Cryptography and Encryption

crypto encrypt-data key-location <local | usb> key <password>

no crypto encrypt-data

Enables and configures system file encryption.

The no form of the command decrypts sensitive information on the system.

Syntax Description

key-location

Configures where to store the encryption key:

• local—stores the key locally

• usb—stores the key on a USB device

key

Configures a key

Default

N/A

Configuration Mode

config

History

3.6.1002

Example

Related Commands

show crypto certificate

Notes

• It is recommended to store the encryption password on a USB device rather than locally

• Enabling encryption may slightly slow system performance

• If the key is stored on the USB, it must be plugged into the switch in order for the switch to boot. After the switch has booted, the USB key is no longer required and, for security purposes, it is recommended to remove it after running “usb eject”. The USB key may be needed again if the switch is rebooted or if the switch needs to be decrypted.

crypto ipsec peer local {enable | keying {ike negotiation {ikev1 | ikev2} | [auth { hmac-sha1 | hmac-sha256 | hmac-sha512 | aes-xcbc} | dh-group | disable | encrypt { 3des-cbc| aes-cbc | aes-gcm} | exchange-mode | lifetime | local | mode | peer-identity | pfs-group | preshared-key | prompt-preshared-key | transform-set] | manual [auth | disable | encrypt | local-spi | mode | remote-spi]}}

Configures IPSec in the system.

Syntax Description

enable

Enables IPSec peering.

ike

Configures IPSec peering using IKE ISAKMP to manage SA keys. The following optional parameters are available:

• auth—configures the authentication algorithm for IPSec peering

• dh-group—configures the phase1 Diffie-Hellman group proposed for secure IKE key exchange

• disable—configures this IPSec peering administratively disabled

• encrypt—configures the encryption algorithm for IPSec peering

• exchange-mode—configures the IKE key exchange mode to propose for peering

• lifetime—configures the SA lifetime to propose for this IPSec peering

• local-identity—configures the ISAKMP payload identification value to send as local endpoint's identity

• mode—configures the peering mode for this IPSec peering

• peer-identity—configures the identification value to match against the peer's ISAKMP payload identification

• pfs-group—configures the phase2 PFS (Perfect Forwarding Secrecy) group to propose for Diffie-Hellman exchange for this IPSec peering

• preshared-key—configures the IKE pre-shared key for the IPSec peering

• prompt-preshared-key—prompts for the pre-shared key, rather than entering it on the command line

• transform-set—configures transform proposal parameters

keying

Configures key management for this IPSec peering.

• auth—configures the authentication algorithm for this IPSec peering

• disable—configures this IPSec peering administratively disabled

• encrypt—configures the encryption algorithm for this IPSec peering

• local-spi—configures the local SPI for this manual IPSec peering

• mode—configures the peering mode for this IPSec peering

• remote-spi—configures the remote SPI for this manual IPSec peering

manual

Configures IPSec peering using manual keys.

Default

N/A

Configuration Mode

config

History

3.2.3000

3.9.3100: Added support for IKEv2 and new ciphers

Example

switch (config)# crypto ipsec peer 10.10.10.10 local 10.7.34.139 enable

Related Commands

show crypto certificate

Notes

As of version 3.9.3100,

NULL will not be supported as an authentication or encryption algorithm for IPsec peering. New ciphers are supported (hmac-sha512 and aes-xcbc for authentication and aes-gcm for encryption. 1, 2, 5, 22, 23, 24 pfs/dh-groups will not be supported, while 19, 20, 21 will be supported only with IKEv2. The transform-set options ah-and-esp-ah are no longer supported. Libreswan is used instead of openswan.

crypto certificate name {<cert-name> | system-self-signed} {comment <new comment> | generate selfsigned [comment <cert-comment> | common-name <domain> | country-code <code> | days-valid <days> | ca-valid <true/false> | email-addr <address> | hash-algorithm {sha1 | sha256} | key-size-bits <bits> | locality <name> | org-unit <name> | organization <name> | serial-num <number> | state-or-prov <name>]} | private-key pem <PEM string> | prompt-private-key | public-cert [comment <comment string> | pem <PEM string>] | regenerate days-valid <days> | ca-valid <true/false> | rename <new name>}

no crypto certificate name <cert-name>

Configures default values for certificate generation.

The no form of the command clears/deletes certain certificate settings.

Syntax Description

cert-name

Unique name by which the certificate is identified.

comment

Specifies a certificate comment.

generate self-signed

Generates certificates. This option has the following parameters which may be entered sequentially in any order:

• comment—specifies a certificate comment (free string)

• common-name—specifies the common name of the issuer and subject (e.g. a domain name)

• country-code—specifies the country codwo-alphanumeric-character country code, or “--” for none)

• days-valid—specifies the number of days the certificate is valid

• email-addr— s pecifies the email address

• hash-algorithm—specifies the hashing function used for signature algorithm.

  Default value is SHA256.

• key-size-bits—specifies the size of the private key in bits (private key length in bits - at least 1024 but 2048 is strongly recommended)

• locality—specifies the locality name

• org-unit—specifies the organizational unit name

• organization—specifies the organization name

• serial-num—specifies the serial number for the certificate (a lower-case hexadecimal serial number prefixed with “0x”)

• state-or-prov—specifies the state or province name

• ca-valid—Specifies certificate CA Basic Constraints flag set to TRUE/FALSE

private-key pem

Specifies certificate contents in PEM format

prompt-private-key

Prompts for certificate private key with secure echo

public-cert

Installs a certificate

regenerate

Regenerates the named certificate using configured certificate generation default values for the specified validity period

rename

Renames the certificate

Default

N/A

Configuration Mode

config

History

3.2.3000

3.3.4402: Added “hash-algorithm” parameter

3.6.4000: Added “days-valid” parameter

3.8.2100: Added "ca-valid" parameter

Example

switch (config) # crypto certificate name system-self-signed generate self-signed hash-algorithm sha256

Related Commands

show crypto certificate

Notes

show crypto certificate [detail | public-pem | default-cert [detail | public-pem] | [name <cert-name> [detail | public-pem] | ca-list [default-ca-list]]

Displays information about all certificates in the certificate database.

Syntax Description

ca-list

Displays the list of supplemental certificates configured for the global default system CA certificate role

default-ca-list

Displays information about the currently configured default certificates of the CA list

default-cert

Displays information about the currently configured default certificate

detail

Displays all attributes related to the certificate

name

Displays information about the certificate specified

public-pem

Displays the uninterpreted public certificate as a PEM formatted data string

Default

N/A

Configuration Mode

config

History

3.2.1000

3.8.2100: Updated output

Example

switch (config) # show crypto certificate

Certificate with name 'system-self-signed' (default-cert)
    Comment:                       system-generated self-signed certificate
    Private Key:                   present
    Serial Number:                 0x546c935511bcafc21ac0e8249fbe0844
    SHA-1 Fingerprint:             fe6df38dd26801971cb2d44f62dbe492b6063c5f
    Validity:
        Starts:                    2012/12/02 13:45:05
        Expires:                   2013/12/02 13:45:05
    Subject:
        Common Name:               IBM-DEV-Bay4
        Country:                   IS
        State or Province: 
        Locality: 
        Organization: 
        Organizational Unit: 
        E-mail Address: 
    Issuer:
        Common Name:               IBM-DEV-Bay4
        Country:                   IS
        State or Province: 
        Locality: 
        Organization: 
        Organizational Unit: 
        E-mail Address: 

    X509 Extensions:
        Basic Constraints:
            CA: TRUE

Related Commands

Notes