[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# Configuring vSAN encryption using Fortanix KMS\n==============================================\n\nTo encrypt data at rest using [vSAN encryption](/vmware-engine/docs/vmware-ecosystem/howto-vsan-encryption), one\noption is to use the Fortanix Key Management Service (KMS).\n\nBefore you begin\n----------------\n\n- Create a Google Cloud project or use an existing one.\n- Verify that you have at least three `n1-standard-4` or higher virtual machine (VM) instances.\n\nDeploy Fortanix KMS on Google Cloud\n-----------------------------------\n\n### Create a VPC network\n\nFor security purposes, create a new Virtual Private Cloud (VPC) network. You\ncan control who has access by adding [firewall rules](/vmware-engine/docs/concepts-firewall-tables)\nor by using another [access control method](/vmware-engine/docs/concepts-permission-model). If your\nproject has a default VPC network, don't use it. Instead,\ncreate your own VPC network with a different subnet IP range so\nthat the only firewall rules in effect are those that you create explicitly.\n\n### Create a VM instance template\n\n1. Follow the steps in [Creating instance templates](/compute/docs/instance-templates/create-instance-templates) to create a new instance template.\n2. Under **Machine type** , select **n1-standard-4 (4 vCPU, 15GB memory)** or higher.\n 1. In the **Boot disk** field, select **Ubuntu 16.04 LTS + 200GB SSD**.\n\n### Create a managed instance group\n\nUsing the steps in [Creating managed instance groups](/compute/docs/instance-groups/creating-groups-of-managed-instances),\ncreate a managed instance group that uses the instance template you created in\nthe previous step.\n\n- Disable [autoscaling](/compute/docs/autoscaler).\n- Under **Number of instances**, enter the number of Fortanix KMS cluster nodes you want.\n\n### Create a health check\n\nOn the **Create a health check** page, check for port 443. Click **Create** to\ncreate a health check.\n\n### Create an internal TCP load balancer\n\n1. On the **Create a load balancer** page, under the **Internal facing or\n internal only** field, select **Only between my VMs**.\n2. Click **Continue** to create a new internal load balancer.\n3. Select **Backend configuration** in the left panel.\n 1. Select the new VPC network that you created.\n 2. Select the managed instance group that you created.\n4. In the left panel, select **Frontend configuration** .\n 1. Select the new VPC network that you created.\n 2. Under **Internal IP**, reserve an internal IP address.\n 3. Under **Port number**, expose ports 443, 4445, and 5696.\n\n### Create an external load balancer\n\n1. On the **Create a load balancer** page, under **Internal facing or internal\n only** , select **From internet to my VMs**.\n2. Click **Continue**.\n3. In the left panel, select **Backend configuration** .\n 1. Select the **Region**.\n 2. Select the managed instance group that you created.\n 3. Select the health check that you created.\n4. In the left panel, select **Frontend configuration** .\n 1. Select the VPC network that you created.\n 2. Reserve a public IP address in the **IP** field.\n 3. Under **Port number**, expose ports 443, 4445, and 5696.\n\n### Add a firewall rule\n\nBy default, the [implied deny ingress](/vpc/docs/firewalls#default_firewall_rules)\nVPC network firewall rule blocks unsolicited incoming\nconnections to VMs in the VPC network.\n\nTo allow incoming connections, set up a firewall rule for your\nVM. After an incoming connection is established with a VM, traffic is permitted\nin both directions over that connection.\n\nYou can [create a firewall rule](/vmware-engine/docs/concepts-firewall-tables) to allow external\naccess to specified ports, or to restrict access between VMs on the same\nnetwork.\n\nAdd a firewall rule to allow the ports 443, 4445, and 5696. Select the\nVPC network you created and restrict the source IP, based on\nyour security requirements.\n\n### Create a DNS\n\nYou can create a DNS for internal and external load balancers by using\n[Cloud DNS](/dns/docs). On this page, `sdkms.vpc.gcloud` is the\nendpoint of the Fortanix KMS that's reachable from the VPC\nnetwork and `sdkms.external.gcloud` is the endpoint that's reachable from the\ninternet.\n\n### Download and install Fortanix KMS\n\nInstall the Fortanix KMS software on each VM instance. For instructions, see the\n[Fortanix Self-Defending KMS installation guide](https://support.fortanix.com/hc/en-us/articles/360043996952-Using-Fortanix-Self-Defending-KMS-For-VMware-Encryption-on-GCP#4.0VPCPeeringwithGCVE-VPC).\nFor the installation package compatible with Google Cloud, contact Fortanix\nSupport.\n\n### Configure UI/KMIP access\n\nThe UI can be accessed by using the `sdkms.external.gcloud` command. The Key\nManagement Interoperability Protocol (KMIP) for VMware can be accessed by using\n`sdkms.vpc.gcloud`.\n\nSet up private services access\n------------------------------\n\nSet up private services access to VMware Engine and connect your\nVPC network to your private cloud. For instructions, see\n[Setting up private services access](/vmware-engine/docs/networking/howto-setup-private-service-access).\n\nEstablish trust between vCenter and Fortanix KMS\n------------------------------------------------\n\n1. In Fortanix KMS, configure a new app.\n2. In the **Applications** page, click **View credentials** for the app that you just created. Then, select the **Username/Password** tab and note the username and password to configure KMS in vCenter.\n3. In vCenter under **Key Management Servers** , configure internal IP `sdkms.vpc.gcloud`.\n4. Make vCenter trust Fortanix KMS:\n 1. In the vCenter **Configure** tab, click the listed Fortanix KMS.\n 2. Click **Establish trust** , then click **Make vCenter trust KMS**.\n 3. Click **Trust**.\n5. Make Fortanix KMS trust vCenter:\n 1. Click **Establish trust** , then click **Make KMS trust vCenter**.\n 2. Under **Choose a method** , click **vCenter certificate**.\n 3. Under **Download vCenter certificate** , click **Download** , then click **Done**.\n6. Enable vSAN encryption.\n 1. In the vSphere client, go to **Cluster \\\u003e vSAN \\\u003e Services**.\n 2. Enable vSAN encryption.\n\nFortanix KMS is ready for use with vSAN encryption and vCenter VM encryption. A\ntamper-proof audit log captures all the crypto operations performed by the\napplication. For VSAN encryption, new security keys are created in Fortanix\nKMS using the KMIP protocol."]]
