Access SD-WAN Edges Using Key-based Authentication
This section explains how to enable key-based authentication, add SSH keys, and access Edges more securely. Secure Shell (SSH) key-based authentication is a secure and robust method for accessing VeloCloud Edges. It provides a strong, encrypted verification and communication process between users and Edges. SSH keys bypass the need to manually enter login credentials and automate secure access to Edges.
Note:
- Both the Edge and the Orchestrator must be using Release 5.0.0 or later for this feature to be available.
- Users with Operator Business or Business Specialist account roles cannot access Edges using key-based authentication.
Perform the following tasks to access Edges using key-based authentication:
- Configure privileges for a user to access Edges securely. Choose the user's basic access level. Users can configure the access level when users create a new user and modify it at a later point in time. Ensure that users have Superuser role to modify the access level for a user. See the following topics:
- Add New User in Arista VeloCloud SASE Global Settings Guide
- API Token in Arista VeloCloud SASE Global Settings Guide
- Generate a new pair of SSH keys or import an existing SSH key. See Add SSH Key.
To revoke SSH Keys, see Revoke SSH Keys.
- Enable key-based authentication to access Edges. See Enable Secure Edge Access for an Enterprise.
For information about Secure Edge CLI commands, see Secure Edge CLI Commands and Sample Outputs.
Add SSH Key
The database stores the public key and shares it with the Edges. The system has the private key. Use this key along with the SSH username to access Edges. Users can generate only one pair of SSH keys at a time. Delete the existing SSH key pair before generating a new one. If a previously generated private key is lost, users cannot recover it from the Orchestrator. Delete the existing key and add a new one to restore access. For details about how to delete SSH keys, refer to Revoke SSH Keys.
Users can perform the following actions based on their roles: add an SSH key. Enable Secure Edge Access for the Enterprise, and switch the authentication mode from Password-based to Key-based. Refer to Enable Secure Edge Access for an Enterprise.
- All users, except those with Operator Business or Business Specialist account roles, can create and revoke SSH keys for themselves.
- Operator Superusers can manage SSH keys for other Operator users, Partner users, and Enterprise users, provided that the Partner user and Enterprise user have delegated user permissions to the Operator.
- Partner Superusers can manage SSH keys of other Partner users and Enterprise users if the Enterprise user has delegated user permissions to the Partner.
- Enterprise Superusers can manage the SSH keys of all users within their enterprise.
- Superusers can only view and revoke the SSH keys for other users.
Note: Enterprise and Partner customers without SD-WAN service access cannot configure or view SSH key-related details.
To add an SSH key:
Revoke SSH Keys
Note: Only a Superuser can delete SSH keys for other users.
To revoke the SSH key:
Enable Secure Edge Access for an Enterprise
To enable Secure Edge Access:
Secure Edge CLI Commands
Available CLI commands, depending on the specific Access Level configuration, are as follows:
Note: Run the help <command name> to view a brief description of the command.
| Commands | Description | Access Level = Basic | Access Level = Privileged |
|---|---|---|---|
| Interaction Commands | |||
| help | Displays a list of available commands. | Yes | Yes |
| pagination | Paginates the output. | Yes | Yes |
| clear | Clears the screen. | Yes | Yes |
| EOF | Exits the secure Edge CLI. | Yes | Yes |
| Debug Commands | |||
| edgeinfo | Displays the Edge’s hardware and firmware information. For a sample output of the command, see edgeinfo | Yes | Yes |
| seainfo | Displays details about the user's secure Edge access. For a sample output of the command, see seainfo. | Yes | Yes |
| ping, ping6 | Pings a URL or an IP address. | Yes | Yes |
| tcpdump | Displays TCP/IP and other packets being transmitted or received over a network to which the Edge is attached. For a sample output of the command, see tcpdump. | Yes | Yes |
| pcap | Captures packet data from network traffic and prints it to a file. For a sample output of the command, see pcap. | Yes | Yes |
| debug | Runs the debug commands for Edges. Run debug-h to view a list of available commands and options. For a sample output of one of the debug commands, see debug. | Yes | Yes |
| diag | Runs the remote diagnostics commands. Run diag-h to view a list of available commands and options. For a sample output of one of the diag commands, see diag. | Yes | Yes |
| ifstatus | Fetches the status of all interfaces. For a sample output of the command, see ifstatus. | Yes | Yes |
| getwanconfig | Fetches the configuration details of all WAN interfaces. Use logical names, such as "GE3" or "GE4", as arguments to fetch the configuration details of that interface. Do not use the physical names, such as "ge3" or "ge4", of the WAN interfaces. For example, run getwanconfig GE3 to view the configuration details of the GE3 WAN interface. Run the ifstatus command to know the interface name mappings. For a sample output of the command, see getwanconfig. | Yes | Yes |
| Configuration Command | |||
| setwanconfig | Configures WAN interfaces (wired interfaces only). Run setwanconfig-h to view configuration options. | Yes | Yes |
| Edge Actions Commands | |||
| deactivate | Deactivates the Edges and reapplies the initial default configuration. | No | Yes |
| restart | Restarts the SD-WAN service. | No | Yes |
| reboot | Reboots the Edge. | No | Yes |
| shutdown | Powers off the Edge. | No | Yes |
| hardreset | Deactivates the Edges, restores the Edge’s default configuration, and restores the original software version. | No | Yes |
| edged | Activates or deactivates the Edge processes. | No | Yes |
| restartdhcpserver | Restarts the DHCP server. | No | Yes |
| Linux Shell Command | |||
| shell | Opens the Linux shell. Type 'exit' to return to the secure Edge CLI. | No | Yes |
Sample Outputs
This section displays sample outputs for specific Secure Edge CLI commands.
edgeinfo
o10test_velocloud_net:velocli> edgeinfo Model: vmware Serial: VMware-420efa0d2a6ccb35-9b9bee2f04f74b32 Build Version: 5.0.0 Build Date: 2021-12-07_20-17-40 Build rev: R500-20211207-MN-8f5954619c Build Hash: 8f5954619c643360455d8ada8e49def34faa688d
seainfo
o10test_velocloud_net:velocli> seainfo
{
"rootlocked": false,
"seauserinfo": {
"o2super_velocloud_net": {
"expiry": 1641600000000,
"privilege": "BASIC"
}
}
}
tcpdump
o10test_velocloud_net:velocli> tcpdump -nnpi eth0 -c 10 reading from file -, link-type EN10MB (Ethernet) 09:45:12.297381 IP6 fd00:1:1:2::2.2426 > fd00:ff01:0:1::2.2426: UDP, length 21 09:45:12.300520 IP6 fd00:ff01:0:1::2.2426 > fd00:1:1:2::2.2426: UDP, length 21 09:45:12.399077 IP6 fd00:1:1:2::2.2426 > fd00:ff01:0:1::2.2426: UDP, length 21 09:45:12.401382 IP6 fd00:ff01:0:1::2.2426 > fd00:1:1:2::2.2426: UDP, length 21 09:45:12.442927 IP6 fd00:1:1:2::2.2426 > fd00:ff01:0:1::2.2426: UDP, length 83 09:45:12.444745 IP6 fd00:ff01:0:1::2.2426 > fd00:1:1:2::2.2426: UDP, length 83 09:45:12.476765 IP6 fd00:ff01:0:1::2.2426 > fd00:1:1:2::2.2426: UDP, length 64 09:45:12.515696 IP6 fd00:ff02:0:1::2.2426 > fd00:1:1:2::2.2426: UDP, length 21
pcap
o10test_velocloud_net:velocli> pcap -nnpi eth4 -c 10 The capture will be saved to file o10test_velocloud_net_2021-12-09_09-57-50.pcap o10test_velocloud_net:velocli> tcpdump: listening on eth4, link-type EN10MB (Ethernet), capture size 262144 bytes 10 packets captured 10 packets received by filter 0 packets dropped by kernel
debug
o10test_velocloud_net:velocli> debug --dpdk_ports_dump name port link ignore strip speed duplex autoneg driver ge3 0 1 0 1 1000 1 1 igb ge6 4 0 2 1 0 0 1 ixgbe ge5 5 0 2 1 0 0 1 ixgbe ge4 1 0 2 1 0 0 0 igb sfp2 2 0 2 1 0 0 1 ixgbe sfp1 3 0 2 1 0 0 1 ixgbe net_vhost0 6 0 0 1 10000 1 0 net_vhost1 7 0 0 1 10000 1 0
diag
o10test_velocloud_net:velocli> diag ARP_DUMP --count 10 Stale Timeout: 2min | Dead Timeout: 25min | Cleanup Timeout: 240min GE3 192.168.1.254 7c:12:61:70:2f:d0 ALIVE 1s LAN-VLAN1 10.10.1.137 b2:84:f7:c1:d3:a5 ALIVE 34s
ifstatus
o10test:velocli> ifstatus
{
"deviceBoardName": "EDGE620-CPU",
"deviceInfo": [],
"edgeActivated": true,
"edgeSerial": "HRPGPK2",
"edgeSoftware": {
"buildNumber": "R500-20210821-DEV-301514018f\n",
"version": "5.0.0\n"
},
"edgedDisabled": false,
"interfaceStatus": {
"GE1": {
"autonegotiation": true,
"duplex": "Unknown! (255)",
"haActiveSerialNumber": "",
"haEnabled": false,
"haStandbySerialNumber": "",
"ifindex": 4,
"internet": false,
"ip": "",
"is_sfp": false,
"isp": "",
"linkDetected": false,
"logical_id": "",
"mac": "18:5a:58:1e:f9:22",
"netmask": "",
"physicalName": "ge1",
"reachabilityIp": "8.8.8.8",
"service": false,
"speed": "Unkn",
"state": "DEAD",
"stats": {
"bpsOfBestPathRx": 0,
"bpsOfBestPathTx": 0
},
"type": "LAN"
},
"GE2": {
"autonegotiation": true,
"duplex": "Unknown! (255)",
"haActiveSerialNumber": "",
"haEnabled": false,
…
…
}
]
}
getwanconfig
o10test_velocloud_net:velocli> getwanconfig GE3
{
"details": {
"autonegotiation": "on",
"driver": "dpdk",
"duplex": "",
"gateway": "169.254.7.9",
"ip": "169.254.7.10",
"is_sfp": false,
"linkDetected": true,
"mac": "00:50:56:8e:46:de",
"netmask": "255.255.255.248",
"password": "",
"proto": "static",
"speed": "",
"username": "",
"v4Disable": false,
"v6Disable": false,
"v6Gateway": "fd00:1:1:1::1",
"v6Ip": "fd00:1:1:1::2",
"v6Prefixlen": 64,
"v6Proto": "static",
"vlanId": ""
},
"status": "OK"
}