topic RE: How to update ssl certificate and key remotely without using management port on summit switches in ExtremeSwitching (EXOS/Switch Engine)

How to update ssl certificate and key remotely without using management port on summit switches

steven_rhoads — Fri, 20 Mar 2015 04:01:00 GMT

How does one download ssl certificate and key from tftp server without using vr-mgmt (managment port). Is there a way to force the download to use the other virtual router? Better yet, is it possible to push the certificates and keys using ridgeline? Some switches are over seas and management port is not connected. Only access is through regular vlan ip.
Lastly, if the certificate and key have are being stored on the switch, but not being used, is it possible to import them locally?

RE: How to update ssl certificate and key remotely without using management port on summit switches

Matt_Tinonga — Fri, 20 Mar 2015 19:50:00 GMT

By default the tftp to should use the vr-default. Or you can call it in the command line. Not sure about pushing from ridgeline.

RE: How to update ssl certificate and key remotely without using management port on summit switches

steven_rhoads — Fri, 20 Mar 2015 20:47:00 GMT

Thanks for the reply, but per ExtremeXOS Concepts guide v15.2 page 80, 'If you do not specify a virtual router, VR-Mgmt is used.' This means that the 'download ssl .....' is using the VR-Mgmt. There are no command line options with the 'download' command to change the vr that I am aware of.

RE: How to update ssl certificate and key remotely without using management port on summit switches

Michael_Suggs1 — Sat, 21 Mar 2015 02:31:00 GMT

http://salfarisi25.wordpress.com/2012/06/11/securing-extreme-switch-enabling-ssh2/

this may answer your questions.

RE: How to update ssl certificate and key remotely without using management port on summit switches

steven_rhoads — Sat, 21 Mar 2015 03:30:00 GMT

Interesting read, but doesn't touch on ssl. I have ssh access to the switches, but extreme networks states that ssl certs and keys cannot be loaded to the switch except through the management vlan. How does everyone here have their racks set up so that access is through the management port remotely?

RE: How to update ssl certificate and key remotely without using management port on summit switches

Drew_C — Sat, 21 Mar 2015 03:30:00 GMT

Hi Steven,
Here's another thread where management network connectivity is discussed.
https://community.extremenetworks.com/extreme/topics/how-to-connect-the-management-port-to-the-netwo...

RE: How to update ssl certificate and key remotely without using management port on summit switches

Bill_Stritzinge — Tue, 24 Mar 2015 04:26:00 GMT

Given your scenario you could create a key and SCP2 it directly to the switch from your command line. Here is the documentation to explain: http://documentation.extremenetworks.com/exos/EXOS_All/Security/t_use-sftp-from-an-external-ssh2-cli...

As to SSL, your only option would be to create a self-signed cert as you already found out that you can only transfer them via the vr-mgmt.