Dell EMC SmartFabric OS10 User Guide Release 10.5.0

System logging over TLS

Confguration notes

Configure system logging over TLS

1. Copy an X.509v3 certificate created by a CA server using a secure method, such as SCP or HTTPS, as described in Manage CA certificates. Then install the trusted CA certificate in EXEC mode.

   crypto ca-cert install ca-cert-filepath [filename]

   • ca-cert-filepath specifies the local path to the downloaded certificate; for example, home://CAcert.pem or usb://CA-cert.pem.
   • filename specifies an optional filename that the certificate is stored under in the OS10 trust-store directory. Enter the filename in the filename.crt format.
2. Obtain an X.509v3 host certificate from the CA server as described in Request and install host certificates:
   1. Create a private key and generate a certificate signing request for the switch.
   2. Copy the CSR file to the CA server for signing.
   3. Copy the CA-signed certificate to the home directory on the switch.
   4. Install the host certificate:

      crypto cert install cert-file home://cert-filepath key-file {key-path | private} 
      [password passphrase] [fips]

   When you install an X.509v3 certificate-key pair:

   • Both take the name of the certificate. For example, if you install a certificate using:

     OS10# crypto cert install cert-file home://Dell_host1.pem key-file home://abcd.key

     The certificate-key pair is installed as Dell_host1.pem and Dell_host1.key. In configuration commands, refer to the pair as Dell_host1. When you configure a security profile, you would enter Dell_host1 in the certificate certificate-name command.
   • For security reasons, because the key file contains private key information, it copied to a secure location in the OS10 file system and deleted from its original location specified in the key-file key-path parameter.
   NOTE fips installs the certificate-key pair as FIPS-compliant. Enter fips to install a certificate-key pair that is used by a FIPS-aware application, such as Syslog over TLS. If you do not enter fips, the certificate-key pair is stored as a non-FIPS-compliant pair.

   You determine if the certificate-key pair is generated as FIPS-compliant. Do not use FIPS-compliant certificate-key pairs outside of FIPS mode. When FIPS mode is enabled, you can still generate CSRs for non-FIPS certificates for use with non-FIPS applications. Be sure to install these certificates as non-FIPS with the crypto cert install command.

3. Configure a security profile for system logging over TLS using an X.509v3 certificate.
   1. Create a Syslog security profile in CONFIGURATION mode. See Security profiles for more information.

      crypto security-profile profile-name

   2. Assign an X.509v3 certificate and private key pair to the security profile in SECURITY-PROFILE mode. For certificate-name, enter the name of the certificate-key pair as it appears in the show crypto certs output without the .pem extension.

      certificate certificate-name 
      exit

   3. Create a system logging-specific profile in CONFIGURATION mode.

      logging security-profile profile-name

      Where profile-name is the name of the Syslog security profile created in Step 2a with the crypto security-profile profile-name command. You cannot delete a crypto server profile if it is configured for a logging server.

   If you reconfigure crypto security profile-name, configured Syslog TLS servers are automatically updated to use the new certificate-key pair used by the new profile.

   If you reconfigure the certificate assigned to a crypto security profile, Syslog TLS servers are automatically updated to use new certificate-key pair.

   If you delete a certificate from a configured crypto security profile, system logging over TLS fails. A host certificate is required for the protocol exchange with an external device.

4. Configure a remote TLS server to receive system messages in CONFIGURATION mode.

   logging server {ipv4–address | ipv6–address} tls [port-number] 
   [severity severity-level] [vrf {management | vrf-name]

Example: Configure Syslog over TLS

OS10# copy tftp://CAadmin:secret@172.11.222.1/cacert.pem home://cacert.pem

OS10# crypto ca-cert install home://cacert.pem
Processing certificate ...
Installed Root CA certificate
CommonName = Certificate Authority CA
IssuerName = Certificate Authority CA

OS10# show crypto ca-certs 
--------------------------------------
| Locally installed certificates     |
--------------------------------------
cacert.crt

OS10# crypto cert generate request cert-file home://clientreq.pem key-file home://clientkey.pem cname "Top of Rack 6" altname "IP:10.0.0.6 DNS:tor6.dell.com" email admin@dell.com organization "Dell EMC" orgunit Networking locality "Santa Clara" state California country US length 2048
Processing certificate ...
Successfully created CSR file /home/admin/clientreq.pem and key

OS10# copy home://clientreq.pem scp://CAadmin:secret@172.11.222.1/clientreq.pem

OS10# copy scp://CAadmin:secret@172.11.222.1/clientcert.pem home://clientcert.pem 
OS10# copy scp://CAadmin:secret@172.11.222.1/clientkey.pem home://clientkey.pem 

OS10# crypto cert install cert-file home://clientcert.pem key-file home://clientkey.pem
Processing certificate ...
Certificate and keys were successfully installed as "clientcert.crt" that may be used in a security profile. CN = 10.0.0.6

OS10# show crypto cert 
--------------------------------------
|  Installed non-FIPS certificates   |
--------------------------------------
clientcert.crt
--------------------------------------
| Installed FIPS certificates        |
--------------------------------------

OS10(config)# crypto security-profile dellprofile
OS10(config-sec-profile)# certificate clientcert
OS10(config-sec-profile)# exit
OS10(config)# logging security-profile dellprofile
OS10(config)# logging server 10.11.86.139 tls
OS10(config)# do show running-configuration logging 
!
logging security-profile dellprofile
logging server 10.11.86.139 tls 514