Document Outline

• Contents
• About This Document
  • In this chapter
  • How this document is organized
  • Supported hardware and software
  • What’s new in this document
  • Document conventions
    • Text formatting
    • Command syntax conventions
    • Notes, cautions, and warnings
    • Key terms
  • Additional information
    • Brocade resources
    • Other industry resources
  • Getting technical help
  • Document feedback
• Encryption Overview
  • In this chapter
  • Host and LUN considerations
  • Terminology
  • The Brocade Encryption Switch
  • The FS8-18 blade
  • FIPS mode
  • Performance licensing
    • Adding a license
    • Licensing best practices
  • Recommendation for connectivity
  • Usage limitations
  • Brocade encryption solution overview
    • Data flow from server to storage
  • Data encryption key life cycle management
  • Master key management
    • Master key generation
    • Master key backup
  • Support for virtual fabrics
  • Cisco Fabric Connectivity support
• Configuring Encryption Using the Management Application
  • Encryption Center features
  • Encryption user privileges
  • Smart card usage
    • Using authentication cards with a card reader
    • Registering authentication cards from a card reader
    • Registering authentication cards from the database
    • Deregistering an authentication card
    • Setting a quorum for authentication cards
    • Using system cards
    • Enabling or disabling the system card requirement
    • Registering system cards from a card reader
    • Deregistering system cards
    • Using smart cards
    • Tracking smart cards
    • Editing smart cards
  • Network connections
  • Blade processor links
    • Configuring blade processor links
  • Encryption node initialization and certificate generation
    • Setting encryption node initialization
  • Steps for connecting to an ESKM/SKM appliance
    • Configuring a Brocade group on ESKM/SKM
    • Registering the ESKM/SKM Brocade group user name and password
    • Setting up the local Certificate Authority (CA) on ESKM/SKM
    • Downloading the local CA certificate from ESKM/SKM
    • Creating and installing the ESKM/SKM server certificate
    • Enabling SSL on the Key Management System (KMS) Server
    • Creating an ESKM/SKM high availability cluster
    • Copying the local CA certificate for a clustered ESKM/SKM appliance
    • Adding ESKM/SKM appliances to the cluster
    • Signing the encryption node KAC certificates
    • Importing a signed KAC certificate into a switch
    • ESKM/SKM key vault high availability deployment
    • Data Encryption Keys
      • Disk keys and tape pool keys support
      • Tape LUN support
      • ESKM/SKM key vault deregistration
  • Encryption preparation
  • Creating an encryption group
    • Configuring key vault settings for HP Enterprise Secure Key Manager (ESKM/SKM)
    • Understanding configuration status results
  • Adding a switch to an encryption group
  • Replacing an encryption engine in an encryption group
  • High availability clusters
    • HA cluster configuration rules
    • Creating HA clusters
    • Removing engines from an HA cluster
    • Swapping engines in an HA cluster
    • Failback option
    • Invoking failback
  • Configuring encryption storage targets
    • Adding an encryption target
  • Configuring hosts for encryption targets
  • Adding target disk LUNs for encryption
    • Configuring storage arrays
  • Adding target tape LUNs for encryption
  • Moving targets
  • Tape LUN write early and read ahead
    • Enabling and disabling tape LUN write early and read ahead
  • Tape LUN statistics
    • Viewing and clearing tape container statistics
    • Viewing and clearing tape LUN statistics for specific tape LUNs
    • Viewing and clearing statistics for tape LUNs in a container
  • Encryption engine rebalancing
    • Rebalancing an encryption engine
  • Master keys
    • Active master key
    • Alternate master key
    • Master key actions
    • Saving the master key to a file
    • Saving a master key to a key vault
    • Saving a master key to a smart card set
      • Overview of Saving a master key to a smart card set
    • Restoring a master key from a file
    • Restoring a master key from a key vault
    • Restoring a master key from a smart card set
    • Creating a master key
  • Security settings
  • Zeroizing an encryption engine
    • Setting zeroization
  • Using the Encryption Targets dialog box
  • Redirection zones
  • Disk device decommissioning
    • Decommissioning Disk LUNs
    • Displaying and deleting decommissioned key IDs
    • Displaying Universal IDs
  • Rekeying all disk LUNs manually
    • Setting disk LUN Re-key All
    • Viewing disk LUN rekeying details
    • Viewing the progress of manual rekey operations
  • Thin provisioned LUNs
    • Thin provisioning support
  • Viewing time left for auto rekey
  • Viewing and editing switch encryption properties
    • Exporting the public key certificate signing request (CSR) from properties
    • Importing a signed public key certificate from properties
    • Enabling and disabling the encryption engine state from properties
  • Viewing and editing encryption group properties
    • General tab
    • Members tab
      • Members tab Remove button
    • Consequences of removing an encryption switch
    • Security tab
    • HA Clusters tab
    • Tape Pools tab
      • Tape pools overview
      • Adding tape pools
    • Engine Operations tab
  • Encryption-related acronyms in log messages
• Configuring Encryption Using the CLI
  • Overview
  • Command validation checks
  • Command RBAC permissions and AD types
  • Cryptocfg Help command output
  • Management LAN configuration
  • Configuring cluster links
    • Special consideration for blades
    • IP Address change of a node within an encryption group
      • Node is a group leader node
      • Node is a member node
  • Setting encryption node initialization
  • Steps for connecting to an SKM or ESKM appliance
    • Configuring a Brocade group
    • Setting up the local Certificate Authority (CA)
    • Downloading the local CA certificate
    • Creating and installing the SKM or ESKM server certificate
    • Enabling SSL on the Key Management System (KMS) Server
    • Creating an SKM or ESKM high availability cluster
    • Copying the local CA certificate
    • Adding SKM or ESKM appliances to the cluster
    • Initializing the Fabric OS encryption engines
    • Signing the Brocade encryption node KAC certificates
    • Registering SKM or ESKM on a Brocade encryption group leader
    • Registering the SKM/ESKM Brocade group user name and password
    • SKM or ESKM key vault high availability deployment
    • Data Encryption Keys
      • Disk keys and tape pool keys support
      • Tape LUN support
      • SKM or ESKM Key Vault Deregistration
    • Adding a member node to an encryption group
  • Generating and backing up the master key
  • High availability clusters
    • HA cluster configuration rules
    • Creating an HA cluster
    • Adding an encryption engine to an HA cluster
    • Removing engines from an HA cluster
    • Swapping engines in an HA cluster
    • Failover/failback policy configuration
      • Policy Configuration Examples
  • Re-exporting a master key
    • Exporting an additional key ID
    • Viewing the master key IDs
  • Enabling the encryption engine
    • Checking encryption engine status
  • Zoning considerations
    • Setting default zoning to no access
    • Frame redirection zoning
    • Creating an initiator - target zone
  • CryptoTarget container configuration
    • LUN rebalancing when hosting both disk and tape targets
    • Gathering information
    • Creating a CryptoTarget container
    • Removing an initiator from a CryptoTarget container
    • Deleting a CryptoTarget container
    • Moving a CryptoTarget container
  • Crypto LUN configuration
    • Discovering a LUN
    • Configuring a Crypto LUN
    • Crypto LUN parameters and policies
    • Configuring a tape LUN
    • Removing a LUN from a CryptoTarget container
    • Modifying Crypto LUN parameters
    • LUN modification considerations
  • Impact of tape LUN configuration changes
  • Configuring a multi-path Crypto LUN
    • Multi-path LUN configuration example
  • Decommissioning LUNs
  • Decommissioning replicated LUNs
    • Decommissioning primary LUNs only
    • Decommissioning secondary LUNs only
    • Decommissioning primary and secondary LUN pairs
  • Force-enabling a decommissioned disk LUN for encryption
  • Force-enabling a disabled disk LUN for encryption
  • Tape pool configuration
    • Tape pool labeling
      • CommVault Galaxy labeling
      • NetBackup labeling
      • NetWorker labeling
    • Creating a tape pool
    • Deleting a tape pool
    • Modifying a tape pool
    • Impact of tape pool configuration changes
  • First-time encryption
    • Resource allocation
    • First-time encryption modes
    • Configuring a LUN for first-time encryption
  • Thin provisioned LUNs
    • Space reclamation
    • Supported operations on thin provisioned LUNs
  • Data rekeying
    • Thin provisioned LUN limitations during rekey
    • Resource allocation
    • Rekeying modes
    • Configuring a LUN for automatic rekeying
    • Initiating a manual rekey session
    • Suspension and resumption of rekeying operations
• Deployment Scenarios
  • In this chapter
  • Single encryption switch, two paths from host to target
  • Single fabric deployment - HA cluster
  • Single fabric deployment - DEK cluster
  • Dual fabric deployment - HA and DEK cluster
  • Multiple paths, one DEK cluster, and two HA clusters
  • Multiple paths, DEK cluster, no HA cluster
  • Deployment in Fibre Channel routed fabrics
  • Deployment as part of an edge fabric
  • Deployment with FCIP extension switches
  • VMware ESX server deployments
• Best Practices and Special Topics
  • Firmware upgrade and downgrade considerations
    • General guidelines
    • Specific guidelines for HA clusters
  • Configuration upload and download considerations
    • Configuration upload at an encryption group leader node
    • Configuration upload at an encryption group member node
    • Information not included in an upload
    • Steps before configuration download
    • Configuration download at the encryption group leader
    • Configuration download at an encryption group member
    • Steps after configuration download
  • HP-UX considerations
  • AIX Considerations
  • Enabling a disabled LUN
  • Disk metadata
  • Tape metadata
  • Tape data compression
  • Tape pools
  • Tape block zero handling
  • Tape key expiry
  • Configuring CryptoTarget containers and LUNs
  • Redirection zones
  • Deployment with Admin Domains (AD)
  • Do not use DHCP for IP interfaces
  • Ensure uniform licensing in HA clusters
  • Tape library media changer considerations
  • Turn off host-based encryption
  • Avoid double encryption
  • PID failover
  • Turn off compression on extension switches
  • Rekeying best practices and policies
    • Manual rekey
    • Latency in rekey operations
    • Allow rekey to complete before deleting a container
    • Rekey operations and firmware upgrades
    • Do not change LUN configuration while rekeying
    • Recommendation for Host I/O traffic during online rekeying and first- time encryption
  • KAC certificate registration expiry
  • Changing IP addresses in encryption groups
  • Disabling the encryption engine
  • Recommendations for Initiator Fan-Ins
  • Best practices for host clusters in an encryption environment
  • HA Cluster deployment considerations and best practices
  • Key Vault Best Practices
  • Tape device LUN mapping
  • Special notes for HP Data Protector backup and restore application
    • Tape pool encryption policy specification
    • Tape LUN encryption policy specification
• Maintenance and Troubleshooting
  • Encryption group and HA cluster maintenance
    • Displaying encryption group configuration or status information
    • Removing a member node from an encryption group
    • Deleting an encryption group
    • Removing an HA cluster member
    • Displaying the HA cluster configuration
    • Replacing an HA cluster member
      • Case 1: Replacing a failed encryption engine in an HA cluster
    • Deleting an HA cluster member
    • Performing a manual failback of an encryption engine
      • Failover/failback example
  • Encryption group merge and split use cases
    • A member node failed and is replaced
      • Impact
      • Recovery
    • A member node reboots and comes back up
      • Impact
      • Recovery
    • A member node lost connection to the group leader
      • Impact
      • Recovery
    • A member node lost connection to all other nodes in the encryption group
      • Impact
      • Recovery
    • Several member nodes split off from an encryption group
      • Impact
      • Recovery
    • Adjusting heartbeat signaling values
    • EG split possibilities requiring manual recovery
      • EG split manual recovery steps
      • Two node EG split manual recovery example
    • Configuration impact of encryption group split or node isolation
  • Encryption group database manual operations
    • Manually synchronizing the encryption group database
    • Manually synchronizing the security database
    • Aborting a pending database transaction
  • Key vault diagnostics
    • Key vault connectivity
  • Measuring encryption performance
  • General encryption troubleshooting
  • Troubleshooting examples using the CLI
    • Encryption Enabled CryptoTarget LUN
    • Encryption Disabled CryptoTarget LUN
  • Management application encryption wizard troubleshooting
    • Errors related to adding a switch to an existing group
    • Errors related to adding a switch to a new group
    • General errors related to the Configure Switch Encryption wizard
  • LUN policy troubleshooting
  • Loss of encryption group leader after power outage
  • MPIO and internal LUN states
    • Suspension and resumption of rekeying operations
  • FS8-18 blade removal and replacement
    • Multi-node EG replacement
    • Single-node EG replacement
  • Brocade Encryption Switch removal and replacement
    • Multi-node EG Case
    • Single-node EG Replacement
  • Reclaiming the WWN base of a failed Brocade Encryption Switch
  • Removing stale rekey information for a LUN
  • Downgrading firmware from Fabric OS 7.2.0
  • Fabric OS and ESKM compatibility matrix
  • Splitting an encryption group into two encryption groups
  • Moving an encryption blade from one EG to another in the same fabric
  • Moving an encryption switch from one EG to another in the same fabric
• State and Status Information
  • In this appendix
  • Encryption engine security processor (SP) states
  • Security processor KEK status
  • Encrypted LUN states
• Index