Users Guide

NOTE: fips installs the certificate-key pair as FIPS-compliant. Enter fips to install a certificate-key pair that is used
by a FIPS-aware application, such as Syslog over TLS. If you do not enter fips, the certificate-key pair is stored as a
non-FIPS-compliant pair.
You determine if the certificate-key pair is generated as FIPS-compliant. Do not use FIPS-compliant certificate-key pairs
outside of FIPS mode. When FIPS mode is enabled, you can still generate CSRs for non-FIPS certificates for use with
non-FIPS applications. Be sure to install these certificates as non-FIPS with the crypto cert install command.
3. Configure a security profile for system logging over TLS using an X.509v3 certificate.
a. Create a Syslog security profile in CONFIGURATION mode. See Security profiles for more information.
crypto security-profile profile-name
b. Assign an X.509v3 certificate and private key pair to the security profile in SECURITY-PROFILE mode. For
certificate-name, enter the name of the certificate-key pair as it appears in the show crypto certs output
without the .pem extension.
certificate certificate-name
exit
c. Create a system logging-specific profile in CONFIGURATION mode.
logging security-profile profile-name
Where profile-name is the name of the Syslog security profile created in Step 2a with the crypto security-
profile profile-name command. You cannot delete a crypto server profile if it is configured for a logging server.
If you reconfigure crypto security profile-name, configured Syslog TLS servers are automatically updated to use the new
certificate-key pair used by the new profile.
If you reconfigure the certificate assigned to a crypto security profile, Syslog TLS servers are automatically updated to use
new certificate-key pair.
If you delete a certificate from a configured crypto security profile, system logging over TLS fails. A host certificate is
required for the protocol exchange with an external device.
4. Configure a remote TLS server to receive system messages in CONFIGURATION mode.
logging server {ipv4–address | ipv6–address} tls [port-number]
[severity severity-level] [vrf {management | vrf-name]
Example: Configure Syslog over TLS
OS10# copy tftp://CAadmin:secret@172.11.222.1/cacert.pem home://cacert.pem
OS10# crypto ca-cert install home://cacert.pem
Processing certificate ...
Installed Root CA certificate
CommonName = Certificate Authority CA
IssuerName = Certificate Authority CA
OS10# show crypto ca-certs
--------------------------------------
| Locally installed certificates |
--------------------------------------
cacert.crt
OS10# crypto cert generate request cert-file home://clientreq.pem key-file home://
clientkey.pem cname "Top of Rack 6" altname "IP:10.0.0.6 DNS:tor6.dell.com" email
[e-mail] organization "Dell EMC" orgunit Networking locality "Santa Clara" state
California country US length 2048
Processing certificate ...
Successfully created CSR file /home/admin/clientreq.pem and key
OS10# copy home://clientreq.pem scp://CAadmin:secret@172.11.222.1/clientreq.pem
OS10# copy scp://CAadmin:secret@172.11.222.1/clientcert.pem home://clientcert.pem
OS10# copy scp://CAadmin:secret@172.11.222.1/clientkey.pem home://clientkey.pem
OS10# crypto cert install cert-file home://clientcert.pem key-file home://clientkey.pem
1806
Troubleshoot Dell EMC SmartFabric OS10