MLNX-GW—Cryptographic (X.509, IPSec) and Encryption

crypto encrypt-data key-location <local> key <password>
no crypto encrypt-data

Enables and configures system file encryption.
The no form of the command decrypts sensitive information on the system.

Syntax Description

key-location

Configures where to store the encryption key:

• local—stores the key locally

key

Configures a key

Default

N/A

Configuration Mode

config

History

8.0.0100

Example

N/A

Related Commands

show crypto certificate

Notes

• Enabling encryption may slightly slow system performance

crypto ipsec peer <IPv4 address> local <IPv4 address> {enable | keying {ike [auth {hmac-md5 | hmac-sha1 | hmac-sha256 | null} | dh-group | disable | encrypt | exchange-mode | lifetime | local | mode | peer-identity | pfs-group | preshared-key | prompt-preshared-key | transform-set] | manual [auth | disable | encrypt | local-spi | mode | remote-spi]}}

Configures IPSec in the system.

Syntax Description

enable

Enables IPSec peering.

ike

Configures IPSec peering using IKE ISAKMP to manage SA keys. The following optional parameters are available:

• auth—configures the authentication algorithm for IPSec peering

• dh-group—configures the phase1 Diffie-Hellman group proposed for secure IKE key exchange

• disable—configures this IPSec peering administratively disabled

• encrypt—configures the encryption algorithm for IPSec peering

• exchange-mode—configures the IKE key exchange mode to propose for peering

• lifetime—configures the SA lifetime to propose for this IPSec peering

• local-identity—configures the ISAKMP payload identification value to send as local endpoint's identity

• mode—configures the peering mode for this IPSec peering

• peer-identity—configures the identification value to match against the peer's ISAKMP payload identification

• pfs-group—configures the phase2 PFS (Perfect Forwarding Secrecy) group to propose for Diffie-Hellman exchange for this IPSec peering

• preshared-key—configures the IKE pre-shared key for the IPSec peering

• prompt-preshared-key—prompts for the pre-shared key, rather than entering it on the command line

• transform-set—configures transform proposal parameters

keying

Configures key management for this IPSec peering.

• auth—configures the authentication algorithm for this IPSec peering

• disable—configures this IPSec peering administratively disabled

• encrypt—configures the encryption algorithm for this IPSec peering

• local-spi—configures the local SPI for this manual IPSec peering

• mode—configures the peering mode for this IPSec peering

• remote-spi—configures the remote SPI for this manual IPSec peering

manual

Configures IPSec peering using manual keys.

Default

N/A

Configuration Mode

config

History

8.0.0100

Example

gateway (config)# crypto ipsec peer 10.10.10.10 local 10.7.34.139 enable

Related Commands

show crypto certificate

Notes

crypto certificate name {<cert-name> | system-self-signed} {comment <new comment> | generate selfsigned [comment <cert-comment> | common-name <domain> | country-code <code> | days-valid <days> | ca-valid <true/false> | email-addr <address> | hash-algorithm {sha1 | sha256} | key-size-bits <bits> | locality <name> | org-unit <name> | organization <name> | serial-num <number> | state-or-prov <name>]} | private-key pem <PEM string> | prompt-private-key | public-cert [comment <comment string> | pem <PEM string>] | regenerate days-valid <days> | ca-valid <true/false> | rename <new name>}

no crypto certificate name <cert-name>

Configures default values for certificate generation.
The no form of the command clears/deletes certain certificate settings.

Syntax Description

cert-name

Unique name by which the certificate is identified.

comment

Specifies a certificate comment.

generate self-signed

Generates certificates. This option has the following parameters which may be entered sequentially in any order:

• comment—specifies a certificate comment (free string)

• common-name—specifies the common name of the issuer and subject (e.g. a domain name)

• country-code—specifies the country codwo-alphanumeric-character country code, or “--” for none)

• days-valid—specifies the number of days the certificate is valid

• email-addr— specifies the email address

• hash-algorithm—specifies the hashing function used for signature algorithm.
  Default value is SHA256.

• key-size-bits—specifies the size of the private key in bits (private key length in bits - at least 1024 but 2048 is strongly recommended)

• locality—specifies the locality name

• org-unit—specifies the organizational unit name

• organization—specifies the organization name

• serial-num—specifies the serial number for the certificate (a lower-case hexadecimal serial number prefixed with “0x”)

• state-or-prov—specifies the state or province name

• ca-valid—Specifies certificate CA Basic Constraints flag set to TRUE/FALSE

private-key pem

Specifies certificate contents in PEM format.

prompt-private-key

Prompts for certificate private key with secure echo.

public-cert

Installs a certificate.

regenerate

Regenerates the named certificate using configured certificate generation default values for the specified validity period.

rename

Renames the certificate

Default

N/A

Configuration Mode

config

History

8.0.0100

Example

gateway (config) # crypto certificate name system-self-signed generate self-signed hash-algorithm sha256

Related Commands

show crypto certificate

Notes

show crypto certificate [detail | public-pem | default-cert [detail | public-pem] | [name <cert-name> [detail | public-pem] | ca-list [default-ca-list]]

Displays information about all certificates in the certificate database.

Syntax Description

ca-list

Displays the list of supplemental certificates configured for the global default system CA certificate role.

default-ca-list

Displays information about the currently configured default certificates of the CA list

default-cert

Displays information about the currently configured default certificate.

detail

Displays all attributes related to the certificate.

name

Displays information about the certificate specified.

public-pem

Displays the uninterpreted public certificate as a PEM formatted data string.

Default

N/A

Configuration Mode

config

History

8.0.0100

Example

gateway (config) # show crypto certificate

Certificate with name 'system-self-signed' (default-cert)
    Comment:                       system-generated self-signed certificate
    Private Key:                   present
    Serial Number:                 0x546c935511bcafc21ac0e8249fbe0844
    SHA-1 Fingerprint:             fe6df38dd26801971cb2d44f62dbe492b6063c5f
    Validity:
        Starts:                    2012/12/02 13:45:05
        Expires:                   2013/12/02 13:45:05
    Subject:
        Common Name:               IBM-DEV-Bay4
        Country:                   IS
        State or Province: 
        Locality: 
        Organization: 
        Organizational Unit: 
        E-mail Address: 
    Issuer:
        Common Name:               IBM-DEV-Bay4
        Country:                   IS
        State or Province: 
        Locality: 
        Organization: 
        Organizational Unit: 
        E-mail Address: 

    X509 Extensions:
        Basic Constraints:
            CA: TRUE

Related Commands

Notes