HP StorageWorks 2/32 Brocade Secure Fabric OS Administrator's Guide (53-100024 - Page 44

Configuring Switch-to-Switch Authentication

Get HP StorageWorks 2/32 - SAN Switch PDF manuals and user guides View all HP StorageWorks 2/32 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 44 highlights

2 Configuring Switch-to-Switch Authentication By default, Secure Fabric OS on Fabric OS v3.2.0, v4.4.0, v5.0.1, v5.1.0, and v5.2.0 use SLAP or FCAP protocols for authentication. These protocols use digital certificates, based on switch WWN and PKI technology to authenticate switches. Support for FCAP is provided in Secure Fabric OS v3.2.0, v4.4.0, v5.0.1, v5.1.0, and v5.2.0 and is used when both switches support it. Authentication automatically defaults to SLAP when a switch does not support FCAP. Alternatively, you can configure Secure Fabric OS to use DH-CHAP authentication. Use the authUtil command to configure the authentication parameters used by the switch. When you configure DHCHAP authentication, you also must define a pair of shared secrets known to both switches. Figure 2-1 illustrates how the secrets are configured. In the pair, one is the local switch secret and the other is the peer switch secret. (Terms local and peer are relative to an initiator-one who initiates authentication is local and the one who responds is peer.) Use secAuthSecret to set shared secrets on the switch. Configured, shared secrets are used at the next authentication. Authentication occurs whenever secure mode is enabled or whenever there is a state change for the switch or port. The state change can be due to a switch reboot, or a switch or port disable and enable. Key database on switch Local secret A Peer secret B Key database on switch Local secret B Peer secret A Switch A Figure 2-1 DH-CHAP Authentication Switch B 2-22 Secure Fabric OS Administrator's Guide Publication Number: 53-1000244-01

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
2-22
Secure Fabric OS Administrator’s Guide
Publication Number: 53-1000244-01
2
Configuring Switch-to-Switch Authentication
By default, Secure Fabric OS on Fabric OS v3.2.0, v4.4.0, v5.0.1, v5.1.0, and v5.2.0 use SLAP or
FCAP protocols for authentication. These protocols use digital certificates, based on switch WWN and
PKI technology to authenticate switches. Support for FCAP is provided in Secure Fabric OS v3.2.0,
v4.4.0, v5.0.1, v5.1.0, and v5.2.0 and is used when both switches support it. Authentication
automatically defaults to SLAP when a switch does not support FCAP.
Alternatively, you can configure Secure Fabric OS to use DH-CHAP authentication. Use the
authUtil
command to configure the authentication parameters used by the switch. When you configure DH-
CHAP authentication, you also must define a pair of
shared secrets
known to both switches.
Figure 2-1
illustrates how the secrets are configured. In the pair, one is the local switch secret and the other is the
peer switch secret. (Terms
local
and
peer
are relative to an initiator—one who initiates authentication is
local and the one who responds is peer.)
Use
secAuthSecret
to set shared secrets on the switch. Configured, shared secrets are used at the next
authentication. Authentication occurs whenever secure mode is enabled or whenever there is a state
change for the switch or port. The state change can be due to a switch reboot, or a switch or port disable
and enable.
Figure 2-1
DH-CHAP Authentication
Switch A
Switch B
Key database on switch
Local secret A
Peer secret B
Key database on switch
Local secret B
Peer secret A