Generating An Ikev2 Digital Certificate; Enabling Ikev2 Preshared Key Authentication - IBM RackSwitch G8000 Application Manual

Generating an IKEv2 Digital Certificate

Enabling IKEv2 Preshared Key Authentication

206
RackSwitch G8000: Application Guide
To create an IKEv2 digital certificate for authentication:
1. Create an HTTPS certificate defining the information you want to be used in the
various fields.
RS G8000(config)# access https generate-certificate
Country Name (2 letter code) []:
State or Province Name (full name) []:
Locality Name (eg, city) []:
Organization Name (eg, company) []:
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:
Email (eg, email address) []:
Confirm generat'eywing certificate? [y/n]: y
Generating certificate. Please wait (approx 30 seconds)
restarting SSL agent
2. Save the HTTPS certificate.
The certificate is valid only until the switch is rebooted. To save the certificate so
that it is retained beyond reboot or power cycles, use the following command:
RS G8000(config)# access https save-certificate
3. Enable IKEv2 RSA-signature authentication:
RS G8000(config)# access https enable
To set up IKEv2 preshared key authentication:
1. Enter the local preshared key.
RS G8000(config)# ikev2 preshare-key local <preshared key, a string of 1-256 chars>
2. If asymmetric authentication is supported, enter the remote key:
RS G8000(config)# ikev2 preshare-key remote
host
>
where the following parameters are used:
– preshared keyA string of 1-256 characters
– IPv6 hostAn IPv6-format host, such as "3000::1"
3. Set up the IKEv2 identification type by entering one of the following commands:
RS G8000(config)# ikev2 identity local address (use an IPv6 address)
RS G8000(config)# ikev2 identity local email <email address>
RS G8000(config)# ikev2 identity local fqdn
To disable IKEv2 RSA-signature authentication method and enable preshared key
authentication, enter:
RS G8000(config)# access https disable
<country code>
<state>
<city>
<company>
<org. unit>
<name>
<email address>
preshared key> <IPv6
<
domain name
< >