Administrator's Guide Supporting RSA Data Protection Manager (DPM) Environments (Supporting Fabric OS v7.2.0) Owner's manual
Table Of Contents
- Contents
- About This Document
- Encryption Overview
- In this chapter
- Host and LUN considerations
- Terminology
- The Brocade Encryption Switch
- The FS8-18 blade
- FIPS mode
- Performance licensing
- Recommendation for connectivity
- Usage limitations
- Brocade encryption solution overview
- Data encryption key life cycle management
- Master key management
- Support for virtual fabrics
- Cisco Fabric Connectivity support
- Configuring Encryption Using the Management Application
- In this chapter
- Encryption Center features
- Encryption user privileges
- Smart card usage
- Using authentication cards with a card reader
- Registering authentication cards from a card reader
- Registering authentication cards from the database
- Deregistering an authentication card
- Setting a quorum for authentication cards
- Using system cards
- Enabling or disabling the system card requirement
- Registering systems card from a card reader
- Deregistering system cards
- Using smart cards
- Tracking smart cards
- Editing smart cards
- Network connections
- Blade processor links
- Encryption node initialization and certificate generation
- Steps for connecting to a DPM appliance
- Exporting the KAC certificate signing request (CSR)
- Submitting the CSR to a certificate authority
- KAC certificate registration expiry
- Importing the signed KAC certificate
- Uploading the CA certificate onto the DPM appliance (and first-time configurations)
- Uploading the KAC certificate onto the DPM appliance (manual identity enrollment)
- DPM key vault high availability deployment
- Loading the CA certificate onto the encryption group leader
- Encryption preparation
- Creating an encryption group
- Adding a switch to an encryption group
- Replacing an encryption engine in an encryption group
- High availability clusters
- Configuring encryption storage targets
- Configuring hosts for encryption targets
- Adding target disk LUNs for encryption
- Adding target tape LUNs for encryption
- Moving targets
- Tape LUN write early and read ahead
- Tape LUN statistics
- Encryption engine rebalancing
- Master keys
- Security settings
- Zeroizing an encryption engine
- Using the Encryption Targets dialog box
- Redirection zones
- Disk device decommissioning
- Rekeying all disk LUNs manually
- Thin provisioned LUNs
- Viewing time left for auto rekey
- Viewing and editing switch encryption properties
- Viewing and editing encryption group properties
- Encryption-related acronyms in log messages
- Configuring Encryption Using the CLI
- In this chapter
- Overview
- Command validation checks
- Command RBAC permissions and AD types
- Cryptocfg Help command output
- Management LAN configuration
- Configuring cluster links
- Setting encryption node initialization
- Steps for connecting to a DPM appliance
- Initializing the Fabric OS encryption engines
- Exporting the KAC certificate signing request (CSR)
- Submitting the CSR to a CA
- Importing the signed KAC certificate
- Uploading the CA certificate onto the DPM appliance (and first-time configurations)
- Uploading the KAC certificate onto the DPM apliance (manual identity enrollment)
- Creating a Brocade encryption group
- Client registration for manual enrollment
- DPM key vault high availability deployment
- Setting heartbeat signaling values
- Adding a member node to an encryption group
- Generating and backing up the master key
- High availability clusters
- Re-exporting a master key
- Enabling the encryption engine
- Zoning considerations
- CryptoTarget container configuration
- Crypto LUN configuration
- Impact of tape LUN configuration changes
- Decommissioning LUNs
- Decommissioning replicated LUNs
- Force-enabling a decommissioned disk LUN for encryption
- Force-enabling a disabled disk LUN for encryption
- SRDF LUNs
- Using SRDF, TimeFinder and RecoverPoint with encryption
- Configuring LUNs for SRDF/TF or RP deployments
- SRDF/TF/RP manual rekeying procedures
- Tape pool configuration
- Configuring a multi-path Crypto LUN
- First-time encryption
- Thin provisioned LUNs
- Data rekeying
- Deployment Scenarios
- In this chapter
- Single encryption switch, two paths from host to target
- Single fabric deployment - HA cluster
- Single fabric deployment - DEK cluster
- Dual fabric deployment - HA and DEK cluster
- Multiple paths, one DEK cluster, and two HA clusters
- Multiple paths, DEK cluster, no HA cluster
- Deployment in Fibre Channel routed fabrics
- Deployment as part of an edge fabric
- Deployment with FCIP extension switches
- Data mirroring deployment
- VMware ESX server deployments
- Best Practices and Special Topics
- In this chapter
- Firmware upgrade and downgrade considerations
- Configuration upload and download considerations
- Configuration upload at an encryption group leader node
- Configuration upload at an encryption group member node
- Information not included in an upload
- Steps before configuration download
- Configuration download at the encryption group leader
- Configuration download at an encryption group member
- Steps after configuration download
- HP-UX considerations
- AIX considerations
- Enabling a disabled LUN
- Decommissioning in an EG containing mixed modes
- Decommissioning a multi-path LUN
- Disk metadata
- Tape metadata
- Tape data compression
- Tape pools
- Tape block zero handling
- Tape key expiry
- Configuring CryptoTarget containers and LUNs
- Redirection zones
- Deployment with Admin Domains (AD)
- Do not use DHCP for IP interfaces
- Ensure uniform licensing in HA clusters
- Tape library media changer considerations
- Turn off host-based encryption
- Avoid double encryption
- PID failover
- Turn off compression on extension switches
- Rekeying best practices and policies
- KAC certificate registration expiry
- Changing IP addresses in encryption groups
- Disabling the encryption engine
- Recommendations for Initiator Fan-Ins
- Best practices for host clusters in an encryption environment
- HA Cluster deployment considerations and best practices
- Key vault best practices
- Tape device LUN mapping
- Maintenance and Troubleshooting
- In this chapter
- Encryption group and HA cluster maintenance
- Displaying encryption group configuration or status information
- Removing a member node from an encryption group
- Deleting an encryption group
- Removing an HA cluster member
- Displaying the HA cluster configuration
- Replacing an HA cluster member
- Deleting an HA cluster member
- Performing a manual failback of an encryption engine
- Encryption group merge and split use cases
- A member node failed and is replaced
- A member node reboots and comes back up
- A member node lost connection to the group leader
- A member node lost connection to all other nodes in the encryption group
- Several member nodes split off from an encryption group
- Adjusting heartbeat signaling values
- EG split possibilities requiring manual recovery
- Configuration impact of encryption group split or node isolation
- Encryption group database manual operations
- Key vault diagnostics
- Measuring encryption performance
- General encryption troubleshooting
- Troubleshooting examples using the CLI
- Management application encryption wizard troubleshooting
- LUN policy troubleshooting
- Loss of encryption group leader after power outage
- MPIO and internal LUN states
- FS8-18 blade removal and replacement
- Brocade Encryption Switch removal and replacement
- Deregistering a DPM key vault
- Reclaiming the WWN base of a failed Brocade Encryption Switch
- Removing stale rekey information for a LUN
- Downgrading firmware from Fabric OS 7.1.0
- Fabric OS and DPM Compatibility Matrix
- Splitting an encryption group into two encryption groups
- Moving an encryption blade from one EG to another in the same fabric
- Moving an encryption switch from one EG to another in the same fabric
- State and Status Information
- Index
viii Fabric OS Encryption Administrator’s Guide (DPM)
53-1002922-01
Impact of tape LUN configuration changes. . . . . . . . . . . . . . . . . . 174
Decommissioning LUNs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
Decommissioning replicated LUNs . . . . . . . . . . . . . . . . . . . . . . . . 176
Decommissioning primary R1 LUNs only . . . . . . . . . . . . . . . . 177
Decommissioning mirror R2 LUNs only . . . . . . . . . . . . . . . . . 177
Decommissioning primary R1 and mirror R2 LUN pairs . . . . 178
Force-enabling a decommissioned disk LUN for encryption . . . . 178
Force-enabling a disabled disk LUN for encryption . . . . . . . . . . . 179
SRDF LUNs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
SRDF pairs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
Enabling remote replication mode . . . . . . . . . . . . . . . . . . . . . 181
Adding replication LUNs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
Rekey operations for replicated LUNs . . . . . . . . . . . . . . . . . . 181
Reading metadata after sync . . . . . . . . . . . . . . . . . . . . . . . . . 182
Using SRDF, TimeFinder and RecoverPoint with encryption . . . . 182
RecoverPoint Configuration Restrictions . . . . . . . . . . . . . . . . 182
Initial Configuration Requirements. . . . . . . . . . . . . . . . . . . . . 183
SRDF/RP initial setup at the source (R1) site . . . . . . . . . . . . 183
SRDF/RecoverPoint remote target (R2) site . . . . . . . . . . . . . 183
Configuring LUNs for SRDF/TF or RP deployments . . . . . . . . . . . 184
Creating new source LUNs that can later be replicated . . . . 184
Migrating LUNs with existing data to LUNs
that can be replicated . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
Synchronizing source and target LUN SRDF/RP pairs . . . . . 186
Configuring TimeFinder target devices. . . . . . . . . . . . . . . . . . 187
Configuring SRDF Gatekeeper LUNs. . . . . . . . . . . . . . . . . . . . 188
SRDF/TF/RP manual rekeying procedures . . . . . . . . . . . . . . . . . . 188
TF snapshot rekeying details. . . . . . . . . . . . . . . . . . . . . . . . . . 188
TF clone/mirror rekeying details . . . . . . . . . . . . . . . . . . . . . . . 188
Rekeying local site (R1) SRDF LUNs . . . . . . . . . . . . . . . . . . . . 189
Rekeying LUNs for RP deployments - local site . . . . . . . . . . . 191
Rekeying remote site (R2) SRDF LUNs . . . . . . . . . . . . . . . . . . 192
Rekeying LUNs for RP deployments - remote site . . . . . . . . . 193
Behavior with Hosts writing beyond reported capacity . . . . . 193
Tape pool configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
Tape pool labeling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
Creating a tape pool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
Deleting a tape pool. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
Modifying a tape pool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197
Impact of tape pool configuration changes . . . . . . . . . . . . . . 197
Configuring a multi-path Crypto LUN . . . . . . . . . . . . . . . . . . . . . . . 198
Multi-path LUN configuration example . . . . . . . . . . . . . . . . . . 199
First-time encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
Resource allocation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
First-time encryption modes . . . . . . . . . . . . . . . . . . . . . . . . . . 202
Configuring a LUN for first-time encryption . . . . . . . . . . . . . . 202