Product Documentation

Configuring a FIPS Appliance for the First Time

Sep 16, 2013

A certificate-key pair is required for HTTPS access to the configuration utility and for secure remote procedure calls. RPC nodes are internal system entities used for system-to-system communication of configuration and session information. One RPC node exists on each appliance. This node stores the password, which is checked against the one provided by the contacting appliance. To communicate with other NetScaler appliances, each appliance requires knowledge of the other appliances, including how to authenticate on the other appliance. RPC nodes maintain this information, which includes the IP addresses of the other NetScaler appliances and the passwords used to authenticate on each.

On a NetScaler MPX appliance virtual appliance, a certificate-key pair is automatically bound to the internal services. On a FIPS appliance, a certificate-key pair must be imported into the hardware security module (HSM) of a FIPS card. To do so, you must configure the FIPS card, create a certificate-key pair, and bind it to the internal services.

To configure secure HTTPS by using the command line interface

  1. Initialize the hardware security module (HSM) on the FIPS card of the appliance. For information about initializing the HSM, see "Configuring the HSM."
  2. If the appliance is part of a high availability setup, enable the SIM. For information about enabling the SIM on the primary and secondary appliances, see "Configuring FIPS Appliances in a High Availability Setup."
  3. Import the FIPS key into the HSM of the FIPS card of the appliance. At the command prompt, type:

    import ssl fipskey serverkey -key ns-server.key -inform PEM

  4. Add a certificate-key pair. At the command prompt, type:

    add certkey server -cert ns-server.cert -fipskey serverkey

  5. Bind the certificate-key created in the previous step to the following internal services. At the command prompt, type:

    bind ssl service nshttps-127.0.0.1-443 -certkeyname server

    bind ssl service nshttps-::11-443 -certkeyname server

To configure secure HTTPS by using the configuration utility

  1. Initialize the hardware security module (HSM) on the FIPS card of the appliance. For information about initializing the HSM, see "Configuring the HSM."
  2. If the appliance is part of a high availability setup, enable the secure information system (SIM). For information about enabling the SIM on the primary and secondary appliances, see " Configuring FIPS Appliances in a High Availability Setup."
  3. Import the FIPS key into the HSM of the FIPS card of the appliance. For more information about importing a FIPS key, see "Importing an Existing FIPS Key."
  4. Navigate to Traffic Management > SSL > Certificates.
  5. In the details pane, click Install.
  6. In the Install Certificate dialog box, type the certificate details.
  7. Click Create, and then click Close.
  8. Navigate to Traffic Management > Load Balancing > Services.
  9. In the details pane, on the Action tab, click Internal Services.
  10. Select nshttps-127.0.0.1-443 from the list, and then click Open.
  11. On the SSL Settings tab, in the Available pane, select the certificate created in step 7, click Add, and then click OK.
  12. Select nshttps-::11-443 from the list, and then click Open.
  13. On the SSL Settings tab, in the Available pane, select the certificate created in step 7, click Add, and then click OK.
  14. Click OK.

To configure secure RPC by using the command line interface

  1. Initialize the hardware security module (HSM) on the FIPS card of the appliance. For information about initializing the HSM, see "Configuring the HSM."
  2. Enable the secure information system (SIM). For information about enabling the SIM on the primary and secondary appliances, see " Configuring FIPS Appliances in a High Availability Setup."
  3. Import the FIPS key into the HSM of the FIPS card of the appliance. At the command prompt, type:

    import ssl fipskey serverkey -key ns-server.key -inform PEM

  4. Add a certificate-key pair. At the command prompt, type:

    add certkey server -cert ns-server.cert -fipskey serverkey

  5. Bind the certificate-key pair to the following internal services. At the command prompt, type:

    bind ssl service nsrpcs-127.0.0.1-3008 -certkeyname server

    bind ssl service nskrpcs-127.0.0.1-3009 -certkeyname server

    bind ssl service nsrpcs-::1l-3008 -certkeyname server

  6. Enable secure RPC mode. At the command prompt, type:

    set ns rpcnode <IP address> -secure YES

To configure secure RPC by using the configuration utility

  1. Initialize the hardware security module (HSM) on the FIPS card of the appliance. For information about initializing the HSM, see "Configuring the HSM."
  2. Enable the secure information system (SIM). For information about enabling the SIM on the primary and secondary appliances, see " Configuring FIPS Appliances in a High Availability Setup."
  3. Import the FIPS key into the HSM of the FIPS card of the appliance. For more information about importing a FIPS key, see "Importing an Existing FIPS Key."
  4. Navigate to Traffic Management > SSL > Certificates.
  5. In the details pane, click Install.
  6. In the Install Certificate dialog box, type the certificate details.
  7. Click Create, and then click Close.
  8. Navigate to Traffic Management > Load Balancing > Services.
  9. In the details pane, on the Action tab, click Internal Services.
  10. Select nsrpcs-127.0.0.1-3008 from the list, and then click Open.
  11. On the SSL Settings tab, in the Available pane, select the certificate created in step 7, click Add, and then click OK.
  12. Select nskrpcs-127.0.0.1-3009 from the list, and then click Open.
  13. On the SSL Settings tab, in the Available pane, select the certificate created in step 7, click Add, and then click OK.
  14. Select nsrpcs-::11-3008 from the list, and then click Open.
  15. On the SSL Settings tab, in the Available pane, select the certificate created in step 7, click Add, and then click OK.
  16. Click OK.
  17. Navigate to System > Network > RPC
  18. In the details pane, select the IP address, and click Open.
  19. In the Configure RPC Node dialog box, select Secure.
  20. Click OK.