Users Guide

When you set the password-less option with X.509v3 authentication, the system authenticates only
locally. Configuring remote authentication using RADIUS or TACAC+ has no effect when X.509v3
authentication when using the password-less option.
X.509v3 authentication requires an SSH client that supports RFC 6187 X.509v3 SSH authentication.
The no version of this command disables the X.509v3 authentication.
Example
OS10(config)# ip ssh server x509v3-authentication security-profile
profile-1
Supported
releases
10.5.2.0 or later
ocsp-check [ocsp-url]
Enables OCSP revocation checks when validating certificates.
Syntax
ocsp-check [ocsp-url]
Parameters ocsp-url — The URL of an OCSP responder used to check revocation. If specified, the URL is used to
check if a certificate is revoked, instead of the OCSP URL in the certificate.
Default Not configured
Command mode SEC-PROFILE
Security and
Access
sysadmin and secadmin
Usage
information
Use the ocsp-check command to enable OCSP verification of certificates presented by the external
devices for a PKI-enabled application on the switch.
The no version of the command disables OCSP revocation checking in a security profile.
Example
OS10(config)# crypto security-profile profile-1
OS10(config-sec-profile)# ocsp-check http://ocspresponder.example.net
Supported
releases
10.5.2.0 or later
Network security
OS10 switch has security features to restrict network traffic, protect the network from attacks, and prevent unauthorized
access to the network.
Access control lists
Access control lists (ACLs) restrict network traffic using policies and improve network performance. For more information about
ACL, see Access control lists.
DHCP snooping
DHCP snooping protects your network from attacks by monitoring the DHCP messages and blocking untrusted or rogue DHCP
servers. For more information about DHCP snooping, see DHCP snooping.
802.1X port access control
802.1x defines access control that prevents unauthorized devices or users from connecting to a network. For more information
about 802.1X, see 802.1X.
1380
Security