E-Trunk Security

Security Policy

The following security policies are available for E-Trunk:

Configure an encrypted password to enhance system security. If the simple option is used, the password is saved in the configuration file in plain text, posing security risks. Therefore, you are advised to use the cipher option to encrypt the password.
Configure the E-Trunk authentication and encryption mode to improve system security. enhanced-hmac-sha256 is more secure than hmac-sha256 and hmac-sha1. You are advised to use enhanced-hmac-sha256.
UDP port 1025, which is the default port to send and receive E-Trunk packets, may conflict with the UDP port used by another protocol. To ensure the forwarding of E-Trunk packets, change the UDP port number used to send and receive E-Trunk packets.
If the master device fails, an attacker can obtain the E-Trunk packets sent by the master device to attack the backup device, causing service interruptions. To resolve this problem, enable the E-Trunk sequence number check function.

The encryption password, authentication and encryption mode, sequence number check function, and UDP port number must be the same on the switches at both ends of an E-Trunk link.

Configuration Method

Configure an encrypted password.

Set the password of E-Trunk 1 to 00E0FC000000 in cipher-text mode.

<HUAWEI> system-view
[HUAWEI] e-trunk 1
[HUAWEI-e-trunk-1] security-key cipher 00E0FC000000

Configure the authentication and encryption mode.

Set the authentication and encryption mode of E-Trunk 1 to enhanced-hmac-sha256.
```
<HUAWEI> system-view
[HUAWEI] e-trunk 1
[HUAWEI-e-trunk-1] authentication-mode enhanced-hmac-sha25  
```
Configure the E-Trunk port number.

Configure UDP port 1026 as the port for sending and receiving E-Trunk packets.
```
<HUAWEI> system-view
[HUAWEI] e-trunk port 1026  
```
The port number ranges from 1025 to 65535. UDP port numbers 49152 to 65535 are randomly allocated by the socket. Do not set the UDP port number to a value in this range; otherwise, E-Trunk cannot work properly.
Enable the sequence number check function.

Enable the sequence number check function on E-Trunk 1.
```
<HUAWEI> system-view
[HUAWEI] e-trunk 1
[HUAWEI-e-trunk-1] sequence enable  
```