-9 config 802.1x authorization attributes	49
Description	49
Format	50
Parameters	50
Restrictions	50
Example	50
4-10 show 802.1x	50
Description	50
Format	50
Parameters	50
Restrictions	50
Example	50
4-11 config 802.1x capability	51
Description	51
Format	51
Parameters	51
Restrictions	51
Example	51
4-12 config 802.1x max_users	52
Description	52
Format	52
Parameters	52
Restrictions	52
Example	52
4-13 config 802.1x auth_parameter	52
Description	52
Format	52
Parameters	53
Restrictions	53
Example	53
4-14 config 802.1x auth_mode	54
Description	54
Format	54
Parameters	54
Restrictions	54
Example	54
4-15 config 802.1x init	54
Description	54
Format	54
Parameters	54
Restrictions	55
Example	55
4-16 config 802.1x reauth	55
Description	55
Format	55
Parameters	55
Restrictions	55
Example	55
4-17 create 802.1x guest_vlan	56
Description	56
Format	56
Parameters	56
Restrictions	56
Example	56
4-18 delete 802.1x guest_vlan	56
Description	56
Format	56
Parameters	57
Restrictions	57
Example	57
4-19 config 802.1x guest_vlan	57
Description	57
Format	57
Parameters	57
Restrictions	57
Example	57
4-20 show 802.1x guest_vlan	58
Description	58
Format	58
Parameters	58
Restrictions	58
Example	58
4-21 config radius add	58
Description	58
Format	59
Parameters	59
Restrictions	59
Example	59
4-22 config radius delete	59
Description	59
Format	60
Parameters	60
Restrictions	60
Example	60
4-23 config radius	60
Description	60
Format	60
Parameters	60
Restrictions	61
Example	61
4-24 show radius	61
Description	61
Format	61
Parameters	61
Restrictions	61
Example	61
4-25 show auth_statistics	62
Description	62
Format	62
Parameters	62
Restrictions	62
Example	62
4-26 show auth_diagnostics	63
Description	63
Format	63
Parameters	63
Restrictions	63
Example	63
4-27 show auth_session_statistics	64
Description	64
Format	64
Parameters	64
Restrictions	64
Example	64
4-28 show auth_client	65
Description	65
Format	65
Parameters	65
Restrictions	65
Example	65
4-29 show acct_client	66
Description	66
Format	66
Parameters	66
Restrictions	66
Example	66
4-30 config accounting service	67
Description	67
Format	67
Parameters	67
Restrictions	67
Example	68
4-31 show accounting service	68
Description	68
Format	68
Parameters	68
Restrictions	68
Example	68
Chapter 5 Access Authentication Control Command List	69
5-1 enable password encryption	69
Description	69
Format	69
Parameters	70
Restrictions	70
Example	70
5-2 disable password encryption	70
Description	70
Format	70
Parameters	70
Restrictions	70
Example	70
5-3 enable authen_policy	71
Description	71
Format	71
Parameters	71
Restrictions	71
Example	71
5-4 disable authen_policy	71
Description	71
Format	71
Parameters	71
Restrictions	72
Example	72
5-5 show authen_policy	72
Description	72
Format	72
Parameters	72
Restrictions	72
Example	72
5-6 create authen_login	72
Description	72
Format	73
Parameters	73
Restrictions	73
Example	73
5-7 config authen_login	73
Description	73
Format	73
Parameters	73
Restrictions	74
Example	74
5-8 delete authen_login	74
Description	74
Format	74
Parameters	74
Restrictions	74
Example	74
5-9 show authen_login	75
Description	75
Format	75
Parameters	75
Restrictions	75
Example	75
5-10 create authen_enable	75
Description	75
Format	75
Parameters	75
Restrictions	76
Example	76
5-11 config authen_enable	76
Description	76
Format	76
Parameters	76
Restrictions	76
Example	77
5-12 delete authen_enable	77
Description	77
Format	77
Parameters	77
Restrictions	77
Example	77
5-13 show authen_enable	77
Description	77
Format	77
Parameters	78
Restrictions	78

Match case Limit results 1 per page

DWS-3160 Series Gigabit Ethernet Unified Switch CLI Reference Guide

977

which the AP may establish a connection. The certificates are distributed when the mutual

authentication feature is enabled, during AP and Switch provisioning, and triggered by an

administrator command.

The X.509 mutual certificate exchange is the only mechanism for peer Switches to authenticate

with each other because Switches don't support pass-phrase authentication. Note that if the

wireless Switch is currently managed by a cluster controller, then any provisioning request toward

this Switch will fail.

When the X.509 mutual authentication is enabled the AP and peer Switch discovery is slower than

when this feature is disabled because certificates are exchanged during the TLS connection setup.

Certification Overview and Usage In the Wireless System:

The TLS connection has two sides: a client side initiates the connection and the server side

accepts the connection. In a Wireless System, the APs act only as TLS clients, and Switches act

as either TLS clients or TLS servers. The Switch acts as a TLS client when it establishes a

connection to a peer Switch.

The TLS protocol supports client verification of server certificates and mutual certificate verification.

The Wireless System configures the TLS session to use mutual certificate verification when the

mutual authentication mode is enabled. When the mutual authentication mode is disabled, the

Wireless System uses anonymous cipher and disables certificate exchange and verification.

In order to verify the certificate each device generates a private key and an X.509 certificate. The

private key is kept on the device and is not given out to other Switches or APs. The certificate

contains a matching public key. The device certificate is given out to other devices in the wireless

system. Data encrypted with the public key using the device's certificate can be decrypted with the

device's private key.

The certificates are encoded using PEM format, which is a Base64 encoded file. The Base64

encoding uses printable ASCII characters to represent binary data. Before the certificate files can

be used for certificate validation they are loaded into the OpenSSL library.

Each wireless device has a copy of a certificate of the device with which it needs to communicate.

During TLS connection establishment the Wireless devices compare the certificate received on the

connection setup with all available loaded certificates for other wireless devices. If a matching

certificate is found then the certificate verification succeeds. The verification function does not

attempt to correlate the IP address of the device with the certificate and it does not check the

certificate expiration date.

The TLS connections are configured to validate the certificates only on the initial connection setup.

The connection reauthentications don't trigger new certificate validation attempts.

Certificate Generation on the Access Point: