Read Me First HP StorageWorks Encryption SAN Switch (AR944-96001, April 2009)

ManualsBrandsHP ManualsStorageHP Encryption SAN Switch

READ ME FIRST

HP StorageWorks

Encryption SAN Switch

To ensure compliance with regulatory requirements, HP recommends that the shielded Cat5, 5e, or

6 network patch cable provided with this shipment be used with the 10/100/1000 Ethernet (RJ45)

management port when the management port is operated above 100Mbps.

Important information

For the latest information on the Encryption switch and blade, including firmware updates, additional

product information, supported SAN configurations, and other documentation, see the HP website:

http://h18006.www1.hp.com/storage/saninfrastructure/switches/encrypt_sanswitch.html

B-series Encryption Switch / Blade configuration rules and

guidelines

Rules for avoiding data loss

The following rules must be adhered to when configuring crypto target containers and their

initiators/LUNs. Failure to adhere to these rules can result in unrecoverable data loss.

1. Back up important data and verify the backup was successful before performing the encryption

configuration steps. This non-encrypted backup data should be saved in a secure location until

the data is encrypted and successfully backed up again.

2. Make sure unauthorized initiators do not have access to an encrypted LUN. Initiators to be con-

figured with no encryption flows should not have a path to an encrypted LUN. Proper zoning

should be configured and enforced. Failure to perform correct zoning will lead to the clear text

servers seeing the encrypted LUN as an uninitialized LUN waiting to be reformatted.

To create and configure initiator and target zones:

a. Identify all target and initiator ports that can potentially participate in encryption flows.

b. Create initiator and target zones.

c. Configure zones using the PWWN (port WWN) of initiator and target ports. Do not use

NWWN (node WWN). Set default zone to noaccess mode.

3. Identify and configure multi-path target ports and initiators.

*53-1001319-02*

Printed in the US

The information in this document is subject to change without notice.

First edition: March 2009Part number: AR944-96001

Summary of content (4 pages)

PAGE 1
READ ME FIRST HP StorageWorks Encryption SAN Switch To ensure compliance with regulatory requirements, HP recommends that the shielded Cat5, 5e, or 6 network patch cable provided with this shipment be used with the 10/100/1000 Ethernet (RJ45) management port when the management port is operated above 100Mbps.
PAGE 2
a. b. c. d. e. f. g. Select a target port that needs to be included in the encryption path. Verify existing available target ports/paths that share LUNs with this target port (in the same fabric or other fabrics). Identify all multi-path target ports for a given LUN that is part of an encryption target. Create target containers, one at a time, for all the identified multi-path target ports. Repeat steps a and b for each target port that needs including in the encryption path.
PAGE 3
2. 3. Although hosts and targets can be connected anywhere in the fabric, HP recommends that the following connectivity guidelines are followed in order to achieve better performance and higher scalability and, more importantly, to avoid cross encryption flows among EEs when multiple EEs are present. See the next guideline for additional information. Encryption switch and encryption blade recommendations for connecting host and storage ports when EEs form part of a larger fabric.
PAGE 4
Figure 2 Connectivity recommendations for Encryption blade AR945A Exceptions If it is essential for hosts and target ports that are part of encryption flows to connect to the encryption switch or blade, ensure the following: • If a target is connected to an EE, the target is hosted on that EE only • If a host is connected to an EE, the host is part of a container on that EE only 4. 5. 6. 4 Plan firmware upgrades carefully, as the EE Switch or Blade is reset after a firmware upgrade.