Users Guide

crypto security-profile radius-prof
certificate dv-fedgov-s6010-1
OS10# show running-configuration radius-server
radius-server host radius-server-2.test.com tls security-profile radius-prof key 9
2b9799adc767c0efe8987a694969b1384c541414ba18a44cd9b25fc00ff180e9
Cluster security
When you enable VLT or a fabric automation application, switches that participate in the cluster use secure channels to communicate with
each other. The secure channels are enabled only when you enable the VLT or fabric cluster conguration on a switch. OS10 installs a
default X.509v3 certicate-key pair to establish secure channels between the peer devices in a cluster.
In a deployment where untrusted devices access management or data ports on an OS10 switch, replace the default certicate-key pair
used for cluster applications. Create a custom X.509v3 certicate-key pair by conguring an application-specic security prole using the
cluster security-profile command.
Before the default or custom X.509v3 certicate-key pair used between the peer devices in a VLT domain or fabric application cluster
expires, install a valid CA certicate by following the procedures in:
• Manage CA certicates.
• Request and install host certicates.
For example, the expiration date for the default certicate-key pair installed by OS10 on a switch running the 10.5.0.0 release is July 27,
2021. To ensure secure communication in a cluster before the expiration date, install a more recent X.509v3 certicate-key pair.
When you replace the default certicate-key pair for cluster applications, ensure that all devices in the cluster use the same custom
certicate-key pair or a unique certicate-key pair issued by the same CA.
CAUTION
: While you replace the default certicate-key pair, cluster devices temporarily lose their secure channel connectivity.
Dell EMC Networking recommends that you change the cluster security conguration during a maintenance time.
This example shows how to install an X.509v3 CA and host certicate-key pair for a cluster application. For more information, see:
• Importing and installing a CA certicate — see Manage CA certicates.
• Generating a CSR and installing a host certicate — see Request and install host certicates.
1. Install a trusted CA certicate.
OS10# copy tftp://CAadmin:secret@172.11.222.1/GeoTrust_Universal_CA.crt
home:// GeoTrust_Universal_CA.crt
OS10# crypto ca-cert install home://GeoTrust_Universal_CA.crt
Processing certificate ...
Installed Root CA certificate
CommonName = GeoTrust Universal CA
IssuerName = GeoTrust Universal CA
2. Generate a CSR, copy the CSR to a CA server, download the signed certicate, and install the host certicate.
OS10# crypto cert generate request cert-file home://s4048-001.csr key-file home://tsr6.key
cname "Top of Rack 6" altname "IP:10.0.0.6 DNS:tor6.dell.com" email [e-mail] organization
"Dell EMC" orgunit Networking locality "Santa Clara" state California country US length 1024
Processing certificate ...
Successfully created CSR file /home/admin/tor6.csr and key
OS10# copy home://tor6.csr scp://CAadmin:secret@172.11.222.1/s4048-001-csr.pem
OS10# copy scp://CAadmin:secret@172.11.222.1/s4048-001.crt usb://s4048-001.crt
OS10# crypto cert install crt-file usb://s4048-001.crt key-file usb://s4048-001.key
986
Security