Brocade Network Advisor SAN User Manual v12.0.0 (53-1002696-01, April 2013)

550 Brocade Network Advisor SAN User Manual
53-1002696-01
Steps for connecting to an LKM/SSKM appliance
20
5. If required, create an LKM/SSKM cluster for high availability. Refer to “LKM/SSKM key vault
high availability deployment” on page 552.
Additional information for consideration is discussed in the following sections:
• “Disk keys and tape pool keys (Brocade native mode support)” on page 553
• “Tape LUN and DF -compatible tape pool support” on page 553
• “LKM/SSKM key vault deregistration” on page 554
Obtaining and importing the LKM/SSKM certificate
Certificates must be exchanged between the LKM/SSKM appliance and the encryption switch to
enable mutual authentication. You must obtain a certificate from the LKM/SSKM appliance and
import it into the encryption group leader. The encryption group leader exports the certificate to
other encryption group members.
To obtain and import an LKM/SSKM certificate, complete the following steps:
1. Open an SSH connection to the NetApp LKM/SSKM appliance and log in.
host$ssh admin@10.33.54.231
admin@10.33.54.231's password:
Copyright (c) 2001-2009 NetApp, Inc.
All rights reserved
+--------------------------------+
| NetApp Appliance Management CLI |
| Authorized use only! |
+--------------------------------+
Cannot read termcapdatabase;
using dumb terminal settings.
Checking system tamper status:
No physical intrusion detected.
2. Add the group leader to the LKM/SSKM key sharing group. Enter lkmserver add --type
third-party
--key-sharing-group "/" followed by the group leader IP address.
lkm-1>lkmserver add --type third-party --key-sharing-group \
"/" 10.32.244.71
NOTICE: LKM Server third-party 10.32.244.71 added.
Cleartext connections not allowed.
3. On the NetApp LKM appliance terminal, enter sys cert getcert-v2 to display the LKM certificate
content.
lkm-1> sys cert getcert-v2
-----BEGIN CERTIFICATE-----
[content removed]
-----END CERTIFICATE-----
4. Copy and paste the LKM/SSKM certificate content from the NetApp LKM/SSKM appliance
terminal into an editor buffer. Save the file as lkmcert.pem on the SCP-capable host. Save the
entire certificate, including the lines
-----BEGIN CERTIFICATE----- and -----END
CERTIFICATE-----.