Switch Engine v33.1.100 Release Notes

Updated Password Policies

The following additional password policies have been added in this release to provide more security for user and password combinations:

The password cannot be the same as the user name.
Characters in the password cannot be repeated in succession, for example "aa" or "11".
Characters cannot be sequential beyond three characters, for example "abcd" or "1234".
A password cannot be reused within 90 days.

Updated SNMPv3 Password and Key policies

The following additional SNMPv3 password and key policies have been added in this release to provide more security:

The encryption algorithm provides a security strength of 112 bits or more.
Cryptographic keys are generated in a secure manner.
Cryptographic keys that are created or used are safely destroyed.

CLI Command to Enable or Disable All Management Access Modes

The following command can be used to enable or disable all the management access modes in the switch:

enable/disable switch access

Entering the previous command results in the following actions:

Enable/disable ssh2 (which also disables SFTP)
Enable/disable telnet
Enable/disable web (http|https), which also disables REST-API
Enable/disable SNMP access

Confidential Information Stored on the Switch Is not Accessibe

The confidential information,sucg as all passwords, keys (symmetric and shared), and SNMP authentication details stored in the switch are not displayed in the configuration or CLI output with simple encoding, like BASE64. They are salted and encrypted by an entropy provider that is SP800-90B compliant.

Administrator Notification When Audit Trail Exceeds a Limit

The administrator is notified when the audit trail size exceeds 90% or more of the disk capacity.

FIPS Mode Is Enabled When Korean CC Mode Is Enabled

When Korean CC mode is enabled on the switch from the CLI, FIPS mode is also enabled. FIPS mode remains enabled when switch is unconfigured after it was configured for Korean CC mode.

Notes for openssl Upgrade to 3.0.1

The following notes apply to an upgrade to openssl 3.0.1:

rsaSHA based certificates are no longer supported; you must migrate to rsaSHA256 based certificates, such as SyslogTLS or RadiusTLS.
SyslogTLS and RadiusTLS are only supported in TLSv1.2.
TLSv1.3 support has been added for the HTTPS protocol.

The following TLS ciphers are supported in 33.1.100:

TLSv1.2:

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

TLSv1.3:

TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_128_GCM_SHA256
TLS_AES_128_CCM_8_SHA256
TLS_AES_128_CCM_SHA256

CLI Commands for Security Profiles

This release has been updated so that a security profile can be configured for the switch for added security. When enabled, the profile remains enabled after upgrading the switch operating system and unconfiguring the switch.

The following command displays the security profile that is currently configured:

show security profile

In this example output, no profiles have been configured:

5420F-24S-4XE-SwitchEngine.10 # show security profile
Security profile (current)      : Off
Security profile (configured)   : Off

In this example output, the Korean CC profile has been configured and the switch Has been rebooted:

5420F-24S-4XE-SwitchEngine.2 # show security profile
Security profile (current)      : Korean Common Criteria
Security profile (configured)   : Korean Common Criteria

The following command configures the Korean CC security profile:

configure security profile [korean-cc]

The following command can be used to unconfigure the security profile:

Note

This command returns the switch to factory default settings.

unconfigure switch erase [all | nvram]

Software and Hardware Self-Test CLI Commands

A new hardware self-test is run during system initialization. The self-test checks the status of the CPU, memory, flash memory, network interface, and power, and then creates a report with pass/fail results of the self-test. The report can be displayed in the CLI and summary results are included in the audit log.

The following command displays the hardware self-test results on a standalone switch:

show diagnostics boot-time

Example:

# show diagnostics boot-time 
 
Switch: 5520-48T-ACDC
Time:   Thu May 23 18:47:34 2024
 
Component             Result  Details
====================  ======  =================================================
CPU                   PASS                                                      
Memory                PASS                                                      
Storage               PASS                                                      
Power                 FAIL    PSU-1: Powered On, PSU-2: Power Failed                   
Mgmt interface        PASS    Mgmt interface present, Link Up

There is an existing CLI command that performs a software self-test, consisting of software diagnostic checks, and then creates a summarized report on the results of the self-test. The report is displayed in the CLI command output and in the audit log. The same software self-tests are now performed as part of the boot process of the switch.

The following command displays the software self-test results on a standalone switch:

show process