HPE FlexNetwork 5510 HI Series Security Configuration Manual page 391

Configure Switch A to establish an SFTP connection to Switch B based on the 192-bit Suite B
algorithms. After the connection is established, you can log in to Switch B from Switch A to manage
and transfer files as an administrator.
Figure 110 Network diagram
SFTP client
Vlan-int2
192.168.0.2/24
Switch A
Configuration procedure
1. Generate the client's certificate and the server's certificate. (Details not shown.)
You must first configure the certificates of the server and the client because they are required
for identity authentication between the two parties.
In this example, the server's certificate file is ssh-server-ecdsa384.p12 and the client's
certificate file is ssh-client-ecdsa384.p12.
2. Configure the SFTP client:
NOTE:
You can modify the pkix version of the client software OpenSSH to support Suite B. This example
uses an HPE switch as an SFTP client.
# Upload the server's certificate file ssh-server-ecdsa384.p12 and the client's certificate file
ssh-client-ecdsa384.p12 to the SFTP client through FTP or TFTP. (Details not shown.)
# Create a PKI domain named server384 for verifying the server's certificate and enter its view.
<SwitchA> system-view
[SwitchA] pki domain server384
# Disable CRL checking.
[SwitchA-pki-domain-server384] undo crl check enable
[SwitchA-pki-domain-server384] quit
# Import the local certificate file ssh-server-ecdsa384.p12 to PKI domain server384.
[SwitchA] pki import domain server384 p12 local filename ssh-server-ecdsa384.p12
The system is going to save the key pair. You must specify a key pair name, which is
a case-insensitive string of 1 to 64 characters. Valid characters include a to z, A
to Z, 0 to 9, and hyphens (-).
Please enter the key pair name[default name: server384]:
# Display information about local certificates in PKI domain server384.
[SwitchA] display pki certificate domain server384 local
Certificate:
Data:
Signature Algorithm: ecdsa-with-SHA384
Vlan-int2
192.168.0.1/24
Version: 3 (0x2)
Serial Number: 1 (0x1)
Issuer: C=CN, ST=BJ, L=BJ, O=AA, OU=Software, CN=SuiteB CA
Validity
Not Before: Aug 20 10:08:41 2015 GMT
Not After : Aug 19 10:08:41 2016 GMT
Subject: C=CN, ST=BJ, O=AA, OU=Software, CN=ssh server
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
SFTP server
Switch B
378