iv

macAddressElseUserLoginSecure configuration example ··············································································· 159

Troubleshooting port security ······································································································································ 162

Cannot set the port security mode ····················································································································· 162

Cannot configure secure MAC addresses ········································································································ 163

Configuring password control ································································································································ 164

Overview ······································································································································································· 164

Password setting ·················································································································································· 164

Password updating and expiration ··················································································································· 165

User login control ················································································································································ 166

Password not displayed in any form ················································································································· 166

Logging ································································································································································· 167

FIPS compliance ··························································································································································· 167

Password control configuration task list ····················································································································· 167

Enabling password control ········································································································································· 167

Setting global password control parameters ············································································································ 168

Setting user group password control parameters ····································································································· 169

Setting local user password control parameters ······································································································· 170

Setting super password control parameters ·············································································································· 171

Displaying and maintaining password control ········································································································· 171

Password control configuration example ·················································································································· 172

Network requirements ········································································································································· 172

Configuration procedure ···································································································································· 172

Verifying the configuration ································································································································· 173

Managing public keys ············································································································································ 175

Overview ······································································································································································· 175

FIPS compliance ··························································································································································· 175

Creating a local key pair ············································································································································ 176

Configuration guidelines ···································································································································· 176

Configuration procedure ···································································································································· 177

Distributing a local host public key ···························································································································· 177

Exporting a host public key to a file ·················································································································· 177

Exporting a host public key and saving it to a file ·························································································· 178

Displaying a host public key ······························································································································ 178

Destroying a local key pair ········································································································································· 179

Configuring a peer host public key ···························································································································· 179

Importing a peer host public key from a public key file ·················································································· 180

Entering a peer host public key ························································································································· 180

Displaying and maintaining public keys ··················································································································· 180

Examples of public key management ························································································································ 180

Example for entering a peer host public key ···································································································· 180

Example for importing a public key from a public key file ············································································· 182

Configuring PKI ······················································································································································· 185

Overview ······································································································································································· 185

PKI terminology ···················································································································································· 185

PKI architecture ···················································································································································· 186

PKI operation ······················································································································································· 186

PKI applications ··················································································································································· 187

Support for MPLS L3VPN ···································································································································· 187

FIPS compliance ··························································································································································· 188

PKI configuration task list ············································································································································ 188

Configuring a PKI entity ·············································································································································· 188

Configuring a PKI domain ··········································································································································· 189

Requesting a certificate ··············································································································································· 192