Public key management configuration examples

 

·     Introduction

·     Prerequisites

·     Restrictions and guidelines

·     Example: Entering a peer host public key

·     Example: Importing a peer host public key from a public key file

 

The following information provides configuration examples for public key management.

 

This document is not restricted to specific software or hardware versions. Procedures and information in the examples might be slightly different depending on the software or hardware version of the device.

The configuration examples were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

The following information is provided based on the assumption that you have basic knowledge of public key management.

 

When you manually enter the peer host public key, make sure the entered key is in the correct format. To obtain the peer host public key in the correct format, display the public key on the peer device and record the key. The format of the public key displayed in any other way might be incorrect. If the key is not in the correct format, the system discards the key and displays an error message.

As a best practice, import rather than enter the peer host public key if you are not sure whether the device supports the format of the recorded peer host public key.

Network configuration

As shown in Figure 1, to prevent illegal access from Device A to Device B, Device B authenticates Device A through a digital signature. Before configuring authentication parameters on Device B, use the following procedure to configure the public key of Device A on Device B:

·     Create RSA key pairs on Device A and display the public keys of the RSA key pairs.

·     Manually specify the RSA host public key of Device A on Device B.

Figure 1 Network diagram

 

Software versions used

This configuration example was created and verified on E8371 of the F5000-AI160 device.

This configuration example was created and verified on E9671 of the M9000-X06 device.

Procedures

Configuring Device A

# On the top navigation bar, click Objects.

# From the navigation pane, select Public Key Management > Local Key Pairs.

# Click Create. The Create Local Key Pair page opens.

# Create an RSA local key pair as follows:

·     Enter key pair name devicea-rsa.

·     Select the RSA algorithm.

·     Enter key length 1800.

# Click OK.

# Click key pair name devicea-rsa to open the Key Pair Details page.

# Record the data displayed in the Public key field.

Figure 2 Creating a local key pair

 

Figure 3 Key details

 

Configuring Device B

# On the top navigation bar, click Objects.

# From the navigation pane, select Public Key Management > Local Key Pairs.

# Click Import. The Import Peer Host Public Key page opens.

# Configure the peer host public key as follows:

·     Enter public key name peer-rsa.

·     Select the Type or copy peer public key import method.

·     In the Public key data field, type the public key data of Device A, or copy and then paste the public key data of Device A.

# Click OK.

Figure 4 Entering the peer host public key

 

Verifying the configuration

1.     Display information about the local public key on Device A.

# On the top navigation bar, click Objects.

# From the navigation pane, Public Key Management > Local Key Pairs.

# Click the Details icon for key pair devicea-rsa to open the Key Pair Details page. The Public key field displays the content of the public key.

Figure 5 Local host public key information

 

2.     Display information about the peer public key configured on Device B.

# On the top navigation bar, click Objects.

# From the navigation pane, Public Key Management > Peer Public Keys.

# Click the Details icon for public key peer-rsa.

Figure 6 Manually configured peer host public key

 

Network configuration

As shown in Figure 7, to prevent illegal access from Device A to Device B, Device B authenticates Device A through a digital signature. Before configuring authentication parameters on Device B, use the following procedure to configure the public key of Device A on Device B:

·     Create RSA key pairs on Device A and export the RSA host public key to a file.

·     Import the RSA host public key of Device A from the public key file to Device B.

Figure 7 Network diagram

 

Software versions used

This configuration example was created and verified on E8371 of the F5000-AI160 device.

This configuration example was created and verified on E9671 of the M9000-X06 device.

Procedures

Configuring Device A

# On the top navigation bar, click Objects.

# From the navigation pane, select Public Key Management > Local Key Pairs.

# Click Create. The Create Local Key Pair page opens.

Figure 8 Creating a local key pair

 

# Create an RSA local key pair as follows:

·     Enter key pair name devicea-rsa.

·     Select the RSA algorithm.

·     Enter key length 1800.

# Click OK.

# Select key pair devicea-rsa, and then click Export. The Export Local Key Pair page opens.

Figure 9 Exporting a local host public key

 

# Select the OpenSSH export format, export the host public key to a file named devicea-rsa, and then click OK.

# After the key is exported to file devicea-rsa, transfer the file to the peer device (Device B). (Details not shown.)

Configuring Device B

# On the top navigation bar, click Objects.

# From the navigation pane, select Public Key Management > Local Key Pairs.

# Click Import. The Import Peer Host Public Key page opens.

# Configure the peer host public key as follows:

·     Enter public key name peer-rsa.

·     Select the Import peer public key from file import method.

·     Select the path of public key file devicea-rsa.

# Click OK.

Figure 10 Importing the peer host public key from a public key file

 

Verifying the configuration

1.     Display information about the local public key on Device A.

# On the top navigation bar, click Objects.

# From the navigation pane, select Public Key Management > Local Key Pairs.

# Click the Details icon for key pair devicea-rsa to open the Key Pair Details page. The Public key field displays the content of the public key.

Figure 11 Local host public key information

 

2.     Display information about the peer public key configured on Device B.

# On the top navigation bar, click Objects.

# From the navigation pane, select Public Key Management > Peer Public Keys.

# Click the Details icon for public key peer-rsa.

Figure 12 Peer host public key imported from a public key file