Scp Configuration Example Based On Suite B Algorithms - HPE FlexNetwork 10500 Series Security Configuration Manual

SCP configuration example based on Suite B algorithms

Network requirements
As shown in
(SSH2), and it uses publickey authentication.
Configure Switch A to establish an SCP connection to Switch B based on the Suite B algorithms.
After the connection is established, you can log in to Switch B as a network-admin to transfer files.
Figure 121 Network diagram
SCP client
Vlan-int2
192.168.0.2/24
Switch A
Configuration procedure
1. Generate the client's certificates and the server's certificates. (Details not shown.)
You must first configure the certificates of the server and the client because they are required
for identity authentication between the two parties.
In this example, the server's certificate files are ssh-server-ecdsa256.p12 and
ssh-server-ecdsa384.p12. The client's certificate files are ssh-client-ecdsa256.p12 and
ssh-client-ecdsa384.p12.
2. Configure the SCP client:
NOTE:
You can modify the pkix version of the client software OpenSSH to support Suite B. This
example uses an HPE switch as an SCP client.
# Upload the server's certificate files (ssh-server-ecdsa256.p12 and
ssh-server-ecdsa384.p12) and the client's certificate files (ssh-client-ecdsa256.p12 and
ssh-client-ecdsa384.p12) to the SCP client through FTP or TFTP. (Details not shown.)
# Create a PKI domain named server256 for verifying the server's certificate ecdsa256 and
enter its view.
<SwitchA> system-view
[SwitchA] pki domain server256
# Disable CRL checking.
[SwitchA-pki-domain-server256] undo crl check enable
[SwitchA-pki-domain-server256] quit
# Import local certificate file ssh-server-ecdsa256.p12 to PKI domain server256.
[SwitchA] pki import domain server256 p12 local filename ssh-server-ecdsa256.p12
The system is going to save the key pair. You must specify a key pair name, which is
a case-insensitive string of 1 to 64 characters. Valid characters include a to z, A
to Z, 0 to 9, and hyphens (-).
Please enter the key pair name[default name: server256]:
# Display information about local certificates in PKI domain server256.
[SwitchA] display pki certificate domain server256 local
Certificate:
Data:
Figure 121, Switch A acts as an SCP client (SSH2). Switch B acts as the SCP server
Vlan-int2
192.168.0.1/24
Version: 3 (0x2)
Serial Number: 3 (0x3)
SCP server
Switch B
454