F5 520, Manual

Page: 32 / 61

Chapter 2
2 - 2
Initializing the FIPS 140 hardware security module
and creating the security world
After you install the 520/540 platform in the network and run the Setup
utility, you can initialize the FIPS 140 hardware security module (HSM).
This is how you prepare the HSM for the security world. The security world
is the environment you create for secure life-cycle management of keys
based on nCipher technology. To create the security world, you run various
utilities from the command line on the 520/540 platform. You can initialize
the HSM and set up the security world in a number of different situations:
• On a single unit or primary unit of a redundant system
• On a redundant system with one HSM in each 520/540 platform (only
required if you have a redundant system)
• On a single 520/540 platform with two HSMs
• On a single or redundant system, adding another HSM to an existing
security world
Note
You will need a paper clip or ballpoint pen and at least two of the smart
cards provided with the security module (three are recommended) before
you begin the initialization process.
Creating the security world on a single unit or the primary unit of
a redundant system
This section describes how to create the security world on a single unit or
the primary unit of a redundant system.
To create the security world on a single unit or the primary
unit of a redundant system
1. Locate the switch labeled M-O-I on the FIPS 140 card at the back
of the controller (see Figure 2.1). Then using a paper clip or your
finger tip, move the switch to the I position.
2. With a ballpoint pen tip, gently push the reset button (Figure 2.2).
If you have done this correctly, the LED blinks quickly for a
moment and then blinks slowly again.
3. Type the following command to start the sw-init utility:
sw-init
Figure 2.3 is an example session of the sw-init utility.