Getting Started with On-premises Connection

1.0 Introduction

This article describes how to configure or onboard the on-premises connection to Fortanix Key Insight to scan resources, certificates, keys, and cryptographic assets from various on-premises infrastructures, including file systems, databases, containers, networks, and source code.

2.0 Terminology References

For the on-premises connection concepts and terminologies, refer to On-premises Connection Concepts.

3.0 Start the Connection Setup

Before configuring an on-premises connection, ensure you can access Fortanix Key Insight.

For information about signing up for Fortanix Armor, creating an Armor account, and accessing Fortanix Key Insight, refer to Getting Started with Key Insight.

You can start the connection setup when you first access Fortanix Key Insight or after you have entered the application.

• First-time users: When you access Fortanix Key Insight for the first time, the connection setup wizard is displayed automatically. Proceed to Section 5: Select Connection Type to select on-premises and configure the connection.

• Existing users:  In Fortanix Key Insight, go to Configuration → Connections → ON-PREMISES → ADD ON-PREMISES SCANNER. Proceed to Section 5: Select Connection Type to select on-premises and configure the connection.

4.0 Prerequisites

The following are the prerequisites to configure an on-premises connection on Fortanix Key Insight:

• Server Specifications

  • The server hosting the scanner must have at least2 virtual Central Processing Units (vCPUs) allocated.

  • The server must have a minimum of8 GB of Random Access Memory (RAM) to support the scanner.

  • The server should have at least20 GB of storage capacity for temporarily storing scanned data.

• Operating System and Libraries

  • Linux: Supported operating systems include Ubuntu 24.04, RHEL 8, and RHEL 9 (or Rocky Linux 9). The necessary packages are available in .deb or .rpm formats.

  • Windows: Supported operating systems include Windows Server 2019, 2022, and 2025. The necessary packages are available in .msi format.

• Network Requirements

  • Outbound (Fortanix On-premises Scanner → External Services)

    The Fortanix On-premises Scanner must be allowed to make outgoing connections to:

    • armor.fortanix.com on port 443

    • Databases on their configured ports

    • Fortanix Key Insight: If outbound IP whitelisting is required, retrieve the current Fortanix IP ranges from the Fortanix SaaS IP Ranges endpoint and allow the applicable IP ranges in your firewall or network infrastructure.

      For information about Fortanix SaaS IP ranges and how to determine the applicable IP addresses based on traffic direction, region, and service, refer to Fortanix SaaS IP Whitelisting.

      IP whitelisting is not mandatory. It is required only if your on-premises environment enforces outbound firewall restrictions.

  • Inbound (File System Scanner Agent (Windows) or File System and Network Scanner Agent (Linux) → Fortanix On-premises Scanner)

    The Fortanix On-premises Scanner must be reachable from the File System Scanner Agent (Windows) or the File System and Network Scanner Agent (Linux):

    • Must accept inbound connections from the File System Scanner Agent’s IP on the configured port. For example, 8080 or 1443.

    • Firewall or security group rules must allow this traffic.

    • The service must bind to 0.0.0.0 or its external or private IP, not just 127.0.0.1.

  NOTE

  Although inbound connectivity is required, the Fortanix On-premises Scanner itself does not expose any ports externally.

• Configuration File

  The Fortanix On-premises Scanner requires a configuration file that includes a list of databases, source code, containers, and file systems with their corresponding credentials, as well as the Fortanix DSM on-premises credentials. This configuration file is in plain text, and it is your responsibility to secure the file and its credentials.

• Mixed Mode Authentication: Ensure that Mixed Mode authentication is enabled in MSSQL if you are using Windows Authentication before starting the scan.

  Perform the following steps to enable the Mixed Mode:

  1. Open Microsoft SQL Server Management Studio (SSMS).

  2. Right click the server’s name and select Properties.

  3. Navigate to the Security page.

  4. Set Server authentication to SQL Server and Windows Authentication mode.

  5. Click OK.

  

5.0 Select Connection Type

Perform the following steps to select the scan type and on-premises connection type:

1. Scanner name: Enter a name for your on-premises connection.

2. Download, install, and the necessary scanner packages to scan resources, certificates, keys, and cryptographic assets across various on-premises infrastructures, including file systems, networks, databases, containers, and source code.

   • Download the Fortanix on-premises scanner package for Databases, Source Code, Containers, and File System infrastructure types.

     For more information on how Fortanix Key Insight integrates with the Fortanix On-premises Scanner for different infrastructure types, refer to the following:

     • Database Scanning Architecture

     • File System Scanning Architecture

     • Source Code Scanning Architecture

     • Containers Scanning Architecture

   • Download both the Fortanix on-premises scanner package and the appropriate agent package for File System and Networks based on your operating system: File System Scanner Agent (Windows) or the File System and Network Scanner Agent (Linux).
     For more information on how Fortanix Key Insight integrates with the Fortanix On-premises Scanner and the File System Scanner Agent (Windows) or File System and Network Scanner Agent (Linux), refer to the following:

     • File System Scanning Architecture

     • Networks Scanning Architecture

3. I have downloaded and installed the Scanner package: Enable the check box to confirm the scanner installation.

4. Click NEXT.

7.0 Add Key Insight Policy

The Fortanix Key Insight System Defined Policy is selected by default on the Key Insight Policy step. This policy is designed to facilitate the scanning of keys and services based on predefined key sizes and permitted operations, ensuring compliance with standard security configurations.

Click NEXT to proceed.

Additionally,

• Click ADD POLICY to add a new user-defined policy to the policy center.

• Click to copy and modify a system-defined policy, converting it into a user-defined policy.

For more information on Fortanix Key Insight policies and features, refer to Cryptographic Policy Management.

NOTE

If you change or update the policy instead of the System Defined Policy, you must Rescan the on-premises connection to apply the new policy.

8.0 Select External Key Source

On the Select External Key Source step, you can select an external key source, such as Fortanix DSM (SaaS or On-premises), to integrate with Fortanix Key Insight for key correlation.

Perform the following steps:

1. Select any of the following options:

   • Yes, connect now: Selecting this option allows you to add the external key source for your on-premises connection to correlate keys using the ADD EXTERNAL KEY SOURCE feature. For more information, refer to Getting Started with External Key Source Connection. After adding the Fortanix DSM connection, select it from the list.

     

   • No, I’ll connect later: Selecting this option allows you to onboard the on-premises connection without adding an external key source. You can add it later if needed.

     

2. Click ADD SCANNER & GENERATE API KEY to add the Fortanix On-premises Scanner using the generated API key. You will be authenticating with Fortanix Key Insight using the API key.

   NOTE

   The Fortanix On-premises Scanner polls to the Fortanix Key Insight platform every 15 seconds to check for any new commands or scan results. The frequent polling ensures that the scanner is always up to date with the latest commands and can act on them promptly.

3. In the API KeyDetails dialog box, click COPY API KEY to copy the API key value. This value is used to authenticate between the Fortanix On-premises Scanner and Fortanix Key Insight.

4. Close the dialog box. The new on-premises connection appears on the ON-PREMISES tab on the Connections page.

   The CONNECTION STATUS column displays one of the following statuses:

   • Connected: The Fortanix On-premises Scanner package has been successfully added, and all keys and resources have been scanned without issues.

   • Pending: The Fortanix On-premises Scanner package has been added, but resources are still pending. For on-premises connections in this state:

     • You must use the generated API key to connect with Fortanix Key Insight.

     • To begin scanning, you need to add the resources after establishing the connection.

   • Disconnected: The Fortanix On-premises Scanner package is connected, but the session has been terminated. For on-premises connections that are disconnected, you will need to restart the scanner to re-establish the connection.

5. If the scanner is successfully connected, you can access the scanned data for an on-premises connection on the Fortanix Key Insight UI.

   NOTE

   After onboarding the on-premises connection:

   • View the on-premises connection UI (Overview,Assessment,Keys, and so on). You can alsoswitch the regionusing the region switcher drop down located on the top navigation bar. When the region is changed, the UI updates automatically to show the data, connections, and scan results for that region.

     For more information about the on-premises connection UI, refer toUser Interface Components.

   • Users with the Account Administrator and Group Administrator roles can manage (edit, delete, rescan, view details, view, copy and regenerate an API key) the connection from the Configuration → Connections → ON-PREMISES.

     • Deleting the on-premises connection cannot be undone.

     • The RESCAN option is available only when the on-premises connection status is 'Connected'. The supported values are Connected, Pending, or Disconnected.

     • On the View Details page:

       • Click SHOW API KEY to copy the API key, if required.

       • Click REGENERATE API KEY to modify the current API key details if the existing API key is no longer suitable for the on-premises connection.

       • Download the required scanner packages using DOWNLOAD PACKAGE, if not already downloaded, to add and scan keys and resources.

       

   • A group with the same name will be created on the Fortanix IAM Groups page. For more information, refer to Fortanix Armor Identity and Access Management (IAM).

9.0 On-premises Infrastructure Types and Supported Cryptographic Elements

After an on-premises connection is successfully onboarded, the Overview UI consolidates discoveries from multiple infrastructure types, including file systems, databases, networks, containers, and source code repositories.

For more information on each on-premises infrastructure type, refer to Infrastructure Types.

NOTE

For on-premises connections, the left navigation panel will display the Resources instead of Services.

The following table summarizes the cryptographic elements supported across different on-premises infrastructure types:

Here,

• ✔ indicates the cryptographic element is supported.

• X indicates the cryptographic element is not supported.

10.0 Troubleshooting

For information about common issues and troubleshooting steps when configuring and running Fortanix Key Insight in on-premises environments, refer to On-premises Connection Troubleshooting.