Home » HP Manuals » Storage Devices » HP Cisco Nexus 5000 » Manual Viewer

HP Cisco Nexus 5000 Cisco MDS 9000 Family CLI Configuration Guide - Release 4. - Page 871

Configuring Certificate Authorities and Digital Certificates, About CAs and Digital Certificates

View all HP Cisco Nexus 5000 manuals

Add to My Manuals
Save this manual to your list of manuals

Page 871 highlights

Send documentation comments to [email protected] 36 C H A P T E R Configuring Certificate Authorities and Digital Certificates Public Key Infrastructure (PKI) support provides the means for the Cisco MDS 9000 Family switches to obtain and use digital certificates for secure communication in the network. PKI support provides manageability and scalability for IPsec/IKE and SSH. This chapter includes the following sections: • About CAs and Digital Certificates, page 36-1 • Configuring CAs and Digital Certificates, page 36-5 • Example Configurations, page 36-15 • Maximum Limits, page 36-37 • Default Settings, page 36-38 About CAs and Digital Certificates This section provides information about certificate authorities (CAs) and digital certificates, and includes the following topics: • Purpose of CAs and Digital Certificates, page 36-2 • Trust Model, Trust Points, and Identity CAs, page 36-2 • RSA Key-Pairs and Identity Certificates, page 36-2 • Multiple Trusted CA Support, page 36-3 • PKI Enrollment Support, page 36-4 • Manual Enrollment Using Cut-and-Paste Method, page 36-4 • Multiple RSA Key-Pair and Identity CA Support, page 36-4 • Peer Certificate Verification, page 36-4 • CRL Downloading, Caching, and Checking Support, page 36-5 • OCSP Support, page 36-5 • Import and Export Support for Certificates and Associated Key Pairs, page 36-5 OL-18084-01, Cisco MDS NX-OS Release 4.x Cisco MDS 9000 Family CLI Configuration Guide 36-1

Section	Page
Cisco MDS 9000 Family CLI Configuration Guide, Release 4.x	1
Contents	3
New and Changed Information	57
Preface	61
Obtaining Documentation and Submitting a Service Request	68
Part 1	69
Getting Started	69
Product Overview	71
Hardware Overview	71
Cisco MDS 9500 Series Multilayer Directors	72
Cisco MDS 9200 Series Fabric Switches	73
Cisco MDS 9216i Multiprotocol Fabric Switch	73
Cisco MDS 9222i Multilayer Fabric Switch	73
Cisco MDS 9100 Series Fixed Configuration Fabric Switches	74
Cisco NX-OS Software Configuration	74
Tools for Software Configuration	75
CLI	75
Cisco MDS 9000 Fabric Manager	75
Software Configuration Overview	76
Basic Configuration	76
Advanced Configuration	76
Switch Configuration	77
Fabric Configuration	77
Security	77
IP Services	77
Intelligent Storage Services	78
Network and Switch Monitoring	78
Traffic Management	78
Before You Begin	79
About the Switch Prompt	80
Default Switch Roles	81
Using the CLI	81
CLI Command Modes	81
CLI Command Hierarchy	82
EXEC Mode Options	83
Configuration Mode	84
Configuration Mode Commands and Submodes	84
Displaying the Present Working Context	87
CLI Command Navigation	88
Command Completion	88
File System Completion	88
The no and Default Forms of Commands	88
CLI Command Configuration Options	89
Getting Help	89
Managing the Switch Configuration	90
Displaying the Switch Configuration	90
Saving a Configuration	93
Clearing a Configuration	93
Displaying Users	93
Sending Messages to Users	93
Using the ping and ping ipv6 Commands	93
Using the Extended ping and ping ipv6 Commands	94
Using traceroute and traceroute ipv6 Commands	95
Configuring Terminal Parameters	96
Setting the Terminal Session Timeout	96
Displaying Terminal Sessions	97
Clearing Terminal Sessions	97
Setting the Terminal Timeout	97
Setting the Terminal Type	97
Setting the Terminal Screen Length	98
Setting the Terminal Screen Width	98
Displaying Terminal Settings	98
Configuring the Switch Banner Message	98
Directing show Command Output to a File	99
Using CLI Variables	99
User-Defined CLI Persistent Variables	100
System-Defined Variables	101
Using Command Aliases	101
Defining Command Aliases	102
About Flash Devices	102
Internal bootflash	103
External CompactFlash (Slot0)	103
Formatting Flash Devices and File Systems	103
Initializing Internal bootflash	103
Formatting External CompactFlash	104
Using Switch File Systems	104
Specifying File Systems	105
Setting the Current Directory	106
Displaying the Current Directory	106
Displaying File Checksums	107
Listing the Files in a Directory	107
Creating a Directory	107
Deleting an Existing Directory	107
Moving Files	108
Copying Files	108
Deleting Files	109
Displaying File Contents	110
Saving Command Output to a File	110
Compressing and Uncompressing Files	110
Displaying the Last Lines in a File	111
Command Scripts	111
Executing Commands Specified in a Script	111
Using CLI Variables in Scripts	112
Setting the Delay Time	113
Part 2	115
Installation and Switch Management	115
Obtaining and Installing Licenses	117
Licensing Terminology	117
Licensing Model	118
Licensing High Availability	124
Options to Install a License	124
Obtaining a Factory-Installed License	125
Performing a Manual Installation	125
Obtaining the License Key File	126
Installing the License Key File	126
Installing the License Key File to a Remote Location	128
Backing Up License Files	128
Identifying License Features in Use	128
Uninstalling Licenses	129
Updating Licenses	130
Grace Period Alerts	131
License Transfers Between Switches	132
Displaying License Information	133
On-Demand Port Activation Licensing	135
About On-Demand Port Activation Licensing	135
Port-Naming Conventions	136
Port Licensing	136
Default Configuration	138
License Status Definitions	142
Configuring Port Activation Licenses	144
Making a Port Eligible for a License	145
Acquiring a License for a Port	145
Moving Licenses Among Ports	146
On-Demand Port Activation License Example	147
Initial Configuration	151
Starting a Switch in the Cisco MDS 9000 Family	152
Initial Setup Routine	153
Preparing to Configure the Switch	153
Default Login	154
Setup Options	154
Assigning Setup Information	155
Configuring Out-of-Band Management	156
Configuring In-Band Management	161
Using the setup Command	165
Accessing the Switch	165
Assigning a Switch Name	166
Where Do You Go Next?	166
Verifying the Module Status	167
Configuring Date, Time, and Time Zone	167
Configuring the Time Zone	168
Adjusting for Daylight Saving Time or Summer Time	168
NTP Configuration	169
About NTP	170
NTP Configuration Guidelines	170
Configuring NTP	171
NTP CFS Distribution	174
Enabling NTP Distribution	174
Committing NTP Configuration Changes	174
Discarding NTP Configuration Changes	175
Releasing Fabric Session Lock	175
Database Merge Guidelines	175
NTP Session Status Verification	175
Management Interface Configuration	176
Obtaining Remote Management Access	176
Using the force Option During Shutdown	177
Default Gateway Configuration	177
Configuring the Default Gateway	178
Telnet Server Connection	178
Disabling a Telnet Connection	179
Configuring Console Port Settings	179
Verifying Console Port Settings	179
Configuring COM1 Port Settings	180
Verifying COM1 Port Settings	181
Configuring Modem Connections	181
Guidelines to Configure Modems	182
Enabling Modem Connections	183
Configuring the Initialization String	183
Configuring the Default Initialization String	184
Configuring a User-Specified Initialization String	185
Initializing a Modem in a Powered-On Switch	185
Verifying the Modem Connection Configuration	186
Configuring CDP	187
Clearing CDP Counters and Tables	188
Displaying CDP Information	188
Configuring FlexAttach Virtual pWWN	193
About FlexAttach Virtual pWWN	193
FlexAttach Virtual pWWN Guidelines and Requirements	194
Configuring FlexAttach Virtual pWWN	194
Enabling FlexAttach Virtual pWWN	194
Automatically Enabling FlexAttach Virtual pWWN	194
Manually Enabling FlexAttach Virtual pWWN	195
Mapping pWWN to Virtual pWWN	195
Verifying FlexAttach Virtual pWWN	196
Verifying the End Device	196
Debugging FlexAttach Virtual pWWN	197
Security Settings for FlexAttach Virtual pWWN	197
FlexAttach Virtual pWWN CFS Distribution	198
Difference Between San Device Virtualization and FlexAttach Port Virtualization	198
Using the CFS Infrastructure	199
About CFS	199
Cisco MDS NX-OS Features Using CFS	200
CFS Features	200
CFS Protocol	201
CFS Distribution Scopes	201
CFS Distribution Modes	202
Uncoordinated Distribution	202
Coordinated Distribution	202
Unrestricted Uncoordinated Distributions	202
Disabling CFS Distribution on a Switch	202
Verifying CFS Distribution Status	203
CFS Application Requirements	203
Enabling CFS for an Application	204
Verifying Application Registration Status	204
Locking the Fabric	205
Verifying CFS Lock Status	205
Committing Changes	206
Discarding Changes	206
Saving the Configuration	206
Clearing a Locked Session	206
CFS Merge Support	207
Verifying CFS Merge Status	207
CFS Distribution over IP	209
Enabling CFS Over IP	211
Verifying the CFS Over IP Configuration	211
Configuring IP Multicast Address for CFS over IP	211
Verifying IP Multicast Address Configuration for CFS over IP	212
Configuring Static IP Peers for CFS over IP	212
Verifying Static IP Peer Configuration	214
CFS Regions	215
About CFS Regions	215
Managing CFS Regions	216
Creating CFS Regions	216
Assigning Applications to CFS Regions	216
Moving an Application to a Different CFS Region	216
Removing an Application from a Region	217
Deleting CFS Regions	217
Displaying CFS Regions	217
Default Settings	217
Software Images	219
About Software Images	219
Dependent Factors for Software Installation	220
Selecting the Correct Software Images for Cisco MDS 9100 Series Switches	220
Selecting the Correct Software Images for Cisco MDS 9200 Series Switches	220
Selecting the Correct Software Images for Cisco MDS 9500 Family Switches	220
Essential Upgrade Prerequisites	221
Software Upgrade Methods	223
Determining Software Compatibility	224
Automated Upgrades	225
Benefits of Using the install all Command	225
Recognizing Failure Cases	226
Using the install all Command	227
Upgrading Services Modules	230
Sample install all Commands	231
Upgrade Status Verification	238
Nondisruptive Upgrades on Fabric and Modular Switches	239
Preparing for a Nondisruptive Upgrade on Fabric and Modular Switches	239
Performing a Nondisruptive Upgrade on a Fabric Switch	242
Viewing the Status of a Nondisruptive Upgrade on a Fabric Switch	243
Troubleshooting a Nondisruptive Upgrade on a Fabric Switch	244
Manual Upgrade on a Dual Supervisor Module Switch	244
Preparing for a Manual Installation	245
Upgrading a Loader	246
Upgrading the BIOS	248
Quick Upgrade	249
Downgrading from a Higher Release	249
Maintaining Supervisor Modules	250
Replacing Supervisor Modules	251
Migrating from Supervisor-1 Modules to Supervisor-2 Modules	251
Standby Supervisor Module Boot Variable Version	251
Standby Supervisor Module Bootflash Memory	252
Standby Supervisor Module Boot Alert	252
Installing Generation 2 Modules in Generation 1 Chassis	252
Replacing Modules	252
Default Settings	253
Working with Configuration Files	255
Managing Configuration Files	255
Displaying Configuration Files	255
Downloading Configuration Files to the Switch	256
Using a File From a Remote Server	256
Using a File From an External CompactFlash Disk (slot0:)	257
Saving Configuration Files to an External Device	257
Saving to a Remote Server	257
Saving to an External CompactFlash Disk (slot0:)	258
Saving the Running Configuration	258
Saving Startup Configurations in the Fabric	258
Unlocking the Startup Configuration File	259
Copying Configuration Files	259
Backing Up Configuration Files	260
Rolling Back to a Previous Configuration	261
Restoring the Configured Redundancy Mode	261
Accessing File Systems on the Standby Supervisor Module	262
Deleting Configuration Files	262
Configuring High Availability	263
About High Availability	263
Switchover Mechanisms	264
HA Switchover Characteristics	264
Initiating a Switchover	264
Switchover Guidelines	265
Verifying Switchover Possibilities	265
Process Restartability	266
Synchronizing Supervisor Modules	266
Copying Boot Variable Images to the Standby Supervisor Module	266
Automatic Copying of Boot Variables	266
Verifying the Copied Boot Variables	266
Displaying HA Status Information	267
Displaying the System Uptime	269
Managing System Hardware	271
Displaying Switch Hardware Inventory	271
Running Compact Flash Tests	274
Running the CompactFlash CRC Checksum Test On Demand	274
Enabling and Disabling the Automatic CompactFlash CRC Checksum Test	274
Setting the CompactFlash CRC Checksum Test Interval	275
Enabling and Disabling Failure Action at the Failure of a CompactFlash Checksum Test	275
Displaying the Frequency and Status of the CompactFlash CRC Checksum Test	275
Updating the CompactFlash Firmware	276
Updating the CompactFlash Firmware On Demand	276
Enabling and Disabling the CompactFlash Firmware Update	277
Setting the CompactFlash Firmware Update Interval	277
Enabling and Disabling Failure Action at the Failure of a CompactFlash Firmware Update	277
Displaying the Frequency and Status of CompactFlash Updates	278
Displaying CompactFlash CRC Test and Firmware Update Statistics	278
Displaying the Switch Serial Number	279
Displaying Power Usage Information	280
Power Supply Configuration Modes	280
Power Supply Configuration Guidelines	281
About Crossbar Management	283
Operational Considerations When Removing Crossbars	284
Gracefully Shutting Down a Crossbar	285
Backward Compatibility for Generation 1 Modules in Cisco MDS 9513 Directors	285
About Module Temperature	286
Displaying Module Temperature	287
About Fan Modules	287
About Clock Modules	289
Displaying Environment Information	290
Default Settings	291
Managing Modules	293
About Modules	294
Supervisor Modules	294
Switching Modules	295
Services Modules	295
Verifying the Status of a Module	296
Checking the State of a Module	296
Connecting to a Module	297
Reloading Modules	298
Reloading a Switch	298
Power Cycling Modules	298
Reloading Switching Modules	299
Preserving the Module Configuration	299
Purging Module Configuration	300
Powering Off Switching Modules	301
Identifying Module LEDs	301
EPLD Configuration	304
Upgrading EPLD Images	305
Displaying EPLD Versions	308
Installing the SSI Boot Image	310
Upgrading the SSI Boot Image	311
SSI Boot Image Upgrade Considerations for the SSM	311
Verifying the SSI Boot Image	312
Configuring the SSI Image Boot Variable	315
Using the install ssi Command	317
Managing SSMs and Supervisor Modules	320
Configuring SSM Global Upgrade Delay	320
Considerations for Replacing SSMs and Supervisor Modules	320
Recovering an SSM After Replacing Corrupted CompactFlash Memory	321
Considerations for Upgrading and Downgrading Cisco MDS NX-OS Releases	321
Default Settings	323
Part 3	325
Switch Configuration	325
Configuring Interfaces	327
Fibre Channel Interfaces	327
Generation 1 Interfaces Configuration Guidelines	328
About Interface Modes	329
E Port	330
F Port	330
FL Port	330
NP Ports	330
TL Port	331
TE Port	331
TF Port	331
TNP Port	332
SD Port	332
ST Port	332
Fx Port	332
B Port	332
Auto Mode	333
N Port Identifier Virtualization	333
About Interface States	333
Administrative States	333
Operational States	334
Reason Codes	334
Configuring Fibre Channel Interfaces	337
Graceful Shutdown	338
Setting the Interface Administrative State	338
Configuring Interface Modes	339
Configuring System Default Port Mode F	339
Configuring Port Speeds	340
Autosensing	341
Specifying a Port Owner	341
Configuring Port Guard	342
Enabling N Port Identifier Virtualization	343
About Interface Descriptions	343
Configuring the Interface Description	343
About Frame Encapsulation	343
About Receive Data Field Size	344
Configuring Receive Data Field Size	344
Identifying the Beacon LEDs	344
About Speed LEDs	344
About Beacon Mode	345
Configuring Beacon Mode	345
About Bit Error Thresholds	345
Switch Port Attribute Default Values	346
About SFP Transmitter Types	347
Displaying Interface Information	348
TL Ports for Private Loops	356
About TL Ports	356
About TL Port ALPA Caches	358
Displaying TL Port Information	358
Manually Inserting Entries into ALPA Cache	360
Displaying the ALPA Cache Contents	360
Clearing the ALPA Cache	360
Buffer Credits	360
About Buffer-to-Buffer Credits	360
Configuring Buffer-to-Buffer Credits	361
About Performance Buffers	362
Configuring Performance Buffers	362
About Extended BB_credits	362
Extended BB_credits on Generation 1 Switching Modules	363
Extended BB_credits on Generation 2 and Generation 3 Switching Modules	364
Configuring Extended BB_credits	364
Displaying BB_Credit Information	365
Management Interfaces	366
About Management Interfaces	366
Configuring Management Interfaces	366
Displaying Management Interface Configuration	367
VSAN Interfaces	368
About VSAN Interfaces	368
Creating VSAN Interfaces	368
Displaying VSAN Interface Information	368
Default Settings	369
Configuring N Port Virtualization	371
About NPV	371
NPV Mode	373
NP Ports	374
NP Links	374
Internal FLOGI Parameters	374
Default Port Numbers	375
NPV CFS Distribution over IP	376
NPV Traffic Management	376
Auto	376
Traffic Map	376
Disruptive	377
Multiple VSAN Support	377
NPV Guidelines and Requirements	377
NPV Traffic Management Guidelines	378
Configuring NPV	378
SUMMARY STEPS	378
Configuring NPV Traffic Management	380
Configuring List of External Interfaces per Server Interface	380
Enable or Disable the Global Policy for Disruptive Load Balancing	380
DPVM Configuration	381
NPV and Port Security	381
Verifying NPV	381
Verifying NPV Traffic Management	383
Configuring Generation 2 and Generation 3 Switching Modules	385
About Generations of Modules and Switches	385
Port Groups and Port Rate Modes	387
Port Groups	387
Port Rate Modes	388
Dedicated Rate Mode	390
Shared Rate Mode	391
Dedicated Rate Mode Configurations for the 8-Gbps Modules	391
Dynamic Bandwidth Management	392
Out-of-Service Interfaces	392
Buffer Credit Allocation	392
Buffer Pools	393
BB_Credit Buffers for Switching Modules	395
48-Port 8-Gbps Fibre Channel Module BB_Credit Buffers	396
24-Port 8-Gbps Fibre Channel Module BB_Credit Buffers	397
4/44-Port 8-Gbps Host-Optimized Fibre Channel Module BB_Credit Buffers	398
48-Port 4-Gbps Fibre Channel Module BB_Credit Buffers	399
24-Port 4-Gbps Fibre Channel Module BB_Credit Buffers	401
18-Port Fibre Channel/4-Port Gigabit Ethernet Multiservice Module BB_Credit Buffers	402
12-Port 4-Gbps Switching Module BB_Credit Buffers	402
4-Port 10-Gbps Switching Module BB_Credit Buffers	404
BB_Credit Buffers for Fabric Switches	405
Cisco MDS 9134 Fabric Switch BB_Credit Buffers	405
Cisco MDS 9124 Fabric Switch BB_Credit Buffers	405
Cisco MDS 9222i Multiservice Modular Switch BB_Credit Buffers	406
Extended BB_Credits	406
Combining Generation 1, Generation 2, and Generation 3 Modules	406
Port Indexes	407
PortChannels	409
Configuring Module Interface Shared Resources	412
Displaying Interface Capabilities	413
Configuration Guidelines for 48-Port, 24-Port, and 4/44-Port 8-Gbps Fibre Channel Switching Modules	414
Migrating from Shared Mode to Dedicated Mode	414
Migrating from Dedicated Mode to Shared Mode	414
Configuration Guidelines for 48-Port and 24-Port 4-Gbps Fibre Channel Switching Modules	415
Migrating from Shared Mode to Dedicated Mode	415
Migrating from Dedicated Mode to Shared Mode	416
Configuration Guidelines for 12-Port 4-Gbps Switching Module Interfaces	416
Configuration Guidelines for 4-Port 10-Gbps Switching Module Interfaces	417
Configuring Port Speed	417
Configuring Rate Mode	419
Configuring Oversubscription Ratio Restrictions	424
Disabling Restrictions on Oversubscription Ratios	426
Oversubscription Ratio Restrictions Example	427
Enabling Restrictions on Oversubscription Ratios	429
Configuring Bandwidth Fairness	429
Enabling Bandwidth Fairness	430