A storage administrator is enabling DH-CHAP for the first time on a Fibre Channel fabric. Which condition must the administrator consider while configuring this feature?

Question

Options

• ANTP must be configured on all devices or the configuration fails.
• BThe MD5 hash must be used if TACACS+ or RADIUS authentication for FCSP is enabled.
• CAll switches on the fabric must be configured for the same password.
• DEnabling DH-CHAP protocol feature is unsupported on FCIP interfaces.

• A
  3% (1)
• B
  84% (27)
• C
  3% (1)
• D
  9% (3)

Explanation

Option B is correct because when DH-CHAP is integrated with an external AAA server (TACACS+ or RADIUS) for FCSP authentication, the MD5 hash algorithm is mandatory - these AAA protocols rely on MD5 internally, so any mismatch in hash algorithm selection will break authentication.

Option A is wrong because DH-CHAP uses a challenge-response mechanism, not time-based tokens, so NTP synchronization is not a requirement - that dependency belongs to protocols like Kerberos.

Option C is wrong because DH-CHAP passwords are configured as pairwise secrets between neighboring switch ports, not as a single shared password across the entire fabric.

Option D is wrong because DH-CHAP is supported on FCIP interfaces; FCIP tunnels FC traffic over IP, and FCSP/DH-CHAP can secure those connections just as with standard FC links.

Memory tip: Think "RADIUS/TACACS+ = MD5 only" - when you bring in external AAA for FCSP, you lose the choice of SHA and must commit to MD5, because those AAA protocols speak MD5 natively.

No community discussion yet for this question.