F5 6900, Руководство по платформе

Страница: 58 / 126

Chapter 6
6 - 2
Creating the FIPS security domain
The first task in creating a FIPS security domain is to initialize the FIPS
HSM and create a security officer (SO) password. The SO password is
required to re-initialize the HSM. When you are configuring a redundant
system, you need to initialize the security domain on one unit, and then
initialize the card on the peer unit using the same security domain name you
used on the first unit.
To create a FIPS security domain, you must perform the following tasks:
• Initialize the first unit in the redundant system.
• Initialize the peer system.
Note
You can initialize the FIPS HSM and create the security domain before you
license the system and create a traffic management configuration.
Initializing the first unit in a redundant system
To initialize the first unit in a redundant system and create a security
domain, you must use the
fipsutil utility. To initialize the HSM and create
an SO password, type the following command:
fipsutil -f init
After the utility starts, you are prompted to create a security officer
password, and then confirm the password. After you create a password and
confirm it, you are prompted for the security domain name. Remember the
security domain name you use. You need the domain name when you
initialize the HSM on the peer unit. The domain name cannot be extracted or
displayed by the software or hardware once you use it.
After you complete the initialization process on the first unit, you can
initialize the peer system.
Initializing the peer system
To initialize the peer unit in the redundant system and add it to the security
domain of the first unit, you must use the
fipsutil utility. Type the following
command:
fipsutil -f init
After the utility starts, you are prompted to create a security officer (SO)
password. You can use the SO password that you created on the first unit;
however, you are not required to use it.