beautypg.com

Brocade Fabric OS Encryption Administrator’s Guide Supporting RSA Data Protection Manager (DPM) Environments (Supporting Fabric OS v7.2.0) User Manual

Page 309

background image

Fabric OS Encryption Administrator’s Guide (DPM)

289

53-1002922-01

Brocade Encryption Switch removal and replacement

6

12. Recreate the EG with the same name as before using the following command.

Admin:switch> cryptocfg –-create –encgroup

13. Invoke configdownload from the previous uploaded configuration.

14. Enable the switch using the switchenable command.

15. Deregister both key vaults using the following command.

Admin:switch> crypocfg –-dereg –keyvault

16. Export the KAC CSR from new node and sign the CSR from the CA that signed the failed node

CSR.

17. Submit the CSR to a CA.

18. Import the signed KAC certificate onto the new node using the cryptocfg

--

import command.

19. Register back the signed KAC CSR/Certificate onto the new node using the following

command:

Admin:switch> cryptocfg --reg -KACcert

20. Register the new node KAC Certificate with the DPM appliances and create an identity for this

node on the DPM appliance in the Identity Group and associate the identity with the newly
created signed certificate.

21. Register the DPM appliance cluster virtual IP and CA certificate onto this node. Import the key

vault certificate file using the following command:

Admin:switch> cryptocfg --import -scp

22. The DPM appliance can then be registered using the imported file using the following

command:

Admin:switch> cryptocfg --reg -keyvault

23. Remove the existing identity of the failed node from the DPM appliance Identity Group.

24. If a master key is not present, restore the master key from a backed up copy. Procedures will

differ depending on the backup media used (for example, recovery smart cards, from the key
vault, from a file on the network, or a file on a USB-attached device). Refer to Chapter 2,
“Configuring Encryption Using the Management Application.”

25. Check the encryption engine (EE) state using following command to ensure that the encryption

engine is online.

Admin:switch> cryptocfg --show -localEE

26. Set the defzone as allAccess on the new Brocade Encryption Switch, so the configuration from

the Fabric is pushed to new Brocade Encryption Switch.

27. Invoke the following command on the new Brocade Encryption Switch:

Admin:switch> cfgsave

28. Reconnect the FC Cables to the new Brocade Encryption Switch.

29. Invoke the cfgsave command on any switch in that fabric. The fabric configuration from the

existing fabric is merged into the new Brocade Encryption Switch.