Re-Authenticating Ports; Managing Secret Key Pairs - HP A7533A - Brocade 4Gb SAN Switch Base Administrator's Manual

2. On a switch running Fabric OS 4.x or 5.x, type authUtil --set -a dhchap; on a switch running
Fabric OS 3.x, type authUtil "
Output similar to the following is displayed:
Authentication is set to dhchap.
When using DH-CHAP, make sure that you configure the switches at both ends of a link.
NOTE: If you set the authentication protocol to DH-CHAP, have not yet configured shared secrets, and
authentication is checked (for example, you enable the switch), switch authentication fails.

Re-authenticating ports

Use the command authutil to re-initiate the authentication on selected ports. It provides flexibility to
initiate authentication for specified E_Ports, set of E_Ports, and all E_Ports on the switch. This command will
not work on Private, Loop, NPIV and FICON devices. The command authutil can re-initiate
authentication only if the device was previously authenticated. If the authentication fails because shared
secrets do not match, the port is disabled.
This command works independently of the authentication policy; this means you can initiate the
authentication even if the switch is in PASSIVE mode. This command is used to restart authentication after
changing the DH-CHAP group, hash type, and shared secret between a pair of switches.
WARNING! This command may bring down the E_Port(s) if the DH-CHAP shared secrets are not installed
correctly.
To re-authenticate E_Ports:
1. Log in to the switch using an account assigned to the admin role.
2. On a switch running Fabric OS 5.3.0 and later, type the following command:
$authutil –-authinit
Example
$authutil –-authinit
Example
$authutil –-authinit
For directors, use the slot/port format for specifying the port number.
Example
$authutil –-authinit

Managing secret key pairs

When you configure the switches at both ends of a link to use DH-CHAP for authentication, you must also
define a secret key pair—one for each end of the link. Use the secAuthSecret command to perform the
following tasks:
• View the WWN of switches with a secret key pair
• Set the secret key pair for switches
• Remove the secret key pair for one or more switches
Note the following characteristics of a secret key pair:
• The secret key pair must be set up locally on every switch. The secret key pair are not distributed
fabric-wide.
• If a secret key pair are not set up for a link, authentication fails. The "Authentication Failed" (reason
code 05h) error will be reported and logged.
• The minimum length of a shared secret is 8 bytes and the maximum length is 40 bytes.
120 Configuring advanced security features
set -a dhchap".
--
<slot/port_number(s)|allE>
2,3,4
allE (all E_ports in the switch)
1/1, 1/2