Additional Microsoft Active Directory Settings; Ldap Certificates For Fips Mode; Importing An Ldap Switch Certificate; Active Directory Keys To Modify - HP A7533A - Brocade 4Gb SAN Switch Base Administrator's Manual
Hp storageworks fabric os 6.1.1 administrator guide (5697-0235, december 2009)
Hide thumbs
Also See for A7533A - Brocade 4Gb SAN Switch Base:
- Administrator's manual (576 pages) ,
- Hardware reference manual (256 pages) ,
- User manual (248 pages)
Table of Contents
Advertisement
Additional Microsoft Active Directory settings
a. Set the following SCHANNEL settings listed in
To support FIPS compliant TLS cipher suites on Microsoft's Active Directory server, allow the
SCHANNEL settings listed in
to allow the SCHANNEL settings for the ciphers, hashes, key exchange and the TLS protocol.
Table 43
Active Directory Keys to modify
Key
Ciphers
Hashes
Key exchange
algorithm
Protocols
b. Enable FIPS algorithm policy on the Microsoft Active Directory. Visit www.microsoft.com for
instructions.
LDAP certificates for FIPS mode
To utilize the LDAP services for FIPS between the switch and the host, you must generate a CSR on the
Active Directory server, import and export the CA certificates. To support server certificate validation, it is
essential to have the CA certificate installed on the switch and Active Directory server. Issue the
secCertUtil command to import the CA certificate to the switch. This will prompt for the remote IP and
login credentials to fetch the CA certificate. The CA certificate should be in any of the standard certificate
formats: .cer, .crt or .pem.
For storing and obtaining CA certificates, follow the instructions earlier in this section. LDAP CA certificate
file names should not contain spaces while using secCertUtil for import/export of the certificate.
Importing an LDAP switch certificate
This option imports the LDAP CA certificate from the remote host to the switch.
1.
Connect to the switch and log in as admin.
2.
Issue the secCertUtil import -ldapcacert command.
Example of importing an LDAP certificate:
switch:admin> seccertutil import -ldapcacert
Select protocol [ftp or scp]: scp
Enter IP address:
Enter remote directory: /users/aUser/certs
Enter certificate name (must have ".crt" or ".cer" ".pem" suffix): LDAPTestCa.cer
Enter Login Name: aUser
Password: <hidden>
Success: imported certificate [LDAPTestCa.cer].
140 Configuring advanced security features
Table
43. See the Microsoft website for instructions that explain how
Sub-key
3DES
SHA1
PKCS
TLSv1.0
192.168.38.206
Table 43
to allow.
Advertisement
Table of Contents
