Nortel Switched Firewall 2.3.3 User’s Guide and Command Reference
256
The Command Line Interface
213455-L, October 2005
3.
Enable SSH access.
For security purposes, SSH access is initially disabled. To explicitly enable SSH, issue the
following commands:
4.
If necessary, generate new SSH keys.
During the initial setup of the Switched Firewall, Nortel recommends that you select the option
to generate new SSH host keys. This is required to maintain a high level of security when
connecting to the Nortel Switched Firewall using a SSH client.
If you fear that your SSH host keys have been compromised, or at any time your security
policy dictates, you can create new host keys using the following CLI command:
When reconnecting to the Nortel Switched Firewall after having generated new host keys, your
SSH client will display a warning that the host identification (or host keys) has been changed.
5.
Use the access list to permit remote access to trusted clients.
If you have already configured the access list for Telnet or the BBI, there is no need to repeat
the process. Otherwise, to permit access to only trusted clients, see
Defining the remote access
list on page 252
.
6.
Use the Check Point SmartDashboard on your management client to add a security
policy that allows SSH traffic.
The firewall policy should be constructed as follows:
Source: The IP address of the management client, or the IP address range of the
management network
Destination: The firewall host IP address
Service: SSH
Action: Allow
>> #
/cfg/sys/adm/ssh/ena
>> SSH Administration#
apply
>> #
/cfg/sys/adm/ssh/sshkeys/generate
>> SSH Administration#
apply
