Use the commands in this section to import the host key from a Central Management System appliance into the managed appliance global host-keys database. This procedure is required for global host-key authentication, in which the connection will be allowed only if the host key the Central Management System appliance sends is already in this database.
Caution
If you choose to use global host-key authentication, you must explicitly enable the feature in addition to importing the host key. For details, see Enabling and disabling strict and global host-key checking using the CLI.
Important
Before you perform this procedure, you must obtain the host key from the Central Management System appliance. You can obtain this key from the Central Management System appliance Web UI or CLI. For details, see Obtaining a host key using the Web UI, Obtaining a managed appliance host key using the CLI, or Obtaining the host key of the CM Series appliance using the CLI.
The host-key string may need to be modified in a Network Address Translation (NAT) deployment. For details, see Global host-key authentication on a appliance in a NAT deployment and Global host-key authentication on a managed appliance in a NAT deployment.
Note
See the ssh commands in the CLI Reference for advanced authentication options.
Log in to the managed appliance CLI.
Go to CLI configuration mode:
hostname > enable hostname # configure terminal
Import the key into the global host-keys database:
hostname (config) # ssh client global known-host "<keyString>"Important
The key must start with the Central Management System appliance IP address, and it must be enclosed in double quotation marks. If the key starts with the hostname, replace the hostname with the IP address.
Verify your change:
hostname (config) # show ssh server host-keysSave your changes:
hostname (config) # write memory
Log in to the managed appliance CLI.
Go to CLI configuration mode:
hostname > enable hostname # configure terminal
Remove the key:
hostname (config) # no ssh client global known-host "<keyString>"Verify your change:
hostname (config) # show ssh server host-keysSave your changes:
hostname (config) # write memory
Caution
If you delete a host key that is in use, the connection between the Central Management System appliance and the managed appliance is broken.
Example
This example imports the host key from a Central Management System appliance into the managed appliance global host-key database.
hostname (config) # ssh client global known-host "10.11.121.13 ssh-rsa AAAAB3 NzaC1yc2EAAAADAQABAAABAQDZZJLE/ftkUddyNW6KdqEQXjS0PjbtzTn3OB51Qg0fdeQHrJgFHM2 /4C9WtDkwuX5jd7gdWnSWYwrXDv657thlyRPIt4Wxjf0bpOolPKAe6shgYq35NxalYDt7Pa/oym51 SN/x9dGaaTFOHvvdAf0Gu5E7nv3YjLjmSgdpSp7auHnYsyJ5O+xlYocXtoBq6jOueyxm8qm76IWL0 07JIJ7ZLgMI8FjZ5gp48r+Hnjrdio2rhKKUP/6B0jpHRxsd8yPxMgJpyz2Dwv9ZIJha67f6sgWYdt 4yxfBc9yr7yG3iVWVJcLE+83aY24X7DBUXFnG3AeciDpEqAit2dPF586hJ" hostname (config) # show ssh server host-keys SSH client Strict Hostkey Checking: ask Minimum protocol version: 2 Cipher list: compatible Minimum key length: 1024 bits SSH Global Known Hosts: Entry 1: Host: 10.11.121.13 Finger Print: c7:64:12:8a:71:a6:da:14:3c:05:37:aa:7a:2e:2a:8c Key Length (bits): 2048 ...