WIXLIB

F5 BIG-IPnShield HSM Integration Guide

Version: 1.0Date: Friday, July 23, 2021Copyright 2021 nCipher Security Limited. All rights reserved.Copyright in this document is the property of nCipher Security Limited. It is not to bereproduced modified, adapted, published, translated in any material form (includingstorage in any medium by electronic means whether or not transiently or incidentally) inwhole or in part nor disclosed to any third party without the prior written permission ofnCipher Security Limited neither shall it be used otherwise than for the purpose forwhich it is supplied.Words and logos marked with or are trademarks of nCipher Security Limited or itsaffiliates in the EU and other countries.Docker and the Docker logo are trademarks or registered trademarks of Docker, Inc. inthe United States and/or other countries.Information in this document is subject to change without notice.nCipher Security Limited makes no warranty of any kind with regard to this information,including, but not limited to, the implied warranties of merchantability and fitness for aparticular purpose. nCipher Security Limited shall not be liable for errors containedherein or for incidental or consequential damages concerned with the furnishing,performance or use of this material.Where translations have been made in this document English is the canonical language.nCipher Security LimitedRegistered Office: One Station SquareCambridge, UK CB1 2GARegistered in England No. 11673268nCipher is an Entrust company.Entrust, Datacard, and the Hexagon Logo are trademarks, registered trademarks, and/orservice marks of Entrust Corporation in the U.S. and/or other countries. All other brandor product names are the property of their respective owners. Because we arecontinuously improving our products and services, Entrust Corporation reserves the rightto change specifications without prior notice. Entrust is an equal opportunity employer.2 of 12F5 BIG-IP nShield HSM Integration Guide

Contents1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41.1. Product configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41.2. Supported nShield hardware and software versions . . . . . . . . . . . . . . . . . . . . . . . . . . 41.3. Supported nShield HSM functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51.4. Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51.5. More information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62. Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72.1. Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72.2. Install the Security World software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72.3. Configure the Security World . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82.4. Configure HSM connectivity to Big-IP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82.5. Manage HSM keys for LTM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9Contact Us . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12F5 BIG-IP nShield HSM Integration Guide3 of 12

1. IntroductionThe nShield Hardware Security Module (HSM) can generate and store a Root of Trust(RoT) that protects security objects used by F5 Big-IP LTM to safeguard users' keys andcredentials. The HSM in FIPS 140-2 Level 2 or Level 3 mode meets compliancerequirements.More than one HSM can enroll to a F5 BIG-IP machine if all HSMs are in the same SecurityWorld.1.1. Product configurationsWe have successfully tested nShield HSM integration with F5 BIG-IP in the followingconfigurations:SoftwareVersionOperating System CentOS 7.3BIG-IP16.0.11.2. Supported nShield hardware and software versionsWe have successfully tested with the following nShield hardware and software versions:1.2.1. Connect XCSecurity WorldFirmwareImageOCS Softcard12.50.1112.60.10 FirmwareImage12.50.812.60.10 ModuleSoftware12.60.11 1.2.2. Connect Security WorldOCS SoftcardModuleSoftware12.60.114 of 12 F5 BIG-IP nShield HSM Integration Guide

1.3. Supported nShield HSM functionalityFeatureSupportModule-only keyYesOCS cardsYesSoftcardsYesnSaaSYesFIPS 140-2 level 3 Yes1.4. RequirementsBefore installing these products, read the associated documentation: For the nShield HSM: Installation Guide and User Guide. If nShield Remote Administration is to be used: nShield Remote Administration UserGuide. F5 BIG-IP documentation system-and-ncipher-hsm-implementation.html).In addition, the integration between nShield HSMs and F5 BIG-IP requires: PKCS #11 support in the HSM. A correct quorum for the Administrator Card Set (ACS). Operator Card Set (OCS), Softcard, or Module-Only protection. If OCS protection is to be used, a 1-of-N quorum must be used. Firewall configuration with usable ports: 9004 for the HSM (hardserver).Furthermore, the following design decisions have an impact on how the HSM is installedand configured: Whether your Security World must comply with FIPS 140-2 Level 3 standards. If using FIPS Restricted mode, it is advisable to create an OCS for FIPSauthorization. The OCS can also provide key protection for the Vault master key.For information about limitations on FIPS authorization, see the InstallationGuide of the nShield HSM. Whether to instantiate the Security World as recoverable or not.F5 BIG-IP nShield HSM Integration Guide5 of 12

1.5. More informationFor more information about OS support, contact your F5 sales representative or EntrustnShield Support, https://nshieldsupport.entrust.com.6 of 12F5 BIG-IP nShield HSM Integration Guide

2. Procedures2.1. Prerequisites1. A Big-IP system must be deployed before following the steps in this guide. Big-IPVirtual Edition was tested but the procedures can be applied to other deployments.2. The BIG-IP system must be licensed for External Interface and Network HSM.3. Access is required to the command line interface of the Big-IP machine and theConfiguration utility web interface.4. A Security World iso file is required for installing the nShield Security Worldsoftware.2.2. Install the Security World softwareThe following steps will be a manual installation of Security World on the BIG-IP machine.Automatic installation steps exist for older versions of Security World software. See theF5 documentation for more information.1. Mount the Security World iso file.% cd /shared% mkdir SecWorld-12.60.11% mount -o loop SecWorld Lin64-12.60.11.iso SecWorld-12.60.112. Untar the Security World files.% cd /shared% sudo tar -zxvf peat for all tar.gz files in the amd64 directory.3. Fix installation directory paths.% mv /shared/opt/nfast/ /shared% rmdir /shared/opt4. Create a link from /opt/nfast to /shared/nfast.% cd /opt% ln -s /shared/nfast% ls -al5. Run the installation.F5 BIG-IP nShield HSM Integration Guide7 of 12

% /opt/nfast/sbin/install6. Run the enquiry utility to see if the hardserver is up and running.% /opt/nfast/bin/enquiry2.3. Configure the Security World1. Enroll the HSM onto the Big-IP machine. The machine has to be a client of the HSM.For more information, see the User Guide for the HSM.% /opt/nfast/bin/nethsmenroll HSM IP Address % /opt/nfast/bin/enquiry2. Create or import the Security World. For more information, see the User Guide forthe HSM.3. Edit cknfastrc in /opt/nfast and update it to contain one of the followingconfigurations:a. For module protection:CKNFAST FAKE ACCELERATOR LOGIN 1b. For OCS or Softcard protection:CKNFAST LOADSHARING 1CKNFAST NO ACCELERATOR SLOTS 14. Add * to end of /shared/opt/nfast/kmdata/config/cardlist.2.4. Configure HSM connectivity to Big-IP1. Use the following command to check the name of the partition to be used. For OCSor Softcard protection, this is typically the name of the cardset.% /opt/nfast/bin/cklist2. Take note of the partition name. This integration uses module protection, so thepartition name was accelerator.3. Log in to the Configuration utility using an account with the administrator role.4. Add the following information under System Certificate Management HSMManagement External HSM.8 of 12F5 BIG-IP nShield HSM Integration Guide

VendorAutoPKCS11 Library ion partition name Password cardset passphrase 5. Select Add to add the partition.6. Select Update.7. Restart the pkcs11d service to apply the new settings to the system.% tmsh restart sys service pkcs11d% tmsh restart sys service tmm8. Confirm that pkcs11d is running.% bigstart status pkcs11d2.5. Manage HSM keys for LTM2.5.1. Generate an HSM keyThe Traffic Management Shell tmsh can be used to generate a key or certificate on theHSM.F5 BIG-IP nShield HSM Integration Guide9 of 12

1. Generate the key.% tmsh create sys crypto key key name gen-certificate common-name cert name security-type nethsm2. Verify that the key was created.% tmsh list sys crypto key test key2.5.2. Generate a self-signed digital certificate1. Log in to the Configuration utility using an account with the administrator role.2. On the Main tab, select System Certificate Management Traffic CertificateManagement. The Traffic Certificate Management screen opens.3. Select Create.4. In the Name field, enter a unique name for the SSL certificate.5. From the Issuer list, select Self.6. In the Common Name field, enter a name. This is typically the name of a web site,such as www.siterequest.com.7. Enter the other certificate details.8. From the Security Type list, select NetHSM.9. From the NetHSM Partition list, select a partition to use.10. From the Key Type list, RSA is selected as the default key type.11. From the Size list, select a size, in bits.12. Select Finished.2.5.3. Request a certificate from a Certificate AuthorityGenerate a certificate signing request (CSR) that can then be submitted to a third-partytrusted certificate authority (CA).1. Log in to the Configuration utility using an account with the administrator role.2. On the Main tab, select System Certificate Management Traffic CertificateManagement. The Traffic Certificate Management screen opens.3. Select Create.4. In the Name field, enter a unique name for the SSL certificate.5. From the Issuer list, select Certificate Authority.6. Enter the other certificate details.7. Select Finished.10 of 12F5 BIG-IP nShield HSM Integration Guide