HPE FlexNetwork 5510 HI Series Security Configuration Guide

381
[SwitchB] ssh2 algorithm public-key x509v3-ecdsa-sha2-nistp384
# Specify server384 as the PKI domain of the server's certificate.
[SwitchB] ssh server pki-domain server384
# Enable the SFTP server.
[SwitchB] sftp server enable
# Assign an IP address to VLAN-interface 2.
[SwitchB] interface vlan-interface 2
[SwitchB-Vlan-interface2] ip address 192.168.0.1 255.255.255.0
[SwitchB-Vlan-interface2] quit
# Set the authentication mode to AAA for user lines.
[SwitchB] line vty 0 63
[SwitchB-line-vty0-63] authentication-mode scheme
[SwitchB-line-vty0-63] quit
# Create a local device management user named client001. Authorize the user to use the SSH
service and assign the network-admin user role to the user.
[SwitchB] local-user client001 class manage
[SwitchB-luser-manage-client001] service-type ssh
[SwitchB-luser-manage-client001] authorization-attribute user-role network-admin
[SwitchB-luser-manage-client001] quit
# Create an SSH user named client001. Specify the authentication method publickey for the
user and specify client384 as the PKI domain for verifying the client's certificate.
[Switch] ssh user client001 service-type sftp authentication-type publickey assign
pki-domain client384
4. Establish an SFTP connection to SFTP server 192.168.0.1 based on the 192-bit Suite B
algorithms.
<SwitchA> sftp 192.168.0.1 suite-b 192-bit pki-domain client384 server-pki-domain
server384
Username: client001
Press CTRL+C to abort.
Connecting to 192.168.0.1 port 22.
sftp>
SCP configuration examples
Devices in the configuration examples are in non-FIPS mode.
When you configure SCP on a device that operates in FIPS mode, follow these restrictions and
guidelines:
• The modulus length of RSA key pairs must be 2048 bits.
• When the device acts as an SCP server, only ECDSA and RSA key pairs are supported. If both
ECDSA and RSA key pairs exist on the server, the server uses the ECDSA key pair.
SCP file transfer with password authentication
Network requirements
As shown in Figure 111:
• You can log in to Switch B through the SCP client that runs on Switch A.

HPE FlexNetwork 5510 HI Series Specifications

General

Brand	HPE
Model	FlexNetwork 5510 HI Series
Category	Switch
Language	English