F5 6900, Platform Manual

Page: 57 / 126

Configuring and Maintaining a FIPS Security Domain
Platform Guide: 6900 and 8900 6 - 1
Understanding the FIPS implementation
The BIG-IP
®
system includes the option to install a FIPS hardware security
module (HSM). Currently, the FIPS HSM is available in the BIG-IP
6900/8900 platform. With this release, the HSM and the BIG-IP key
management software provide FIPS-140 level 2 support. This level of
support provides the following security benefits.
• Keys are stored in the HSM where they are protected from physical and
software attacks.
• Keys can never be extracted in plain text format.
This chapter describes how to configure a redundant system from the factory
with one FIPS HSM installed in each unit. To implement a FIPS solution in
a BIG-IP redundant system, you must perform the following tasks.
• Install the BIG-IP systems and connect a serial console.
• Create the FIPS security domain from the console.
• Run the Configuration utility.
• Run the fipscardsync utility to synchronize the FIPS HSMs from the
console.
Some of these tasks are described in other documents. When a section in this
document has tasks described in other documents, it contains links or
pointers to the related documentation.
WARNING
Do not issue back-to-back FIPS commands such as fipsutil reset and fipsutil
crash . Issuing these commands too quickly may destabilize the system.
Installing the BIG-IP systems and connecting a serial
console
The first two tasks that you need to complete when setting up a FIPS
configuration on a redundant system are to install the systems and connect a
serial console. For details about performing these tasks, refer to the
following documentation:
• For details about installing the hardware, see the Installing and
connecting the hardware , on page 2-1.
• For information on connecting a serial console, for version 9.x BIG-IP
systems, see Installation, Licensing, and Upgrades for BIG-IP Systems ,
and for version 10.x BIG-IP systems, see BIG-IP
®
Systems: Getting
Started Guide .
After you set up the systems and configure a serial console, you can create
the FIPS security domain.