Check Point R80.20 - Step 3: Configuring the Gemalto HSM Client Workstation

Hardware Security Module (HSM)
Next Generation Security Gateway Guide R80.20 | 85
Step
Description
3
Run the sysconf recenCert command in LunaSH to generate a new HSM Appliance
Server certificate (server.pem).
From the
Gemalto SafeNet Network HSM 6.2.2 Product Documentation , go to
Configuration Guide > [Step 7] Create a trusted link and register Client and Appliance
with each other
4 Complete the configuration of your HSM Appliance Server to work with Check Point
Security Gateway.
Run these commands in LunaSH:
4A Set the applicable partition to be active and auto-activated:
lunash:> partition showPolicies -partition <
Partition Name >
lunash:> partition changePolicy -partition < Partition Name > -
policy 22
-value 1
lunash:> partition changePolicy -partition < Partition Name > -
policy 23
-value 1
lunash:> partition showPolicies -partition < Partition Name >
Note - If you do not set the partition to stay auto-activated, the partition does not stay
activated when the machine is shut down for more than two hours.
4B Disable the client source IP address validation by NTLS upon an NTLA client connection:
lunash:> ntls ipcheck disable
Note - This will allow HSM Appliance Server to accept traffic from Check Point Cluster
members that is hidden behind Cluster VIP address, and from Check Point Security
Gateways hidden behind NAT.
Step 3: Configuring the Gemalto HSM Client
Workstation
You use the Gemalto HSM Client Workstation to create a CA Certificate on the Gemalto HSM
Appliance Server.
Check Point Security Gateway uses this CA Certificate for HTTPS Inspection when storing and
accessing SSL keys on the Gemalto HSM Appliance Server.
Workflow in this section:
Step
Description
1 Install a Windows-based or Linux-based computer to use as an HSM Client workstation.