Users Guide

3. (Optional) Enable CRL checking for certificates received from external devices in SECURITY-PROFILE mode. CRL checking verifies
the validity of a certificate using the CRLs installed on the switch.
revocation-check
4. (Optional) Enable peer name checking for certificates presented by external devices in SECURITY-PROFILE mode. Peer name
checking ensures that the certificate matches the name of the peer device, such as a remote server name.
peer-name-check
5. Use the security profile to configure X.509v3-based service; for example, to configure RADIUS over TLS authentication using an
X.509v3 certificate, enter the
radius-server host tls command:
radius-server host {hostname | ip-address} tls security-profile profile-name
[auth-port port-number] key {0 authentication-key | 9 authentication-key | authentication-
key}
Example: Security profile in RADIUS over TLS authentication
OS10# show crypto cert
--------------------------------------
| Installed non-FIPS certificates |
--------------------------------------
dv-fedgov-s6010-1.pem
--------------------------------------
| Installed FIPS certificates |
--------------------------------------
OS10#
OS10(config)#
OS10(config)# crypto security-profile radius-prof
OS10(config-sec-profile)# certificate dv-fedgov-s6010-1
OS10(config-sec-profile)# revocation-check
OS10(config-sec-profile)# peer-name-check
OS10(config-sec-profile)# exit
OS10(config)#
OS10(config)# radius-server host radius-server-2.test.com tls security-profile radius-prof
key radsec
OS10(config)# end
OS10# show running-configuration crypto security-profile
!
crypto security-profile radius-prof
certificate dv-fedgov-s6010-1
OS10# show running-configuration radius-server
radius-server host radius-server-2.test.com tls security-profile radius-prof key 9
2b9799adc767c0efe8987a694969b1384c541414ba18a44cd9b25fc00ff180e9
Cluster security
When you enable VLT or a fabric automation application, switches that participate in the cluster use secure channels to communicate with
each other. The secure channels are enabled only when you enable the VLT or fabric cluster configuration on a switch. OS10 installs a
default X.509v3 certificate-key pair to establish secure channels between the peer devices in a cluster.
Replace the default certificate-key pair used for cluster applications:
• In a deployment where untrusted devices access management or data ports on an OS10 switch.
• Before the default X.509v3 certificate expires on July 27, 2021. If the default certificate-key pair expires, the VLT domain on peer
switches does not come up.
NOTE:
The expiration date for the default certificate-key pair installed by OS10 on a switch running the 10.5.0.0 release
is July 27, 2021. To ensure secure communication in a cluster before the expiration date, install a more recent X.509v3
certificate-key pair.
Create a custom X.509v3 certificate-key pair by configuring an application-specific security profile using the cluster security-
profile command. Before the default or custom X.509v3 certificate-key pair used between the peer devices in a VLT domain or fabric
application cluster expires, install a valid CA certificate by following the procedures in:
• Manage CA certificates.
974
Security