09-Security Configuration Guide

HomeSupportResource CenterSwitchesH3C S6300 Switch SeriesH3C S6300 Switch SeriesTechnical DocumentsConfigureConfiguration GuidesH3C S6300 Switch Series Configuration Guides-Release 243x-6W10009-Security Configuration Guide
20-Keychain configuration
Title Size Download
20-Keychain configuration 82.51 KB

Configuring keychains

Overview

A keychain, a sequence of keys, provides dynamic authentication to ensure secure communication by periodically changing the key and authentication algorithm without service interruption.

Each key in a keychain has a key string, authentication algorithm, sending lifetime, and receiving lifetime. When the system time is within the lifetime of a key in a keychain, an application uses the key to authenticate incoming and outgoing packets. The keys in the keychain take effect one by one according to the sequence of the configured lifetimes. In this way, the authentication algorithms and keys are dynamically changed to implement dynamic authentication.

A keychain operates in absolute time mode. In this mode, each time point during a key's lifetime is the UTC time and is not affected by the system's time zone and daylight saving time.

Configuration procedure

Follow these guidelines when you configure a keychain:

·           To make sure only one key in a keychain is used at a time to authenticate packets to a peer, set non-overlapping sending lifetimes for the keys in the keychain.

·           The keys used by the local device and the peer device must have the same authentication algorithm and key string.

To configure a keychain:

 

Step

Command

Remarks

1.      Enter system view.

system-view

N/A

2.      Create a keychain and enter keychain view.

keychain keychain-name [ mode absolute ]

By default, no keychains exist.

3.      (Optional.) Set a tolerance time for accept keys in the keychain.

accept-tolerance { value | infinite }

By default, no tolerance time is configured for accept keys in a keychain.

4.      Create a key and enter key view.

key key-id

By default, no keys exist.

5.      Specify an authentication algorithm for the key.

authentication-algorithm hmac-sha-256

By default, no authentication algorithm is specified for a key.

6.      Configure a key string for the key.

key-string { cipher | plain } string

By default, no key string is configured.

7.      Set the sending lifetime in UTC mode for the key.

send-lifetime utc start-time start-date { duration { duration-value | infinite } | to end-time end-date }

By default, the sending lifetime is not configured for a key.

8.      Set the receiving lifetime in UTC mode for the key.

accept-lifetime utc start-time start-date { duration { duration-value | infinite } | to end-time end-date }

By default, the receiving lifetime is not configured for a key.

9.      (Optional.) Specify the key as the default send key.

default-send-key

By default, no key in a keychain is specified as the default send key.

 

Displaying and maintaining keychain

Execute display commands in any view.

 

Task

Command

Display keychain information.

display keychain [ name keychain-name [ key key-id ] ]

 

Keychain configuration example

Network requirements

As shown in Figure 1, establish an OSPFv3 neighbor relationship between Switch A and Switch B, and use a keychain to authenticate packets between the switches. Configure key 1 and key 2 for the keychain and make sure key 2 is used immediately when key 1 expires.

Figure 1 Network diagram

 

Configuration procedure

Configuring Switch A

# Configure IPv6 addresses for interfaces. (Details not shown.)

# Configure OSPFv3.

<SwitchA> system-view

[SwitchA] ospfv3 1

[SwitchA-ospfv3-1] router-id 1.1.1.1

[SwitchA-ospfv3-1] quit

[SwitchA] interface vlan-interface 100

[SwitchA-Vlan-interface100] ospfv3 1 area 0

[SwitchA-Vlan-interface100] quit

# Create a keychain named abc, and specify the absolute time mode for it.

[SwitchA] keychain abc mode absolute

# Create key 1 for the keychain abc, specify an authentication algorithm, and configure a key string and the sending and receiving lifetimes for the key.

[SwitchA-keychain-abc] key 1

[SwitchA-keychain-abc-key-1] authentication-algorithm hmac-sha-256

[SwitchA-keychain-abc-key-1] key-string plain 123456

[SwitchA-keychain-abc-key-1] send-lifetime utc 10:00:00 2015/02/06 to 11:00:00 2015/02/06

[SwitchA-keychain-abc-key-1] accept-lifetime utc 10:00:00 2015/02/06 to 11:00:00 2015/02/06

[SwitchA-keychain-abc-key-1] quit

# Create key 2 for the keychain abc, specify an authentication algorithm, and configure a key string and the sending and receiving lifetimes for the key.

[SwitchA-keychain-abc] key 2

[SwitchA-keychain-abc-key-2] authentication-algorithm hmac-sha-256

[SwitchA-keychain-abc-key-2] key-string plain pwd123

[SwitchA-keychain-abc-key-2] send-lifetime utc 11:00:00 2015/02/06 to 12:00:00 2015/02/06

[SwitchA-keychain-abc-key-2] accept-lifetime utc 11:00:00 2015/02/06 to 12:00:00 2015/02/06

[SwitchA-keychain-abc-key-2] quit

[SwitchA-keychain-abc] quit

# Configure VLAN-interface 100 to use the keychain abc for authentication.

[SwitchA] interface vlan-interface 100

[SwitchA-Vlan-interface100] ospfv3 authentication-mode keychain abc

[SwitchA-Vlan-interface100] quit

Configuring Switch B

# Configure IPv6 addresses for interfaces. (Details not shown.)

# Configure OSPFv3.

<SwitchB> system-view

[SwitchB] ospfv3 1

[SwitchB-ospfv3-1] router-id 2.2.2.2

[SwitchB-ospfv3-1] quit

[SwitchB] interface vlan-interface 100

[SwitchB-Vlan-interface100] ospfv3 1 area 0

[SwitchB-Vlan-interface100] quit

# Create a keychain named abc, and specify the absolute time mode for it.

[SwitchB] keychain abc mode absolute

# Create key 1 for the keychain abc, specify an authentication algorithm, and configure a key string and the sending and receiving lifetimes for the key.

[SwitchB-keychain-abc] key 1

[SwitchB-keychain-abc-key-1] authentication-algorithm hmac-sha-256

[SwitchB-keychain-abc-key-1] key-string plain 123456

[SwitchB-keychain-abc-key-1] send-lifetime utc 10:00:00 2015/02/06 to 11:00:00 2015/02/06

[SwitchB-keychain-abc-key-1] accept-lifetime utc 10:00:00 2015/02/06 to 11:00:00 2015/02/06

[SwitchB-keychain-abc-key-1] quit

# Create key 2 for the keychain abc, specify an authentication algorithm, and configure a key string and the sending and receiving lifetimes for the key.

[SwitchB-keychain-abc] key 2

[SwitchB-keychain-abc-key-2] authentication-algorithm hmac-sha-256

[SwitchB-keychain-abc-key-2] key-string plain pwd123

[SwitchB-keychain-abc-key-2] send-lifetime utc 11:00:00 2015/02/06 to 12:00:00 2015/02/06

[SwitchB-keychain-abc-key-2] accept-lifetime utc 11:00:00 2015/02/06 to 12:00:00 2015/02/06

[SwitchB-keychain-abc-key-2] quit

[SwitchB-keychain-abc] quit

# Configure VLAN-interface 100 to use the keychain abc for authentication.

[SwitchB] interface vlan-interface 100

[SwitchB-Vlan-interface100] ospfv3 authentication-mode keychain abc

[SwitchB-Vlan-interface100] quit

Verifying the configuration

1.      When the system time is within the lifetime from 10:00:00 to 11:00:00 on the day 2015/02/06, verify the status of the keys in the keychain abc.

# Display keychain information on Switch A. The output shows that key 1 is the valid key.

[SwitchA] display keychain

 

 Keychain name          : abc

   Mode                 : absolute

   Accept tolerance     : 0

   Default send key ID  : None

   Active send key ID   : 1

   Active accept key IDs: 1

 

   Key ID               : 1

     Key string         : $c$3$dYTC8QeOKJkwFwP2k/rWL+1p6uMTw3MqNg==

     Algorithm          : hmac-sha-256

     Send lifetime      : 10:00:00 2015/02/06 to 11:00:00 2015/02/06

     Send status        : Active

     Accept lifetime    : 10:00:00 2015/02/06 to 11:00:00 2015/02/06

     Accept status      : Active

 

   Key ID               : 2

     Key string         : $c$3$7TSPbUxoP1ytOqkdcJ3K3x0BnXEWl4mOEw==

     Algorithm          : hmac-sha-256

     Send lifetime      : 11:00:00 2015/02/06 to 12:00:00 2015/02/06

     Send status        : Inactive

     Accept lifetime    : 11:00:00 2015/02/06 to 12:00:00 2015/02/06

     Accept status      : Inactive

# Display keychain information on Switch B. The output shows that key 1 is the valid key.

[SwitchB]display keychain

 

 Keychain name          : abc

   Mode                 : absolute

   Accept tolerance(min): 0

   Default send key ID  : None

   Active send key ID   : 1

   Active accept key IDs: 1

 

   Key ID               : 1

     Key string         : $c$3$/G/Shnh6heXWprlSQy/XDmftHa2JZJBSgg==

     Algorithm          : hmac-sha-256

     Send lifetime      : 10:00:00 2015/02/06 to 11:00:00 2015/02/06

     Send status        : Active

     Accept lifetime    : 10:00:00 2015/02/06 to 11:00:00 2015/02/06

     Accept status      : Active

 

   Key ID               : 2

     Key string         : $c$3$t4qHAw1hpZYN0JKIEpXPcMFMVT81u0hiOw==

     Algorithm          : hmac-sha-256

     Send lifetime      : 11:00:00 2015/02/06 to 12:00:00 2015/02/06

     Send status        : Inactive

     Accept lifetime    : 11:00:00 2015/02/06 to 12:00:00 2015/02/06

     Accept status      : Inactive

2.      When the system time is within the lifetime from 11:00:00 to 12:00:00 on the day 2015/02/06, verify the status of the keys in the keychain abc.

# Display keychain information on Switch A. The output shows that key 2 becomes the valid key.

[SwitchA]display keychain

 

 Keychain name          : abc

   Mode                 : absolute

   Accept tolerance     : 0

   Default send key ID  : None

   Active send key ID   : 2

   Active accept key IDs: 2

 

   Key ID               : 1

     Key string         : $c$3$dYTC8QeOKJkwFwP2k/rWL+1p6uMTw3MqNg==

     Algorithm          : hmac-sha-256

     Send lifetime      : 10:00:00 2015/02/06 to 11:00:00 2015/02/06

     Send status        : Inactive

     Accept lifetime    : 10:00:00 2015/02/06 to 11:00:00 2015/02/06

     Accept status      : Inactive

 

   Key ID               : 2

     Key string         : $c$3$7TSPbUxoP1ytOqkdcJ3K3x0BnXEWl4mOEw==

     Algorithm          : hmac-sha-256

     Send lifetime      : 11:00:00 2015/02/06 to 12:00:00 2015/02/06

     Send status        : Active

     Accept lifetime    : 11:00:00 2015/02/06 to 12:00:00 2015/02/06

     Accept status      : Active

# Display keychain information on Switch B. The output shows that key 2 becomes the valid key.

[SwitchB]display keychain

 

 Keychain name          : abc

   Mode                 : absolute

   Accept tolerance     : 0

   Default send key ID  : None

   Active send key ID   : 1

   Active accept key IDs: 1

 

   Key ID               : 1

     Key string         : $c$3$/G/Shnh6heXWprlSQy/XDmftHa2JZJBSgg==

     Algorithm          : hmac-sha-256

     Send lifetime      : 10:00:00 2015/02/06 to 11:00:00 2015/02/06

     Send status        : Inactive

     Accept lifetime    : 10:00:00 2015/02/06 to 11:00:00 2015/02/06

     Accept status      : Inactive

 

   Key ID               : 2

     Key string         : $c$3$t4qHAw1hpZYN0JKIEpXPcMFMVT81u0hiOw==

     Algorithm          : hmac-sha-256

     Send lifetime      : 11:00:00 2015/02/06 to 12:00:00 2015/02/06

     Send status        : Active

     Accept lifetime    : 11:00:00 2015/02/06 to 12:00:00 2015/02/06

     Accept status      : Active