Fabric OS Administrator's Guide v7.0.0 (53-1002148-02, June 2011)

320 Fabric OS Administrator’s Guide
53-1002148-02
Encryption and compression example
14
myswitch:root> authutil --show
AUTH TYPE HASH TYPE GROUP TYPE
--------------------------------------
dhchap md5 4
Switch Authentication Policy: ON
Device Authentication Policy: OFF
myswitch:root>
Next, you set a secret key. For this you need to get the WWN of the peer switch.
myswitch:root> secauthsecret
Usage: secAuthSecret <args>
--show: displays the secret key database
--set: sets up (add or modify) secret keys
--remove [wwn | domain | <sw name>]: removes an entry from secret key database
--remove --all: deletes secret key database
myswitch:root> secauthsecret --set
This command is used to set up secret keys for the DH-CHAP authentication.
The minimum length of a secret key is 8 characters and maximum 40
characters. Setting up secret keys does not initiate DH-CHAP
authentication. If switch is configured to do DH-CHAP, it is performed
whenever a port or a switch is enabled.
Warning: Please use a secure channel for setting secrets. Using
an insecure channel is not safe and may compromise secrets.
Following inputs should be specified for each entry.
1. WWN for which secret is being set up.
2. Peer secret: The secret of the peer that authenticates to peer.
3. Local secret: The local secret that authenticates peer.
Press enter to start setting up secrets >1
Enter peer WWN, Domain, or switch name (Leave blank when done):
10:00:00:05:1e:e5:cb:00
Enter peer secret:
Re-enter peer secret:
Enter local secret:
Re-enter local secret:
Enter peer WWN, Domain, or switch name (Leave blank when done):
Are you done? (yes, y, no, n): [no] y
Saving data to key store... Done.
myswitch:root> secauthsecret --show
WWN DId Name
-----------------------------------------------
10:00:00:05:1e:e5:cb:00 150 dcx_150
myswitch:root>
Next, you enable encryption on port 0. Note that the first attempt fails because the port is currently
enabled. This example uses the portCfgShow command to check the result. Notice that the output
shows encryption to be enabled on the port.
myswitch:root> portcfgencrypt --enable 0
Please disable port to configure Encryption/Compression.