Dell MX9116n EMC SmartFabric OS10 User Guide - Page 974

3. (Optional) Enable CRL checking for certificates received from external devices in SECURITY-PROFILE mode. CRL checking verifies the validity of a certificate using the CRLs installed on the switch. revocation-check 4. (Optional) Enable peer name checking for certificates presented by external devices in SECURITY-PROFILE mode. Peer name checking ensures that the certificate matches the name of the peer device, such as a remote server name. peer-name-check 5. Use the security profile to configure X.509v3-based service; for example, to configure RADIUS over TLS authentication using an X.509v3 certificate, enter the radius-server host tls command: radius-server host {hostname | ip-address} tls security-profile profile-name [auth-port port-number] key {0 authentication-key | 9 authentication-key | authenticationkey} Example: Security profile in RADIUS over TLS authentication OS10# show crypto cert Installed non-FIPS certificates dv-fedgov-s6010-1.pem Installed FIPS certificates OS10# OS10(config)# OS10(config)# crypto security-profile radius-prof OS10(config-sec-profile)# certificate dv-fedgov-s6010-1 OS10(config-sec-profile)# revocation-check OS10(config-sec-profile)# peer-name-check OS10(config-sec-profile)# exit OS10(config)# OS10(config)# radius-server host radius-server-2.test.com tls security-profile radius-prof key radsec OS10(config)# end OS10# show running-configuration crypto security-profile ! crypto security-profile radius-prof certificate dv-fedgov-s6010-1 OS10# show running-configuration radius-server radius-server host radius-server-2.test.com tls security-profile radius-prof key 9 2b9799adc767c0efe8987a694969b1384c541414ba18a44cd9b25fc00ff180e9 Cluster security When you enable VLT or a fabric automation application, switches that participate in the cluster use secure channels to communicate with each other. The secure channels are enabled only when you enable the VLT or fabric cluster configuration on a switch. OS10 installs a default X.509v3 certificate-key pair to establish secure channels between the peer devices in a cluster. Replace the default certificate-key pair used for cluster applications: • In a deployment where untrusted devices access management or data ports on an OS10 switch. • Before the default X.509v3 certificate expires on July 27, 2021. If the default certificate-key pair expires, the VLT domain on peer switches does not come up. NOTE: The expiration date for the default certificate-key pair installed by OS10 on a switch running the 10.5.0.0 release is July 27, 2021. To ensure secure communication in a cluster before the expiration date, install a more recent X.509v3 certificate-key pair. Create a custom X.509v3 certificate-key pair by configuring an application-specific security profile using the cluster securityprofile command. Before the default or custom X.509v3 certificate-key pair used between the peer devices in a VLT domain or fabric application cluster expires, install a valid CA certificate by following the procedures in: • Manage CA certificates. 974 Security