Trusted platform module support
On supported FortiManager hardware devices, the Trusted Platform Module (TPM) is used to protect system against malicious attacks.
The dedicated module hardens the FortiManager by storing your master‑encryption‑password which is created when the private data encryption feature is enabled. For more information about which models feature TPM support, see the FortiManager Data Sheet.
By default, the TPM is disabled. To enable it, you must enable private-data-encryption and set the 32 hexadecimal digit master‑encryption‑password.
When private data encryption is enabled, the master-encryption-password is used to generate a primary key which encrypts and protects the individual passwords stored on the FortiManager (for example, FortiManager Admin passwords, HA passwords, SNMP passwords, and others). These individual passwords are not stored within the TPM themselves.
The primary key is never displayed in the FortiManager backup file or the system CLI, thereby obscuring the information and leaving the encrypted information in the TPM.
|
The TPM module does not encrypt the FortiManager disk drive or protect sensitive data contained in managed FortiGate configurations that are stored in FortiManager databases.
|
Configuration backups and migrations
The primary key binds the encrypted backup file to a specific FortiManager unit and never leaves the TPM. When backing up the configuration, the TPM uses the key to encrypt the master‑encryption‑password in the FortiManager backup file. When restoring a configuration that includes a TPM protected master‑encryption‑password:
-
If TPM is enabled but has a different master‑encryption‑password than the FortiManager backup file, then the configuration cannot be restored.
-
If TPM is enabled and the master‑encryption‑password is the same in the FortiManager backup file, then the configuration can be restored.
For information on backing up and restoring the configuration, see Backing up the system and Restoring the configuration.
The master-encryption-password is also required when migrating the configuration, regardless if TPM is available on the other FortiManager model. For more information, see
To check if your FortiManager device has a TPM:
Enter the following command in the FortiManager CLI:
diagnose hardware info
The output in the CLI includes ### TPM info, which displays if the TPM is detected (enabled), not detected (disabled), or not available.
To enable TPM and input the master‑encryption‑password:
Enter the following command in the FortiManager CLI:
config system global
set private-data-encryption enable
end
Please type your private data encryption key (32 hexadecimal numbers):
********************************
Please re-enter your private data encryption key (32 hexadecimal numbers) again:
********************************
Your private data encryption key is accepted.