Dhchap Compatibility With Fibre Channel Features; About Enabling Dhchap - Cisco Nexus 5000 Series Configuration Manual

Configuring FC-SP and DHCHAP
The terms FC-SP and DHCHAP are used interchangeably in this chapter.
Note
DHCHAP is a mandatory password-based, key-exchange authentication protocol that supports both
switch-to-switch and host-to-switch authentication. DHCHAP negotiates hash algorithms and DH groups
before performing authentication. It supports MD5 and SHA-1 algorithm-based authentication.
To configure DHCHAP authentication using the local password database, perform this task:
SUMMARY STEPS
1. Enable DHCHAP.
2. Identify and configure the DHCHAP authentication modes.
3. Configure the hash algorithm and DH group.
4. Configure the DHCHAP password for the local switch and other switches in the fabric.
5. Configure the DHCHAP timeout value for reauthentication.
6. Verify the DHCHAP configuration.
DETAILED STEPS
Step 1 Enable DHCHAP.
Step 2 Identify and configure the DHCHAP authentication modes.
Step 3 Configure the hash algorithm and DH group.
Step 4
Configure the DHCHAP password for the local switch and other switches in the fabric.
Step 5 Configure the DHCHAP timeout value for reauthentication.
Step 6 Verify the DHCHAP configuration.

DHCHAP Compatibility with Fibre Channel Features

This section identifies the impact of configuring the DHCHAP feature along with existing Cisco NX-OS
features:
• SAN port channel interfaces—If DHCHAP is enabled for ports belonging to a SAN port channel,
• Port security or fabric binding—Fabric-binding policies are enforced based on identities authenticated
• VSANs—DHCHAP authentication is not done on a per-VSAN basis.

About Enabling DHCHAP

By default, the DHCHAP feature is disabled in all switches.
OL-xxxxx-xx
DHCHAP authentication is performed at the physical interface level, not at the port channel level.
by DHCHAP.
Cisco Nexus 5000 Series NX-OS SAN Switching Configuration Guide
DHCHAP
201