Brocade Network Advisor SAN User Manual v12.3.0 - Manual (Page 774)

722 Brocade Network Advisor SAN User Manual
53-1003154-01
Steps for connecting to an LKM/SSKM appliance
20
Data Encryption Keys
The following sections describe Data Encryption Key (DEK) behavior during DEK creation, retrieval,
and updates as they relate to disk keys and tape pool keys, and tape LUN and DF-compatible tape
pool support:
Disk keys and tape pool keys (Brocade native mode support)
Data Encryption Key (DEK) creation, retrieval, and update for disk and tape pool keys in Brocade
native mode are as follows:
• DEK creation: The DEK is archived into the primary LKM/SSKM. Upon successful archival of
the DEK onto the primary LKM/SSKM, the DEK is read from the secondary LKM/SSKM until it
is either synchronized to the secondary LKM/SSKM, or a timeout of 10 seconds occurs (2
seconds with 5 retries).
- If key archival of the DEK to the primary LKM/SSKM is successful, the DEK that is created
can be used for encrypting disk LUNs or tape pools in Brocade native mode.
- If key archival of the DEK to the primary LKM/SSKM fails, an error is logged and the
operation is retried. If the failure occurs after archival of the DEK to the primary
LKM/SSKM, but before synchronization to the secondary LKM/SSKM, a VAULT_OFFLINE
error is logged and the operation is retried. Any DEK archived to the primary LKM/SSKM in
this case is not used.
• DEK retrieval: The DEK is retrieved from the primary LKM/SSKM if the primary LKM/SSKM is
online and reachable. If the registered primary LKM/SSKM is not online or not reachable, the
DEK is retrieved from a clustered secondary LKM/SSKM.
• DEK update: DEK update behavior is the same as DEK creation.
Tape LUN and DF -compatible tape pool support
Data Encryption Key (DEK) creation, retrieval, and update for tape LUN and DF-compatible tape
pool support are as follows:
• DEK creation: The DEK is created and archived to the primary LKM/SSKM only. Upon
successful archival of the DEK to the primary LKM/SSKM, the DEK can be used for encryption
of a Tape LUN or DF-Compatible tape pool. The DEK is synchronized to a secondary
LKM/SSKM through LKM/SSKM clustering.
If DEK archival onto the primary LKM/SSKM fails, DEK archival is retried to the clustered
secondary LKM/SSKM. If DEK archival also fails to the secondary LKM/SSKM, an error is
logged and the operation is retried.
• DEK retrieval: The DEK is retrieved from the primary LKM/SSKM if the primary LKM/SSKM is
online and reachable. If the primary LKM/SSKM is not online or reachable, the DEK is
retrieved from the clustered secondary LKM/SSKM.
• DEK update: DEK update behavior is the same as DEK creation.