This article provides the steps necessary to restrict management access to HTTPS and SSH on PowerConnect 7000.
This procedure assumes:
- The switch is already configured with an IP address and is reachable within the network.
- There is an account created with Privilege Level 15. To verify this, use the command:
show users accounts
For newer N-Series switches and additional management options, see
How to set up management access for Dell Networking N2000, N3000, and N4000 Series Switches.
- Connect to the switch by the console, telnet, or ssh.
- The 7000 series requires a Privileged Exec (Enable) mode password for remote management over ssh or telnet. Failure to set this password may result in severely limited CLI management ability. Add an enable password:
console> enable
console# config
console(config)# enable password MYPASSWORD
- To enable SSH, enter the following commands:
console(config)# crypto key generate rsa
console(config)# crypto key generate dsa
console(config)# ip ssh server
If issues arise with specific commands, ensure you are running the latest firmware version.
Caution: Before disabling either telnet or HTTP access, verify SSH or HTTPS access.
- To disable telnet, run:
console(config)# ip telnet server disable
- To enable HTTPS, enter the following commands:
console(config)# crypto certificate 1 generate
console(config-crypto-cert)# key-generate <512-2048>
console(config-crypto-cert)# exit
console(config)# ip http secure-certificate <1 - 2> Instance of the certificate to be activated.
console(config)# ip http secure-server
This system can generate and store two certificates. To generate the second key, replace the number 1 with 2. To activate the second key, use:
(config)# ip http secure-certificate 2
- To disable HTTP, enter:
console(config)# no ip http server
- After verifying connectivity using SSH or HTTPS, save the configuration by entering:
console# copy running-config startup-config
Note: After completing these steps, expect to receive errors about certificate authenticity. These are due to the certificates and keys being self-generated. This is not an error.