Next-Generation Firewall
Set Up Connectivity with an HSM (SCM)
Table of Contents
Set Up Connectivity with an HSM (SCM)
Learn how to set up a secure connection between your Strata Cloud Manager service and
a hardware security module supported by Palo Alto Networks.
HSM clients are integrated with Strata Cloud Manager (SCM) for use with the following
HSM vendors:
- nCipher nShield Connect—The supported client versions are TBD.
- SafeNet Network—The supported client versions are 6.2.1, 6.2.2, 6.3, 7.0, 7.1, and 7.2.
- Thales CipherTrust Manager—The supported client version is 12.40.2, which also has backward compatibility up to version 11.50.
The HSM server version must be compatible with these client versions. Refer to the
HSM vendor documentation for the client-server version compatibility matrix.
Downgrading HSM servers might not be an option after you upgrade them.
- Select .In the Hardware Security Module box, select Customize.Under Provider Configured, select one of the three HSM vendors.Enter the HSM server information.SafeNet Network HSM
- Select + and enter the Module Name followed by an IPv4 address for the Server Address.
- (HA only) Select High Availability,
specify the Auto Recovery Retry value (maximum
number of times the HSM client tries to recover its connection to an HSM
server before failing over to an HSM HA peer server; range is 0 to 500;
default is 0), and enter a High Availability Group
Name. If you configure two or more HSM servers, the best practice is to enable High Availability; otherwise, SCM does not use the additional HSM servers.
- Once you have entered all the HSM servers, select Save.
nCipher nCshield Connect- Select + and enter the Module Name followed by an IPv4 address for the Server Address.
- Enter an IPv4 address for the Remote Filesystem Address.
- Once you have entered all the HSM servers, select Save.
Thales CipherTrust Manager HSM- Enter the Module Name followed by an IPv4 address for the Server Address.
- Select Save.
Once the HSM settings are saved, the Hardware Security Module box displays the provider and server of your HSM.
