HP StorageWorks 8/80 HP StorageWorks Fabric OS 6.2 administrator guide (5697-0 - Page 134

• 00 for the DH Null option • 01 for the1024 bit key • 02 for the 1280 bit key • 03 for the 1536 bit key • 04 for the 2048 bit key This section illustrates using the authUtil command to display the current authentication parameters and to set the authentication protocol to DH-CHAP. Viewing the current authentication parameter settings for a switch 1. Log in to the switch using an account assigned to the admin role. 2. On a switch running Fabric OS 6.0.0 or later, enter authUtil --show. Output similar to the following is displayed: AUTH TYPE HASH TYPE GROUP TYPE fcap,dhchap sha1,md5 0, 1, 2, 3, 4 Switch Authentication Policy: PASSIVE Device Authentication Policy: OFF Setting the authentication protocol used by the switch to DH-CHAP 1. Log in to the switch using an account assigned to the admin role. 2. On a switch running Fabric OS 4.x or 5.x, enter authUtil --set -a dhchap; on a switch running Fabric OS 3.x, enter authUtil "--set -a dhchap". Output similar to the following is displayed: Authentication is set to dhchap. When using DH-CHAP, make sure that you configure the switches at both ends of a link. NOTE: If you set the authentication protocol to DH-CHAP, have not yet configured shared secrets, and authentication is checked (for example, you enable the switch), switch authentication fails. Re-authenticating E_Ports Use the command authUtil to re-initiate the authentication on selected ports. The command provides flexibility to initiate authentication for specified E_Ports, a set of E_Ports, or all E_Ports on the switch. This command, however, does not work on private, loop, NPIV and FICON devices. The command can re-initiate authentication only if the device was previously authenticated. If the authentication fails because shared secrets do not match, the port is disabled. This command works independently of the authentication policy; this means you can initiate the authentication even if the switch is in PASSIVE mode. The command is used to restart authentication after changing the DH-CHAP group, hash type, or shared secret between a pair of switches. IMPORTANT: This command may bring down E_Ports if the DH-CHAP shared secrets are not installed correctly. 1. Log in to the switch using an account assigned to the admin role. 2. On a switch running Fabric OS 5.3.0 and later, enter the following command: switch:admin> authutil --authinit Example: Specific ports on the switch switch:admin> authutil --authinit 2,3,4 132 Configuring advanced security features