Configuring A New Chassis Key Value - Cisco ASR 5000 Series Administration Manual

System Settings
The chassis key is used to generate the chassis ID which is stored in a file and used as the master key for
protecting sensitive data (such as passwords and secrets) in configuration files
For release 15.0 and higher, the chassis ID is an SHA256 hash of the chassis key. The chassis key can be set
by users through a CLI command or via the Quick Setup Wizard. If the chassis ID does not exist, a local MAC
address is used to generate the chassis ID.
For release 19.2 and higher, the user must explicitly set the chassis key through the Quick Setup Wizard or
CLI command. If it is not set, a default chassis ID using the local MAC address will not be generated. In the
absence of a chassis key (and hence the chassis ID), sensitive data will not appear in a saved configuration
file. The chassis ID is the SHA256 hash (encoded in base36 format) of the user entered chassis key plus a
32-byte secure random number. This assures that the chassis key and chassis ID have 32-byte entropy for key
security.
If a chassis ID is not available encryption and decryption for sensitive data in configuration files will not
work.

Configuring a New Chassis Key Value

CLI Commands
Important
Use the Exec mode chassis key value key_string command to enter a new chassis key.
The key_string is an alphanumeric string of 1 through 16 characters. The chassis key is stored as a one-way
encrypted value, much like a password. For this reason, the chassis key value is never displayed in plain-text
form.
The Exec mode chassis keycheck key_string command generates a one-way encrypted key value based on
the entered key_string. The generated encrypted key value is compared against the encrypted key value of the
previously entered chassis key value. If the encrypted values match, the command succeeds and keycheck
passes. If the comparison fails, a message is displayed indicating that the key check has failed. If the default
chassis key (MAC address) is currently being used, this key check will always fail since there will be no
chassis key value to compare against.
Use the chassis keycheck command to verify whether multiple chassis share the same chassis key value.
Important
For additional information, refer to the Exec Mode Commands chapter in the Command Line Interface
Reference.
Beginning with Release 15.0, the chassis ID will be generated from the chassis key using a more secure
algorithm. The resulting 44-character chassis ID will be stored in the same file.
Release 14 and Release 15 chassis IDs will be in different formats. Release 15 will recognize a Release 14
chassis ID and consider it as valid. Upgrading from 14.x to 15.0 will not require changing the chassis ID or
configuration file.
Only a user with Security Administrator privilege can execute the chassis key value and chassis keycheck
commands.
For release 19.2 and higher, in the absence of an existing chassis ID file the chassis keycheck command
is hidden.
Configuring a New Chassis Key Value
ASR 5500 System Administration Guide, StarOS Release 21.4
67