Network Configuration
The SafeNet ProtectServer Network HSM is intended to be installed in a data center and accessed remotely over a network. Network access is provided by two Ethernet LAN ports. The SafeNet ProtectServer Network HSM is also equipped with an RJ-45 console port, used to provide serial access to the appliance for initial network configuration.
The network device interfaces (eth0 and eth1) and console port are located on the front of the appliance, as illustrated below:
Serial port
Connect a serial device to the SafeNet ProtectServer Network HSM to perform initial network configuration via PSESH. Use the console port to configure at least one of the network interfaces. Once you have configured an interface, you can connect the appliance to the network and access PSESH to complete the network configuration.
Appliance configuration
The following network parameters are configured at the appliance level:
>Appliance hostname. A hostname is optional, unless you are using DNS.
Ethernet LAN device configuration
The SafeNet ProtectServer Network HSM is equipped with two individually-configurable Ethernet LAN network devices. You can configure the following network settings for each device:
> IPv4 or IPv6 address. You can configure the addresses using static or DHCP addressing.
>Network gateway. Devices must use a gateway appropriate for the network (IPv4 or IPv6).
>Network mask. IPv4 devices must use dotted-quad format (for example, 255.255.255.0). IPv6 devices can use full or shorthand syntax.
>Static network route.
>DNS configuration. Although you configure DNS at the device level, the settings you configure for a device are available to all devices on the appliance if the configured device is connected to the network. To ensure DNS access, it is recommended that you configure each device. You can configure the following settings:
•DNS nameservers
•DNS search domains
These settings apply to static network configurations only. If you are using DHCP, the DNS search domains and DNS nameservers configured on the DHCP server are used.
Gathering Appliance Network Information
Before you begin, obtain the following information (see your network administrator for most of these items):
HSM Appliance Network Parameters
>IP address and subnet mask for each LAN port you want to use (if you are using static IP addressing)
>Hostname for the HSM appliance (registered with network DNS)
>Domain name (per port)
>Default gateway IP address (per port)
>DNS Name Server IP address(es) (per port)
>Search Domain name(s) (per port)
>Device subnet mask (per port)
DNS Entries
>Ensure that you have configured your DNS Server(s) with the correct entries for the appliance and the client.
>If you are using DHCP, then all references to the Client and the HSM appliance (as in Certificates) should use hostnames.
Configuring the Network Parameters
You can use the serial connection to configure all of your network parameters, or configure a single port and use it to access the appliance over the network and complete the configuration.
NOTE Use a locally-connected serial terminal when changing the appliance IP address, to avoid SSH admin console disconnection.
To configure the appliance and port network parameters:
It is recommended that you configure and test each device. You need to know the IP address of at least one network interface to establish an SSH connection to the appliance.
1.Login to the appliance as admin or pseoperator.
2.Configure the IP address, network mask, and gateway (optional) on at least one of the Ethernet LAN ports (eth0 or eth1). You can specify a static address, or retrieve one from a DHCP server. You can configure each port to use an IPv4 or IPv6 address.
| Static |
psesh:> network interface static -device <netdevice> -ip <IP_address> -netmask <netmask> [-gateway <IP_address>] |
| DHCP |
psesh:> network interface dhcp -device <netdevice> |
Either of these commands will prompt you to restart the network service.
3.[Optional] Set the appliance hostname and domain name.
psesh:> network hostname <hostname>
psesh:> network domain <netdomain>
You must configure your DNS server to resolve the hostname to the IP address configured on the Ethernet port of the appliance. Do this for each Ethernet port connected to a network. See your network administrator for assistance.
4.[Optional] Add a domain name server to the network configuration for the appliance. The name server is added to the appliance DNS table. There is one DNS table that applies to all network devices (ports) on the appliance.
psesh:> network dns add nameserver <IP_address> -device <net_device>
NOTE The domain name settings apply to static network configurations only. If you are using DHCP, the DNS name servers configured on the DHCP server are used.
When you add a DNS server to a specific network device, it is added to the DNS table for the appliance and becomes available to both devices, provided the device you added it to is connected to the network. For example, if you add a DNS server to eth0, eth1 will be able to access the DNS server if eth0 is connected to the network. If eth0 is disconnected from the network, eth1 also loses DNS server access. To ensure that any DNS server you add is available in the event of a network or port failure, it is recommended that you add it to both network-connected devices.
5.[Optional] Add a search domain to the network configuration. These are automatically appended to an internet address you specify in PSESH. For example, if you add the search domain mycompany.com, entering the command network ping hsm1 would search for the domain hsm1.mycompany.com. If the domain resolves, it pings the device with that hostname.
lunash:> network dns add searchdomain <domain> -device <net_device>
The search domain is added to the appliance DNS table.
NOTE The search domain settings apply to static network configurations only. If you are using DHCP, the DNS search domains configured on the DHCP server are used.
When you add a DNS search domain to a specific network device, it is added to the DNS table for the appliance and becomes available to both devices, provided the device you added it to is connected to the network. For example, if you add a DNS server to eth0, eth1 will be able to access the DNS server if eth0 is connected to the network. If eth0 is disconnected from the network, eth1 also loses DNS server access. To ensure that any DNS server you add is available in the event of a network or port failure, it is recommended that you add it to both network-connected devices.
If you have chosen to perform setup via SSH, you will likely lose your network connection as you confirm the change of IP address from the default setting.
6.[Optional] Add iptables ACCEPT and DROP rules to manage network access to the appliance.
By default, the SafeNet ProtectServer Network HSM allows access to all networks and hosts. The default policy for the INPUT and OUTPUT chain is set to ACCEPT. The default policy for the FORWARD chain is set to DROP, since the SafeNet ProtectServer Network HSM is not used to forward packets, as in a router or proxy.
CAUTION! If you are configuring iptables via SSH, a malformed rule can cause a lockout.
a.To add an ACCEPT rule, specify a host or network:
psesh:> network iptables addrule accept host -ip <IP_address>
psesh:> network iptables addrule accept network -net <IP_address> -mask <netmask>
b.To add a DROP rule, specify a host or network:
psesh:> network iptables addrule drop host -ip <IP_address>
psesh:> network iptables addrule drop network -net <IP_address> -mask <netmask>
c.To see the current list of rules:
psesh:> network iptables show
d.To delete a rule, specify the rule's position on the list:
psesh:> network iptables delrule -rulenum <number>
A rule's number is based on its current list position, so executing network iptables delrule -rulenum 1 multiple times will eventually delete the entire list.
e.Save your iptables changes:
psesh:> network iptables save
You must execute this command, or any changes will be lost on the next appliance reboot.
7.After making any change to the network configuration, reboot the appliance:
psesh:> sysconf appliance reboot
8.View the new network settings:
psesh:> network show
SSH Network Access
After you have completed the network configuration, you can access the SafeNet ProtectServer Network HSM over the network using the SSH protocol. You need an SSH client such as puTTY (available for free from www.putty.org).
