Print

Control Plane Security

This section contains the following topics:

Transport Layer Security

Transport Layer Security (TLS), the successor to Secure Sockets Layer (SSL), is a security protocol used to communicate between client and server. It establishes an encrypted communication channel to secure data.

By default, EOS uses a self signed certificate for client and server connections. However, some browsers or TLS libraries may refuse connections to the default self-signed certificates on EOS and in such case it is recommended to install the TLS server certificates that meet the following criteria:

  • RSA key sizes must be greater than or equal to 2048 bits.
  • There must be less than 825 days to expiry.
  • Certificate must use SHA-2 family of Hashing function.
Note:

Although Arista switches use TLS, the terms TLS and SSL are used interchangeably in this document.

Following are the two main components used by TLS for authentication of identity before any communication starts.

  • Certificate
  • Key

An SSL certificate is required to establish asecure connection between the client and server. The certificate includes all of the details which are necessary for authentication. Cryptographic keys are used to provide a secure channel of communication. TLS uses two cryptographic keys:a private keyknown only to the server and a public key embedded in the certificate. The keys are used to validate the certificate.

This chapter contains the following sections.

Overview

Configuration

Rotating Certificate and Key Pair

Resetting Diffie-Hellman Parameters

Configuring the TLS Handshake Settings

Displaying Certificate and Key Information

TLS Commands

Overview

With SSL certificate, key, and profile management framework we can manage and configure SSL certificates, keys and profiles. The SSL is an application-layer protocol which transfers the data securely between the client and server using a combination of authentication, encryption, and data integrity. The SSL uses certificates and private-public key pairs to provide this security. An user can configure a SSL profile which includes certificate, key and trusted CA certificates used in SSL communication. A user can manage certificates, keys, and also multiple SSL profiles. A SSL profile can be configured and attached to any other EOS configuration which supports SSL communication. The individual EOS configuration using this framework includes details of using SSL profile in their configuration.

The only private keys supported are those using the RSA algorithm. Both the certificate and keys must be encoded in Privacy Enhanced Mail (PEM) format.

Example

This is a code sample of a PEM encoded certificate.

$cat server.crt
-----BEGIN CERTIFICATE-----
MIIC3zCCAkgCAQkwDQYJKoZIhvcNAQEEBQAwcTELMAkGA1UEBhMCVVMxCzAJBgNV
BAgMAkNBMQswCQYDVQQHDAJTQzEPMA0GA1UECgwGQXJpc3RhMQwwCgYDVQQLDANT
RE4xCzAJBgNVBAMMAmNhMRwwGgYJKoZIhvcNAQkBFg1jYUBhcmlzdGEuY29tMCAX
DTE0MDgxMTIxNDQxN1oYDzIwNjkwNTE0MjE0NDE3WjB5MQswCQYDVQQGEwJVUzEL
MAkGA1UECAwCQ0ExCzAJBgNVBAcMAlNDMQ8wDQYDVQQKDAZBcmlzdGExDDAKBgNV
BAsMA1NETjEPMA0GA1UEAwwGc2VydmVyMSAwHgYJKoZIhvcNAQkBFhFzZXJ2ZXJA
YXJpc3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOBOP/jh
xk28sUH+lhM/mY6QoyLGcbnygwe/hzIjn2mASnf7uPFGhB62JTt7tQv2xmu/MJfs
aVsNeYXP3ZOcmRO0uk9suGVbII7QJUomnsq1dJh59UyMfws6V6ergmhwEZCDIirV
7nbUDz+uSdNutQL4w/VB+juuWXQ8ztbmygT2ymySaHRK3XnDrAiva0UUVbSmEHH0
wLPsNVNYUxJ4PpOB9luw4upe6ACF9SFtMDz3BDcrL6Gq5idWw3YkQfzBwEl+5hkF
hu0owON29I5T8FpAx+Hzpl48YWW65d/4F40S3XRN312xALM8RrQOU/Chx9Sfg0iJ
dsXWNagx1eyW2EECAwEAATANBgkqhkiG9w0BAQQFAAOBgQBedfuKHvNDpEkdO2AE
Kihs/YeRGgp+5g7hXU0U2TMAMS545ZQ99pFbnScmIC0m68aw1VXILuj+vlkxAM27
oc8iB+gG7oaFtJpWTvmIHqzeHWb0zrwjPhtXTafWEoam8sJZt38Pc4UVb7lQCd6v
ZCLZZJmC2IL0SG7bLN7yaALCSQ==
-----END CERTIFICATE-----

Example

This is a code sample of a PEM encoded RSA key.

$cat server.key

-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEA4E4/+OHGTbyxQf6WEz+ZjpCjIsZxufKDB7+HMiOfaYBKd/u4
8UaEHrYlO3u1C/bGa78wl+xpWw15hc/dk5yZE7S6T2y4ZVsgjtAlSiaeyrV0mHn1
TIx/CzpXp6uCaHARkIMiKtXudtQPP65J0261AvjD9UH6O65ZdDzO1ubKBPbKbJJo
dErdecOsCK9rRRRVtKYQcfTAs+w1U1hTEng+k4H2W7Di6l7oAIX1IW0wPPcENysv
oarmJ1bDdiRB/MHASX7mGQWG7SjA43b0jlPwWkDH4fOmXjxhZbrl3/gXjRLddE3f
XbEAszxGtA5T8KHH1J+DSIl2xdY1qDHV7JbYQQIDAQABAoIBACv/TU8NQi+HXqGa
RWe7Juyu9EDi+fXGWutPJz6vfBpenrzQNGOnOE0p3z2+szGIkz0ZQHfcWIISr46O
ymCk6+XQombn5XeEG2vH6jiUQLt0Qk2SRopgWJ8kL4NlAexoZxmYj0AlvGO0jtUn
47VEVt8hWpal/WZteYByWQQQOvoj7EhlANIKUGUG9yOcBcEApdHsgOcXewrbilZQ
d4kbpegxQhjKU9jLUXRsIPV2YFrDcT83/94PFTRk/vFBOnWS/Ygt5vRedcoF2HcR
TJMyE+JwnwGJzTPKwbPJgLnjrEGVrqEerCuTU9v0PpFxu0AOEeV1kPyNbRZzzC+p
al70ZI0CgYEA/Ge1Hj5OBjS2DLUYG0zhmc4xoiIqcgPJCn6QQmfqa6DbscQzXsnp
GqNlwvB76L0mwNOSABX53YaXhFCrYXMRsXWl95hK7NYCGnD6f/fYcr3u+NdBm5+N
qEiqcq779arAXqGaN/TGKsm507ngyLBrMbUlaPQEXfaBjrQL3f0k7qMCgYEA44AW
1ptUWy0Wx5oa1wdYVgGw+Wbxb8JY88pj29JhE3Qwhy9FBq7x0wZOoQDSkyvbu9aZ
bEiUtctXDDNE/Fy7XgEBMiqrn4R383pbZ5LnmsFKZEcADU1Pe4HjDgSq1rjNSJSA
xEz8xRQvIvy4kpp/tpKsN/Xg2ZBnQmqgj6LWv8sCgYBKeSsWnlmVOS5R94kCXR/f
qtg4N46Aj59dClT0Uwb29MJ95B8oI7k00+ttpllZJZ5unL5iahmMhG7maor2uOYK
j2UF9hh9YvPB633uDin+SQ5eu9yu11gLxE0Og5TyOoyCH3qKch2aeGTtFNY/QNaQ
FxvPqNg1BUva2EL8H/oqswKBgQDjbW1nZSjTbSPUrq4eQG2CrXYqHUtHmlYqgS2K
16nMNN8+hXbP05xUhX2dXqEkFzg3c7U0lupzQq/mtmpEjr+Qnhh/+kBP27G+aZdu
12FJR+oCjSf0JFFM+u/tV6UhuuUdpbeEhiI7Mo5cv6AUjvcVoVMhLmB1nvJbZxTU
AsoEOQKBgHHVuuq4kWDfORCYwTvZPX0byQu++QhlOFfClYBIVuCP4/cU0o3Kw1Z6
tf+zP2rBMOl5eD7IBHjAtOlNjXcFgiyymNxJDKJSmTpw1VePncmuT5UMq8rbljSW
Yg0QGwyvB1Cat2mpgqVWS7YT0nmTooWmQdO3Qp48f+bVvmO/dJXS
-----END RSA PRIVATE KEY-----

Configuration

Configuring Certificates

Copying a certificate to the Switch

The copy certificate command copies the certificate to certificate: file system from any supported source URLs of the copy command.

Example

This command copies a server.crt certificate to certificate: file system.
switch#copy file:/tmp/ssl/server.crt certificate:
Copy completed successfully.
Errors while Copying the certificates

Examples

  • A single source file can contain multiple PEM encoded certificates but only one PEM encoded certificate per file is supported. An error occurs when such multiple PEM encoded file is copied and the copy fails and error is displayed as shown.
    switch#copy file:tmp/ssl/multi.crt certificate:
    % Error copying file:tmp/ssl/multi.crt to certificate: (Multiple PEM entities in 
    single file not supported)
  • An error occurs when a source file containing an invalid PEM encoded certificate is copied. When such files are copied, the copy fails and an error is displayed as shown.
    switch#copy file:tmp/ssl/bad.crt certificate:
    % Error copying file:tmp/ssl/bad.crt to certificate: (Invalid certificate)
  • An error occurs when a source file containing a certificate with password protected key is copied. When such files are copied, the copy fails and an error is displayed as shown.
    switch#copy file:tmp/ssl/pass.key sslkey:
    % Error copying file:tmp/ssl/pass.key to sslkey: (Password protected keys are not 
    supported)
    Note: Only certificates with RSA public keys are supported. When a certificate, without RSA public keys, is copied, the copy fails and an error is displayed as shown below.
    switch#copy file:tmp/ssl/dsa.crt certificate:
    % Error copying file:tmp/ssl/dsa.crt to certificate: (Certificate does not have
    RSA key)
Deleting a certificate

The delete command deletes the certificate configuration from the certificate: file system on switch.

Example

This command deletes the server.crt certificate from the switch.
switch#delete certificate:server.crt 
Generating certificates

The following commands help user to generate a self-signed certificate or certificate signing request (CSR).

Examples

  • This command generates a self-signed certificate or certificate signing request (CSR). In the example below an existing private key (test.key) is used to generate the certificates. The generated certificate signing request (CSR) can be viewed on the CLI, whereas a self-signed certificate will be saved to the certificate: file system.
    switch#security pki certificate generate self-signed test.crt key test.key 
  • This command specifies the digest and the validity (in days) of the certificate. The validity is applicable only for self-signed certificates:
    switch#security pki certificate generate signing-request key test.key digest sha256 validity 365 
  • This command adds the certificate parameters such as common-name, country, email and others.
    switch#security pki certificate generate signing-request key test.key parameters common-name Test [country US ...] 

Configuring Keys

Copying a key to the Switch

The copy command copies the RSA key to sslkey: file system. The key can be copied from any supported source URLs of the copy command.

Example

This command copies a server.key RSA key to sslkey: file system.
switch#copy file:/tmp/ssl/server.key sslkey:
Copy completed successfully.
Errors While Copying the keys

Examples

  • Generally a single source file can contain multiple PEM encoded keys but only one PEM encoded key per file is supported. An error occurs when such multiple PEM encoded file is copied and the copy fails and error is displayed as shown.
    switch#copy file:tmp/ssl/multi.key sslkey:
    % Error copying file:tmp/ssl/multi.key to sslkey: (Multiple PEM entities in 
    single file not supported)
  • An error occurs when a source file containing invalid PEM encoded key is copied. When such files are copied the copy fails, and an error is displayed as shown.
    switch#copy file:tmp/ssl/bad.key sslkey:
    % Error copying file:tmp/ssl/bad.key to sslkey: (Invalid RSA key)
Deleting a key

The delete command deletes the key configuration from the switch.

Example

This command deletes the server.key key from the switch.
switch#delete sslkey:server.key 
Generating keys

The following commands help user to generate RSA keys.

Examples

  • This command generate a 2048-bit long RSA private key and saves it to sslkey:test.key.
    switch#security pki key generate rsa 2048 test.key 
  • This command generate a 4096-bit long self-signed certificate RSA key and 2048-bit long certificate signing request RSA key.
    switch#security pki certificate generate self-signed test.crt key test.key 
    generate rsa 4096
    switch#security pki certificate generate signing-request key test.key 
    generate rsa 2048

Configuring a certificate with a RSA key in SSL Profile

A SSL profile is configured with a certificate and its corresponding RSA key. The public key information in the certificate must match the RSA key. This certificate and RSA key pair are used to authenticate to the peer during SSL negotiation. The individual EOS features that use SSL profile configuration will decide whether the certificate and key configuration is optional or mandatory.

Example

switch#config
switch(config)#management security
switch(config-mgmt-security)#ssl profile server
switch(config-mgmt-sec-ssl-profile-server)#certificate server.crt key server.key

In case, if the RSA key configured in SSL profile does not match with the configured certificate, the SSL profile state becomes invalid, and an error is displayed.

Example

switch(config-mgmt-security)#ssl profile server
switch(config-mgmt-sec-ssl-profile-server)#certificate server.crt key client.key
switch(config-mgmt-sec-ssl-profile-server)#show management security ssl profile
 Profile StateError
------------- ------------- ----------------------------------------
 serverinvalidCertificate 'server.crt' does not match
with key
Configuring SSL Profile with a certificate authority (CA)

During SSL negotiation with mutual authentication, the peer (or client) certificate is verified by checking if it is signed by one of these trusted certificates. For peer certificates that do not have a chain to a trusted certificate, the full bundle of certificates leading to the trusted certificates must be included. The individual EOS features that use SSL profile configuration will decide whether the trusted certificate configuration is optional or mandatory.

Example

switch#config
switch(config)#management security
switch(config-mgmt-security)#ssl profile server
switch(config-mgmt-sec-ssl-profile-server)#trust certificate ca1.crt
switch(config-mgmt-sec-ssl-profile-server)#trust certificate ca2.crt
Configuring certificate chains

The certificate chains are used to provide a chain of trust for the SSL Profile server certificate to a remote party. Several chain certificate commands can be issued to build a certificate chain with many intermediate CAs, regardless of the order. Use the chain certificate command to configure the certificate chain for a SSL profile. The no form of the command deletes the certificate configuration.

Examples

  • These commands configure the certificate chains for intermediate.crt, assuming that server.crt is issued by an intermediate CA intermediate.crt and intermediate.crt is itself issued by the root CA ca.crt.
    switch#config
    switch#(config)#management security
    switch#(config-mgmt-security)#ssl profile server
    switch#(config-mgmt-sec-ssl-profile-server)#certificate server.crt key 
    server.key
    switch#(config-mgmt-sec-ssl-profile-server)#chain certificate intermediate.crt
  • The other peer can be configured to trust ca.crt in order to verify the certificate chain during the TLS handshake as shown in the below example.
    switch#config
    switch#(config)#management security
    switch(config-mgmt-security)#ssl profile client
    switch(config-mgmt-sec-ssl-profile-client)#certificate client.crt key client.key
    switch(config-mgmt-sec-ssl-profile-client)#trust certificate ca.crt
  • To check the revocation status of the server certificate chain, the client can add the certificate Revocation List (CRLs) to its SSL profile configuration. One CRL needs to be specified for every CA in the chain, even if its not revoking any certificate.
    switch#config
    switch#(config)#management security
    switch(config-mgmt-security)#ssl profile client
    switch(config-mgmt-sec-ssl-profile-client)#crl intermediate.crl
    switch(config-mgmt-sec-ssl-profile-client)#crl ca.crl
Note: Both the chain certificate and crl commands look into the certificate: directory to find the right PEM file.
Local certificate checks

The way certificates are verified locally before SSL negotiation can be modified to add or relax some checks. The following are the few checks to perform before any communication with the peer.

Examples

  • Check if the certificate has an extended key usage attribute:
    switch(config-mgmt-sec-ssl-profile-client)#certificate requirement extended-key-usage 
  • Check if all the trusted certificates or certificates in the chain have a CA basic constraints set to true.
    switch(config-mgmt-sec-ssl-profile-client)#trust certificate requirement 
    basic-constraints ca true
    switch(config-mgmt-sec-ssl-profile-client)#chain certificate requirement 
    basic-constraints ca true
  • Do not mark an expired certificate as invalid.
    switch(config-mgmt-sec-ssl-profile-client)#certificate policy expiry-date ignore
Displaying SSL profile status and SSL profile errors

The show management security ssl profile command displays the SSL profile status information. To view a specific SSL profile status use the name of the SSL profile, else all SSL profile status are displayed.

Example

This command displays the status of SSL profile server.
switch#show management security ssl profile server
 ProfileState
------------- -----------
 server valid

If there are any errors in the SSL profile, an invalid state is displayed and the errors are listed in the third column. Once the error is fixed, the SSL profile becomes valid.

Examples

  • When the certificate 'server.crt' does not match with the key the following error is shown.
    switch#show management security ssl profile server
     ProfileState Error
    ------------- ------------- ----------------------------------------
     server invalid Certificate 'server.crt' does not match
    with key
    
  • When a trusted certificate 'ca2.crt' does not exist the following error is shown.
    switch#show management security ssl profile server
     ProfileState Error
    ------------- ------------- ----------------------------------------
     server invalid Certificate 'ca2.crt' does not exist
    
  • When a trusted certificate 'foo.crt' is not self-signed root certificate the following error is shown.
    switch#show management security ssl profile server
     ProfileState Error
    ------------- ------------- ----------------------------------------
    server invalid Certificate 'foo.crt' is trusted and not
     a root certificate
    
  • When the certificate 'server.crt' is expired the following error is shown.
    switch#show management security ssl profile server
     ProfileState Error
    ------------- ------------- ----------------------------------------
     server invalid Certificate 'server.crt' has expired
    
  • When the certificate chain is missing an intermediate certificate the following error is shown.
    switch#show management security ssl profile server
    ProfileState Error
    -------------- ------------- ---------------------------------------------
    serverinvalidProfile has invalid certificate chain
     Certificate 'intermediate.crt' does not exist
    

Rotating Certificate and Key Pair

The certificate and key pair used in SSL profile can be rotated using rotation commands. For example, let's say we want to rotate cert.pem and key.pem in the SSL profile profile01.
switch01#show running-config section ssl
management security
ssl profile profile01
certificate cert.pem key key.pem
Run the security pki certificate generate signing-request rotation ssl profile command to generate a new key and corresponding signing request for SSL profile profile01. This command also generates a unique rotation ID that can be later used to import the certificate.
switch01#security pki certificate generate signing-request rotation ssl profile profile01 key generate rsa 2048 parameters common-name switch01
Rotation ID: 2ad7771e8cbc11ebbba37483ef8d9c4b
Certificate Signing Request:
-----BEGIN CERTIFICATE REQUEST-----
MIICZzCCAU8CAQAwEzERMA8GA1UEAwwIc3dpdGNoMDEwggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQCy5EsczfEZlAVNZQ8/nfRgEF3bg/tz0XrQJwP/zHhI
UFx1A1VI4O7XhUrYReH1h4OQWhXXX0AHTLTsaClJWHH9m7SXb4iZVo/Y1zXGdyju
1FmnWnNDi72M8f60WXG9gAMtnZK9K53A3lwvrKS+CwJkLCOjlH4xyp1Wsg1+yfay
AdfXAj+s1Vmg3Rux/XR8iP3N620YVbQ+AfWUQkSNFSsykcTeLvx2WybqX4p4Kids
nqU28ml/NZPS5wEc2OXhagrBn3jHbxdmI33/4SJHN8iNZ6h+gQz+JI18bQrlTHng
RzAx1ENvnz7ZzzeN/n/wh/ArZ6Q9aojrBtAk55aGuY4hAgMBAAGgDzANBgkqhkiG
9w0BCQ4xADANBgkqhkiG9w0BAQsFAAOCAQEAqwQbAsdw6UhpvjDk8OdmXLgCNOSC
jGFLFZe4I67gDmyGQR2lG1brRTQPKp7OphpPxaqr3YvxErEFdQ35gvIUyo9j8qp1
F22yAZGjLqU3prnGLEAZ/I3PcdivNVzL9UJw/JMfHI1CMH6yGtbEI2BXsCTetfxm
JE+N9ujfBlQ/MjUR6IszNxEB2YkFh/DvnVUHoqV0ka+JRmMhGkmTrXwad8bhxYZs
g7cwXktsMLuy2otK21fkFcRvd9OHXssJ2Mf7914ALiDe2sfixHX+35SytR8bahTk
z09HPCkxJmfl+cdhS9SWXrXpHHwXicjwYCj1pqZulBFXtgnVs2Kmd3NnRA==
-----END CERTIFICATE REQUEST-----
The complete syntax of the above command is as follows. The import-timeout specifies the timeout for this rotation ID. If no certificate is imported within this timeout, the rotation ID expires and will be deleted.
switch#security pki certificate generate signing-request rotation ssl profile <profile-name> 
key generate rsa <2048|3072|4096>
[ import-timeout <minutes> ] (default: 60 mins) 
[ digest <sha256|sha384|sha512> ](default: sha256) parameters common-name <common-name>
[ country <country-code> ]
[ state <state-name> ] 
[ locality <locality-name> ] 
[ organization <org-name> ] 
[ organization-unit <org-unit-name> ] 
[ email <email> ] 
[ subject-alternative-name [ ip <ip1 ip2 …> ] 
[ dns<nm1 nm2 …> ] [ dns<nm1 nm2 …> ]
Use the show security pki certificate rotation command to view the status of rotation IDs.
Example
switch#show security pki certificate rotation
 Rotation IDProfile Name State Expiry
-------------------------------------- ------------------ -------------------- -------------------
 2ad7771e8cbc11ebbba37483ef8d9c4b profile01Import Pending2021-03-24 10:15:37
Copy the signing request, get it signed by a CA and import the certificate using the security pki certificate rotation import <rotation-id> command. Use the rotation ID that was generated with the signing request.
switch#security pki certificate rotation import 2ad7771e8cbc11ebbba37483ef8d9c4b
Enter TEXT certificate. Type 'EOF' on its own line to end.
-----BEGIN CERTIFICATE-----
MIICnTCCAYWgAwIBAgIJANzHst3ljdWfMA0GCSqGSIb3DQEBCwUAMA4xDDAKBgNV
BAMMA2ZvbzAeFw0yMTAzMjQxNjAyMDdaFw0yMjAzMjQxNjAyMDdaMA4xDDAKBgNV
BAMMA2ZvbzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK2LhqPnQ3Oz
1Pg1PB5toNyCNB60IdCDUVXZcwmyCgS6ifwBYgmw/mCq3iOFncEilaCNIkaFKiWf
b7s43jQd9tmAbnnQw3xUO8jDweus+yCumMNjLLQApbTOZDE4zDonmbWh6kswh8qI
batiz9wR7l5K1bPbbmQx6nO28LrcLCuFSZWrw4R2nprQxdoo5eAotMsGDQdh2vn7
k4yD0CQGVCquVzKI+iVgW7yIfiZ9cwWdFTAlTmkrqQsq+edZmvnuNcOaZm22R5Sb
aPy9osv82oZk8iMX+oDYddY2wMQzLd7ByWlAh4bzCJxNMPIz8hrxU84up0I4srXi
xDVXdL1d2JsCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEADkjfobxF7BAVFdIjyWHL
ID+9D1t96JvCe+PDUyggow6iZE8ROq2fIFHuXhXMrd/neN3WtxqtjvGBnS49t4fa
qIcjerkIPwLaBSwWdpm/1FrIFejYqU0symRE3bKJULLBEdQhyox37D2uqPm71ado
5rXCX9pSu2oNOThd/877QKxtrKa5pekx1acxEa4E0QJ0/YPwkA5nCzM9jy7DZlH2
+cdtCxREeqlhOJUJxQ2354LyykU2fOXe6AGGdVE9hdIOJDnG26VVb+gFt2qaKD5+
3D3/Gd1pm4P3+9aENlhAcr0PUoL3xUApeIdkEf7n8KHiNP+gmlPyVDTCAudwHnwq
Vg==
-----END CERTIFICATE-----
EOF
Success
Commit the rotation ID using the security pki certificate rotation commit <rotation-id> command. This will rotate cert.pem and key.pem of SSL profile profile01 with new certificate and key.
switch#security pki certificate rotation commit 2ad7771e8cbc11ebbba37483ef8d9c4b
Success
Note: If the key is generated outside EOS, then instead of the above workflow, we can rotate the certificate and key pair using a single command as below:
switch#security pki certificate rotation commit ssl profile profile01
Enter TEXT private key. Type 'EOF' on its own line to end.
-----BEGIN PRIVATE KEY-----
MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCti4aj50Nzs9T4
NTwebaDcgjQetCHQg1FV2XMJsgoEuon8AWIJsP5gqt4jhZ3BIpWgjSJGhSoln2+7
ON40HfbZgG550MN8VDvIw8HrrPsgrpjDYyy0AKW0zmQxOMw6J5m1oepLMIfKiG2r
Ys/cEe5eStWz225kMepztvC63CwrhUmVq8OEdp6a0MXaKOXgKLTLBg0HYdr5+5OM
g9AkBlQqrlcyiPolYFu8iH4mfXMFnRUwJU5pK6kLKvnnWZr57jXDmmZttkeUm2j8
vaLL/NqGZPIjF/qA2HXWNsDEMy3ewclpQIeG8wicTTDyM/Ia8VPOLqdCOLK14sQ1
V3S9XdibAgMBAAECggEAEdDMLSD4HTVzDFoBW8mlpQ10G/TNBd1Sk7gY0FV9JCLM
OIPMfzHdeKoB15lcv691DIArP8cQM8A21ab5tKr2JOTuMnDaffXIagyikzb0/tQT
1qhaFeHaHCTFP4yBQKBgQDczahFFYJRP0joT4Hu
iywlkhbyOHV7b9xuPPhqwQxFYqHvEE0qBnmjBzXujbpdb+V18QFGyl0uH4mHr+lt
izcyAbEx5YL/y5Vu08bITZr0mUxS0ZkDXg6n6GKJVIPUH05xSZb/eqtSFIq/DsBQ
YSwu6WzOj4dNpEQAeD8jMmGAlwKBgQDJNWTNyC2JgDYmF039gwNEOY+UuJQ3v/Jo
Ei2IHG4ISxVlZc9lZgLuWHDyS6zNOIeSAYIzDVSsRAGH9sWaK4E4Yno4KHptRC5F
MEbtnrojTO2ANC9JcWo2EgP31r1OJolFpKUiPhOEAzdEYd/sdp9tWEusszTrn8fb
PHvSHUFknQKBgDe8VhByOH4HyoCRqUusp80oDlDAPa+V8f+FtnNEHbPaDORKqh/E
mKm1ZUC9V+DEIRjfaCIVbOX6of21Quga7yjZUoA03hdxrVvXa2Mea9H4bFKvg79c
27g4qb7erZQ6/tML72i370z90HQf5h2kGcIRvBx8EHxhzaSMtetNiV0rAoGAP3Qz
QiJrGf3xFborwlNa6F0uxrwfIiXKkL+K1G4C1WK4cK3W5idxrTD/DaqH6IB3YLhR
E0CU/27C/Nn6H1CxA9MqsCMz2NmzreY3uCBim1dbXx8V+pdl439y+Ooj8U195RSz
b0UcanmJKGulbrFKPfWmh+RMQDK3mJBOjEjlopECgYAr6F+60TZ7ZAvA0vZ9Plrn
tzvY7GhopJgJfAvfi5nBXPS+fkdKtWzOmhW1jon1ka0fEeRQnQjB7DSYB4zldufPKiD+EXgJtQbhS
qfdtgL7QlhVrpO/s5tUrPE/KRu/yLGtEWruQlDCawpMPA63eP4XER/MHVXBkqbWy
85vx46SisOBAnuEum0yMngru5fARoBKO1aV7G94FI7Eu5rDqeVYsE5jrdnWJTZTg
pHf9RYUOlz8RwwbD/xUs+cKbM1qhaFeHaHCTFP4yBQKBgQDczahFFYJRP0joT4Hu
iywlkhbyOHV7b9xuPPhqwQxFYqHvEE0qBnmjBzXujbpdb+V18QFGyl0uH4mHr+lt
izcyAbEx5YL/y5Vu08bITZr0mUxS0ZkDXg6n6GKJVIPUH05xSZb/eqtSFIq/DsBQ
YSwu6WzOj4dNpEQAeD8jMmGAlwKBgQDJNWTNyC2JgDYmF039gwNEOY+UuJQ3v/Jo
Ei2IHG4ISxVlZc9lZgLuWHDyS6zNOIeSAYIzDVSsRAGH9sWaK4E4Yno4KHptRC5F
MEbtnrojTO2ANC9JcWo2EgP31r1OJolFpKUiPhOEAzdEYd/sdp9tWEusszTrn8fb
PHvSHUFknQKBgDe8VhByOH4HyoCRqUusp80oDlDAPa+V8f+FtnNEHbPaDORKqh/E
mKm1ZUC9V+DEIRjfaCIVbOX6of21Quga7yjZUoA03hdxrVvXa2Mea9H4bFKvg79c
27g4qb7erZQ6/tML72i370z90HQf5h2kGcIRvBx8EHxhzaSMtetNiV0rAoGAP3Qz
QiJrGf3xFborwlNa6F0uxrwfIiXKkL+K1G4C1WK4cK3W5idxrTD/DaqH6IB3YLhR
E0CU/27C/Nn6H1CxA9MqsCMz2NmzreY3uCBim1dbXx8V+pdl439y+Ooj8U195RSz
b0UcanmJKGulbrFKPfWmh+RMQDK3mJBOjEjlopECgYAr6F+60TZ7ZAvA0vZ9Plrn
tzvY7GhopJgJfGr1GYQPJi38DJ5NR/w64js21t5X2yJ4xcCB3H7R0QWJ9EE+fc+7
nBYFJlaDzSRBbES24yGh4n4Vc6luYW9A+YJR3EaElE6RMWyzIY8J8kV2xuTaK9xe
pdM9x1J1kIm2rA1mcO4Xqw==
-----END PRIVATE KEY-----
EOF
Enter TEXT certificate. Type 'EOF' on its own line to end.
-----BEGIN CERTIFICATE-----
MIICnTCCAYWgAwIBAgIJANzHst3ljdWfMA0GCSqGSIb3DQEBCwUAMA4xDDAKBgNV
BAMMA2ZvbzAeFw0yMTAzMjQxNjAyMDdaFw0yMjAzMjQxNjAyMDdaMA4xDDAKBgNV
BAMMA2ZvbzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK2LhqPnQ3Oz
1Pg1PB5toNyCNB60IdCDUVXZcwmyCgS6ifwBYgmw/mCq3iOFncEilaCNIkaFKiWf
b7s43jQd9tmAbnnQw3xUO8jDweus+yCumMNjLLQApbTOZDE4zDonmbWh6kswh8qI
batiz9wR7l5K1bPbbmQx6nO28LrcLCuFSZWrw4R2nprQxdoo5eAotMsGDQdh2vn7
k4yD0CQGVCquVzKI+iVgW7yIfiZ9cwWdFTAlTmkrqQsq+edZmvnuNcOaZm22R5Sb
aPy9osv82oZk8iMX+oDYddY2wMQzLd7ByWlAh4bzCJxNMPIz8hrxU84up0I4srXi
xDVXdL1d2JsCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEADkjfobxF7BAVFdIjyWHL
ID+9D1t96JvCe+PDUyggow6iZE8ROq2fIFHuXhXMrd/neN3WtxqtjvGBnS49t4fa
qIcjerkIPwLaBSwWdpm/1FrIFejYqU0symRE3bKJULLBEdQhyox37D2uqPm71ado
5rXCX9pSu2oNOThd/877QKxtrKa5pekx1acxEa4E0QJ0/YPwkA5nCzM9jy7DZlH2
+cdtCxREeqlhOJUJxQ2354LyykU2fOXe6AGGdVE9hdIOJDnG26VVb+gFt2qaKD5+
3D3/Gd1pm4P3+9aENlhAcr0PUoL3xUApeIdkEf7n8KHiNP+gmlPyVDTCAudwHnwq
Vg==
-----END CERTIFICATE-----
EOF
Success
Once the certificate and key pair is rotated, use the show management security ssl certificate cert.pem and show management security ssl key key.pem commands to display the new contents.

Resetting Diffie-Hellman Parameters

The Diffie-Hellman parameters file is used for symmetric key exchange during SSL negotiation. When the system is booted, the system auto generates a Diffie-Hellman parameters file if one does not exist. To reset the auto generated Diffie-Hellman parameters file, use the reset command. The individual features that use SSL profile configuration will decide whether they also use the Diffie-Hellman parameters file. The switch uses 2048-bit Diffie-Hellman parameters with no options to select the size.

Note: Not all features that use SSL profile configuration will use Diffie-Hellman parameters file.

Example

This command resets the Diffie-Hellman parameters file.
switch#reset ssl diffie-hellman parameters

Displaying the Diffie-Hellman parameters

The show management security ssl diffie-hellman command displays the Diffie-Hellman parameters.

Example

This command displays the Diffie-Hellman parameters.
switch#show management security ssl diffie-hellman
Last successful reset on Apr 10 16:18:08 2015
Diffie-Hellman Parameters 1024 bits
 Generator: 2
 Prime: dc47b5edc0d2b41451432f79f45efab452bba7b1ab118c194d671d6752ed1c550
664ed8f052ad0fdad623c1d54ae5aee5e728d2bd7a6221636b787a4c08d1fef8c
6dcd10759d38f8b70b47d1c7972d69b0b295a2ee6ab44cfc7352cb133e85197c8
9f1fc27aac7e8e02afb4fb01ca1cb05558a7bef505b73a8d06cdfe403576b

Configuring the TLS Handshake Settings

During a TLS handshake, both peers send each other a list of the TLS versions they support as a way to agree on and use the highest common version. In a SSL profile the following allowable versions can be configured using the tls versions command. By default, TLSv1, TLSv1.1 and TLSv1.2 are enabled.

Examples

  • This command will force TLSv1.2 to be used. If the other peer doesnt support this version, the TLS handshake will fail.
    switch#config
    switch#(config)#management security
    switch(config-mgmt-security)#ssl profile client
    switch(config-mgmt-sec-ssl-profile-client)#
    switch(config-mgmt-sec-ssl-profile-client)#tls versions 1.2
  • These commands add support for TLSv1.1 on top of the already configured TLSv1.2.
    switch(config-mgmt-sec-ssl-profile-client)#tls versions add 1.1
    switch(config-mgmt-sec-ssl-profile-client)#tls versions 1.1 1.2

Similarly to the TLS version, the cipher suite is negotiated between the client and the server during a TLS handshake. Ideally, the client will send the list of cipher suites it supports and the server will choose a common cipher suite after looking at the clients list as well as its own list of cipher suites. The the cipher-list setting here is an Open SSL cipher string that is HIGH:!NULL:!MD5, which only allows key length larger than 128 bits and forbids cipher suites using MD5. The full list of cipher suites can be expanded using the shell command openssl ciphers HIGH:!NULL:!MD5

Example

This command builds a cipher suite list.
switch(config-mgmt-sec-ssl-profile-client)#cipher-list AESGCM
switch(config-mgmt-sec-ssl-profile-client)#cipher-list SHA256:SHA384
switch(config-mgmt-sec-ssl-profile-client)#cipher-list ECDHE-ECDSA-AES256-GCM-SHA384

Enabling the Federal Information Processing Standards (FIPS) Mode

Federal Information Processing Standards (FIPS) is a cryptographic standard used to restrict the cryptographic functions and protocol versions that are used by OpenSSL.

Example

This command enables the FIPS mode for a SSL profile.
switch(config-mgmt-sec-ssl-profile-client)#fips restrictions 

Displaying Certificate and Key Information

Displaying Certificate Information

Displaying the directory information

The dir command displays the directory output of certificate file systems.

Example

This command displays the directory output of certificate: file-system.
switch#dir certificate:
Directory of certificate:/
 -rw- 3319 Apr 10 11:50 server.crt
No space information available
Displaying the certificate information

The show management security ssl certificate command displays the certificate information. To view a specific certificate use the name of the certificate, else all the certificates are displayed.

Example

This command displays the server.crt certificate information.
switch#show management security ssl certificate server.crt
Certificate server.crt:
 Version:1
 Serial Number:9
 Issuer:
Common name: ca
Email address: ca@foo.com
Organizational unit: Foo Org
Organization:Foo
Locality:SC
State: CA
Country: US
 Validity:
Not before: Aug 11 21:44:17 2014 GMT
Not After:May 14 21:44:17 2069 GMT
 Subject:
Common name:server
Email address:server@arista.com
Organizational unit:Foo Org
Organization: Foo
Locality: SC
State:CA
Country:US
 Subject public key info:
Encryption Algorithm: RSA
Size: 2048 bits
Public exponent:65537
Modulus:e04e3ff8e1c64dbcb141fe96133f998e90a322c671b9f28307bf873
2239f69804a77fbb8f146841eb6253b7bb50bf6c66bbf3097ec695b
0d7985cfdd939c9913b4ba4f6cb8655b208ed0254a269ecab574987
ea5ee80085f5216d303cf704372b2fa1aae62756c3762441fcc1c04
635a831d5ec96d841
Displaying Certificate Revocation List (CRL) information

The show management security ssl crl command displays the installed Certificate Revocation List (CRL) information. To view a specific CRL use the name of the CRL, else all the CRLs are displayed.

Example

This command displays the intermediate.crl information.
switch#show management security ssl crl intermediate.crl
CRL intermediate.crl:
 CRL Number: 11
 Issuer:
Common name: intermediate
Email address: intermediate@foo.com
Organizational unit: Foo Org
Organization: Foo
State: CA
Country: US
 Validity:
Last Update: Jul 19 19:27:34 2016 GMT
Next Update: Dec 05 19:27:34 2043 GMT

Displaying Key Information

Displaying the directory information

The dir command displays the directory output of SSL key file systems.

Example

This command displays the directory output of sslkey: file-system.
switch#dir sslkey:
Directory of sslkey:/
 -rw- 1675 Apr 10 12:55 server.key
No space information available
Displaying the RSA key information

The show management security ssl key command displays the RSA key information. To view a specific RSA key use the name of the key, else all the keys are displayed. For security reasons, only the public part of the key is displayed.

Example

This command displays the server.key key information.
switch#show management security ssl key server.key
Key server.key:
 Encryption Algorithm: RSA
 Size: 2048 bits
 Public exponent:65537
 Modulus:e04e3ff8e1c64dbcb141fe96133f998e90a322c671b9f28307bf873
 2239f69804a77fbb8f146841eb6253b7bb50bf6c66bbf3097ec695b
 0d7985cfdd939c9913b4ba4f6cb8655b208ed0254a269ecab574987
 b502f8c3f541fa3bae59743cced6e6ca04f6ca6c9268744add79c3a
 f8178d12dd744ddf5db100b33c46b40e53f0a1c7d49f83488976c5d

TLS Commands

copy file: certificate:

The copy file: certificate: command copies the certificate to certificate: file system. The certificate can be copied from any supported source URLs of the copy command.

Command Mode

Global Configuration

Command Syntax

copy file: file_name certificate:

Parameters

  • file_name location or the path of the file or the directory where the certificate is saved.

Guidelines

The following points to be considered while using the copy command:

  • Generally a single source file can contain multiple PEM encoded certificates but only one PEM encoded certificate per file is supported. An error occurs when such multiple PEM encoded file is copied and the copy fails and displays an error.
  • An error occurs when a source file containing invalid PEM encoded certificate is copied. When such files are copied the copy fails, and displays an error.
  • An error occurs when a source files containing a certificate with password protected key is copied. When such files are copied the copy fails, and displays an error.

The following errors occur while copying the certificates:

  • When multiple PEM encoded certificates are copied, the copy task fails and the following error is displayed.
    switch(config)#copy file:tmp/ssl/multi.crt certificate:
    % Error copying file:tmp/ssl/multi.crt to certificate: (Multiple PEM entities in 
    single file not supported)
    
  • When a source file containing invalid PEM encoded certificate is copied, the copy task fails and the following error is displayed.
    switch(config)#copy file:tmp/ssl/bad.crt certificate:
    % Error copying file:tmp/ssl/bad.crt to certificate: (Invalid certificate)
    
  • When a source file containing a certificate with password protected key is copied, the copy task fails and the following error is displayed.
    switch(config)#copy file:tmp/ssl/pass.key sslkey:
    % Error copying file:tmp/ssl/pass.key to sslkey: (Password protected keys are not 
    supported)
    
  • Only certificates with RSA public keys are supported. When a certificate without RSA public key is copied the copy fails, and an error is displayed.
    switch(config)#copy file:tmp/ssl/dsa.crt certificate:
    % Error copying file:tmp/ssl/dsa.crt to certificate: (Certificate does not have 
    RSA key)
    

Example

This command copies a server.crt certificate to certificate: file system.
switch(config)#copy file:/tmp/ssl/server.crt certificate:
Copy completed successfully.

copy file: sslkey:

The copy file: sslkey: command copies the SSL key to the sslkey: file system. The key can be copied from any supported source URLs of the copy command.

Command Mode

Global Configuration

Command Syntax

copy file: file_name sslkey:

Parameters

file_name location or the path of the file or the directory where the key is saved.

Guidelines

The following points to be considered while using the copy command:

  • Generally a single source file can contain multiple PEM encoded keys but only one PEM encoded key per file is supported. An error occurs when such multiple PEM encoded file is copied and the copy fails and shows an error.
  • An error occurs when a source file containing invalid PEM encoded key is copied. When such files are copied the copy fails, and shows an error.

The following errors occur while copying the certificates:

  • When multiple PEM encoded keys are copied, the copy fails and the following error occurs.
    switch#copy file:tmp/ssl/multi.key sslkey:
    % Error copying file:tmp/ssl/multi.key to sslkey: (Multiple PEM entities in 
    single file not supported)
    
  • When a source file containing invalid PEM encoded key is copied, the following error occurs.
    switch#copy file:tmp/ssl/bad.key sslkey:
    % Error copying file:tmp/ssl/bad.key to sslkey: (Invalid RSA key)
    

Example

This command copies a server.key key to the sslkey: file system.
switch(config)#copy file:/tmp/ssl/server.key sslkey:
Copy completed successfully.

delete certificate:

The delete certificate: command deletes a specified certificate from certificate: file system on the switch.

Command Mode

Global Configuration

Command Syntax

delete certificate: certificate_name

Parameters

certificate_name name of the certificate to be deleted.

Example

This command deletes the server.crt certificate from the switch.
switch(config)#delete certificate:server.crt

delete sslkey:

The delete sslkey: command deletes a SSL key from sslkey: file system on a switch.

Command Mode

Global Configuration

Command Syntax

delete sslkey: key_name

Parameters

key_name name of the key.

Example

This command deletes the server.key SSL key on the switch.
switch(config)#delete sslkey:server.key 

dir certificate:

The dir certificate: command displays the directory output of certificate: file system on the switch.

Command Mode

Global Configuration

Command Syntax

dir certificate:

Example

This command shows the directory output of certificate: file system on the switch.
switch(config)#dir certificate:
Directory of certificate:/
 -rw- 3319 Apr 10 11:50 server.crt
No space information available

dir sslkey:

The dir sslkey: command displays the directory output of sslkey: file system on the switch.

Command Mode

Global Configuration

Command Syntax

dir sslkey:

Example

This command shows the directory output of sslkey: file system on the switch.
switch(config)#dir sslkey:
Directory of sslkey:/
 -rw- 1675 Apr 10 12:55 server.key
No space information available

reset ssl diffie-hellman parameters

The reset ssl diffie-hellman parameters command resets the Diffie-Hellman parameters file after a system reboot.

Command Mode

Global Configuration

Command Syntax

reset ssl diffie-hellman parameters

Example

This command resets the Diffie-Hellman parameters file.
switch(config)#reset ssl diffie-hellman parameters
switch(config)#

security pki certificate generate

The security pki certificate generate command is used to generate a self-signed certificate or a certificate signing request (CSR) certificate. The generated CSR is displayed on the CLI, whereas a self-signed certificate is saved to the certificate: file system.

Many other parameters can be entered and applied to the certificate as shown in the following examples below.

Command Mode

Global Configuration

Command Syntax

security pki certificate generate {self-signed | signing-request} certificate_name Key key_name

Parameters

  • certificate_name name of the certificate to generate. Options includes.
    • self-signed request to generate self-signed certificate.
    • signing-request request to generate signing-request.
    • digest signs the certificate or key with the following cryptographic hash algorithm (sha256, sha384, sha512).
    • key_name name of the key to modify.
  • parameters signing request parameters for a certificate. Option includes.
    • common-name common name for use in subject.
    • country two-letter country code for use in subject
    • email email address for use in subject
    • locality locality name for use in subject
    • organization organization name for use in subject
    • organization-unit organization Unit Name for use in subject
    • state state for use in subject
    • subject-alternative-name subject alternative name extension
    • rotation to generate a unique rotation ID
  • validity validity of the certificate in days. Value ranges from 1 to 30000 .

Examples

  • This command generates a self-signed certificate or CSR certificate. In the example below an existing private key (test.key) is used to generate the certificates.
    switch(config)#security pki certificate generate self-signed test.crt key test.key 
  • This command specifies the digest and the validity (in days) of the certificate or key.
    switch(config)#security pki certificate generate signing-request key test.key digest sha256 validity 365 
  • This command adds the certificate parameters such as common-name, country, email, and others.
    switch(config)#security pki certificate generate signing-request key test.key parameters common-name Test [country US ...] 

security pki key generate

The security pki key generate command generates a RSA key used to validate a specific certificate.

The key generated can be modified and saved by entering the value of the length in generate rsa <length> parameter.

Command Mode

Global Configuration

Command Syntax

security pki key generate rsa key_name

Parameters

  • rsa use Rivest-Shamir-Adleman (RSA) algorithm. Options include.
    • 2048 Use 2048-bit keys
    • 3072 Use 3072-bit keys
    • 4096 Use 4096-bit keys
  • key_name name of the key to generate.

Examples

  • This command generates a a 2048-bit long RSA private key(test.key) and save it to sslkey:test.key.
    switch(config)#security pki key generate rsa 2048 test.key 
  • This command modifies the generated RSA key length value.
    switch(config)#security pki certificate generate self-signed test.crt key 
    test.key generate rsa 4096
    switch(config)#security pki certificate generate signing-request key test.key 
    generate rsa 2048
    

show management security ssl certificate

The show management security ssl certificate command displays information about the certificate. Provide the name of the certificate if you want to view more information of the certificate. If no name is provided, this command displays information of all the certificates.

Command Mode

EXEC

Command Syntax

show management security ssl certificate [certificate_name]

Parameter

certificate_name name of the certificate. This is optional.

Example

This command displays the server.crt certificate information.
switch#show management security ssl certificate server.crt
Certificate server.crt:
 Version:1
 Serial Number:9
 Issuer:
Common name: ca
Email address: ca@foo.com
Organizational unit: Foo Org
Organization:Foo
Locality:SC
State: CA
Country: US
 Validity:
Not before: Aug 11 21:44:17 2014 GMT
Not After:May 14 21:44:17 2069 GMT
 Subject:
Common name:server
Email address:server@arista.com
Organizational unit:Foo Org
Organization: Foo
Locality: SC
State:CA
Country:US
 Subject public key info:
Encryption Algorithm: RSA
Size: 2048 bits
Public exponent:65537
Modulus:e04e3ff8e1c64dbcb141fe96133f998e90a322c671b9f28307bf873
2239f69804a77fbb8f146841eb6253b7bb50bf6c66bbf3097ec695b
0d7985cfdd939c9913b4ba4f6cb8655b208ed0254a269ecab574987
9f54c8c7f0b3a57a7ab826870119083222ad5ee76d40f3fae49d36e
b502f8c3f541fa3bae59743cced6e6ca04f6ca6c9268744add79c3a
c08af6b451455b4a61071f4c0b3ec3553585312783e9381f65bb0e2
ea5ee80085f5216d303cf704372b2fa1aae62756c3762441fcc1c04
97ee6190586ed28c0e376f48e53f05a40c7e1f3a65e3c6165bae5df
f8178d12dd744ddf5db100b33c46b40e53f0a1c7d49f83488976c5d
635a831d5ec96d841

show management security ssl crl

The show management security ssl crl command displays the basic information on the installed certificate revocation list (CRLs).To view information of a specific CRL provide the name of the CRL. If no name is provided, this command shows information of all the CRLs.

Note: The command only shows basic information and does not show any information on the revocation status of certificates.

Command Mode

EXEC

Command Syntax

show management security ssl crl

Example

This command displays the basic information of the intermediate.crl CRL.
switch#show management security ssl crl intermediate.crl
CRL intermediate.crl:
 CRL Number: 11
 Issuer:
Common name: intermediate
Email address: intermediate@foo.com
Organizational unit: Foo Org
Organization: Foo
State: CA
Country: US
 Validity:
Last Update: Jul 19 19:27:34 2016 GMT
Next Update: Dec 05 19:27:34 2043 GMT

show management security ssl diffie-hellman

The show management security ssl diffie-hellman command displays the Diffie-Hellman parameter information.

Command Mode

EXEC

Command Syntax

show management security ssl diffie-hellman

Example

This command displays the Diffie-Hellman parameter information.
switch#show management security ssl diffie-hellman
Last successful reset on Apr 10 16:18:08 2015
Diffie-Hellman Parameters 1024 bits
 Generator: 2
 Prime: dc47b5edc0d2b41451432f79f45efab452bba7b1ab118c194d671d6752ed1c550
664ed8f052ad0fdad623c1d54ae5aee5e728d2bd7a6221636b787a4c08d1fef8c
6dcd10759d38f8b70b47d1c7972d69b0b295a2ee6ab44cfc7352cb133e85197c8
9f1fc27aac7e8e02afb4fb01ca1cb05558a7bef505b73a8d06cdfe403576b

show management security ssl key

The show management security ssl key command displays the RSA key information. To view information of a specific key, provide the name of the key in the command. If no name is provided, this command displays information of all the keys.

Note: For security reasons, only the public part of the key is shown.

Command Mode

EXEC

Command Syntax

show management security ssl key [key_name]

Parameter

key_name name of the key. This is optional.

Example

This command displays the server.key key information.
switch#show management security ssl key server.key
Key server.key:
Encryption Algorithm: RSA
Size: 2048 bits
Public exponent:65537
Modulus:e04e3ff8e1c64dbcb141fe96133f998e90a322c671b9f28307bf873
2239f69804a77fbb8f146841eb6253b7bb50bf6c66bbf3097ec695b
0d7985cfdd939c9913b4ba4f6cb8655b208ed0254a269ecab574987
9f54c8c7f0b3a57a7ab826870119083222ad5ee76d40f3fae49d36e
b502f8c3f541fa3bae59743cced6e6ca04f6ca6c9268744add79c3a
c08af6b451455b4a61071f4c0b3ec3553585312783e9381f65bb0e2
ea5ee80085f5216d303cf704372b2fa1aae62756c3762441fcc1c04
97ee6190586ed28c0e376f48e53f05a40c7e1f3a65e3c6165bae5df
f8178d12dd744ddf5db100b33c46b40e53f0a1c7d49f83488976c5d
635a831d5ec96d841

show management security ssl profile

The show management security ssl profile command displays the SSL profile status information. To display information of a specific SSL profile, provide the name of the profile. If no name is provided, this command displays profile status of all the SSL profiles.

If there are any errors in the SSL profile, the state is shown invalid and the errors are listed in the third column as shown in the example below.

Command Mode

EXEC

Command Syntax

show management security ssl profile [profile_name]

Parameter

profile_name name of the SSL profile, this is optional.

Examples

  • This command displays the SSL profile status of profile server.
    switch#show management security ssl profile server
     ProfileState
    ------------- -----------
     server valid
  • If the certificate 'server.crt' does not match with the key the following error occurs.
    switch#show management security ssl profile server
     ProfileState Error
    ------------- ------------- ----------------------------------------
     server invalid Certificate 'server.crt' does not match
    with key
  • If a trusted certificate 'ca2.crt' does not exist the following error occurs.
    switch#show management security ssl profile server
     ProfileState Error
    ------------- ------------- ----------------------------------------
     server invalid Certificate 'ca2.crt' does not exist
  • If a trusted certificate 'foo.crt' is not self-signed root certificate the following error occurs.
    switch#show management security ssl profile server
     ProfileState Error
    ------------- ------------- ----------------------------------------
    server invalid Certificate 'foo.crt' is trusted and not
     a root certificate
  • If the certificate 'server.crt' is expired the following error occurs.
    switch#show management security ssl profile server
     ProfileState Error
    ------------- ------------- ----------------------------------------
     server invalid Certificate 'server.crt' has expired
  • If the certificate chain is missing an intermediate certificate the following error occurs.
    switch#show management security ssl profile server
    ProfileState Error
    -------------- ------------- ---------------------------------------------
    serverinvalidProfile has invalid certificate chain
     Certificate 'intermediate.crt' does not exist

ssl profile

The ssl profile command places the switch in the SSL profile configuration mode. Various SSL profile management configurations are allowed in this mode. For example, this mode allows to configure a SSL profile with a certificate and its corresponding RSA key.

Similarly, other configurations such as trust certificate, chain certificate, crl, tls, cipher-list can be configured to a SSL profile in this mode.

The no form of the command deletes the SSL profile management configuration from running-config.

Command Mode

Management Security Mode

SSL Profile Mode

Command Syntax

ssl profile profile_name

Parameter

profile_name name of the profile.

Examples

  • These commands place the switch in SSL profile mode.
    switch#config
    switch(config)#management security
    switch(config-mgmt-security)#ssl profile server
    switch(config-mgmt-sec-ssl-profile-server)#
    
  • These commands configure SSL profile server with a certificate and its corresponding RSA key. The no command deletes the certificate configuration.
    switch#config
    switch(config)#management security
    switch(config-mgmt-security)#ssl profile server
    switch(config-mgmt-sec-ssl-profile-server)#certificate server.crt key server.key
    switch(config-mgmt-sec-ssl-profile-server)#no certificate server.crt key server.key
    
  • These commands configure the trust certificate ca1.crt to an SSL profile. The no command deletes a trusted certificate configuration.
    switch#config
    switch(config)#management security
    switch(config-mgmt-security)#ssl profile server
    switch(config-mgmt-sec-ssl-profile-server)#trust certificate ca1.crt
    switch(config-mgmt-sec-ssl-profile-server)#no trust certificate ca1.crt
    
  • These commands configure the intermediate.crt chain certificate to an SSL profile. The no command deletes a chain certificate configuration.
    switch#config
    switch(config)#management security
    switch(config-mgmt-security)#ssl profile server
    switch(config-mgmt-sec-ssl-profile-server)#certificate server.crt key server.key
    switch(config-mgmt-sec-ssl-profile-server)#chain certificate intermediate.crt
    switch(config-mgmt-sec-ssl-profile-server)#no chain certificate intermediate.crt
    
  • These commands provides certificate revocation list (CRL) to a SSL profile to check the revocation status of the certificate chain. The no command deletes the crl configuration.
    switch#config
    switch(config)#management security
    switch(config-mgmt-security)#ssl profile server
    switch(config-mgmt-sec-ssl-profile-server)#crl intermediate.crl
    switch(config-mgmt-sec-ssl-profile-server)#crl ca.crl
    switch(config-mgmt-sec-ssl-profile-server)#no crl ca.crl
    
  • These commands configure TLSv1.2 to be used in the SSL profile.
    switch#config
    switch(config)#management security
    switch(config-mgmt-security)#ssl profile server
    switch(config-mgmt-sec-ssl-profile-server)#tls versions 1.2
    
  • These commands build a cipher suite list.
    switch#config
    switch(config)#management security
    switch(config-mgmt-security)#ssl profile server
    switch(config-mgmt-sec-ssl-profile-server)#cipher-list AESGCM
    switch(config-mgmt-sec-ssl-profile-server)#cipher-list SHA256:SHA38
    switch(config-mgmt-sec-ssl-profile-server)#cipher-list ECDHE-ECDSA-AES256-GCM-SHA384
    
  • This command check that the certificate has an extended key usage attribute.
    switch(config-mgmt-sec-ssl-profile-client)#certificate requirement extended-key-usage
    
  • These commands check that all the trusted certificates or certificates in the chain have a CA basic constraints set to true.
    switch(config-mgmt-sec-ssl-profile-client)#trust certificate requirement basic-constraints ca true
    switch(config-mgmt-sec-ssl-profile-client)#chain certificate requirement basic-constraints ca true
    
  • This command enables the Federal Information Processing Standards (FIPS) mode for a SSL profile.
    switch(config-mgmt-sec-ssl-profile-client)#fips restrictions 

802.1X Port Security

This section explains the basic concepts behind 802.1X port security, including switch roles, how the switches communicate, and the procedure used for authenticating clients.

802.1X Port Security Introduction

802.1X is an IEEE standard protocol that prevents unauthorized devices from gaining access to the network.

802.1X defines three device roles,

  • Supplicant (client)
  • Authenticator (switch)
  • Authentication server (RADIUS)

Before authentication can succeed, switchport is in unauthorized mode and blocks all traffic but, after authentication has succeeded, normal data can then flow through the switchport.

Port security control who can send or receive traffic from an individual switch port. An end node is not allowed to send or receive traffic through a port until the node is authenticated by a RADIUS server.

This prevents unauthorized individuals from connecting to a switch port to access your network. Only designated valid users on a RADIUS server will be allowed to use the switch to access the network.

802.1X Port Security Description

802.1X port security controls can send traffic through and receive traffic from the individual switch ports. A supplicant must authenticate itself using EAPoL packets with the switch before it can gain full access to the port. Arista switches act as an authenticator, passing the messages from 802.1X supplicants through to the RADIUS server and vice versa. 802.1X can operate in two different modes:

Single Host Mode: Once the 802.1X supplicant is authenticated on the port, only the traffic coming from the supplicant's MAC is allowed through the port.

Multi-Host Mode: Once the 802.1X supplicant is authenticated on the port, traffic coming from any source MAC is allowed through the port.

Both these modes allow only one 802.1X supplicant to be authenticated for one port. Once it is successfully authenticated, no other 802.1X supplicant can be authenticated, unless the current one logs off.

Apart from 802.1X authentication, Arista switches also support MAC-Based Authentication (MBA), which allows devices not speaking 802.1X to have access to the network. The authenticator uses the MAC address of such devices as username/password in its RADIUS request packets. Depending on the MAC-Based Authentication configuration on the RADIUS server, it decides whether to authenticate the supplicant or not. Unlike 802.1X supplicants, multiple MBA supplicants are allowed on a single port. The MBA configuration is independent of the 802.1X host modes. MBA supplicants will not be considered to allow or reject unauthenticated traffic, based on the host mode.

Arista switches also support Dynamic VLAN assignment, which allows the RADIUS server to indicate the desired VLAN for the supplicant, using the tunnel attributes with the Access-Accept message. Both 802.1X and MBA supplicants can be assigned a VLAN via the RADIUS server. Note that only one VLAN per port is supported. When the first host authenticates, the authenticator port is put in the respective VLAN (via dynamic VLAN assignment) and subsequently, all other hosts must belong to that VLAN as well.

802.1X features are now supported on 802.1Q trunk ports allowing the user to have Port-Based Network Access Control (PNAC) on such a port. With this feature, traffic coming into an 802.1X enabled port with a VLAN tag can also be authenticated via both 802.1X or MBA.

By default, traffic from any unauthenticated device on an 802.1X enabled port is dropped. By configuring Authentication Failure VLAN on the authenticator switch, 802.1X or MBA supplicants traffic can be put into a specific VLAN, if the supplicant fails to authenticate via the RADIUS server.

Note: Only one configurable VLAN for failure is supported. That is, failure due to server timeout, server unreachable, server AUTH-FAIL, or Quarantine.

Switch Roles for 802.1X Configurations

The 802.1X standard specifies the roles of Supplicant (client), Authenticator, and Authentication Server in a network. Switch Roles for 802.1X Configurations illustrates these roles.

Authentication server The switch that validates the client and specifies whether or not the client may access services on the switch. The switch supports Authentication Servers running RADIUS.

Authenticator The switch that controls access to the network. In an 802.1X configuration, the switch serves as the Authenticator. As the Authenticator, it moves messages between the client and the Authentication Server. The Authenticator either grants or does not grant network access to the client based on the identity data provided by the client, and the authentication data provided by the Authentication Server.

Figure 1. Authenticator, Supplicant, and Authentication Server in an 802.1X configuration

Supplicant/Client The client provides a username or password data to the Authenticator. The Authenticator sends this data to the Authentication Server. Based on the supplicants information, the Authentication Server determines whether the supplicant can use services given by the Authenticator. The Authentication Server gives this data to the Authenticator, which then provides services to the client, based on the authentication result.

Authentication Process

The authentication that occurs between a supplicant, authenticator, and authentication server include the following processes.

  • Either the authenticator (a switch port) or the supplicant starts an authentication message exchange. The switch starts an exchange when it detects a change in the status of a port, or if it gets a packet on the port with a source MAC address that is not included in the MAC address table.
  • An authenticator starts the negotiation by sending an EAP-Request/Identity packet. A supplicant starts the negotiation with an EAPOL-Start packet, to which the authenticator answers with a EAP-Request/Identity packet.
  • The supplicant answers with an EAP-Response/Identity packet to the authentication server via the authenticator.
  • The authentication server responds with an EAP-Request packet to the supplicant via the authenticator.
  • The supplicant responds with an EAP-Response.
  • The authentication server transmits either an EAP-Success packet or EAP-Reject packet to the supplicant.
  • If an EAP-Reject is received, the supplicant will receive an EAP-Reject message and their traffic will not be forwarded.

Communication Between the Switches

For communication between the switches, 802.1X port security uses the Extensible Authentication Protocol (EAP), defined in RFC 2284 and the RADIUS authentication protocol.

The 802.1X standard defines a method for encapsulating EAP messages so they can be sent over a LAN. This encapsulated kind of EAP is known as EAP over LAN (EAPOL). The standard also specifies a means of transferring the EAPOL information between the client or Supplicant, Authenticator, and Authentication Server.

EAPOL messages are passed between the Supplicants and Authenticators Port Access Entity (PAE). Communication Between the Switches shows the relationship between the Authenticator PAE and the Supplicant PAE.

Figure 2. Authenticator PAE and Supplicant PAE

Authenticator PAE: The Authenticator PAE communicates with the Supplicant PAE to receive the Supplicants identifying information. Behaving as a RADIUS client, the Authenticator PAE passes the Supplicants information to the Authentication Server, which decides whether to grant the Supplicant access. If the Supplicant passes authentication, the Authenticator PAE allows it access to the port.

Supplicant PAE The Supplicant PAE provides information about the client to the Authenticator PAE and replies to requests from the Authenticator PAE. The Supplicant PAE may initiate the authentication procedure with the Authenticator PAE, as well as send logoff messages.

Dot1x Dropped Counters

The Dot1x Dropped Counters count the packets dropped by dot1x interfaces. The dropped counter will not represent all the dropped packets in case of high volume dropping, and the CPU queue drop counter will reflect the rest of the dropped packet counter. This is due to the fact that EOS limits the bandwidth for the packets that get sent to the CPU.

The following counters are supported and increment depending on the dot1x interface configuration mode:

  • Eapol unauthorized port (indicates the dropped packet number due to the unauthorized Eapol port when Mac Base Authorization is disabled).
  • Eapol unauthorized host ( indicates the dropped packet number due to the unauthorized Eapol host).
  • MBA unauthorized host (counts the dropped packet due to the unauthorized host when Mac Base Authorization is enabled.)
Platform Compatibility
  • 7050X/X2/X3 series
  • 7060X/X2/X3 series
  • CCS-720XP series
  • 7300X/7320X/7300X3 series
  • DCS-7060DX4 series
  • DCS-7260 series

Enable 802.1X Port Control

To enable 802.1X port authentication on the switch, global command configuration is required:

switch(config)#dot1x system-auth-control

Port mode can be set to access/trunk port and 802.1X port access entity is set to authenticator:

switch(config-if-Et1)#switchport mode access
switch(config-if-Et1)#dot1x pae authenticator

Controlled and Uncontrolled Ports

A physical port on the switch used with 802.1X has two virtual access points that include a controlled port and an uncontrolled port. The controlled port grants full access to the network. The uncontrolled port only gives access for EAPOL traffic between the client and the Authentication Server. When a client is authenticated successfully, the controlled port is opened to the client.

Figure 3. Ports before and after client authentication
Control Port State

Before the port is authenticated, the port is in an unauthorized state. In this state, only EAPOL packets are processed by 802.1X agent and all other packets are dropped. After the port is successfully authenticated, the port is in the authorized state and all packets are allowed to pass. The state transition is controlled by authentication exchange between supplicant and authentication server. However, the user can control the state by using any one of the following commands:

switch(config-if-Et1)#dot1x port-control force-authorized
switch(config-if-Et1)#dot1x port-control force-unauthorized
switch(config-if-Et1)#dot1x port-control auto
  • force-authorized disables 802.1X authentication and directly put the port to the authorized state. This is the default setting.
  • force-unauthorized also disables 802.1X authentication and directly put the port to unauthorized state, ignoring all attempts by the client to authenticate.
  • auto enables 802.1X authentication and put the port to unauthorized state first. The port state remains in an unauthorized state or transit to authorized state according to authentication result and configuration.
Uncontrolled Port State

The uncontrolled port on the Authenticator is the only one open before a client is authenticated. The uncontrolled port permits only EAPOL frames to be swapped between the client and the Authentication Server. No traffic is allowed to pass through the controlled portin the unauthorized state.

During authentication, EAPOL messages are swapped between the Supplicant PAE and the Authenticator PAE, and RADIUS messages are swapped between the Authenticator PAE and the Authentication Server. If the client is successfully authenticated, the controlled port becomes authorized, and traffic from the client can flow through the port normally.

All controlled ports on the switch are placed in the authorized state, allowing all traffic, by default. When authentication is initiated, the controlled port on the interface is initially set in the unauthorized state. If a client connected to the port is authenticated successfully, the controlled port is set in the authorized state.

Message Exchange During Authentication

Multiple clients connected to a 802.1X-enabled port illustrates an exchange of messages between an 802.1X-enabled client, a switch operating as Authenticator, and a RADIUS server operating as an Authentication Server.

Arista switches support MD5-challenge TLS and any other EAP-encapsulated authentication types in EAP Request or Response messages. In other words, the switches are transparent to the authentication scheme used.

Authenticating Multiple Clients Connected to the Same Port

Arista switches support 802.1X authentication for ports with more than one client connected to them. Multiple clients connected to a 802.1X-enabled port illustrates a sample configuration where multiple clients are connected to a single 802.1X port. 802.1X authentication may use multi-host mode, or (on selected switches) single-host mode. In both modes, the port authenticates the packets received from any one client, and the packets received from other clients are dropped, until the connected client is authenticated by the RADIUS server.

Single-host Mode

In single-host mode, once the 802.1X client has been authenticated by the RADIUS server further authentication is not required, but the port accepts packets only from the MAC address of the authenticated client.

Figure 4. Message Exchange During Authentication
Multi-host Mode

In multi-host mode, once the 802.1X client has been authenticated by the RADIUS server, the port is open to accept all packets from any connected client, and these packets do not require any authentication.

802.1X MAC- Based Authentication

The 802.1X MAC-based authentication allows a set of MAC addresses to be programmed into the RADIUS server. These MAC addresses (MAC-based authentication supplicants) do not connect to 802.1X profiles but are still allowed access to the network. The authenticator identifies devices that do not support 802.1X and uses the MAC address of these devices as username and password in its RADIUS request packets.

In a MAC-based authentication, every supplicant trying to gain access to the authenticator port is individually authenticated as opposed to authenticating just one supplicant on a given VLAN or port with 802.1X. The behavior is different for MAC-based authentication supplicants when we have a 802.1.x supplicant authenticated in single host and multi-host 802.1X modes.

To enable Mac-based authentication, use the following command:
switch(config-if-Et1/1)#dot1x mac based authentication 
Note: This command is added to the existing 802.1X configuration on the port, so a typical 802.1X interface configuration with MAC-Based Authentication enabled may look something like this:
switch(config-if-Et1/1)#show active
speed forced 1000full
dot1x pae authenticator
dot1x port-control auto
dot1x mac based authentication
Figure 5. Multiple clients connected to a 802.1X-enabled port

Configuring 802.1X Port Security

Basic steps to implementing 802.1X Port-based Network Access Control and RADIUS accounting on the switch:

  1. A RADIUS server is required on one or more of your network servers or management stations. 802.1X is not supported with the TACACS+ authentication protocol.
  2. You must create supplicant accounts on the RADIUS server:
    • The account for a supplicant connected to an authenticator port must have a username and password combination when set to the 802.1X authentication mode.
      • An account for the supplicant connected to an authenticator port and placed in the MAC address-based authentication mode needs use the MAC address of the node as both the username and password.
      • Connected clients to an 802.1X authenticator port will require 802.1X client software.
  3. The RADIUS client must be configured by entering the IP addresses and encryption keys of the authentication servers on your network.
  4. The port access control settings must be configured on the switch. This includes the following:
    • Specifying the port roles.
      • Configuring 802.1X port parameters.
        • Enabling 802.1X Port-based Network Access Control.
    Guidelines
    • Do not set a port that is connected to a RADIUS authentication server to the authenticator role as an authentication server cannot authenticate itself.
    • A supplicant connected to an authenticator port set to the 802.1X username and password authentication method must have 802.1X client software.
    • To prevent unauthorized individuals from accessing the network through unattended network workstations, end users of 802.1X port-based network access control should always log off when they are finished with a work session.
    • The RADIUS client should be configured on the switch before activating port-based access control.

Configuring 802.1X Authentication Methods

IEEE 802.1X port security relies on external client-authentication methods, which must be configured for use. The method currently supported on Arista switches is RADIUS authentication. To configure the switch to use a RADIUS server for client authentication, use the aaa authentication dot1x command.

Example

This command configures the switch to use RADIUS authentication.
switch(config)#aaa authentication dot1x default group radius
switch(config)#

Configuring Dot1x Dropped Counters

Use the statistics packets dropped command to cofigure the dot1x dropped counters on the switch under dot1x configuration mode. By default, the dot1x dropped counters is disabled. The no form of the command disables the dot1x dropped counters from the running configuration.

Example
  • These commands places the switch in the dot1x mode and enables the dot1x dropped counters.
    switch(config-dot1x)#statistics packets dropped

Globally Enable IEEE 802.1X

To enable IEEE 802.1X port authentication globally on the switch, use the dot1x system-auth-control command.

Example

This command enables IEEE 802.1X globally on the switch.
switch(config)#dot1x system-auth-control
switch(config)

Designating Authenticator Ports

To set the port access entity (PAE) type of an Ethernet or management interface to the authenticator, use the dot1x pae authenticator command.

Example

These commands configure the PAE type to authenticator on the Ethernet interface 1 to enable IEEE 802.1X on the port.
switch(config)#interface ethernet 1
switch(config-if-Et1)#dot1x pae authenticator
switch(config-if-Et1)#

Example

For ports to act as authenticator ports to connected supplicants, those ports must be designated using the dot1x port-control command.

The auto option of thedot1x port-control command designates an authenticator port for immediate use, blocking all traffic that is not authenticated by the AAA server.

Example

This command configures Ethernet 1 to immediately begin functioning as an authenticator port.
switch(config)#interface ethernet 1
switch(config-if-Et1)#dot1x port-control auto
switch(config-if-Et1)#

The force-authorized option of the dot1x port-control command sets the state of the port to authorized without authentication, allowing traffic to continue uninterrupted.

Example

These commands designate Ethernet 1 as an authenticator port that will forward packets without authentication.
switch(config)#interface ethernet 1
switch(config-if-Et1)#dot1x port-controlforce-authorized
switch(config-if-Et1)#

To designate a port as an authenticator but prevent it from authorizing any traffic, use the force-unauthorized option of the dot1x port-control command.

Example

The force-unauthorized option of the dot1x port-control command places the specified port in the unauthorized state, which will deny any access requests from users of the ports.
switch(config)#interface ethernet 1
switch(config-if-Et1)#dot1x port-controlforce-authorized
switch(config-if-Et1)#

Specifying the Authentication Mode for Multiple Clients

By default, Arista switches authenticate in multi-host mode, allowing packets from any source MAC address once 802.1X authentication has taken place. To configure the switch for single-host mode (allowing traffic only from the authenticated clients MAC address), use the dot1x host-mode command.

Example

These commands configure Ethernet interface 1 to use single-host mode for 802.1X authentication.
switch(config)#interface Ethernet 1
switch(config-if-Et1)#dot1x host-mode single-host
switch(config-if-Et1)#

Configuring Re-authentication

The dot1x reauthentication command enables re-authentication of authenticator ports with the default values.

The dot1x timeout reauth-period command allows to customize the re-authentication period of authenticator ports.

Examples
  • These commands configures the configuration mode interface to require re-authentication from clients at regular intervals.
    switch(config)#interface Ethernet 1
    switch(config-if-Eth)#dot1x reauthentication
  • These commands configure the Ethernet interface 1 authenticator to require re-authentication from clients every 6 hours (21600 seconds).
    switch(config)#interface Ethernet 1
    switch(config-if-Et1)#dot1x reauthentication
    switch(config-if-Et1)#dot1x timeout reauth-period 21600
    switch(config-if-Et1)#
  • These commands deactivate re-authentication on Ethernet interface 1.
    switch(config)#interface Ethernet 1
    switch(config-if-Et1)#no dot1x reauthentication
    switch(config-if-Et1)#

Setting the EAP Request Maximum

The dot1x reauthorization request limit command configures the number of times the switch retransmits an 802.1X Extensible Authentication Protocol (EAP) request packet before ending the conversation and restarting authentication.

Example

These commands set the number of times the authenticator sends an EAP request packet to the client before restarting authentication.
switch(config)#interface ethernet 1
switch(config-if-Et1)#dot1x reauthorization request limit 4
switch(config-if-Et1)#

The default value is 2.

Disabling Authentication on a Port

To disable authentication on an authenticator port, use the no form of the dot1x port-control command.

Example

These commands disable authentication on Ethernet interface 1.
switch(config)#interface ethernet 1
switch(config-if-Et1)#no dot1x port-control
switch(config-if-Et1)#

Setting the Quiet Period

If the switch fails to immediately authenticate the client, the time the switch waits before trying again is specified by the dot1x timeout quiet-period command. This timer also indicates how long a client that failed authentication is blocked.

Example

These commands set the 802.1X quiet period for Ethernet interface 1 to 30 seconds.
switch(config)#interface ethernet 1
switch(config-if-Et1)#dot1x timeout quiet-period 30

The default value is 60 seconds.

Setting the Dot1x Timeout Reauth-period

The dot1x timeout reauth-period command specifies the time period in seconds that the configuration mode interface waits before requiring re-authentication from clients.

Example

These commands configure the timeout reauth-period to 21600 seconds.
switch(config)#interface Ethernet 1
switch(config-if-Et1)#dot1x reauthentication
switch(config-if-Et1)#dot1x timeout reauth-period 21600

The default value is 3600 seconds.

Setting the Transmission Timeout

Authentication and re-authentication are accomplished by the authenticator sending an Extensible Authentication Protocol (EAP) request to the supplicant and the supplicant sending a reply which the authenticator forwards to an authentication server. If the authenticator doesnt receive a reply to the EAP request, it waits a specified period of time before retransmitting. To configure that wait time, use the dot1x timeout tx-period command.

Example

These commands configure Ethernet interface 1 to wait 30 seconds before retransmitting EAP requests to the supplicant.
switch(config)#interface Ethernet 1
switch(config-if-Et1)#dot1x timeout tx-period 30
switch(config-if-Et1)#

The default value is 5 seconds.

Enable Authentication Failure VLAN

Configure Authentication Failure VLAN on a dot1x-enabled port using the following CLI command under the interface-config mode. The CLI command to set VLAN10 as authentication failure VLAN is as follows:

switch(config-if-Et1/1)#dot1x authentication failure action traffic allow vlan 10

When no authentication failure VLAN is configured on a dot1x-enabled port, the default action is to drop any unauthorized traffic on the port. This behavior can also be specified using the following command:

Example

switch(config-if-Et1/1)#dot1x authentication failure action traffic drop

Clearing 802.1X Statistics

The clear dot1x statistics command resets the 802.1X counters.

Examples
  • This command clears the 802.1X counters on all interfaces.
    switch#clear dot1x statistics all
    switch#
  • This command clears the 802.1X counters on Ethernet interface 1.
    switch#clear dot1x statistics interface ethernet 1
    switch#

Displaying 802.1X Information

You can display information about 802.1X on the switch and on individual ports.

Displaying 802.1X statistics

Use the show dot1x statistics command to display 802.1X statistics for the specified port or ports.

Example

  • This command displays IEEE 802.1X statistics for Ethernet interface 5.
    switch#show dot1x interface ethernet 5 statistics
    Dot1X Authenticator Port Statistics for Ethernet5
    -------------------------------------------------
    RxStart = 0RxLogoff = 0RxRespId = 0
    RxResp = 0 RxInvalid = 0 RxTotal = 0
    TxReqId = 0TxReq = 0 TxTotal = 0
    RxVersion = 0LastRxSrcMAC = 0000.0000.0000
    switch#
  • This command displays the dot1x dropped counters for all the dot1x interfaces.
    switch#show dot1x all statistics
    Dot1X Authenticator Port Statistics for Ethernet51/1
    -------------------------------------------------
    RX start = 1 RX logoff = 0 RX response ID = 1
    RX response = 10 RX invalid = 0RX total = 12
    TX request ID = 2TX request = 11 TX total = 13
    RX version = 2 Last RX src MAC = ded6.404b.ec94
    Data packet drop counters:
    EAPOL unauthorized port = 2
    EAPOL unauthorized host = 1
    MBA unauthorized host = 0
    
    Dot1X Authenticator Port Statistics for Ethernet49
    -------------------------------------------------
    RX start = 1 RX logoff = 0 RX response ID = 1
    RX response = 10 RX invalid = 0RX total = 12
    TX request ID = 2TX request = 11 TX total = 13
    RX version = 2 Last RX src MAC = ded6.404b.ec94
    Data packet drop counters:
    EAPOL unauthorized port = 2
    EAPOL unauthorized host = 1
    MBA unauthorized host = 0

Displaying 802.1X supplicant information

Use the show dot1x hosts command to display information for all the supplicants.

Example

This command displays 802.1X supplicant information.
switch#show dot1x hosts
Interface: Ethernet1/1
Supplicant MAC Auth MethodState VLAN Id
-------------- ---------------- -------
e2:29:cb:11:2f:4aEAPOLSUCCESS 300
e2:29:cb:11:2f:4bMAC-BASED-AUTH SUCCESS 300

Displaying Mac-address Tables

Use the show mac address-table command to display the MAC address of the supplicants allowed to pass the traffic through the port.

Example

switch#show mac address-table
Mac Address Table
------------------------------------------------------------------

VlanMac Address TypePortsMoves Last Move
--------------- -------------- ---------
300 e229.cb11.2f4aSTATICEt1/1
300 e229.cb11.2f4bSTATICEt1/1
Total Mac Addresses for this criterion: 2

Displaying Port Security Configuration Information

The show dot1x command shows information about the 802.1X configuration on the specified port or ports.

Example

This commands displays IEEE 802.1X configuration information for Ethernet interface 5.
switch#show dot1x interface ethernet 5
Dot1X Information for Ethernet5
--------------------------------------------
PortControl : auto
QuietPeriod : 60 seconds
TxPeriod: 5 seconds
ReauthPeriod: 3600 seconds
MaxReauthReq: 2
switch#

Displaying the Status of the 802.1X Attributes for each Port.

Use the show dotx1 interface interface-id command to display the status of the 802x1 attributes for each port.

Example
switch(config-if-Et1/1)#show dot1x interface ethernet1/1
 Dot1X Information for Ethernet1
 --------------------------------------------
 PortControl : force-authorized
 HostMode: multi-host
 QuietPeriod : 60 seconds
 TxPeriod: 5 seconds
 ReauthPeriod: 0 seconds
 MaxReauthReq: 2
 ReauthTimeoutIgnore : No
 AuthFailVlan: 10

Displaying VLANS

Use the show vlan command to display if a VLAN has been dynamically assigned to the port.

Example

switch#show vlan
VLANName StatusPorts
----- ------------- --------- ----------------------------------
1 defaultactive
2 VLAN0002 activeEt7, Et17, Et18, Et41
300*VLAN0300 activeEt1/1, Et6, Et19, Et20, Et29
 Et30, Et31, Et32, Et42, Et43, Et44

* indicates a Dynamic VLAN

Displaying_802.1X_Information

Use the show dot1x all brief command to display IEEE 802.1X status for all ports.

Example
  • The following commands display a summary of IEEE 802.1X status.
    switch#show dot1x all brief
    Interface Client Status
    -------------------------------------------------------------
    Ethernet5 None Unauthorized
    switch#

802.1X Configuration Commands

clear dot1x statistics

The clear dot1x statistics command resets the 802.1X counters on the specified interface or all interfaces.

Command Mode

Privileged EXEC

Command Syntax

clear dot1x statistics INTERFACE_NAME

Parameters
  • INTERFACE_NAMEInterface type and number. Options include:
    • all Display information for all interfaces.
    • interface ethernet e_num Ethernet interface specified by e_num.
    • interface loopback l_num Loopback interface specified by l_num.
    • interface management m_num Management interface specified by m_num.
    • interface port-channel p_num Port-Channel Interface specified by p_num.
    • interface vlan v_num VLAN interface specified by v_num.

Example

This command resets the 802.1X counters on all interfaces.
switch#clear dot1x statistics all
switch#

dot1x mac based authentication

The dot1x mac based authentication command enables MAC-based authentication on the existing 802.1X authenticator port.

The no dot1x mac based authentication and the default dot1x mac based authentication commands restore the switch default by disabling the corresponding dot1x mac based authentication command for the specific 802.1X authenticator port.

Command Mode

Interface-Ethernet Configuration

Command Syntax

dot1x mac based authentication

no dot1x mac based authentication

default dot1x mac based authentication

Related Command

show dot1x hosts

Example

These commands configure MAC-based authentication on Ethernet interface 1.
switch(config)#interface ethernet 1
switch(config-if-Et1)#dot1x mac based authentication
switch(config-if-Et1)#

dot1x pae authenticator

The dot1x pae authenticator command sets the port access entity (PAE) type of the configuration mode interface to authenticator, which enables IEEE 802.1X on the port. IEEE 802.1X is disabled on all ports by default.

The no dot1x pae authenticator and default dot1x pae authenticator commands restore the switch default by deleting the corresponding dot1x pae authenticator command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Management Configuration

Command Syntax

dot1x pae authenticator

no dot1x pae authenticator

default dot1x pae authenticator

Examples
  • These commands configure Ethernet interface 2 as a port access entity (PAE) authenticator, enabling IEEE 802.1X on the port.
    switch(config-if-Et1)#interface ethernet 2
    switch(config-if-Et1)#dot1x pae authenticator
    switch(config-if-Et1)#
  • These commands disable IEEE 802.1X authentication on Ethernet interface 2.
    switch(config-if-Et1)#interface ethernet 2
    switch(config-if-Et1)#no dot1x pae authenticator
    switch(config-if-Et1)#

dot1x reauthentication

The dot1x reauthentication command configures the configuration mode interface to require re-authentication from clients at regular intervals. The interval is set by the dot1x timeout reauth-period command.

The no dot1x reauthentication and default dot1x reauthentication commands restore the default setting by deleting the corresponding dot1x reauthentication command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Management Configuration

Command Syntax

dot1x reauthentication

no dot1x reauthentication

default dot1x reauthentication

Example

These commands configure the Ethernet interface 1 authenticator to require periodic re-authentication from clients.
switch(config)#interface Ethernet 1
switch(config-if-Et1)#dot1x reauthentication
switch(config-if-Et1)#

dot1x reauthorization request limit

The dot1x reauthorization request limit command configures how many times the switch retransmits an 802.1X Extensible Authentication Protocol (EAP) request packet before ending the conversation and restarting authentication.

The no dot1x reauthorization request limit and default dot1x reauthorization request limit commands restore the default value of 2 by deleting the corresponding dot1x reauthorization request limit command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Management Configuration

Command Syntax

dot1x reauthorization request limit attempts

no dot1x reauthorization request limit

default dot1x reauthorization request limit

Parameters

attemptsMaximum number of attempts. Values range from 1 to 10; default value is 2.

Examples
  • This command sets the 802.1X EAP-request retransmit limit to 6.
    switch(config)#interface ethernet 1 
    switch(config-if-Et1)#dot1x reauthorization request limit 6
    switch(config-if-Et1)#
  • This command restores the default request repetition value of 2.
    switch(config)#interface ethernet 1 
    switch(config-if-Et1)#no dot1x reauthorization request limit
    switch(config-if-Et1)#

dot1x system-auth-control

The dot1x system-auth-control command enables 802.1X authentication on the switch.

The no dot1x system-auth-control and default dot1x system-auth-control commands disables 802.1X authentication by removing the dot1x system-auth-control command from running-config.

Command Mode

Global Configuration

Command Syntax

dot1x system-auth-control

no dot1x system-auth-control

default dot1x system-auth-control

Examples
  • This command enables 802.1X authentication on the switch.
    switch(config)#dot1x system-auth-control
    switch(config)#
  • This command disables 802.1X authentication on the switch.
    switch(config)#no dot1x system-auth-control
    switch(config)#

dot1x timeout quiet-period

If the switch fails to immediately authenticate the client, the time the switch waits before trying again is specified by the dot1x timeout quiet-period command. This timer also indicates how long a client that failed authentication is blocked.

The no dot1x timeout quiet-period and default dot1x timeout quiet-period commands restore the default quiet period of 60 seconds by removing the corresponding dot1x timeout quiet-period command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Management Configuration

Command Syntax

dot1x timeout quiet-period quiet_time

no dot1x timeout quiet-period

default dot1x timeout quiet-period

Parameter

quiet_time Interval in seconds. Values range from 1 to 65535. Default value is 60.

Example

These commands set the 802.1X quiet period for Ethernet interface 1 to 30 seconds.
switch(config)#interface Ethernet 1
switch(config-if-Et1)#dot1x timeout quiet-period 30
switch(config-if-Et1)#

dot1x timeout reauth-period

The dot1x timeout reauth-period command specifies the time period that the configuration mode interface waits before requiring re-authentication from clients.

The no dot1x timeout reauth-period and default dot1x timeout reauth-period commands restore the default period of 60 minutes by removing the corresponding dot1x timeout reauth-period command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Management Configuration

Command Syntax

dot1x timeout reauth-period reauth_time

no dot1x timeout reauth-period

default dot1x timeout reauth-period

Parameter

reauth_time The number of seconds the interface passes traffic before requiring re-authentication. Values range from 1 to 65535. Default value is 3600.

Example

These commands configure the Ethernet interface 1 authenticator to require re-authentication from clients every 6 hours (21600 seconds).
switch(config)#interface Ethernet 1
switch(config-if-Et1)#dot1x reauthentication
switch(config-if-Et1)#dot1x timeout reauth-period 21600
switch(config-if-Et1)#

dot1x timeout tx-period

Authentication and re-authentication are accomplished by the authenticator sending an Extensible Authentication Protocol (EAP) request to the supplicant and the supplicant sending a reply which the authenticator forwards to an authentication server. If the authenticator does not get a reply to the EAP request, it waits a specified period of time before retransmitting. The dot1x timeout tx-periodcommand configures that wait time.

The no dot1x timeout tx-period and default dot1x timeout tx-period commands restore the default wait time by removing the corresponding dot1x timeout tx-period command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Management Configuration

Command Syntax

dot1x timeout tx-period tx_time

no dot1x timeout tx-period

default dot1x timeout tx-period

Parameter

tx_time Values range from 1 to 65535. Default value is 5.

Example

These commands configure Ethernet interface 1 to wait 30 seconds before retransmitting EAP requests to the supplicant.
switch(config)#interface Ethernet 1
switch(config-if-Et1)#dot1x timeout tx-period 30
switch(config-if-Et1)#

dot1x host-mode

When multiple clients are connected to an Ethernet interface providing 802.1X authentication, the port can either accept packets from all MAC addresses once the supplicant has been authenticated (multi-host mode), or it can accept only those packets originating from the MAC address of the authenticated client (single-host mode). The dot1x host-mode command specifies the host mode for authentication of multiple clients on the configuration mode interface.

The no dot1x host-mode and default dot1x host-mode commands restore the switch default (multi-host mode) by removing the corresponding dot1x host-mode command for the configuration mode interface.

Command Mode

Interface-Ethernet Configuration

Command Syntax

dot1x host-mode [multi-host | single-host]

no dot1x host-mode

default dot1x host-mode

Parameters
  • multi-host Configures the interface to use multi-host mode (the default).
  • single-host Configures the interface to use single-host mode.
Example
  • These commands configure Ethernet interface 1 to use single-host mode for 802.1X authentication.
    switch(config)#interface ethernet 1
    switch(config-if-Et1)#dot1x host-mode single-host
    switch(config-if-Et1)#

dot1x port-control

The dot1x port-control command configures the configuration mode interface as an authenticator port and specifies whether it will authenticate traffic.

The no dot1x port-control and default dot1x port-control commands configure the port to pass traffic without authorization by removing the corresponding dot1x port-control command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Management Configuration

Command Syntax

dot1x port-control STATE

no dot1x port-control

default dot1x port-control

Parameters
  • STATE Specifies whether the interface will authenticate traffic. The default value is force-authorized. Options include:
    • auto Configures the port to authenticate traffic using Extensible Authentication Protocol messages.
      • force-authorized Configures the port to pass traffic without authentication.
      • force-unauthorized Configures the port to block all traffic regardless of authentication.
Examples
  • These commands configure Ethernet interface 1 to pass traffic without authentication. This is the default setting.
    switch(config)#interface Ethernet 1
    switch(config-if-Et1)#dot1x port-control force-authorized
    switch(config-if-Et1)#
  • These commands configure Ethernet interface 1 to block all traffic.
    switch(config)#interface Ethernet 1
    switch(config-if-Et1)#dot1x port-control force-unauthorized
    switch(config-if-Et1)#
  • These commands configure Ethernet interface 1 to authenticate traffic using EAP messages.
    switch(config)#interface Ethernet 1
    switch(config-if-Et1)#dot1x port-control auto
    switch(config-if-Et1)#

show dot1x all brief

The show dot1x all brief command displays the IEEE 802.1X status for all ports.

Command Mode

EXEC

Command Syntax

show dot1x all brief

Example

This command displays the IEEE 802.1X status.
switch#show dot1x all brief
Interface ClientStatus
-------------------------------------------------------------
Ethernet5 NoneUnauthorized
switch#

show dot1x hosts

The show dot1x hosts command displays 802.1X information for all the supplicants.

Command Mode

EXEC

Command Syntax

show dot1x hosts [ethernet]

Parameter

ethernet e_num Ethernet interface specified by e_num.

Example

This command displays 802.1X information for all the supplicants.
switch#show dot1x hosts
Interface: Ethernet1/1
Supplicant MACAuth Method State VLAN Id
------------------------- ----- -------
e2:29:cb:11:2f:4a MAC-BASED-AUTHSUCCESS300

show dot1x statistics

The show dot1x statistics command displays 802.1X statistics for the specified port or ports.

Command Mode

EXEC

Command Syntax

show dot1x INTERFACE_NAME statistics

Parameters
  • INTERFACE_NAME Interface type and number. Options include:
    • all Display information for all interfaces.
    • ethernet e_num Ethernet interface specified by e_num.
    • loopback l_num Loopback interface specified by l_num.
    • management m_num Management interface specified by m_num.
    • port-channel p_num Port-Channel Interface specified by p_num.
    • vlan v_num VLAN interface specified by v_num.

      Output Fields

  • RxStartNumber of EAPOL-Start frames received on the port.
  • TxReqIdNumber of EAP-Request/Identity frames transmitted on the port.
  • RxVersionVersion number of the last EAPOL frame received on the port.
  • RxLogoffNumber of EAPOL-Logoff frames received on the port.
  • RxInvalidNumber of invalid EAPOL frames received on the port.
  • TxReqNumber of transmitted EAP-Request frames that were not EAP-Request/Identity.
  • LastRxSrcMACThe source MAC address in the last EAPOL frame received on the port.
  • RxRespIdThe number of EAP-Response/Identity frames received on the port
  • RxTotalThe total number of EAPOL frames transmitted on the port.
  • TxTotalThe total number of EAPOL frames transmitted on the port.

Example

This command displays the 802.1X statistics for Ethernet interface 5.
switch#show dot1x interface ethernet 5 statistics
Dot1X Authenticator Port Statistics for Ethernet5
-------------------------------------------------
RxStart = 0RxLogoff = 0RxRespId = 0
RxStart= 0 RxInvalid = 0 RxTotal = 0
TxReqId = 0TxReq = 0 TxTotal = 0
RxVersion = 0LastRxSrcMAC = 0000.0000.0000
switch#

show dot1x

The show dot1x command displays 802.1X information for the specified interface.

Command Mode

EXEC

Command Syntax

show dot1x INTERFACE_NAME INFO

Parameters
  • INTERFACE_NAME Interface type and number. Options include:
    • all Display information for all interfaces.
    • ethernet e_num Ethernet interface specified by e_num.
    • loopback l_num Loopback interface specified by l_num.
    • management m_num Management interface specified by m_num.
    • port-channel p_num Port-Channel Interface specified by p_num.
    • vlan v_num VLAN interface specified by v_num.
  • INFO Type of information the command displays. Values include:
    • <no parameter> displays summary of the specified interface.
    • detail displays all 802.1X information for the specified interface.
Examples
  • This command displays 802.1X summary information for Ethernet interface 5.
    switch#show dot1x interface ethernet 5
    Dot1X Information for Ethernet5
    --------------------------------------------
    PortControl : auto
    QuietPeriod : 60 seconds
    TxPeriod: 5 seconds
    ReauthPeriod: 3600 seconds
    MaxReauthReq: 2
    switch#
  • This command displays detailed 802.1X information for Ethernet interface 5.
    switch#show dot1x interface ethernet 5 detail
    Dot1X Information for Ethernet5
    --------------------------------------------
    PortControl : auto
    QuietPeriod : 60 seconds
    TxPeriod: 5 seconds
    ReauthPeriod: 3600 seconds
    MaxReauthReq: 2
    
    Dot1X Authenticator Client
    
    Port Status : Unauthorized
    switch#

statistics packets dropped

The statistics packets droppedcommand to cofigure the dot1x dropped counters on the switch under dot1x configuration mode. By default, the dot1x dropped counters is disabled. The no form of the command disables the dot1x dropped counters from the running configuration.

The no statistics packets dropped command disables the dot1x dropped counters from the running configuration.

Command Mode

Dot1x Configuration

Command Syntax

statistics packets dropped

no statistics packets dropped

Example
  • These commands places the switch in the dot1x mode and enables the dot1x dropped counters.
    switch(config-dot1x)#statistics packets dropped
..