Brocade Fabric OS Encryption Administrator's Guide v7.1.0 (53-1002721-01, March 2013)

iv Fabric OS Encryption Administrator’s Guide (SKM/ESKM)
53-1002721-01
Support for virtual fabrics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Cisco Fabric Connectivity support . . . . . . . . . . . . . . . . . . . . . . . . . . .12
Chapter 2 Configuring Encryption Using the Management Application
Encryption Center features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Encryption user privileges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
Smart card usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Using authentication cards with a card reader . . . . . . . . . . . . . 16
Registering authentication cards from a card reader . . . . . . . . 17
Registering authentication cards from the database . . . . . . . . 19
Deregistering an authentication card. . . . . . . . . . . . . . . . . . . . .20
Setting a quorum for authentication cards . . . . . . . . . . . . . . . .20
Using system cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Enabling or disabling the system card requirement . . . . . . . . .22
Registering systems card from a card reader . . . . . . . . . . . . . . 22
Deregistering system cards. . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
Using smart cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
Tracking smart cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
Editing smart cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26
Network connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Blade processor links . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Configuring blade processor links . . . . . . . . . . . . . . . . . . . . . . .28
Encryption node initialization and certificate generation. . . . . . . . .28
Setting encryption node initialization . . . . . . . . . . . . . . . . . . . . .29
Steps for connecting to an ESKM/SKM appliance . . . . . . . . . . . . . .29
Configuring a Brocade group on ESKM/SKM . . . . . . . . . . . . . .30
Registering the ESKM/SKM Brocade group user name
and password. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30
Setting up the local Certificate Authority (CA) on
ESKM/SKM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32
Downloading the local CA certificate from ESKM/SKM . . . . . .33
Creating and installing the ESKM/SKM server certificate . . . .34
Enabling SSL on the Key Management System (KMS)
Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .35
Creating an ESKM/SKM High Availability cluster . . . . . . . . . . .35
Copying the local CA certificate for a clustered ESKM/SKM
appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .36
Adding ESKM/SKM appliances to the cluster . . . . . . . . . . . . . .36
Signing the encryption node KAC certificates . . . . . . . . . . . . . . 37
Importing a signed KAC certificate into a switch . . . . . . . . . . . .38
ESKM/SKM key vault high availability deployment . . . . . . . . . .38
Encryption preparation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .40
Creating a new encryption group . . . . . . . . . . . . . . . . . . . . . . . . . . . .40
Configuring key vault settings for HP Enterprise Secure
Key Manager (ESKM/SKM). . . . . . . . . . . . . . . . . . . . . . . . . . . . .45
Understanding configuration status results. . . . . . . . . . . . . . . .49
Adding a switch to an encryption group. . . . . . . . . . . . . . . . . . . . . . .50