Brocade Communications Systems Network Advisor 12.3.0, User Manual

Page: 786 / 1940

734 Brocade Network Advisor SAN User Manual
53-1003154-01
Steps for connecting to a TEKA appliance
20
ESKM/SKM key vault deregistration
Deregistration of either the primary or secondary ESKM/SKM key vault from an encryption switch
or blade is allowed independently.
•
Deregistration of primary ESKM: You can deregister the primary ESKM/SKM from an
encryption switch or blade without deregistering the backup or secondary ESKM/SKM for
maintenance or replacement purposes. Future key operations will use only the secondary
ESKM/SKM until the primary ESKM/SKM is reregistered on the Brocade Encryption Switch or
blade.
When the primary ESKM/SKM is replaced with a different ESKM/SKM, you must first
synchronize the DEKs from the secondary ESKM/SKM before reregistering the primary
ESKM/SKM.
•
Deregistration of secondary ESKM: You can deregister the secondary ESKM/SKM
independently. Future key operations will use only the primary ESKM/SKM until the secondary
ESKM/SKM is reregistered on the encryption switch or blade.
When the secondary ESKM/SKM is replaced with a different ESKM/SKM, you must first
synchronize the DEKs from primary ESKM/SKM before reregistering the secondary
ESKM/SKM.
Steps for connecting to a TEKA appliance
TEKA provides a web user interface for management of clients, keys, admins, and configuration
parameters. A Thales officer creates domains, groups, and managers (a type of administrator),
assigns groups to domains, and assigns managers to manage groups. Managers are responsible
for creating clients and passwords for the groups they manage.
The following configuration steps are performed from the TEKA web user interface and from the
Management application:
1. Set up network connections to TEKA. Refer to “Setting up TEKA network connections” on
page 735.
2. Create a TEKA client. Refer to “Creating a client on TEKA” on page 736.
3. Establish TEKA key vault credentials. Refer to “Establishing TEKA key vault credentials on the
switch” on page 737.
4. Sign encryption node certificate signing requests. Refer to “Exporting the Fabric OS node
self-signed KAC certificates” on page 740.
5. Import the signed requests onto the encryption nodes. Refer to “Converting the KAC certificate
format” on page 740.