Reference Guide

If you are configuring authentication on an EX_Port, there is no need to set the authentication policy to Active or On. EX_Ports
can operate on any switch authentication policy.
6. Verify the authentication configuration using the authUtil --show command.
The following example sets up authentication in preparation for in-flight encryption. Specifically, it configures DH-CHAP for
authentication, sets the DH group to group 4, sets up a pre-shared secret key, and activates authentication.
switch:admin> authutil --set -a dhchap
Authentication is set to dhchap.
switch:admin> authutil --set -g "4"
DH Group was set to 4.
switch:admin> secauthsecret --set
This command is used to set up secret keys for the DH-CHAP authentication.
The minimum length of a secret key is 8 characters and maximum 40
characters. Setting up secret keys does not initiate DH-CHAP
authentication. If switch is configured to do DH-CHAP, it is performed
whenever a port or a switch is enabled.
Warning: Please use a secure channel for setting secrets. Using
an insecure channel is not safe and may compromise secrets.
Following inputs should be specified for each entry.
1. WWN for which secret is being set up.
2. Peer secret: The secret of the peer that authenticates to peer.
3. Local secret: The local secret that authenticates peer.
Press enter to start setting up secrets >
Enter peer WWN, Domain, or switch name (Leave blank when done): 10:00:00:05:1e:e5:cb:00
Enter peer secret:
Re-enter peer secret:
Enter local secret:
Re-enter local secret:
Enter peer WWN, Domain, or switch name (Leave blank when done):
Are you done? (yes, y, no, n): [no] y
Saving data to key store... Done.
switch:admin> secauthsecret --show
WWN DId Name
-----------------------------------------------
10:00:00:05:1e:e5:cb:00 150 dcx_150
switch:admin> authutil --policy -sw active
Warning: Activating the authentication policy requires either DH-CHAP secrets or PKI certificates
depending on the protocol selected. Otherwise, ISLs will be segmented during next E-port bring-up.
ARE YOU SURE (yes, y, no, n): [no] y
Auth Policy is set to ACTIVE
switch:admin> authutil --show
AUTH TYPE HASH TYPE GROUP TYPE
--------------------------------------
dhchap md5 4
Switch Authentication Policy: ACTIVE
Device Authentication Policy: OFF
For additional information about configuring DH-CHAP and FCAP authentication protocols, refer to Authentication policy for
fabric elements on page 227.
In-flight Encryption and Compression
Brocade Fabric OS Administration Guide, 8.0.1
53-1004111-02 411