Set Up Connectivity with a SafeNet Network HSM (2024)

Define connection settings for each SafeNet Network HSM.

Log in to the firewall web interface andselect

Device

Setup

HSM

.

Edit the Hardware Security Module Provider settingsand set the

Provider Configured

to

SafeNet NetworkHSM

.

Add

each HSM server as follows.A high availability (HA) HSM configuration requires at least twoservers; you can have a cluster of up to 16 HSM servers. All HSMservers in the cluster must run the same SafeNet version and mustauthenticate separately. You should use a SafeNet cluster only whenyou want to replicate the keys across the cluster. Alternatively, youcan add up to 16 SafeNet HSM servers to function independently.

Enter a

Module Name

(an ASCIIstring of up to 31 characters) for the HSM server.

Enter an IPv4 address for the HSM

Server Address

.

(

HA only

) Select

High Availability

,specify the

Auto Recovery Retry

value (maximumnumber of times the HSM client tries to recover its connection to anHSM server before failing over to an HSM HA peer server; range is0 to 500; default is 0), and enter a

High AvailabilityGroup Name

(an ASCII string up to 31 characters long).

See Also

Using a Hardware Security Module (HSM) — Documentation hyperledger-fabricdocs masterHSMs for General Purpose Use CasesSupport CommunityKey Management and use cases for HSMs

If you configure two or more HSMservers, the best practice is to enable

High Availability

.Otherwise the firewall does not use the additional HSM servers.

Click

OK

and

Commit

your changes.

(

Optional

) Configure aservice route to connect to the HSM if you don’t want the firewallto connect through the Management interface (default).

If you configure a service routefor the HSM, running the

clear session all

CLIcommand clears all existing HSM sessions, which brings all HSM statesdown and then up again. During the several seconds required forHSM to recover, all SSL/TLS operations will fail.

Select

Device

Setup

Services

andclick

Service Route Configuration

.

Customize

a service route.The

IPv4

tab is active by default.

Click

HSM

in the Service column.

Select a

Source Interface

forthe HSM.

Click

OK

and

Commit

your changes.

Configure the firewall to authenticate to the HSM.

Select

Device

Setup

and

SetupHardware Security Module

.

Select the HSM

Server Name

.

Select

Automatic

or

Manual

foryour authentication and trust certificate.

Enter the

Administrator Password

to authenticatethe firewall to the HSM.

Click

OK

.

The firewall tries to authenticate to the HSM and displaysa status message.

Click

OK

again.

Register the firewall as an HSM client with the HSM serverand assign the firewall to a partition on the HSM server.

If the HSM has a firewall with thesame

<cl-name>

already registered, you mustfirst remove the duplicate registration by running the

client delete -client

<cl-name>

command,where

<cl-name>

is the name of the registeredclient (firewall) you want to delete.

Log in to the HSM from a remote system.

Register the firewall using the

client register -c

<cl-name>

-ip

<fw-ip-addr>

CLIcommand, where

<cl-name>

is a name that youassign to the firewall for use on the HSM and

<fw-ip-addr>

isthe IP address for that firewall.

Assign a partition to the firewall using the

client assignpartition -c

<cl-name>

-p

<partition-name>

CLIcommand, where

<cl-name>

is the name you assignedto the firewall using the

client register

commandand

<partition-name>

is the name of a previouslyconfigured partition that you want to assign to this firewall.

Configure the firewall to connect to the HSM partition.

Select

Device

Setup

HSM

andrefresh (



) the display.

Setup HSM Partition

(HardwareSecurity Operations settings).

Enter the

Partition Password

to authenticatethe firewall to the partition on the HSM.

Click

OK

.

(

HA only

) Repeat the previous authentication,registration, and partition connection steps to add another HSMto the existing HA group.

If you remove an HSM from your configuration,repeat the previous partition connection step to remove the deletedHSM from the HA group.

Verify firewall connectivity and authentication withthe HSM.

Select

Device

Setup

HSM

andcheck the authentication and connection Status:

Green

—The firewall is successfully authenticatedand connected to the HSM.

Red

—The firewall failed to authenticate to the HSMor network connectivity to the HSM is down.

View the following columns in Hardware Security Module Statusto determine the authentication status:

Serial Number

—The serial number of the HSMpartition if the firewall successfully authenticated to the HSM.

Partition

—The partition name on the HSM that is assignedto the firewall.

Module State

—The current state of the HSM connection.This value is always

Authenticated

ifthe Hardware Security Module Status displays the HSM.

{{ } else { }}