For adding additional AS with a F5 load balancer that passes the TLS connections, please do the following:
1. On each AS run the following command to generate new CSR's.
- fmos pki gen-csr filename.csr -K file.key -i -n VIPfqdn
2. Take the generated CSR's from each AS and get them signed, either by the customers CA or the CA on the FireMon DB. Make sure the CA provides the entire cert chain.
- To sign a certificate using the FMOS CA, use this command:
- fmos ca sign csrfile.csr outputcertname.cer --days 365
- If using the FireMon CA, you will need to export the root cert with the following command run on the DB server:
- fmos ca export-ca-cert root.cer --ca root
3. Import the signed certs and the root certs in the appropiate AS with the following. The --chain option may be used if importing intermediate certs.
- fmos pki import-server-cert cert.cer file.key --chain chain.pem
- fmos pki import-ca root.cer
4. Import the root CA cert into each DC with the following:
- fmos pki import-ca root.cer
5. Switch all DC's to the VIP fqdn with the following:
- fmos ecosystem switchover VIPfqdn
The Public Hostname setting in the AS SCP should not be needed, however if the DC's will not join this may need to be set to the VIP fqdn.
Comments
0 comments
Article is closed for comments.