R21xx-HP FlexFabric 11900 Security Command Reference

137
prefer-kex: Specifies the preferred key exchange algorithm. The default algorithm is dh-group-exchange
in non-FIPS mode and is dh-group14 in FIPS mode.
Algorithms dh-group-exchange, dh-group1, and dh-group14 are arranged in ascending order in the
aspects of security strength and calculation time.
• dh-group-exchange: Specifies the key exchange algorithm diffie-hellman-group-exchange-sha1.
• dh-group1: Specifies the key exchange algorithm diffie-hellman-group1-sha1.
• dh-group14: Specifies the key exchange algorithm diffie-hellman-group14-sha1.
prefer-stoc-cipher: Specifies the preferred server-to-client encryption algorithm. The default is aes128.
prefer-stoc-hmac: Specifies the preferred server-to-client HMAC algorithm. The default is sha1.
publickey keyname: Specifies the host public key of the sever, which is used to authenticate the server.
The keyname argument is a case-insensitive string of 1 to 64 characters.
source: Specifies a source IP address or source interface to connect to the server. By default, the device
automatically selects a source IP address based on the routing entry. To avoid the communication failure
between the client and the server due to interface faults, use the specified Loopback interface as the
source interface, and IP address of this interface as the source IP address.
interface interface-type interface-number: Specifies a source interface. The interface-type
interface-number argument specifies a source interface by its type and number. The IPv4 address of this
interface is the source IP address to send packets.
ip ip-address: Specifies a source IPv4 address.
Usage guidelines
When the client's authentication method is publickey, the client must get the local private key for digital
signature. Because the publickey authentication uses either RSA or DSA algorithm, you must specify an
algorithm (by using the identity-key keyword) in order to get the correct data for the local private key.
Examples
# Connect an SCP client to the SCP server 200.1.1.1, specify the public key of the server as svkey, and
download the file abc.txt from the server. The SCP client uses publickey authentication. Use the following
algorithms:
• The preferred key exchange algorithm is dh-group14.
• The preferred server-to-client encryption algorithm is aes128.
• The preferred client-to-server HMAC algorithm is sha1.
• The preferred server-to-client HMAC algorithm is sha1-96.
• The preferred compression algorithm between the server and client is zlib.
<Sysname> scp 200.1.1.1 get abc.txt prefer-kex dh-group14 prefer-stoc-cipher aes128
prefer-ctos-hmac sha1 prefer-stoc-hmac sha1-96 prefer-compress zlib publickey svkey
scp ipv6
Use scp ipv6 to transfer files with an IPv6 SCP server.
Syntax
In non-FIPS mode:
scp ipv6 server [ port-number ] [ vpn-instance vpn-instance-name ] [ -i interface-type interface-number ]
{ put | get } source-file-name [ destination-file-name ] [ identity-key { dsa | rsa } | prefer-compress zlib
| prefer-ctos-cipher { 3des | aes128 | aes256 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 |