Users Guide

Security proles
To use independent sets of security credentials for dierent OS10 applications, you can congure multiple security proles and assign them
to OS10 applications. A security prole consists of a certicate and private key pair.
For example, you can maintain dierent security proles for RADIUS over TLS authentication and SmartFabric services. Using dierent
security proles allows you to upgrade one application without interrupting the operation of the other one. Assign a security prole to an
application when you congure the prole.
When you install a certicate-key pair, both take the name of the certicate. For example, if you install a certicate using:
OS10# crypto cert install cert-file home://Dell_host1.pem key-file home://abcd.key
The certicate-key pair is installed as Dell_host1.pem and Dell_host1.key. In conguration commands, refer to the pair as
Dell_host1. When you congure a security prole, you would enter Dell_host1 in the certificate certificate-name
command.
Congure security prole
1 Create an application-specic security prole in CONFIGURATION mode.
crypto security-profile profile-name
2 Assign a certicate and private key pair to the security prole in SECURITY-PROFILE mode. For certificate-name, enter the
name of the certicate-key pair as it appears in the
show crypto certs output without the .pem extension.
certificate certificate-name
exit
3 (Optional) Enable CRL checking for certicates received from external devices in SECURITY-PROFILE mode. CRL checking veries
the validity of a certicate using the CRLs installed on the switch.
revocation-check
4 (Optional) Enable peer name checking for certicates presented by external devices in SECURITY-PROFILE mode. Peer name
checking ensures that the certicate matches the name of the peer device, such as a remote server name.
peer-name-check
5 Use the security prole to congure X.509v3-based service; for example, to congure RADIUS over TLS authentication using an X.
509v3 certicate, enter the radius-server host tls command:
radius-server host {hostname | ip-address} tls security-profile profile-name
[auth-port
port-number] key {0 authentication-key | 9 authentication-key | authentication-
key}
Example: Security prole in RADIUS over TLS authentication
OS10# show crypto cert
--------------------------------------
| Installed non-FIPS certificates |
--------------------------------------
dv-fedgov-s6010-1.pem
--------------------------------------
| Installed FIPS certificates |
--------------------------------------
OS10#
OS10(config)#
OS10(config)# crypto security-profile radius-prof
OS10(config-sec-profile)# certificate dv-fedgov-s6010-1
OS10(config-sec-profile)# revocation-check
OS10(config-sec-profile)# peer-name-check
OS10(config-sec-profile)# exit
OS10(config)#
OS10(config)# radius-server host radius-server-2.test.com tls security-profile radius-prof key
radsec
OS10(config)# end
OS10# show running-configuration crypto security-profile
!
Security
985