HP Brocade BladeSystem 4/12 HP StorageWorks Fabric OS 6.x administrator guide - Page 113
Selecting authentication protocols, Re-authenticating ports
View all HP Brocade BladeSystem 4/12 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 113 highlights
Selecting authentication protocols Use the authUtil command to perform the following tasks: • Display the current authentication parameters • Select the authentication protocol used between switches • Select the Diffie-Hellman (DH) group for a switch Run the authUtil command on the switch you want to view or change. Options for specifying which DH group you want to use include: • 00 - DH Null option • 01 - 1024 bit key • 02 - 1280 bit key • 03 - 1536 bit key • 04 - 2048 bit key This section illustrates using the authUtil command to display the current authentication parameters and to set the authentication protocol to DH-CHAP. To view the current authentication parameter settings for a switch: 1. Log in to the switch using an account assigned to the admin role. 2. On a switch running Fabric OS 6.0, type authUtil --show. Output similar to the following is displayed: AUTH TYPE HASH TYPE GROUP TYPE fcap,dhchap sha1,md5 0, 1, 2, 3, 4 Switch Authentication Policy: PASSIVE Device Authentication Policy: OFF To set the authentication protocol used by the switch to DH-CHAP: 1. Log in to the switch using an account assigned to the admin role. 2. On a switch running Fabric OS 4.x or 5.x, type authUtil --set -a dhchap; on a switch running Fabric OS 3.x, type authUtil "--set -a dhchap". Output similar to the following is displayed: Authentication is set to dhchap. When using DH-CHAP, make sure that you configure the switches at both ends of a link. NOTE: If you set the authentication protocol to DH-CHAP, have not yet configured shared secrets, and authentication is checked (for example, you enable the switch), switch authentication fails. Re-authenticating ports Use the command authutil to re-initiate the authentication on selected ports. It provides flexibility to initiate authentication for specified E_Ports, set of E_Ports, and all E_Ports on the switch. This command will not work on Private, Loop, NPIV and FICON devices. The command authutil can re-initiate authentication only if the device was previously authenticated. If the authentication fails because shared secrets do not match, the port is disabled. This command works independently of the authentication policy; this means you can initiate the authentication even if the switch is in PASSIVE mode. This command is used to restart authentication after changing the DH-CHAP group, hash type, and shared secret between a pair of switches. Fabric OS 6.x administrator guide 113