Administrator's Guide Supporting RSA Data Protection Manager (DPM) Environments (Supporting Fabric OS v7.2.0) Owner's manual
Table Of Contents
- Contents
- About This Document
- Encryption Overview
- In this chapter
- Host and LUN considerations
- Terminology
- The Brocade Encryption Switch
- The FS8-18 blade
- FIPS mode
- Performance licensing
- Recommendation for connectivity
- Usage limitations
- Brocade encryption solution overview
- Data encryption key life cycle management
- Master key management
- Support for virtual fabrics
- Cisco Fabric Connectivity support
- Configuring Encryption Using the Management Application
- In this chapter
- Encryption Center features
- Encryption user privileges
- Smart card usage
- Using authentication cards with a card reader
- Registering authentication cards from a card reader
- Registering authentication cards from the database
- Deregistering an authentication card
- Setting a quorum for authentication cards
- Using system cards
- Enabling or disabling the system card requirement
- Registering systems card from a card reader
- Deregistering system cards
- Using smart cards
- Tracking smart cards
- Editing smart cards
- Network connections
- Blade processor links
- Encryption node initialization and certificate generation
- Steps for connecting to a DPM appliance
- Exporting the KAC certificate signing request (CSR)
- Submitting the CSR to a certificate authority
- KAC certificate registration expiry
- Importing the signed KAC certificate
- Uploading the CA certificate onto the DPM appliance (and first-time configurations)
- Uploading the KAC certificate onto the DPM appliance (manual identity enrollment)
- DPM key vault high availability deployment
- Loading the CA certificate onto the encryption group leader
- Encryption preparation
- Creating an encryption group
- Adding a switch to an encryption group
- Replacing an encryption engine in an encryption group
- High availability clusters
- Configuring encryption storage targets
- Configuring hosts for encryption targets
- Adding target disk LUNs for encryption
- Adding target tape LUNs for encryption
- Moving targets
- Tape LUN write early and read ahead
- Tape LUN statistics
- Encryption engine rebalancing
- Master keys
- Security settings
- Zeroizing an encryption engine
- Using the Encryption Targets dialog box
- Redirection zones
- Disk device decommissioning
- Rekeying all disk LUNs manually
- Thin provisioned LUNs
- Viewing time left for auto rekey
- Viewing and editing switch encryption properties
- Viewing and editing encryption group properties
- Encryption-related acronyms in log messages
- Configuring Encryption Using the CLI
- In this chapter
- Overview
- Command validation checks
- Command RBAC permissions and AD types
- Cryptocfg Help command output
- Management LAN configuration
- Configuring cluster links
- Setting encryption node initialization
- Steps for connecting to a DPM appliance
- Initializing the Fabric OS encryption engines
- Exporting the KAC certificate signing request (CSR)
- Submitting the CSR to a CA
- Importing the signed KAC certificate
- Uploading the CA certificate onto the DPM appliance (and first-time configurations)
- Uploading the KAC certificate onto the DPM apliance (manual identity enrollment)
- Creating a Brocade encryption group
- Client registration for manual enrollment
- DPM key vault high availability deployment
- Setting heartbeat signaling values
- Adding a member node to an encryption group
- Generating and backing up the master key
- High availability clusters
- Re-exporting a master key
- Enabling the encryption engine
- Zoning considerations
- CryptoTarget container configuration
- Crypto LUN configuration
- Impact of tape LUN configuration changes
- Decommissioning LUNs
- Decommissioning replicated LUNs
- Force-enabling a decommissioned disk LUN for encryption
- Force-enabling a disabled disk LUN for encryption
- SRDF LUNs
- Using SRDF, TimeFinder and RecoverPoint with encryption
- Configuring LUNs for SRDF/TF or RP deployments
- SRDF/TF/RP manual rekeying procedures
- Tape pool configuration
- Configuring a multi-path Crypto LUN
- First-time encryption
- Thin provisioned LUNs
- Data rekeying
- Deployment Scenarios
- In this chapter
- Single encryption switch, two paths from host to target
- Single fabric deployment - HA cluster
- Single fabric deployment - DEK cluster
- Dual fabric deployment - HA and DEK cluster
- Multiple paths, one DEK cluster, and two HA clusters
- Multiple paths, DEK cluster, no HA cluster
- Deployment in Fibre Channel routed fabrics
- Deployment as part of an edge fabric
- Deployment with FCIP extension switches
- Data mirroring deployment
- VMware ESX server deployments
- Best Practices and Special Topics
- In this chapter
- Firmware upgrade and downgrade considerations
- Configuration upload and download considerations
- Configuration upload at an encryption group leader node
- Configuration upload at an encryption group member node
- Information not included in an upload
- Steps before configuration download
- Configuration download at the encryption group leader
- Configuration download at an encryption group member
- Steps after configuration download
- HP-UX considerations
- AIX considerations
- Enabling a disabled LUN
- Decommissioning in an EG containing mixed modes
- Decommissioning a multi-path LUN
- Disk metadata
- Tape metadata
- Tape data compression
- Tape pools
- Tape block zero handling
- Tape key expiry
- Configuring CryptoTarget containers and LUNs
- Redirection zones
- Deployment with Admin Domains (AD)
- Do not use DHCP for IP interfaces
- Ensure uniform licensing in HA clusters
- Tape library media changer considerations
- Turn off host-based encryption
- Avoid double encryption
- PID failover
- Turn off compression on extension switches
- Rekeying best practices and policies
- KAC certificate registration expiry
- Changing IP addresses in encryption groups
- Disabling the encryption engine
- Recommendations for Initiator Fan-Ins
- Best practices for host clusters in an encryption environment
- HA Cluster deployment considerations and best practices
- Key vault best practices
- Tape device LUN mapping
- Maintenance and Troubleshooting
- In this chapter
- Encryption group and HA cluster maintenance
- Displaying encryption group configuration or status information
- Removing a member node from an encryption group
- Deleting an encryption group
- Removing an HA cluster member
- Displaying the HA cluster configuration
- Replacing an HA cluster member
- Deleting an HA cluster member
- Performing a manual failback of an encryption engine
- Encryption group merge and split use cases
- A member node failed and is replaced
- A member node reboots and comes back up
- A member node lost connection to the group leader
- A member node lost connection to all other nodes in the encryption group
- Several member nodes split off from an encryption group
- Adjusting heartbeat signaling values
- EG split possibilities requiring manual recovery
- Configuration impact of encryption group split or node isolation
- Encryption group database manual operations
- Key vault diagnostics
- Measuring encryption performance
- General encryption troubleshooting
- Troubleshooting examples using the CLI
- Management application encryption wizard troubleshooting
- LUN policy troubleshooting
- Loss of encryption group leader after power outage
- MPIO and internal LUN states
- FS8-18 blade removal and replacement
- Brocade Encryption Switch removal and replacement
- Deregistering a DPM key vault
- Reclaiming the WWN base of a failed Brocade Encryption Switch
- Removing stale rekey information for a LUN
- Downgrading firmware from Fabric OS 7.1.0
- Fabric OS and DPM Compatibility Matrix
- Splitting an encryption group into two encryption groups
- Moving an encryption blade from one EG to another in the same fabric
- Moving an encryption switch from one EG to another in the same fabric
- State and Status Information
- Index

Fabric OS Encryption Administrator’s Guide (DPM) 71
53-1002922-01
Adding target disk LUNs for encryption
2
Configuring storage arrays
The Storage Array contains a list of storage ports that will be used later in the LUN centric view. You
must assign storage ports from the same storage array for multi-path I/O purposes. On the LUN
centric view, storage ports in the same storage array are used to get the associated CryptoTarget
containers and initiators from the database. Storage ports that are not assigned to any storage
array but are within the fabrics of the encryption group will be listed as a single target port on the
LUN centric view. Storage Arrays are configured using the Storage Port Mapping dialog box. You will
need to:
1. Configure target and zone initiator ports in the same zone in order for the target container to
come online and discover LUNs in the storage system.
2. Create CryptoTarget containers for each target port in the storage array from the Target
Container dialog box. Add initiator ports to the container. You must create target containers for
those target ports in the configured storage arrays or unassigned target ports before mapping
any LUN on the LUN centric view. If you do not create the container, LUN discovery will not
function.
NOTE
The controller LUN (LUN 0) must be added to the container as clear text in order for the host to see
the LUNs in the container.
For more detailed information on creating a crypto target container, refer to the chapter describing
storage arrays in this administrator’s guide.
Remote replication LUNs
The Symmetrix Remote Data Facility (SRDF) transmits data that is being written to both a local
Symmetrix array and a remote symmetrix array. The replicated data facilitates a fast switchover to
the remote site for data recovery.
SRDF supports the following methods of data replication:
• Synchronous Replication provides real-time mirroring of data between the source Symmetrix
and the target Symmetrix systems. Data is written simultaneously to the cache of both systems
in real time before the application I/O is completed, thus ensuring the highest possible data
availability.
• Semi-Synchronous Replication writes data to the source system, completes the I/O, then
synchronizes the data with the target system. Since the I/O is completed prior to synchronizing
data with the target system, this method provides an added performance advantage. A second
write will not be accepted on a Symmetrix source device until its target device has been
synchronized.
• Adaptive Copy Replication transfers data from the source devices to the remote devices
without waiting for an acknowledgment. This is especially useful when transferring large
amounts of data during data center migrations, consolidations, and in data mobility
environments.
• Asynchronous Replication places host writes into chunks and then transfers an entire chunk to
the target system. When a complete chunk is received on the target system, the copy cycle is
committed. If the SRDF links are lost during data transfer, any partial chunk is discarded,
preserving consistency on the target system. This method provides a consistent point-in-time
remote image that is not far behind the source system and results in minimal data loss if there
is a disaster at the source site.