Brocade Fabric OS Encryption Administrator’s Guide Supporting RSA Data Protection Manager (DPM) Environments (Supporting Fabric OS v7.2.0) - Manual (Page 226)

206 Fabric OS Encryption Administrator’s Guide (DPM)
53-1002922-01
Data rekeying
3
Rekeying is only applicable to disk array LUNs or fixed block devices. There is no rekeying support
for tape media. If there is a need to re-encrypt encrypted tape contents with a new key, the process
is equivalent to restoring the data from tape backup. You decrypt the data with the old DEK and
subsequently back up the tape contents to tape storage, which will have the effect of encrypting
the data with the new DEK.
Thin provisioned LUN limitations during rekey
• The WRITE_SAME command will not be supported for the unmap operation.
• The UNMAP command will be rejected during a rekey.
• Rekey temporarily uses the last 512 blocks. As a result, these blocks will be marked as
provisioned by the thin provisioned LUN.
• The first 16 blocks of the LUN will be mapped automatically (if it was unmapped), after the LUN
has been configured as an encrypted LUN.
Resource allocation
A maximum of ten concurrent rekey sessions are supported per Encryption Group, with a maximum
of ten concurrent rekey/encryption sessions per target container and 10 concurrent sessions per
physical initiator. If your configuration has two containers that are accessed by the same physical
initiator, you cannot have more than ten concurrent rekey or encryption sessions. This includes
both rekey (auto and manual) and first-time encryption sessions.
When scheduled rekey or first-time encryption sessions exceed the maximum allowable limit, these
sessions will be pending and a Temporarily out of resources message is logged. Whenever an
active rekey of first-time encryption session completes, the next pending session is scheduled.
The system checks once every 15 minutes to determine if there are any rekey or first-time
encryption sessions pending. If resources are available, the next session in the queue is processed.
There may be up to an hour lag before the next session in the queue is processed. It is therefore
recommended that you do not schedule more than 10 rekey or first-time encryption sessions.
Rekeying modes
Rekeying operations can be performed under the following conditions:
• Offline rekeying : The hosts accessing the LUN are offline, or host I/O is halted.
• Online rekeying: The hosts accessing the LUN are online, and host I/O is active.