Check Point R80.20 - Additional Actions for a Gemalto HSM Appliance Server; Disabling Communication from the Check Point Gateway to the Gemalto HSM Appliance Server; Deleting a Trust Link with the HSM Appliance Server

Hardware Security Module (HSM)
Next Generation Security Gateway Guide R80.20 | 91
Step
Description
5 On the Security Gateway, fetch the local policy:
# fw fetch local
6 Confirm that HTTPS Inspection is activated successfully on outbound traffic.
From an internal computer, connect to any HTTPS web site.
On the internal computer, in the web browser, you should receive the signed CA
certificate from the HSM Appliance Server.
Additional Actions for a Gemalto HSM Appliance Server
Disabling Communication from the Check Point Gateway to the
Gemalto HSM Appliance Server
You can disable communication from the Check Point Gateway to an HSM Appliance. For example,
when the HSM Appliance is under maintenance.
To disable communication from the Check Point Security Gateway to the HSM Appliance:
Step
Description
1 Connect to the command line on the Check Point Security Gateway.
2 Log in to the Expert mode.
3 Edit the configuration file $FWDIR/conf/hsm_configuration.C :
# vi $FWDIR/conf/hsm_configuration.C
4
Set the value of the ":enabled" attribute to "no":
:enabled ("no")
5 Save the changes in the file and exit the Vi editor.
6 Fetch the local policy:
# fw fetch local
Deleting a Trust Link with the HSM Appliance Server
If you need to establish new Trust Link between a Check Point Security Gateway and an HSM
Appliance Server, you have to delete the current Trust Link. For example, when you replace or
reconfigure a Check Point Security Gateway, or an HSM Appliance Server.
Step
Description
1 Delete the current Trust Link on Check Point Security Gateway:
a) Connect to the command line.
b) Log in to the Expert mode.
c) Go to the SafeNet HSM Simplified Client installation directory:
# cd /usr/safenet/lunaclient/bin/
d) Delete the old Trust Link:
# ./vtl deleteServer -n <
IP Address of HSM Appliance >