Avaya 3050-VM, User Manual, Page: 141 / 274

cryptographic information stored on the cards is deleted. The next time a user turns
on the ASA 310-FIPS device, the Setup menu will be displayed after having logged
in as the admin user through a console connection.
When selecting
new
or
join
in the Setup menu, you will be prompted to insert the
HSM-SO iKey and HSM-USER iKey associated with each HSM card, and provide
the current password stored on the respective iKey. This is required to initialize the
HSM card anew. After you have provided the correct password for the iKey being
requested by the Setup utility, a new passwords can be defined for that iKey.
For more information about installing and adding ASA 310-FIPS device in a cluster,
see Installing an ASA 310-FIPS on page 56.
An ASA 310-FIPS Cluster Must be Reconstructed onto New
Devices
If your cluster of ASA 310-FIPS devices has been damaged beyond repair (by fire, for example)
you can reconstruct the complete cluster, including certificates, private keys, and wrap keys.
However, this requires that you have access to the following:
• A new set of ASA 310-FIPS devices, replacing the cluster of damaged devices.
• A backup configuration file, saved to an FTP/TFTP/SCP/SFTP server as a precautionary
measure by using the
/cfg/ptcfg
command in the former cluster. For more information
about the
ptcfg
command, see the "Configuration Menu " chapter in the Command
Reference .
• The black CODE-SO and CODE-USER iKeys that were used when the now damaged
cluster of ASA 310-FIPS devices was first created. The black CODE iKeys are needed
to transfer the wrap key used in the former cluster onto the HSM cards in the new ASA
310-FIPS devices, as well as for decrypting private key information in the backup
configuration file.
• The secret passphrase that was defined in the former cluster when first initialized
(Provided your former cluster was running in FIPS mode).
To reconstruct the cluster configuration, certificates, private keys, and wrap keys used in the
former cluster onto a new set of ASA 310-FIPS ASA 310-FIPS devices, follow these steps:
1. Install the first ASA 310-FIPS in a new cluster by following the instructions on
Installing an ASA 310-FIPS on page 56 up to and including step 5 on page 142.
Note:
When asked to use FIPS or Extended Security Mode, select the same mode that
was used in the former cluster.
2. When both HSM cards have been initialized, you will be asked if you want to use
new or existing HSM-CODE iKeys. Type
existing
and press ENTER.
An ASA 310-FIPS Cluster Must be Reconstructed onto New Devices
User Guide April 2013 141