HP Cisco MDS 9020 Cisco MDS 9000 Family Storage Media Encryption Configuration - Page 269

Security, Communication

Get HP Cisco MDS 9020 - Fabric Switch PDF manuals and user guides View all HP Cisco MDS 9020 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 269 highlights

Appendix F Planning For Cisco SME Installation Security Send documentation comments to [email protected] Note For more information about key policies, refer to the Storage Media Encryption Key Management White Paper and Chapter 6, "Cisco SME Key Management." • Use basic or standard or advanced key security mode. To learn more about master key security modes, refer to Chapter 4, "Cisco SME Cluster Management." If you are using smart cards in the standard or advanced security mode, ensure that you do the following: • Install the GemPlus smart card reader drivers on the host used for Cisco SME provisioning. These card reader drivers are included in the Cisco MDS 9000 Management Software and Documentation CD-ROM. • Order the required number of smart cards and readers. • Identify a host in the customer environment for setting up the Fabric Manager server and KMC. Refer to Chapter 1, "Product Overview" to learn about the server requirements. Security Determine whether you will use SSL for switch-to-KMC communication. If you are using SSL, then do the following tasks: • Identify whether a self-signed certificate is required or whether the customer will use their own certificate as the root certificate. • List the names and IP addresses of the switches where the certificates will be installed. • Install OpenSSL. This application could be installed on the server used for Fabric Manager server and KMC. - For the server running Windows operating system, download and install OpenSSL from the following locations: http://gnuwin32.sourceforge.net/packages/openssl.htm http://www.slproweb.com/products/Win32OpenSSL.html The SSL installed should be used to generate keys. - Use the OpenSSL application installed at the following location: C:\Program Files\GnuWin32\bin\openssl.exe Note For a server running on Linux, the OpenSSL application should already be available on the server. • Identify the authentication modes used in the SAN, that is local database, TACACS+, or RADIUS. Communication Verify that you do the following tasks: • Allow the following ports on the firewall server: OL-18091-01, Cisco MDS NX-OS Release 4.x Cisco MDS 9000 Family Storage Media Encryption Configuration Guide F-3

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
  • 241
  • 242
  • 243
  • 244
  • 245
  • 246
  • 247
  • 248
  • 249
  • 250
  • 251
  • 252
  • 253
  • 254
  • 255
  • 256
  • 257
  • 258
  • 259
  • 260
  • 261
  • 262
  • 263
  • 264
  • 265
  • 266
  • 267
  • 268
  • 269
  • 270
  • 271
  • 272
  • 273
  • 274
  • 275
  • 276
  • 277
  • 278
  • 279
  • 280
Send documentation comments to [email protected]
F-3
Cisco MDS 9000 Family Storage Media Encryption Configuration Guide
OL-18091-01, Cisco MDS NX-OS Release 4.x
Appendix F
Planning For Cisco SME Installation
Security
Note
For more information about key policies, refer to the
Storage Media Encryption Key
Management White Paper
and
Chapter 6, “Cisco SME Key Management.”
•
Use basic or standard or advanced key security mode.
To learn more about master key security modes, refer to
Chapter 4, “Cisco SME Cluster
Management.”
If you are using smart cards in the standard or advanced security mode, ensure that you do the following:
•
Install the GemPlus smart card reader drivers on the host used for Cisco SME provisioning. These
card reader drivers are included in the Cisco MDS 9000 Management Software and Documentation
CD-ROM.
•
Order the required number of smart cards and readers.
•
Identify a host in the customer environment for setting up the Fabric Manager server and KMC.
Refer to
Chapter 1, “Product Overview”
to learn about the server requirements.
Security
Determine whether you will use SSL for switch-to-KMC communication. If you are using SSL, then do
the following tasks:
•
Identify whether a self-signed certificate is required or whether the customer will use their own
certificate as the root certificate.
•
List the names and IP addresses of the switches where the certificates will be installed.
•
Install OpenSSL. This application could be installed on the server used for Fabric Manager server
and KMC.
–
For the server running Windows operating system, download and install OpenSSL from the
following locations:
The SSL installed should be used to generate keys.
–
Use the OpenSSL application installed at the following location:
C:\Program Files\GnuWin32\bin\openssl.exe
Note
For a server running on Linux, the OpenSSL application should already be available on the
server.
•
Identify the authentication modes used in the SAN, that is local database, TACACS+, or RADIUS.
Communication
Verify that you do the following tasks:
•
Allow the following ports on the firewall server: