Brocade Communications Systems Brocade 8/12c Administrator's Manual page 149

The switch on which you create the encryption group becomes the designated group leader. Once
you have created an encryption group, all group-wide configurations, including key vault
configuration, adding member nodes, configuring failover policy settings, and setting up storage
devices, as well as all encryption management operations, are performed on the group leader.
3. Set the key vault type for SKM/ESKM by entering the cryptocfg --set -keyvault command.
4. Import the CA certificate from the download location used when
5. As the switches come up, enable the encryption engines.
6. Use the cryptocfg - - show groupcfg command to verify that the key vault state is Connected.
Fabric OS Encryption Administrator's Guide
53-1002159-03
Successful execution sets the key vault type for the entire encryption group. The following
example sets the key vault type to SKM, which is the selection also used for ESKM.
SecurityAdmin:switch>cryptocfg --set -keyvault SKM
Set key vault status: Operation Succeeded.
certificate" on page 121, and register SKM as the key vault. The group leader automatically
shares this information with other group members.
SecurityAdmin:switch>cryptocfg --import -scp <CA certificate file>
<host IP> <host username> <host path>
SecurityAdmin:switch>cryptocfg --reg -keyvault <CA certificate file>
<SKM IP> primary
At this point, it may take around one minute to fully configure the switch with SKM/ESKM.
SecurityAdmin:switch>cryptocfg --enableEE
Operation succeeded.
Mace_127:admin> cryptocg --show groupcfg
rbash: cryptocg: command not found
Mace_127:admin> cryptocfg --show -groupcfg
Encryption Group Name:
Failback mode:
Replication mode:
Heartbeat misses:
Heartbeat timeout:
Key Vault Type:
System Card:
Primary Key Vault:
IP address:
Certificate ID:
Certificate label:
State:
Type:
Secondary Key Vault not configured
Additional Key Vault/Cluster Information:
Key Vault/CA Certificate Validity:
Port for Key Vault Connection:
Time of Day on Key Server:
Server SDK Version:
Encryption Node (Key Vault Client) Information:
Node KAC Certificate Validity:
Time of Day on the Switch:
Steps for connecting to an SKM or ESKM appliance
mace127_mace129
Auto
Disabled
3
2
SKM
Disabled
10.32.53.55
Brocade
skmcert
Connected
SKM
"Downloading the local CA
Yes
9000
2010-03-17 17:51:31
4.8.1
Yes
2010-03-17 17:22:05
3
129