Updating The Firmwarekey; The Firmwaredownload Command; Configuring The Switch For Signed Firmware - HP A7533A - Brocade 4Gb SAN Switch Base Administrator's Manual

A different firmware key pair is created for digitally signed firmware releases. The private key file for the
digitally signed firmware releases is used to sign released firmware, and the public key file is packaged
inside these digitally signed firmware releases.
NOTE: If FIPS is enabled, all logins should be done through SSH or direct serial and the transfer protocol
should be SCP.

Updating the firmwarekey

1. Log in to the switch as admin.
2. Enter the firmwareKeyUpdate command.
3. Respond to the prompts as follows:
Server Name
or IP Address
Download
from USB
Network
protocol
User name
File name
Password

The firmwareDownload Command

As mentioned previously, the public key file will need to be packaged, installed, and run on your switch
before downloading a signed firmware.
When firmwareDownload installs a firmware file, it needs to validate the signature of the file. Different
scenarios are handled as follows:
• If a firmware file does not have a signature, how it is handled depends on the "signed_firmware"
parameter on the switch. If it is enabled, firmwareDownload will fail. Otherwise, firmwareDownload
will display a warning message and proceed normally. So when downgrading to a non-FIPS
compliant firmware, the "signed_firmware" flag needs to be disabled.
• If the firmware file has a signature but the validation fails, firmwareDownload will fail. This means
the firmware is not from HP for B-Series products or its content has been modified.
• If the firmware file has a signature and the validation succeeds, firmwareDownload will proceed
normally.

Configuring the switch for signed firmware

1. Log in to the switch as admin.
2. Enter the configure command.
3. Respond to the prompts as follows:
System Service
ssl attributes
snmp attributes
rpcd attributes
226 Installing and maintaining firmware
Enter the name or IP address of the FTP server, or SSH server for SCP, where the
firmwarekey file is stored; for example, 192.1.2.3.
Optional: -U (upper case) Specify this option if you want to download from the USB
device attached to the active CP.
Specify the file transfer protocol used to download the firmware from the file server. Valid
values are FTP and SCP. The Values are not case-sensitive. If "-p" is not specified,
firmwareKeyUpdate will determine the protocol automatically by checking the
config.security parameter on the switch.
Enter the user name of your account on the server; for example, "JaneDoe".
Specify the fully qualified path name of the firmware directory, for example,
/pub/firmwarekey/pubkey.pem,12345. Absolute path names may be specified using
forward slashes (/).
Enter a password. This operand can be omitted if firmware is accessible through USB or
if no password is required by the FTP server. This operand is required when accessing an
SSH server.
Default is no; press Enter to select default setting.
Default is no; press Enter to select default setting.
Default is no; press Enter to select default setting.
Default is no; press Enter to select default setting.