NVIDIA MLNX-GW User Manual for NVIDIA Skyway Appliance v8.1.4000
NVIDIA MLNX-GW User Manual for NVIDIA Skyway Appliance v8.2.2200

MLNX-GW—Cryptographic (X.509, IPSec) and Encryption

This page contains commands for configuring, generating, and modifying x.509 certificates used in the system. Certificates are used for creating a trusted SSL connection to the system.

Crypto commands also cover IPSec configuration commands used for establishing a secure connection between hosts over IP layer which is useful for transferring sensitive information.

This feature encrypts all sensitive data on NVIDIA systems. To activate encryption on the gateway: systems including logs certificates, keys, etc.

  1. Enable encryption and configure key location as USB (if you are using a USB device).

    Copy
    Copied!
                

    gateway (config)# crypto encrypt-data key-location usb key mypassword   Warning! All sensitive files are about to be encrypted - System will perform reset factory, configuration files will be preserved - System will be rebooted - Active configuration will be preserved - Do not power-off, wait for the system to boot   Type 'YES' to confirm this action: YES

    Important

    Encryption and decryption perform “reset factory keep-config” on the gateway system once configured. This means that sysdumps, logs, and images are deleted.

    Warning

    The key may be saved locally as well by using the parameter “local” instead of “usb” but that configuration is less secure.

  2. After the system reboots, verify configuration.

    Copy
    Copied!
                

    gateway (config)# show crypto encrypt-data Sensitive files encryption: Status: enabled Key location: usb Cipher: aes256

    Warning

    Once encryption is enabled, reverting back to an older version while encrypted is not possible. The command “no crypto encrypt-data” must be run before attempting to downgrade to an older OS version.

    Warning

    If encryption is enabled, upgrading to a new OS version maintains the encryption configuration.

crypto encrypt-data

crypto encrypt-data key-location <local> key <password>
no crypto encrypt-data

Enables and configures system file encryption.
The no form of the command decrypts sensitive information on the system.

Syntax Description

key-location

Configures where to store the encryption key:

  • local—stores the key locally

key

Configures a key

Default

N/A

Configuration Mode

config

History

8.0.0100

Example

N/A

Related Commands

show crypto certificate

Notes

  • Enabling encryption may slightly slow system performance

crypto ipsec ike

crypto ipsec ike {clear sa [peer {any | <IPv4 address>} local <IPv4 address>] | restart}

Manages the IKE (ISAKMP) process or database state.

Syntax Description

clear

Clears IKE (ISAKMP) peering state

sa

Clears IKE generated ISAKMP and IPSec security associations (remote peers are affected)

peer

Clears security associations for the specified IKE peer (remote peers are affected).

  • all—clears security associations for all IKE peerings with a specific local address (remote peers are affected)

  • IPv4 address—clears security associations for specific IKE peering with a specific local address (remote peers are affected)

IPv4 address

Clears security associations for the specified IKE peering (remote peer is affected).

local

Clear security associations for the specified/all IKE peering (remote peer is affected).

restart

Restarts the IKE (ISAKMP) daemon (clears all IKE state, peers may be affected).

Default

N/A

Configuration Mode

config

History

8.0.0100

Example

gateway (config)# crypto ipsec ike restart

Related Commands

show crypto certificate

Notes

crypto ipsec peer local

crypto ipsec peer <IPv4 address> local <IPv4 address> {enable | keying {ike [auth {hmac-md5 | hmac-sha1 | hmac-sha256 | null} | dh-group | disable | encrypt | exchange-mode | lifetime | local | mode | peer-identity | pfs-group | preshared-key | prompt-preshared-key | transform-set] | manual [auth | disable | encrypt | local-spi | mode | remote-spi]}}

Configures IPSec in the system.

Syntax Description

enable

Enables IPSec peering.

ike

Configures IPSec peering using IKE ISAKMP to manage SA keys. The following optional parameters are available:

  • auth—configures the authentication algorithm for IPSec peering

  • dh-group—configures the phase1 Diffie-Hellman group proposed for secure IKE key exchange

  • disable—configures this IPSec peering administratively disabled

  • encrypt—configures the encryption algorithm for IPSec peering

  • exchange-mode—configures the IKE key exchange mode to propose for peering

  • lifetime—configures the SA lifetime to propose for this IPSec peering

  • local-identity—configures the ISAKMP payload identification value to send as local endpoint's identity

  • mode—configures the peering mode for this IPSec peering

  • peer-identity—configures the identification value to match against the peer's ISAKMP payload identification

  • pfs-group—configures the phase2 PFS (Perfect Forwarding Secrecy) group to propose for Diffie-Hellman exchange for this IPSec peering

  • preshared-key—configures the IKE pre-shared key for the IPSec peering

  • prompt-preshared-key—prompts for the pre-shared key, rather than entering it on the command line

  • transform-set—configures transform proposal parameters

keying

Configures key management for this IPSec peering.

  • auth—configures the authentication algorithm for this IPSec peering

  • disable—configures this IPSec peering administratively disabled

  • encrypt—configures the encryption algorithm for this IPSec peering

  • local-spi—configures the local SPI for this manual IPSec peering

  • mode—configures the peering mode for this IPSec peering

  • remote-spi—configures the remote SPI for this manual IPSec peering

manual

Configures IPSec peering using manual keys.

Default

N/A

Configuration Mode

config

History

8.0.0100

Example

gateway (config)# crypto ipsec peer 10.10.10.10 local 10.7.34.139 enable

Related Commands

show crypto certificate

Notes

crypto certificate ca-list

crypto certificate ca-list [default-ca-list name {<cert-name> | system-self-signed}]
no crypto certificate ca-list [default-ca-list name {<cert-name> | system-self-signed}]

Adds the specified CA certificate to the default CA certificate list.
The no form of the command removes the certificate from the default CA certificate list.

Syntax Description

cert-name

The name of the certificate.

Default

N/A

Configuration Mode

config

History

8.0.0100

Example

gateway (config) # crypto certificate default-cert name test

Related Commands

show crypto certificate

Notes

  • Two certificates with the same subject and issuer fields cannot both be placed onto the CA list

  • The no form of the command does not delete the certificate from the certificate database

  • Unless specified otherwise, applications that use CA certificates will still consult the well-known certificate bundle before looking at the default-ca-list

crypto certificate default-cert

crypto certificate default-cert name {<cert-name> | system-self-signed}
no crypto certificate default-cert name {<cert-name> | system-self-signed}

Designates the named certificate as the global default certificate role for authentication of this system to clients.
The no form of the command reverts the default-cert name to “system-self-signed” (the “cert-name” value is optional and ignored).

Syntax Description

cert-name

The name of the certificate.

Default

N/A

Configuration Mode

config

History

8.0.0100

Example

gateway (config) # crypto certificate default-cert name test

Related Commands

show crypto certificate

Notes

  • A certificate must already be defined before it can be configured in the default-cert role

  • If the named default-cert is deleted from the database, the default-cert automatically becomes reconfigured to the factory default, the “system-self-signed” certificate

crypto certificate generation

crypto certificate generation default {country-code | days-valid > | ca-valid <true/false> | email-addr | hash-algorithm {sha1 | sha256} | key-size-bits | locality | org-unit | organization | state-or-prov}

Configures default values for certificate generation.

Syntax Description

country-code

Configures the default certificate value for country code with a two-alphanumeric-character code or -- for none.

days-valid

Configures the default certificate valid days.
Default value: 365 days

email-addr

Configures the default certificate value for email address.

hash-algorithm {sha1 | sha256}

Configures the default certificate hashing algorithm.

key-size-bits

Configures the default certificate value for private key size (private key length in bits—at least 1024, but 2048 is strongly recommended).

locality

Configures the default certificate value for locality.

org-unit

Configures the default certificate value for organizational unit.

organization

Configures the default certificate value for the organization name.

state-or-prov

Configures the default certificate value for state or province.

ca-valid {true | false}

Configures the default certificate CA Basic Constraints flag set to TRUE/FALSE.

Default

hash-algorithm – sha1

Configuration Mode

config

History

8.0.0100

Example

gateway (config) # crypto certificate generation default hash-algorithm sha256

Related Commands

show crypto certificate

Notes

crypto certificate name

crypto certificate name {<cert-name> | system-self-signed} {comment <new comment> | generate selfsigned [comment <cert-comment> | common-name <domain> | country-code <code> | days-valid <days> | ca-valid <true/false> | email-addr <address> | hash-algorithm {sha1 | sha256} | key-size-bits <bits> | locality <name> | org-unit <name> | organization <name> | serial-num <number> | state-or-prov <name>]} | private-key pem <PEM string> | prompt-private-key | public-cert [comment <comment string> | pem <PEM string>] | regenerate days-valid <days> | ca-valid <true/false> | rename <new name>}

no crypto certificate name <cert-name>

Configures default values for certificate generation.
The no form of the command clears/deletes certain certificate settings.

Syntax Description

cert-name

Unique name by which the certificate is identified.

comment

Specifies a certificate comment.

generate self-signed

Generates certificates. This option has the following parameters which may be entered sequentially in any order:

  • comment—specifies a certificate comment (free string)

  • common-name—specifies the common name of the issuer and subject (e.g. a domain name)

  • country-code—specifies the country codwo-alphanumeric-character country code, or “--” for none)

  • days-valid—specifies the number of days the certificate is valid

  • email-addr— specifies the email address

  • hash-algorithm—specifies the hashing function used for signature algorithm.
    Default value is SHA256.

  • key-size-bits—specifies the size of the private key in bits (private key length in bits - at least 1024 but 2048 is strongly recommended)

  • locality—specifies the locality name

  • org-unit—specifies the organizational unit name

  • organization—specifies the organization name

  • serial-num—specifies the serial number for the certificate (a lower-case hexadecimal serial number prefixed with “0x”)

  • state-or-prov—specifies the state or province name

  • ca-valid—Specifies certificate CA Basic Constraints flag set to TRUE/FALSE

private-key pem

Specifies certificate contents in PEM format.

prompt-private-key

Prompts for certificate private key with secure echo.

public-cert

Installs a certificate.

regenerate

Regenerates the named certificate using configured certificate generation default values for the specified validity period.

rename

Renames the certificate

Default

N/A

Configuration Mode

config

History

8.0.0100

Example

gateway (config) # crypto certificate name system-self-signed generate self-signed hash-algorithm sha256

Related Commands

show crypto certificate

Notes

crypto certificate system-self-signed

crypto certificate system-self-signed regenerate {[days-valid <days>] | ca-valid <true/false>}

Configures default values for certificate generation.

Syntax Description

days-valid

Specifies the number of days the certificate is valid.

ca-valid

Specifies certificate CA Basic Constraints flag set to TRUE/FALSE.

Default

N/A

Configuration Mode

config

History

8.0.0100

Example

gateway (config) # crypto certificate system-self-signed regenerate days-valid 3
gateway (config) # crypto certificate system-self-signed regenerate ca-valid false

Related Commands

show crypto certificate

Notes

show crypto certificate

show crypto certificate [detail | public-pem | default-cert [detail | public-pem] | [name <cert-name> [detail | public-pem] | ca-list [default-ca-list]]

Displays information about all certificates in the certificate database.

Syntax Description

ca-list

Displays the list of supplemental certificates configured for the global default system CA certificate role.

default-ca-list

Displays information about the currently configured default certificates of the CA list

default-cert

Displays information about the currently configured default certificate.

detail

Displays all attributes related to the certificate.

name

Displays information about the certificate specified.

public-pem

Displays the uninterpreted public certificate as a PEM formatted data string.

Default

N/A

Configuration Mode

config

History

8.0.0100

Example

gateway (config) # show crypto certificate

Certificate with name 'system-self-signed' (default-cert)
Comment: system-generated self-signed certificate
Private Key: present
Serial Number: 0x546c935511bcafc21ac0e8249fbe0844
SHA-1 Fingerprint: fe6df38dd26801971cb2d44f62dbe492b6063c5f

Validity:
Starts: 2012/12/02 13:45:05
Expires: 2013/12/02 13:45:05

Subject:
Common Name: IBM-DEV-Bay4
Country: IS
State or Province:
Locality:
Organization:
Organizational Unit:
E-mail Address:

Issuer:
Common Name: IBM-DEV-Bay4
Country: IS
State or Province:
Locality:
Organization:
Organizational Unit:
E-mail Address:

    X509 Extensions:
Basic Constraints:
CA: TRUE

Related Commands

Notes

show crypto encrypt-data

show encrypt-data

Displays sensitive data encryption information.

Syntax Description

N/A

Default

N/A

Configuration Mode

config

History

8.0.0100

Example

gateway (config)# show crypto encrypt-data
Sensitive files encryption:
Status: enabled
Key location: usb
Cipher: aes256

Related Commands

Notes

show crypto ipsec

show crypto ipsec [brief | configured | ike | policy | sa]

Displays information ipsec configuration.

Syntax Description

N/A

Default

N/A

Configuration Mode

config

History

8.0.0100

Example

gateway (config)# show crypto ipsec
IPSec Summary
-------------
Crypto IKE is using pluto (Openswan) daemon.
Daemon process state is stopped.

No IPSec peers configured.

IPSec IKE Peering State
-----------------------
Crypto IKE is using pluto (Openswan) daemon.
Daemon process state is stopped.

No active IPSec IKE peers.

IPSec Policy State
------------------
No active IPSec policies.

IPSec Security Association State
--------------------------------
No active IPSec security associations.

Related Commands

Notes

© Copyright 2023, NVIDIA. Last updated on May 23, 2023.