Use the commands in this section to import the host key or keys from one node of a Central Management System cluster into the global host-keys database of the other node, and then repeat the process on the other node. This procedure is required for global host-key authentication, in which the connection will be allowed only if the host key one node sends is already in the global host-keys database of the other node.
You must import a host key for the default HA interface. Trellix recommends that you also import the host key for the backup HA interface, if one is configured. The host-key strings will be identical for each interface, except for the IP address.
Caution
If you choose to use global host-key authentication, you must explicitly enable it in addition to importing the host key. For details, see Enabling strict and global host-key checking using the CLI.
Note
Before you perform this procedure, you must obtain the global host key from each node. For details, see Obtaining a host key using the CLI and Obtaining a host key for the primary node using the Web UI .
Log in to the CLI of one node.
Enable the CLI configuration mode:
node-hostname > enable node-hostname # configure terminal
Stop the cluster engine:
node-hostname (config) # ha engine stopImport each key you obtained from the other node into the global host-keys database:
node-hostname (config) # ssh client global known-host "<other node key string>"
Important
The key must start with the IP address, and it must be enclosed in double quotation marks.
Verify your change:
node-hostname (config) # show ssh clientSave your change:
node-hostname (config) # write memoryReboot the node:
node-hostname (config) # reloadRepeat these steps on the other node.
Examples
This example imports the host keys from node2 into the global host-key database of node1. In this example, the cluster is in a dual-interface deployment, so host keys are imported for the default HA interface and the backup HA interface. Relevant information is highlighted for illustration.
node1 (config) # ha engine stop node1 (config) # ssh client global known-host "10.0.0.2 ssh-rsa AAAAB3NAfgbzY ulDSIxOKZTh2VBnKsy0qRWrCps64Itlh6iRlr7JxazaC1yc2EAAAADAQABAAABAQCzd5JwKtk5BjH Le/jxkF0JzWcXOTw9l0bz2SctkQrihkqg/zXqrmxtE6Z2f2oxUobcax+eqS6QMp5nnbPTDLJTbHCN njkawdDC6IhLk0BdncChpTS9E+ZF/F67YwpuIpgraWrchTCwfG+jAtTAGsygD0VVrchTCcncChpTS 9E+ZF/F67YwpuIpgraWcoXuZxZKy13wfsJDhMfWk/nrEqicQ4BJN4M/8AzP+fd9sda3li" node1 (config) # ssh client global known-host "10.0.1.2 ssh-rsa AAAAB3NAfgbzY ulDSIxOKZTh2VBnKsy0qRWrCps64Itlh6iRlr7JxazaC1yc2EAAAADAQABAAABAQCzd5JwKtk5BjH Le/jxkF0JzWcXOTw9l0bz2SctkQrihkqg/zXqrmxtE6Z2f2oxUobcax+eqS6QMp5nnbPTDLJTbHCN njkawdDC6IhLk0BdncChpTS9E+ZF/F67YwpuIpgraWrchTCwfG+jAtTAGsygD0VVrchTCcncChpTS 9E+ZF/F67YwpuIpgraWcoXuZxZKy13wfsJDhMfWk/nrEqicQ4BJN4M/8AzP+fd9sda3li" hostname (config) # show ssh client SSH client Strict Hostkey Checking: ask Minimum protocol version: 2 Cipher list: compatible Minimum key length: 1024 bits
SSH Global Known Hosts: Entry 1: Host: 10.0.0.2 Finger Print: 54:fa:10:2a:f4:c2:cf:3a:46:b1:a4:ed:72:78:b8:22 Key Length (bits): 2048 Entry 2: Host: 10.0.1.2 Finger Print: 54:fa:10:2a:f4:c2:cf:3a:46:b1:a4:ed:72:78:b8:22 Key Length (bits): 2048 .... node1 (config) # write memory node1 (config) # reload