Brocade Fabric OS Encryption Administrator’s Guide Supporting Key Management Interoperability Protocol (KMIP) Key-Compliant Environments (Supporting Fabric OS v7.1.0) - Manual (Page 201)

Fabric OS Encryption Administrator’s Guide (KMIP) 183
53-1002747-02
Crypto LUN configuration
3
Discovering a LUN
When adding a LUN to a CryptoTarget container, you must specify a LUN Number. The LUN Number
needed for configuring a given Crypto LUN is the LUN Number as exposed to a particular initiator.
The Brocade Encryption platform provides LUN discovery services through which you can identify
the exposed LUN number for a specified initiator. If you already know the exposed LUN numbers for
the various initiators accessing the LUN, you may skip the LUN discovery step and directly configure
the Crypto LUN.
1. Log in to the group leader as Admin or FabricAdmin.
2. Enter the cryptocfg
--
discoverLUN command followed by the CryptoTarget container Name.
FabricAdmin:switch> cryptocfg --discoverLUN my_disk_tgt
Container name: my_disk_tgt
Number of LUN(s): 1
Host: 10:00:00:00:c9:2b:c9:3a
LUN number: 0x0
LUN serial number: 200000062B0F726D0C000000
Key ID state: Key ID not available
Key ID: 3a:21:6a:bd:f2:37:d7:ea:6b:73:f6:19:72:89:c6:4f
CAUTION
When configuring a LUN with multiple paths, perform the LUN discovery on each of the
CryptoTarget containers for each of the paths accessing the LUN and verify that the serial
number for these LUNs discovered from these CryptoTarget containers are the same. This
indicates and validates that these CryptoTarget containers are indeed paths to the same LUN.
Refer to the section
“Configuring a multi-path Crypto LUN” on page 191 for more information.
Configuring a Crypto LUN
You configure a Crypto LUN by adding the LUN to the CryptoTarget container and enabling the
encryption property on the Crypto LUN. The LUNs of the target that are not enabled for encryption
must still be added to the CryptoTarget container with the cleartext policy option.
You can add a single LUN to a CryptoTarget container, or you can add multiple LUNs by providing a
range of LUN Numbers. When adding a single LUN, you can either provide a 16-bit (2 byte) hex
value of the LUN Number, for example, 0x07. Alternately you can provide a 64-bit (8 byte) value in
WWN or LUN ID format, for example, 00:07:00:00:00:00:00:00. When adding a range of LUN
Numbers, you may use two byte hex values or decimal numbers.
LUN configurations and modifications must be committed to take effect. The commit limit when
using the CLI is 25. If the number of paths for a LUN exceeds the limit, then more than one
transaction must be sent. Attempts to commit configurations or modifications that exceed the
maximum commit allowed will fail with a warning. There is also a five second delay before the
commit operation takes effect. In addition to the commit limits, make sure the LUNs in previously
committed LUN configurations and LUN modifications have a LUN state of Encryption Enabled
before creating and committing another batch of LUN configurations or LUN modifications.