Chapter 2: ProtectServer External 2 Installation and Configuration
5.
[Optional] Add a domain name server to the network configuration for the appliance. The name server is
added to the appliance DNS table. There is one DNS table that applies to all network devices (ports) on the
appliance.
psesh:>
network dns add nameserver
<IP_address>
-device
<net_device>
NOTE
The domain name settings apply to static network configurations only. If you are using
DHCP, the DNS name servers configured on the DHCP server are used.
When you add a DNS server to a specific network device, it is added to the DNS table for the appliance and
becomes available to both devices, provided the device you added it to is connected to the network. For
example, if you add a DNS server to eth0, eth1 will be able to access the DNS server if eth0 is connected to
the network. If eth0 is disconnected from the network, eth1 also loses DNS server access. To ensure that
any DNS server you add is available in the event of a network or port failure, it is recommended that you add
it to both network-connected devices.
6.
[Optional] Add a search domain to the network configuration. These are automatically appended to an
internet address you specify in PSESH. For example, if you add the search domain
mycompany.com
,
entering the command
network ping hsm1
would search for the domain
hsm1.mycompany.com
. If the
domain resolves, it pings the device with that hostname.
lunash:>
network dns add searchdomain
<domain>
-device
<net_device>
The search domain is added to the appliance DNS table.
NOTE
The search domain settings apply to static network configurations only. If you are
using DHCP, the DNS search domains configured on the DHCP server are used.
When you add a DNS search domain to a specific network device, it is added to the DNS table for the
appliance and becomes available to both devices, provided the device you added it to is connected to the
network. For example, if you add a DNS server to eth0, eth1 will be able to access the DNS server if eth0 is
connected to the network. If eth0 is disconnected from the network, eth1 also loses DNS server access. To
ensure that any DNS server you add is available in the event of a network or port failure, it is recommended
that you add it to both network-connected devices.
If you have chosen to perform setup via SSH, you will likely lose your network connection as you confirm the
change of IP address from the default setting.
7.
[Optional] Add iptables ACCEPT and DROP rules to manage network access to the appliance.
By default, the ProtectServer External 2 allows access to all networks and hosts. The default policy for the
INPUT and OUTPUT chain is set to ACCEPT. The default policy for the FORWARD chain is set to DROP,
since the ProtectServer External 2 is not used to forward packets, as in a router or proxy.
CAUTION!
If you are configuring iptables via SSH, a malformed rule can cause a lockout.
a.
To add an ACCEPT rule, specify a host or network:
psesh:>
network iptables addrule accept host -ip
<IP_address>
psesh:>
network iptables addrule accept network -net
<IP_address>
-mask
<netmask>
b.
To add a DROP rule, specify a host or network:
Thales ProtectServer HSM 5.9.1 ProtectServer HSM and ProtectToolkit Installation and Configuration Guide
2021-11-02 08:51:40-04:00 Copyright 2009-2021 Thales Group
34
