Administrator's Guide Supporting NetApp Lifetime Key Manager (LKM) and KeySecure Storage Secure Key Manager (SSKM) Environments (Supporting Fabric OS v7.2.0) User Manual

Fabric OS Encryption Administrator’s Guide (LKM/SSKM) 33
53-1002925-01
Steps for connecting to an LKM/SSKM appliance
2
Disk keys and tape pool keys (Brocade native mode support)
DEK creation, retrieval, and update for disk and tape pool keys in Brocade native mode are as
follows:
• DEK creation: The DEK is archived into the primary LKM/SSKM. Upon successful archival of
the DEK onto the primary LKM/SSKM, the DEK is read from the secondary LKM/SSKM until it
is either synchronized to the secondary LKM/SSKM, or a timeout of 10 seconds occurs
(2 seconds with 5 retries).
- If key archival of the DEK to the primary LKM/SSKM is successful, the DEK that is created
can be used for encrypting disk LUNs or tape pools in Brocade native mode.
- If key archival of the DEK to the primary LKM/SSKM fails, an error is logged and the
operation is retried. If the failure occurs after archival of the DEK to the primary
LKM/SSKM, but before synchronization to the secondary LKM/SSKM, a VAULT_OFFLINE
error is logged and the operation is retried. Any DEK archived to the primary LKM/SSKM in
this case is not used.
• DEK retrieval: The DEK is retrieved from the primary LKM/SSKM if the primary LKM/SSKM is
online and reachable. If the registered primary LKM/SSKM is not online or not reachable, the
DEK is retrieved from a clustered secondary LKM/SSKM.
• DEK Update: DEK update behavior is the same as DEK creation.
Tape LUN and DF -compatible tape pool support
• DEK creation: The DEK is created and archived to the primary LKM/SSKM only. Upon
successful archival of the DEK to the primary LKM/SSKM, the DEK can be used for encryption
of a Tape LUN or DF-Compatible tape pool. The DEK is synchronized to a secondary
LKM/SSKM through LKM/SSKM clustering.
If DEK archival onto the primary LKM/SSKM fails, DEK archival is retried to the clustered
secondary LKM/SSKM. If DEK archival also fails to the secondary LKM/SSKM, an error is
logged and the operation is retried.
• DEK retrieval: The DEK is retrieved from the primary LKM/SSKM if the primary LKM/SSKM is
online and reachable. If the primary LKM/SSKM is not online or reachable, the DEK is
retrieved from the clustered secondary LKM/SSKM.
• DEK update: DEK update behavior is the same as DEK creation.
LKM/SSKM key vault deregistration
Deregistration of either the primary or secondary LKM/SSKM key vault from an encryption switch
or blade is allowed independently.
• Deregistration of Primary LKM/SSKM: You can deregister the Primary LKM/SSKM from an
encryption switch or blade without deregistering the backup or secondary LKM/SSKM for
maintenance or replacement purposes. However, when the primary LKM/SSKM is
deregistered, key creation operations will fail until either the primary LKM/SSKM is
reregistered, or the secondary LKM/SSKM is deregistered and reregistered as the primary
LKM/SSKM.
When the primary LKM/SSKM is replaced with a different LKM/SSKM, you must first
synchronize the DEKs from the secondary LKM/SSKM before reregistering the primary
LKM/SSKM.