Cisco MDS 9000 Family NX-OS Security Configuration Guide

DHCHAP Compatibility with Existing Cisco MDS Features

This section identifies the impact of configuring the DHCHAP feature along with existing Cisco MDS features:

• PortChannel interfaces—If DHCHAP is enabled for ports belonging to a PortChannel, DHCHAP authentication is performed at the physical interface level, not at the PortChannel level.
• FCIP interfaces—The DHCHAP protocol works with the FCIP interface just as it would with a physical interface.
• Port security or fabric binding—Fabric binding policies are enforced based on identities authenticated by DHCHAP.
• VSANs—DHCHAP authentication is not done on a per-VSAN basis.
• High availability—DHCHAP authentication works transparently with existing HA features.

About Enabling DHCHAP

By default, the DHCHAP feature is disabled in all switches in the Cisco MDS 9000 Family.

You must explicitly enable the DHCHAP feature to access the configuration and verification commands for fabric authentication. When you disable this feature, all related configurations are automatically discarded.

Enabling DHCHAP

To enable DHCHAP for a Cisco MDS switch, follow these steps:

To enable DHCHAP for a Cisco MDS switch using Fabric Manager, follow these steps:

Step 1 Expand Switches, expand Security and then select FC-SP.

You see the FC-SP (DHCHAP) configuration in the Information pane shown in Figure 11-2.

Figure 11-2 FC-SP Configuration

The Control tab is the default. You see the FC-SP enable state for all switches in the fabric.

Step 2 Set the Command drop-down menu to enable for all switches that you want to enable FC-SP on.

Step 3 Click the Apply Changes icon to enable FC-SP and DHCHAP on the selected switches.

About DHCHAP Authentication Modes

The DHCHAP authentication status for each interface depends on the configured DHCHAP port mode.

When the DHCHAP feature is enabled in a switch, each Fibre Channel interface or FCIP interface may be configured to be in one of four DHCHAP port modes:

• On—During switch initialization, if the connecting device supports DHCHAP authentication, the software performs the authentication sequence. If the connecting device does not support DHCHAP authentication, the software moves the link to an isolated state.
• Auto-Active—During switch initialization, if the connecting device supports DHCHAP authentication, the software performs the authentication sequence. If the connecting device does not support DHCHAP authentication, the software continues with the rest of the initialization sequence.
• Auto-Passive (default)—The switch does not initiate DHCHAP authentication, but participates in DHCHAP authentication if the connecting device initiates DHCHAP authentication.
• Off—The switch does not support DHCHAP authentication. Authentication messages sent to such ports return error messages to the initiating switch.

Note Whenever DHCHAP port mode is changed to a mode other than the Off mode, reauthentication is performed.

Note Changing DHCHAP port mode for a VE link requires a port flap on both the ends.

Table 11-1 identifies the switch-to-switch authentication behavior between two Cisco MDS switches in various modes.

Configuring the DHCHAP Mode

To configure the DHCHAP mode for a particular interface, follow these steps:

To configure the DHCHAP mode for a particular interface using Fabric Manager, follow these steps:

Step 1 Expand Switches, expand Interfaces and then select FC Physical.

You see the interface configuration in the Information pane.

Step 2 Click the FC-SP tab.

You see the FC-SP (DHCHAP) configuration in the Information pane shown in Figure 11-3.

Figure 11-3 FC-SP (DHCHAP) Interface Modes

Step 3 Set the Mode drop-down menu to the DHCHAP authentication mode you want to configure for that interface.

Step 4 Click the Apply Changes icon to save these DHCHAP port mode settings.

About DHCHAP Hash Algorithm

Cisco MDS switches support a default hash algorithm priority list of MD5 followed by SHA-1 for DHCHAP authentication.

Tip If you change the hash algorithm configuration, then change it globally for all switches in the fabric.

Caution If AAA authentication for fcsp dhchap is enabled, the MD5 hash algorithm must be set if AAA authentication uses RADIUS or TACACS+. This is because RADIUS and TACACS+ applications do not support other hash algorithms.

---

Configuring the DHCHAP Hash Algorithm

To configure the hash algorithm, follow these steps:

To configure the hash algorithm using Fabric Manager, follow these steps:

Step 1 Choose Switches > Security and then select FC-SP.

Step 2 Click the General/Password tab.

You see the DHCHAP general settings mode for each switch shown in Figure 11-4.

Figure 11-4 General/ Password Tab

Step 3 Change the DHCHAP HashList for each switch in the fabric.

Step 4 Click the Apply Changes icon to save the updated hash algorithm priority list.

About DHCHAP Group Settings

FC-SP supports multiple DHCHAP groups. The allowed groups may be changed from the default list. The list is configured in the order of highest to lowest priority to be used when negotiating with the FC-SP peer. Each side compares the list of groups received with the local group list and the highest priority group is used. Each group should be specified no more than once in the configuration command.

Refer to the fcsp dhchap command in the Cisco MDS 9000 Series NX-OS Command Reference Guide for details about the groups.

Tip If you change the DH group configuration, change it globally for all switches in the fabric.

Configuring the DHCHAP Group Settings

To change the DH group settings, follow these steps:

To change the DH group settings using Fabric Manager, follow these steps:

Step 1 Expand Switches > Security and then select FC-SP.

Step 2 Click the General/Password tab.

Step 3 Change the DHCHAP GroupList for each switch in the fabric.

Step 4 Click the Apply Changes icon to save the updated hash algorithm priority list.

About DHCHAP Password

DHCHAP authentication in each direction requires a shared secret password between the connected devices. To do this, you can use one of three approaches to manage passwords for all switches in the fabric that participate in DHCHAP.

• Approach 1—Use the same password for all switches in the fabric. This is the simplest approach. When you add a new switch, you use the same password to authenticate that switch in this fabric. It is also the most vulnerable approach if someone from the outside maliciously attempts to access any one switch in the fabric.
• Approach 2—Use a different password for each switch and maintain that password list in each switch in the fabric. When you add a new switch, you create a new password list and update all switches with the new list. Accessing one switch yields the password list for all switches in that fabric.
• Approach 3—Use different passwords for different switches in the fabric. When you add a new switch, multiple new passwords corresponding to each switch in the fabric must be generated and configured in each switch. Even if one switch is compromised, the password of other switches are still protected. This approach requires considerable password maintenance by the user.

Note All passwords are restricted to 64 alphanumeric characters and can be changed, but not deleted.

Tip We recommend using RADIUS or TACACS+ for fabrics with more than five switches. If you need to use a local password database, you can continue to do so using Approach 3 and using the Cisco MDS 9000 Family Fabric Manager to manage the password database.

Configuring DHCHAP Passwords for the Local Switch

To configure the DHCHAP password for the local switch, follow these steps:

To configure the DHCHAP password for the local switch using Fabric Manager, follow these steps:

Step 1 Expand Switches > Security and then select FC-SP.

You see the FC-SP configuration in the Information pane.

Step 2 Click the Local Passwords tab.

Step 3 Click the Create Row icon to create a new local password.

You see the Create Local Passwords dialog box.

Step 4 (Optional) Check the switches that you want to configure the same local password on.

Step 5 Select the switch WNN and fill in the Password field.

Step 6 Click Create to save the updated password.

About Password Configuration for Remote Devices

You can configure passwords in the local authentication database for other devices in a fabric. The other devices are identified by their device name, which is also known as the switch WWN or device WWN. The password is restricted to 64 characters and can be specified in clear text (0) or in encrypted text (7).

Note The switch WWN identifies the physical switch. This WWN is used to authenticate the switch and is different from the VSAN node WWN.

Configuring DHCHAP Passwords for Remote Devices

To locally configure the remote DHCHAP password for another switch in the fabric, follow these steps:

To locally configure the remote DHCHAP password for another switch in the fabric using Fabric Manager, follow these steps:

Step 1 Right-click an ISL and select Enable FC-SP from the drop-down list (see Figure 11-5).

Figure 11-5 Enable FC-SP

You see the Enable FC-SP dialog box.

Figure 11-6 Enable FC-SP Dialog Box

Step 2 Click Apply to save the updated password.

About DHCHAP Timeout Value

During the DHCHAP protocol exchange, if the MDS switch does not receive the expected DHCHAP message within a specified time interval, authentication failure is assumed. The time ranges from 20 (no authentication is performed) to 1000 seconds. The default is 30 seconds.

When changing the timeout value, consider the following factors:

• The existing RADIUS and TACACS+ timeout values.
• The same value must also be configured on all switches in the fabric.

Configuring the DHCHAP Timeout Value

To configure the DHCHAP timeout value, follow these steps:

To configure the DHCHAP timeout value using Fabric Manager, follow these steps:

Step 1 Expand Switches > Security and then select FC-SP.

You see the FC-SP configuration in the Information pane.

Step 2 Click the General/Password tab.

You see the DHCHAP general settings mode for each switch (see Figure 11-7).

Figure 11-7 General/Password Tab

Step 3 Change the DHCHAP timeout value for each switch in the fabric.

Step 4 Click the Apply Changes icon to save the updated information.

Configuring DHCHAP AAA Authentication

You can individually set authentication options. If authentication is not configured, local authentication is used by default.

To configure the AAA authentication refer to the Chapter7, “Configuring Security Features on an External AAA Server” Follow these steps:

Enabling FC-SP on ISLs

There is an ISL pop-up menu in Fabric Manager called Enable FC-SP that enables FC-SP on switches at either end of the ISL. You are prompted for an FC-SP generic password, then asked to set FC-SP interface mode to ON for affected ports. Right-click an ISL and click Enable FC-SP to access this feature.

Displaying Protocol Security Information

Use the show fcsp commands to display configurations for the local database (see Example 11-1 through 11-6 ).

Example 11-1 Displays DHCHAP Configurations in FC Interfaces

Example 11-2 Displays DHCHAP Statistics for an FC Interface

Example 11-3 Displays the FC-SP WWN of the Device Connected through a Specified Interface

Example 11-4 Displays Hash Algorithm and DHCHAP Groups Configured for the Local Switch

Example 11-5 Displays the DHCHAP Local Password Database

Example 11-6 Displays the ASCII Representation of the Device WWN

Tip Use the ASCII representation of the device WWN (identified in bold in Example 11-6) to configure the switch information on RADIUS and TACACS+ servers.