The Firmwaredownload Command; Configuring The Switch For Signed Firmware; Power-On Firmware Checksum Test - HP A7533A - Brocade 4Gb SAN Switch Base Administrator's Manual

The firmwareDownload command

As mentioned previously, the public key file will need to be packaged, installed, and run on your switch
before downloading a signed firmware.
When firmwareDownload installs a firmware file, it needs to validate the signature of the file. Different
scenarios are handled as follows:
a. If a firmware file does not have a signature, how it is handled depends on the signed_firmware
parameter on the switch. If it is enabled, firmwareDownload fails. Otherwise,
firmwareDownload displays a warning message and proceeds normally. So when downgrading
to a non-FIPS compliant firmware, the signed_firmware flag needs to be disabled.
b. If the firmware file has a signature but the validation fails, firmwareDownload fails. This means
the firmware is not from HP or its content has been modified.
c. If the firmware file has a signature and the validation succeeds, firmwareDownload proceeds
normally.
DMM, and third party application images are not signed.

Configuring the switch for signed firmware

To configure the switch for signed firmware:
1. Log in to the switch as admin.
2. Issue the configure command.
3. Respond to the prompts as follows:
System Service Default is no; press Enter to select default setting.
ssl attributes
snmp attributes Default is no; press Enter to select default setting.
rpcd attributes Default is no; press Enter to select default setting.
cfgload
attributes
Webtools
attributes
System

Power-on firmware checksum test

FIPS requires the checksums of the executables and libraries on the file system to be validated before Fabric
OS modules are launched. This is to make sure these files have not been changed after they are installed.
When firmware RPM packages are installed during firmwareDownload, the MD5 checksums of the
firmware files are stored in the RPM database on the filesystem. This will go through all of the files in the
RPM database. Every file compares its current checksum with the checksum that is in the RPM database. If
they are different, the command will tell you.
Because the validation may take up to a few minutes, it will not be performed during hot code load. It is
only performed after a cold reboot of the switch.
For more information on FIPS, see
188 Installing and maintaining firmware
Default is no; press Enter to select default setting.
Select Yes. The following questions are displayed:
Enforce secure config Upload/Download: Select Yes
Enforce signed firmware download: Select Yes
Default is no; press Enter to select default setting.
Default is no; press Enter to select default setting.
"Configuring advanced security features" on page 107.