Brocade Fabric OS Encryption Administrator’s Guide Supporting RSA Data Protection Manager (DPM) Environments (Supporting Fabric OS v7.2.0) User Manual
Page 309
Fabric OS Encryption Administrator’s Guide (DPM)
289
53-1002922-01
Brocade Encryption Switch removal and replacement
6
12. Recreate the EG with the same name as before using the following command.
Admin:switch> cryptocfg –-create –encgroup
13. Invoke configdownload from the previous uploaded configuration.
14. Enable the switch using the switchenable command.
15. Deregister both key vaults using the following command.
Admin:switch> crypocfg –-dereg –keyvault
16. Export the KAC CSR from new node and sign the CSR from the CA that signed the failed node
CSR.
17. Submit the CSR to a CA.
18. Import the signed KAC certificate onto the new node using the cryptocfg
--
import command.
19. Register back the signed KAC CSR/Certificate onto the new node using the following
command:
Admin:switch> cryptocfg --reg -KACcert
20. Register the new node KAC Certificate with the DPM appliances and create an identity for this
node on the DPM appliance in the Identity Group and associate the identity with the newly
created signed certificate.
21. Register the DPM appliance cluster virtual IP and CA certificate onto this node. Import the key
vault certificate file using the following command:
Admin:switch> cryptocfg --import -scp
22. The DPM appliance can then be registered using the imported file using the following
command:
Admin:switch> cryptocfg --reg -keyvault
23. Remove the existing identity of the failed node from the DPM appliance Identity Group.
24. If a master key is not present, restore the master key from a backed up copy. Procedures will
differ depending on the backup media used (for example, recovery smart cards, from the key
vault, from a file on the network, or a file on a USB-attached device). Refer to Chapter 2,
“Configuring Encryption Using the Management Application.”
25. Check the encryption engine (EE) state using following command to ensure that the encryption
engine is online.
Admin:switch> cryptocfg --show -localEE
26. Set the defzone as allAccess on the new Brocade Encryption Switch, so the configuration from
the Fabric is pushed to new Brocade Encryption Switch.
27. Invoke the following command on the new Brocade Encryption Switch:
Admin:switch> cfgsave
28. Reconnect the FC Cables to the new Brocade Encryption Switch.
29. Invoke the cfgsave command on any switch in that fabric. The fabric configuration from the
existing fabric is merged into the new Brocade Encryption Switch.