---
title: "Fortanix DSM for VMware Encryption on GCP"
slug: "fortanix-dsm-for-vmware-encryption-on-gcp"
updated: 2026-07-27T16:18:37Z
published: 2026-07-27T16:18:37Z
canonical: "support.fortanix.com/fortanix-dsm-for-vmware-encryption-on-gcp"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM for VMware Encryption on GCP

## 1.0 Introduction

This article describes how to integrate **Fortanix-Data-Security-Manager (DSM)** for **VMware Encryption on GCP**. It also contains the information that a user needs to:

- Deploy Fortanix DSM on Google Cloud Platform
- Perform Virtual Private Cloud (VPC) Peering with GCVE-VPC
- Configure GCVE-VPC vCenter

### 1.1 Before you Begin

*For more information on Google Cloud account creation and other steps, refer to the* [*Google official documentation*](https://cloud.google.com/docs)*.*

## 2.0 Prerequisites

Ensure the following:

- Fortanix DSM installation package for GCP
- VM Type: "n1-standard-4" or higher
- VM Count: 3 or higher

## 3.0 Deploying Fortanix Data Security Manager on GCP

### 3.1 Creating a VPC Network

For security purposes, create a new network. You can control who has access by adding firewall rules or by using another access control method.

If your project has a default VPC network, do not use it. Instead, create your own VPC network so that the only firewall rules in effect are those that you create explicitly.

Create a new VPC with a subnet IP range different from GCVE-VPC.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Create New VPC.png)

**Figure 1: Create new VPC**

### 3.2 Creating an Instance Template

1. In the **Create an instance** page, select **New VM instance from template** in the left panel and then in the **Machine type** field select **n1-standard-4 (4 vCPU, 15GB memory)** or higher.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Select Machine Type.png)

**Figure 2: Select machine type**
2. In the **Boot disk** field, select **Ubuntu 16.04 LTS+ 200GB SSD**.
3. Click **Create** to create the Instance Template.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add Boot Disc Details.png)

**Figure 3: Add boot disc details**

### 3.3 Creating an Instance Group

Create an “Instance Group” using the “Instance Template” created in the previous step.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Disable Auto Scaling.png)

**Figure 4: Disable auto-scaling and select no. of DSM cluster**

1. In the **Create an instance group** page, select **New managed instance group** in the left panel.
2. Disable **Auto-scaling**.
3. In the **Number of instances** enter the number of Fortanix DSM cluster nodes.
4. Click **Create**. The VMs specified will be created after this step.

### 3.4 Creating Health

1. In the **Create a health check** page, check for port 443.
2. Click **Create** to create a health check.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Healthcheck.png)

**Figure 5: Check for port**

### 3.5 Creating an Internal TCP Load Balancer

1. In the **Create a load balancer** page, under **Internal facing or internal only** field, select **Only between my VMs**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Internal Load Balancer Configuration.png)

**Figure 6: Internal load balancer configuration**
2. Click **Continue** to create a new internal load balancer.
3. Select **Backend configuration** in the left panel,

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Backend Configuration.png)

**Figure 7: Backend configuration**
  1. Select the “VPC” created in [*Section 3.1: Creating a VPC Network*](/v1/docs/using-fortanix-data-security-manager-for-vmware-encryption-on-gcp#31-creating-a-vpc-network).
  2. Select the Instance group created in [*Section 3.3: Create an Instance Group*](/v1/docs/using-fortanix-data-security-manager-for-vmware-encryption-on-gcp#33-create-an-instance-group).
4. Select **Frontend configuration** in the left panel,

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Frontend Configuration.png)

**Figure 8: Frontend configuration**
  1. Select the “VPC” created in [*Section 3.1: Creating a VPC Network*](/v1/docs/using-fortanix-data-security-manager-for-vmware-encryption-on-gcp#31-creating-a-vpc-network).
  2. Reserve an internal IP address in the **Internal IP** field.
  3. Expose ports **443**, **4445**, and **5696** on this load-balancer in the **Port number** field.

### 3.6 Creating an External Load Balancer

1. In the **Create a load balancer** page, under **Internal facing or internal only** field, select **From internet to my VMs**.
2. Click **Continue**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/External Load Balancer Configuration.png)

**Figure 9: External load balancer configuration**
3. Select **Backend configuration** in the left panel,

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Backend Configuration 2.png)

**Figure 10: Backend configuration**
  1. Select the **Region**.
  2. Select the Instance group created in [*Section 3.3: Create an Instance Group*](/v1/docs/using-fortanix-data-security-manager-for-vmware-encryption-on-gcp#33-create-an-instance-group).
  3. Select the **Health check** created in [*Section 3.4: Create Health*](/v1/docs/using-fortanix-data-security-manager-for-vmware-encryption-on-gcp#34-create-health).
4. Select **Frontend configuration** in the left panel,

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Frontend Configuration 2.png)

**Figure 11: Frontend configuration**
  1. Select the “VPC” created in [*Section 3.1: Creating a VPC Network*](/v1/docs/using-fortanix-data-security-manager-for-vmware-encryption-on-gcp#31-creating-a-vpc-network).
  2. Reserve a public IP address in the **IP** field.
  3. Expose ports **443**, **4445**, and **5696** on this load-balancer.

### 3.7 Adding a Firewall Rule

By default, an *implied firewall rule* blocks incoming connections outside your VPC network. To allow incoming connections, set up a firewall rule for your VM. After an incoming connection is established with a VM, traffic is permitted in both directions over that connection.

You can create a firewall rule to allow external access to specified ports or to restrict access between VMs on the same network.

1. In the Cloud console, go to the **Firewall** rules page.
2. Add a firewall rule to allow the ports **"443,4445, and 5696"****.**
3. Select the “VPC” created as part of this process.
4. Restrict to source IP based on the security requirements.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add Firewall Rule.png)

**Figure 12: Add firewall rule**

### 3.8 Creating a DNS

Create a DNS for internal and external load balancers.

- This can be either done in Google DNS or outside.
- For this example, **sdkms.vpc.gcloud** will be your VPC reachable endpoint of Fortanix DSM.
- Also, **sdkms.external.gcloud** will be your internet reachable endpoint.

### 3.9 Downloading and Installing Fortanix DSM

The package needs to be installed on all the servers. To install the Fortanix DSM package:

1. The latest installation file is available [*here*](https://fortanix.zendesk.com/hc/en-us/articles/10644636415380-DSM-Installation-Package-Downloads-on-prem). **This needs a partner account, which Fortanix provides to the relevant contact person.**
2. Download and copy the Fortanix DSM installation file `sdkms_<version>_install.sh` to each server. The latest installation files are hosted on [https://support.fortanix.com](https://support.fortanix.com).
3. Install the package by running the following command, replacing the package name with the filename of the package in your Fortanix DSM distribution.

```bash
sudo chmod +x sdkms_2.3.688-124_install.sh
sudo ./sdkms_2.3.688-124_install.sh
```

Reboot the system if new version of kernel was installed.

```bash
sudo reboot
```

> [!NOTE]
> NOTE
> 
> Swap must be disabled again after the node boots up.
4. Perform a reset on all servers by running the following command:

```bash
sudo sdkms-cluster reset --delete-data
```

Install the Fortanix DSM software on each VM. *For more information, refer to the* [*Fortanix Data Security Manager Installation Guide - On-Prem*](/v1/docs/fortanix-data-security-manager-installation-guide-on-prem)*.*

*For the GCP compatible installation package, contact* [*Fortanix Support*](mailto:support@fortanix.com)*.*

### 3.10 Accessing UI / KMIP

- The user interface (UI) can be accessed using **sdkms.external.gcloud**.
- The KMIP for VMware can be accessed using **sdkms.vpc.gcloud**.

## 4.0 VPC Peering with GCVE-VPC

The following are instructions to establish VPC Peering between **Project ID=fortanix, VPC name = gcve-vpc** and the VMWare SDDC (Software-Defined Data Center).

### 4.1 Enabling Service Networking APIs

To enable Service Networking APIs, use the following command:

```bash
gcloud services enable servicenetworking.googleapis.com --project=fortanix
```

### 4.2 Enabling Service Management APIs

To enable Service Management APIs use the command:

```bash
gcloud services enable serviceconsumermanagement.googleapis.com --project=fortanix
```

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Enable Service Networking.png)

**Figure 13: Enable service networking and management APIs**

### 4.3 Reserving an IP Block for VPN Gateway Address Space

Next, reserve an IP block used for VPN Gateway Address Space (prefix length must be 28). This range is already assigned to your environment (192.168.1.0/28).

```bash
gcloud beta compute addresses create gcvs-rsvd-vpngw --project=fortanix --addresses=192.168.1.0 --prefix-length=28 --description="IP range for VMware Private Cloud VPN gateway" --purpose=VPC_PEERING --network=gcve-vpc –global
```

### 4.4 Reserving an IP Block for Management Address Space

Next, reserve an IP block used for VPN Management Address space for your VMware Private Cloud. This range is already assigned to your environment (192.168.0.0/24).

```bash
gcloud beta compute addresses create gcvs-rsvd-mgmt --project=fortanix --addresses=192.168.0.0 --prefix-length=24 --description="IP range for VMware Private Cloud Network" --purpose=VPC_PEERING --network=gcve-vpc --global
```

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Reserve IP Block.png)

**Figure 14: Reserve IP block for networking and management address space**

### 4.5 Creating a VPC Peering

Create a VPC peering using the following command:

```bash
gcloud beta services vpc-peerings connect --project=fortanix --service=vpc-peering.gcloud.gcve-vpc.com --network=gcve-vpc --ranges=gcvs-rsvd-vpngw,gcvs-rsvd-mgmt
```

### 4.6 Accepting the VPC Peering Request

After creating the VPC peering connection, wait for the GCP-GCVE-VPC to accept the VPC-peering request.

## 5.0 Configure GCVE-VPC vCenter

To configure GCVE-VPC vCenter, follow the steps described below:

1. Configure a new account/group/app on the Fortanix DSM.
2. Configure internal IP **sdkms.vpc.gcloud** into vCenter Key-Management-Servers.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Make Vcenter.png)

**Figure 15: Make vCenter trust KMS**

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Trsut Established.png)

**Figure 16: Trust established**

**Make KMS Trust vCenter:**

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Make KMS Trust VCenter.png)

**Figure 17: Make KMS trust vCenter**

**Choose a Certificate:**

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Choose a Certificate.png)

**Figure 18: Choose a certificate**

**Download vCenter Certificate:**

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Download vCenter Certificate.png)

**Figure 19: Download vCenter certificate**

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Certifcate Configured.png)

**Figure 20: Certificate configured**

*For more information, refer to* [*Using Fortanix Data Security Manager as a KMS to Secure VMware Virtual Environments*](/v1/docs/using-fortanix-data-security-manager-as-a-kms-to-secure-vmware-virtual-environments).
  1. In the “Applications” page and click “**VIEW CREDENTIALS**” of the app you just created. Then, click the “**Username/Password**” tab and note the Username and Password to configure KMS in vCenter.
  2. Establish trust with Fortanix DSM : **Make vCenter trust KMS**.
3. Enable vSAN encryption.

Fortanix DSM is ready for use with vSAN encryption and vCenter VM encryption. A tamper proof audit log captures all the crypto operations performed by the application.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1768774873295.png)

**Figure 23: Fortanix DSM successfully configured**

For VSAN encryption, new security keys are created in Fortanix DSM using the KMIP protocol.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/GCP-SO.png)

**Figure 24: Configuration successful**
  1. In the VMware vSphere Client, go to **Cluster** → **vSAN** → **Services**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Enable vSAN Encryption.png)

**Figure 21: Enable vSan encryption**
  2. Enable vSAN **Encryption**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Enable vSAN Encryption 2.png)

**Figure 22: Enable vSan encryption**

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

## Related

- [Fortanix DSM as a KMS to Secure VMware Virtual Environments](/fortanix-dsm-as-a-kms-to-secure-vmware-virtual-environments.md)
- [Fortanix DSM for VMware Cloud Director](/fortanix-dsm-for-vmware-cloud-director.md)