Brocade Fabric OS Encryption Administrator's Guide v7.1.0 (53-1002721-01, March 2013)

Fabric OS Encryption Administrator’s Guide (SKM/ESKM) 29
53-1002721-01
Steps for connecting to an ESKM/SKM appliance
2
Setting encryption node initialization
Encryption nodes are initialized by the Configure Switch Encryption wizard when you confirm a
configuration. Encryption nodes may also be initialized from the Encryption Center dialog box.
1. Select a switch from the Encryption Center Devices table, then select Switch > Init Node from
the menu task bar.
2. Select Yes after reading the warning message to initialize the node.
Steps for connecting to an ESKM/SKM appliance
The ESKM/SKM management web console can be accessed from any web browser with Internet
access to the ESKM/SKM appliance. The URL for the appliance is as follows:
https://<appliance hostname>:<appliance port number>
Where:
- <appliance hostname> is the hostname or IP address when installing the ESKM/SKM
appliance.
- <appliance port number> is 9443 by default. If a different port number was specified
when installing the ESKM/SKM appliance, use that port number.
The following configuration steps are performed from the ESKM/SKM management web console
and from BNA:
1. Configure a Brocade group on the ESKM/SKM. Refer to “Configuring a Brocade group on
ESKM/SKM” on page 30.
2. Register the Brocade group user name and password on the encryption node. Refer to
“Registering the ESKM/SKM Brocade group user name and password” on page 30.
3. Set up a local CA on the ESKM/SKM. Refer to “Setting up the local Certificate Authority (CA) on
ESKM/SKM” on page 32.
4. Download the CA certificate. Refer to “Downloading the local CA certificate from ESKM/SKM”
on page 33.
5. Create and install an ESKM/SKM server certificate. Refer to “Creating and installing the
ESKM/SKM server certificate” on page 34.
6. Enable an SSL connection. Refer to “Enabling SSL on the Key Management System (KMS)
Server” on page 35.
7. Configure a cluster of ESKM/SKM appliances for high availability. Refer to:
• “Creating an ESKM/SKM High Availability cluster” on page 35.
• “Copying the local CA certificate for a clustered ESKM/SKM appliance” on page 36.
• “Adding ESKM/SKM appliances to the cluster” on page 36.
8. Export and sign the encryption node certificate signing requests. Refer to “Signing the
encryption node KAC certificates” on page 37.
9. Import the signed certificates into the encryption node. Refer to “Importing a signed KAC
certificate into a switch” on page 38.