Using Fortanix Data Security Manager with F5 BIG-IP Virtual Edition

  • Updated on Mar 12, 2025
  • Published on Jun 26, 2024
  • 7 minute(s) read

1.0 Introduction

This article describes how to integrate Fortanix-Data-Security-Manager (DSM) with F5 Networks Big IP Virtual Edition (VE) version 15.1.2.1 or later.

It also contains the information that a user requires to:

  • Set inbound traffic rules if using Azure Marketplace platform

  • Set admin password for BIG-IP VE

2.0 Prerequisites

NOTE

The minimum supported BIG IP Version is 15.1.2.1.

2.1 F5 BIG-IP Local Traffic Manager (LTM) 15.1.2.1 or Later

Virtual Edition (VE) is utilized for this article. Both hardware and virtual edition platforms support network Hardware Security Module (HSM) integration. Additionally, you will need to provide a license covering the network HSM module.

2.2 Creating Inbound Traffic Rules if Using Azure Marketplace Platform

To access the BIG-IP Configuration utility, you must open port 8443. To connect to BIG-IP VE using SSH, use the open port 22. To connect to your application through BIG-IP VE, use the open port 443 (in this example).

  1. In the Azure portal, click All Services → Network security groups.

  2. Filter the list to find your group and click it.

  3. In the left menu, under Settings, click Inbound security rules.

  4. Click Add.

    Name

    Value

    Source Port Ranges

    An IP range on your network.

    Destination Port Ranges

    22

    Protocol

    TCP

    Name

    A description, like SSH access.

  5. Click Add again.

  6. Repeat Steps 4 and 5, using 8443 as the Destination port range. This allows management traffic for the port 8443 to reach BIG-IP VE.

  7. Repeat Steps 4 and 5, using 443 as the Destination port range. This allows traffic for your application (in this example).

2.3 Setting Admin Password for BIG-IP VE

Give BIG-IP VE six to ten minutes to finish deploying before you attempt to connect.

The first time you boot BIG-IP VE, you must connect to the instance and create a strong admin password. You will use the admin account and password to access the BIG-IP Configuration utility.

This management interface may be accessible to the Internet, so ensure the password is secure.

  1. Connect to BIG-IP VE.

  2. To change to the tmsh prompt, type:

    tmsh

  3. Modify the admin password.

    modify auth password admin

    The terminal screen displays the message:

    changing password for admin
new password:

  4. Type the new password and press Enter.
    The terminal screen displays the message:

    confirm password

  5. Re-type the new password, and then press Enter.

  6. Ensure that the system retains the password change and press Enter.

  7. Save the system configuration.

    save sys config

      Traffic goes through BIG-IP VE to a pool. Your application servers should be members of this pool.

  8. Now, open a web browser and go to the BIG-IP Configuration utility, for example: https://<external-ip-address>:8443 .

3.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

3.1 Signing Up

To get started with the Fortanix Data Security Manager (DSM) cloud service, you must register an account at <Your_DSM_Service_URL>. For example, https://eu.smartkey.io.

For detailed steps on how to set up the Fortanix DSM, refer to the User's Guide: Sign Up for Fortanix Data Security Manager SaaS documentation.

3.2 Creating an Account

Access the <Your_DSM_Service_URL> on the web browser and enter your credentials to log in to the Fortanix DSM.

Figure 1: Logging In

3.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

  1. Click the Groups menu item in the DSM left navigation bar and click the + button on the Groups page to add a new group.

    Figure 2: Add Groups

  2. On the Adding new group page, enter the following details:

    • Title: Enter a title for your group.

    • Description (optional): Enter a short description for the group.

  3. Click the SAVE button to create the new group.

The new group has been added to the Fortanix DSM successfully.

3.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

  1. Click the Apps menu item in the DSM left navigation bar and click the + button on the Apps page to add a new app.

    Figure 3: Add Application

  2. On the Adding new app page, enter the following details:

    • App name: Enter the name of your application.

    • Interface (optional): Keep the default value.

    • ADD DESCRIPTION (optional): Enter a short description for the application.

    • Authentication method: Select the default API Key as the method of authentication from the drop down menu. For more information on these authentication methods, refer to User's Guide: Authentication documentation.

    • Assigning the new app to groups: Select the group created in Section 3.3: Creating a Group from the list.

  3. Click the SAVE button to add the new application. 

The new application has been added to the Fortanix DSM successfully.

3.5 Copying the API Key

Perform the following steps to copy the API key from the Fortanix DSM:

  1. Click the Apps menu item in the DSM left navigation bar and click the app created in Section 3.4: Creating an Application to go to the detailed view of the app.

  2. On the INFO tab, click the VIEW API KEY DETAILS button.

  3. From the API Key Details dialog box, copy the API Key of the app to be used later.

4.0 Install the Fortanix Plugin

In this step, use the ssh client to log in to the BIG-IP as root. From there use the following commands to download and install the Fortanix plugin onto the BIG-IP. The plugin, (RPM) is available for download from here.

cd /shared/
mkdir nethsm
cd nethsm

curl -O https://download.fortanix.com/clients/3.11.1281/fortanix-pkcs11-3.11.1281-0.x86_64.rpm
rpm -ivh ./fortanix-pkcs11-3.11.1281-0.x86_64.rpm

5.0 Configure BIG-IP netHSM Integration

  1. Add the Fortanix HSM library to the BIG-IP.

    tmsh create sys crypto fips external-hsm vendor auto pkcs11-lib-path /opt/fortanix/pkcs11/fortanix_pkcs11.so

  2. Create the /config/fortanix.cfg file.

    vi /config/fortanix.cfg

    Add the following lines and save the file:

    ##### sample fortanix config file
# cat /config/fortanix.cfg
api_endpoint="https://<fortanix_dsm_url>"
api_key=""
# specify if endpoint uses self-signed certificate 
ca_certs_file = ""
[log]
file = "/var/log/fortanix.log"

  3. Configure the netHSM partition.

    tmsh create sys crypto fips nethsm-partition auto password "file:///config/fortanix.cfg"

  4. Restart the pkcs11d service.

    bigstart restart pkcs11d tmm

  5. Test the connectivity - use the BIG-IP management GUI to test the connectivity between the BIG-IP and Fortanix DSM. After logging into the BIG-IP GUI navigate to System → Certificate Management → HSM Management → External HSM. Under the 'Partitions' section select the checkbox in the Partition List and click Test. Following is an example output of a successful connectivity test.  

    BigIP_4.png

    Figure 4: Test the connectivity

6.0 Configuring BIG-IP and Fortanix DSM

6.1 Import Private Key into Fortanix DSM

Now that we have our external HSM, (Fortanix), https://fortanix.aserracorp.com, integrated with our BIG-IP let us put it to use.

Perform the following steps to import an RSA key in the Fortanix DSM:

  1. Click the Security Objects menu item in the DSM left navigation bar and click the + button on the Security Objects page to add a security object.

    Figure 5: Add Security Object

  2. On the Add New Security Object page, enter the following details:

    • Security Object name: Enter the name of your security object.

      NOTE

      Note this name as it will be used later in the NGINX configuration file.

    • Group: Select the group as created in Section 3.3: Creating a Group.

    • Select the IMPORT radio button.

    • Choose a type: Select the RSA key type.

    • Key Size: Indicates the size of the key in bits.

    • In the Place value here or import from file section, select the value format type as Base64 and click the UPLOAD A FILE button to upload the key file.

    • Key operations permitted: Select the required operations to define the actions that can be performed with the cryptographic keys, such as encryption, decryption, signing, and verifying.

  3. Click the IMPORT button to create the new security object.

The new security object is added to the Fortanix DSM successfully.

6.2 Import SSL Certificate and netHSM Key Pointer into BIG-IP

With Fortanix DSM now hosting the private key, import the corresponding certificate into the BIG-IP. Additionally, create a key resource pointing to the Fortanix DSM-hosted key.

  1. Log in to the BIG-IP management GUI and navigate to System → Certificate Management → SSL Certificate List → Import.

  2. Select Certificate as Import Type and enter a name.

  3. Browse and upload the certificate, click Import.

  4. Restart the pkcs11d service.

    bigstart restart pkcs11d tmm

  5. Next, navigate to System → Certificate Management → SSL Certificate List → Import.

  6. Select Key as Import Type and enter a name. The name must match the security object name of the Fortanix DSM-stored key.

  7. Select Key Source as From NetHSM, and click Import.

BigIP_6.png

Figure 6: Import SSL certificate

6.2 Create SSL Profile and Attach to Virtual Server

Finally, create a Client SSL profile and associate it with the virtual server.

  1. Log in to the BIG-IP management GUI and navigate to Local Traffic → Profiles → SSL → CLIENT → +.

  2. Enter a name and select the Custom checkbox.

  3. In the Certificate Key Chain section, click Add.

  4. Select the previously imported certificate and key from the drop-down menus

  5. Click Finished to create the profile.

  6. Navigate to Local Traffic → Virtual Servers and select the appropriate virtual server.

  7. Under the SSLProfile (Client) section, select the previously create SSL profile.

  8. Click Update to save the modified virtual server.

BigIP_7.png

Figure 7: Create SSL profile

The application is now secured with the BIG-IP offloading the crypto workload to Fortanix DSM.

7.0 Update the PKCS#11 Version

To upgrade the F5 Big-IP VE release, perform the following steps to update the PKCS#11 version.

Perform the following steps on F5 CLI (in bash mode):

  1. Run the following command to check the current version installed of PKCS#11 library:

    rpm -qa | grep fortanix-pkcs11

  2. Run the following command to delete the installed version of PKCS#11 library:

    rpm -e fortanix-pkcs11-<version>

  3. Run the following command to install a different version of PKCS#11 library:

    rpm -ivh fortanix-pkcs11-<version>

Related articles