IBM SAN384B-2, Installation, Service And User Manual

Page: 78 / 190

v Refer to the "Steps for connecting to a TKLM appliance" section of the Fabric OS
Encryption Administrator’s Guide Supporting Tivoli Key Lifecycle Manager (TKLM)
Environments
for detailed information on initial setup. That section includes the
following information:
– All switches you plan to include in an encryption group must have a secure
connection to the Tivoli Key Lifecycle Manager (TKLM). A local LINUX host
must be available to transfer certificates.
– Be sure that the clock time on the TKLM server and on the Brocade
encryption nodes are the same. A difference of only a few minutes can cause
the TLS connectivity to fail.
– Repeat the same steps for configuring both the primary and the secondary
key vault.
– Both the primary and secondary key vaults should be registered before
exporting MK or encrypting LUNs. If the secondary key vault is registered
midway after encryption is done for some of the LUNs, then the key database
should be backed up and restored on the secondary TKLM from the already
registered primary TKLM before registering the secondary TKLM.
– The following is a suggested order for the initial steps needed to create a
secure connection to TKLM. (Refer to the "Steps for connecting to a TKLM
appliance" section of the
Fabric OS Encryption Administrator’s Guide Supporting
Tivoli Key Lifecycle Manager (TKLM) Environments for additional steps.)
1. Initialize all encryption nodes to generate Key authentication center (KAC)
certificates and export the signed KAC certificates to a local LINUX host.
2.
Obtain the necessary user credentials and log in to the TKLM server
appliance from the TKLM management web console.
Configuring for encryption (optional)
Summary of procedure
The optional FS8-18 encryption blade requires configuration to enable the
configuration functions. This section provides a brief overview of those
configuration steps. Refer to the
Fabric OS Encryption Administrator’s Guide (TKLM
Key Management) for the detailed procedures to configure the encryption functions.
Note:
If the encryption blade (FS8-18) is being configured for the first time for encryption
services, you will need to perform several pre-initialization tasks related to
configuring the encryption node (switch), including:
v
Generating the Critical Security Parameters (CSPs) and certificates
v Loading and setting up the certificates
v
Establishing a trusted link (LKM Appliance)
v Configuring the global parameters and policies of the encryption group
v
Generating and backing up the master key in RSA environments
v
Handling key-vault high-availability
v Configuring cluster interconnect
After completing the pre-initialization tasks, you may need to perform several
tasks related to configuring the encryption group. Figure 18 on page 47
summarizes the flow of the encryption-configuration tasks.
46
SAN384B-2 Installation, Service, and User Guide