Document Outline

• Contents
• About This Document
  • In this chapter
  • How this document is organized
  • Supported hardware and software
  • What’s new in this document
  • Document conventions
    • Text formatting
    • Command syntax conventions
    • Notes, cautions, and warnings
    • Key terms
  • Additional information
    • Brocade resources
    • Other industry resources
  • Getting technical help
  • Document feedback
• Encryption Overview
  • In this chapter
  • Host and LUN considerations
  • Terminology
  • The Brocade Encryption Switch
  • The FS8-18 blade
  • FIPS mode
  • Performance licensing
    • Adding a license
    • Licensing best practices
  • Recommendation for connectivity
  • Usage limitations
  • Brocade encryption solution overview
    • Data flow from server to storage
  • Data encryption key life cycle management
  • Master key management
    • Master key generation
    • Master key backup
  • Support for virtual fabrics
  • Cisco Fabric Connectivity support
• Configuring Encryption Using the Management Application
  • In this chapter
  • Encryption Center features
  • Encryption user privileges
  • Smart card usage
    • Using authentication cards with a card reader
    • Registering authentication cards from a card reader
    • Registering authentication cards from the database
    • Deregistering an authentication card
    • Setting a quorum for authentication cards
    • Using system cards
    • Enabling or disabling the system card requirement
    • Registering systems card from a card reader
    • Deregistering system cards
    • Using smart cards
    • Tracking smart cards
    • Editing smart cards
  • Network connections
  • Blade processor links
    • Configuring blade processor links
  • Encryption node initialization and certificate generation
    • Setting encryption node initialization
  • Key Management Interoperability Protocol
  • Steps for connecting to a KMIP appliance (SafeNet KeySecure)
    • Setting FIPS compliance
    • Creating a local CA
    • Creating a server certificate
    • Creating a cluster
    • Configuring a Brocade group on the KeySecure appliance
    • Registering the KeySecure Brocade group user name and password
    • Signing the encryption node KAC CSR on KMIP
    • Importing a signed KAC certificate into a switch
    • Backing up the certificates
    • Configuring the KMIP server
    • Adding a node to the cluster
  • Encryption preparation
  • Creating an encryption group
    • Configuring key vault settings for Key Management Interoperability Protocol (KMIP)
    • Understanding configuration status results
  • Adding a switch to an encryption group
  • Replacing an encryption engine in an encryption group
  • High availability (HA) clusters
    • HA cluster configuration rules
    • Creating HA clusters
    • Removing engines from an HA cluster
    • Swapping engines in an HA cluster
    • Failback option
    • Invoking failback
  • Configuring encryption storage targets
    • Adding an encryption target
  • Configuring hosts for encryption targets
  • Adding target disk LUNs for encryption
    • Configuring storage arrays
  • Adding target tape LUNs for encryption
  • Moving Targets
  • Configuring encrypted tape storage in a multi-path environment
  • Tape LUN write early and read ahead
    • Enabling and disabling tape LUN write early and read ahead
  • Tape LUN statistics
    • Viewing and clearing tape container statistics
    • Viewing and clearing tape LUN statistics for specific tape LUNs
    • Viewing and clearing statistics for tape LUNs in a container
  • Encryption engine rebalancing
    • Rebalancing an encryption engine
  • Master keys
    • Active master key
    • Alternate master key
    • Master key actions
    • Saving the master key to a file
    • Saving a master key to a key vault
    • Saving a master key to a smart card set
      • Saving a master key to a smart card set - Overview
    • Restoring a master key from a file
    • Restoring a master key from a key vault
    • Restoring a master key from a smart card set
    • Creating a master key
  • Security Settings
  • Zeroizing an encryption engine
    • Setting zeroization
  • Using the Encryption Targets dialog box
  • Redirection zones
  • Disk device decommissioning
    • Decommissioning disk LUNs
    • Displaying and deleting decommissioned key IDs
    • Displaying Universal IDs
  • Rekeying all disk LUNs manually
    • Setting disk LUN Re-key All
    • Viewing disk LUN rekeying details
    • Viewing the progress of manual rekey operations
  • Thin provisioned LUNs
    • Thin provisioning support
  • Viewing time left for auto rekey
  • Viewing and editing switch encryption properties
    • Exporting the public key certificate signing request (CSR) from properties
    • Importing a signed public key certificate from properties
    • Enabling and disabling the encryption engine state from properties
  • Viewing and editing encryption group properties
    • General tab
    • Members tab
      • Members tab Remove button
    • Consequences of removing an encryption switch
    • Security tab
    • HA Clusters tab
    • Tape Pools tab
      • Tape pools overview
      • Adding tape pools
    • Engine Operations tab
  • Encryption-related acronyms in log messages
• Configuring Encryption Using the CLI
  • In this chapter
  • Overview
  • Command validation checks
  • Command RBAC permissions and AD types
  • Cryptocfg Help command output
  • Management LAN configuration
  • Configuring cluster links
    • Special consideration for blades
    • IP Address change of a node within an encryption group
      • Node is a group leader node
      • Node is a member node
  • Setting encryption node initialization
  • Steps for connecting to a KMIP appliance (SafeNet KeySecure)
    • Setting FIPS compliance
    • Creating a local CA
    • Creating a server certificate
    • Creating a cluster
    • Backing up the certificates
    • Configuring the KMIP server
    • Adding a node to the cluster
  • Configuring the Brocade Encryption Switch key vault setup (SafeNet KeySecure)
    • Setting the key vault type to KMIP
    • Setting key vault Parameters
    • Exporting the KAC CSR to a local machine
    • Signing the KAC CSR using the Local CA
    • Configure the user name and password
    • Register the KAC certificate
    • Register the key vaults as primary and secondary key vaults
    • Verify connectivity
    • Initializing the Brocade encryption engines
    • Registering KMIP on a Brocade encryption group leader
  • Adding a member node to an encryption group
  • Generating and backing up the master key
  • High availability clusters
    • HA cluster configuration rules
    • Creating an HA cluster
    • Adding an encryption engine to an HA cluster
    • Removing engines from an HA cluster
    • Swapping engines in an HA cluster
    • Failover/failback policy configuration
      • Policy Configuration Examples
  • Re-exporting a master key
    • Exporting an additional key ID
    • Viewing the master key IDs
  • Enabling the encryption engine
    • Checking encryption engine status
  • Zoning considerations
    • Setting default zoning to no access
    • Frame redirection zoning
    • Creating an initiator - target zone
  • CryptoTarget container configuration
    • LUN rebalancing when hosting both disk and tape targets
    • Gathering information
    • Creating a CryptoTarget container
    • Removing an initiator from a CryptoTarget container
    • Deleting a CryptoTarget container
    • Moving a CryptoTarget container
  • Crypto LUN configuration
    • Discovering a LUN
    • Configuring a Crypto LUN
    • Crypto LUN parameters and policies
    • Configuring a tape LUN
    • Removing a LUN from a CryptoTarget container
    • Modifying Crypto LUN parameters
    • LUN modification considerations
  • Impact of tape LUN configuration changes
  • Configuring a multi-path Crypto LUN
    • Multi-path LUN configuration example
  • Decommissioning LUNs
  • Decommissioning replicated LUNs
    • Decommissioning primary LUNs only
    • Decommissioning secondary LUNs only
    • Decommissioning primary and secondary LUN pairs
  • Force-enabling a decommissioned disk LUN for encryption
  • Force-enabling a disabled disk LUN for encryption
  • Tape pool configuration
    • Tape pool labeling
      • CommVault Galaxy labeling
      • NetBackup labeling
      • NetWorker labeling
    • Creating a tape pool
    • Deleting a tape pool
    • Modifying a tape pool
    • Impact of tape pool configuration changes
  • First-time encryption
    • Resource allocation
    • First-time encryption modes
    • Configuring a LUN for first-time encryption
  • Thin provisioned LUNs
    • Space reclamation
  • Data rekeying
    • Resource allocation
    • Rekeying modes
    • Configuring a LUN for automatic rekeying
    • Initiating a manual rekey session
    • Suspension and resumption of rekeying operations
• Deployment Scenarios
  • In this chapter
  • Single encryption switch, two paths from host to target
  • Single fabric deployment - HA cluster
  • Single fabric deployment - DEK cluster
  • Dual fabric deployment - HA and DEK cluster
  • Multiple paths, one DEK cluster, and two HA clusters
  • Multiple paths, DEK cluster, no HA cluster
  • Deployment in Fibre Channel routed fabrics
  • Deployment as part of an edge fabric
  • Deployment with FCIP extension switches
  • VMware ESX server deployments
• Best Practices and Special Topics
  • In this chapter
  • Firmware upgrade and downgrade considerations
    • General guidelines
    • Specific guidelines for HA clusters
  • Configuration upload and download considerations
    • Configuration upload at an encryption group leader node
    • Configuration upload at an encryption group member node
    • Information not included in an upload
    • Steps before configuration download
    • Configuration download at the encryption group leader
    • Configuration download at an encryption group member
    • Steps after configuration download
  • HP-UX considerations
  • AIX Considerations
  • Enabling a disabled LUN
  • Disk metadata
  • Tape metadata
  • Tape data compression
  • Tape pools
  • Tape block zero handling
  • Tape key expiry
  • Configuring CryptoTarget containers and LUNs
  • Redirection zones
  • Deployment with Admin Domains (AD)
  • Do not use DHCP for IP interfaces
  • Ensure uniform licensing in HA clusters
  • Tape library media changer considerations
  • Turn off host-based encryption
  • Avoid double encryption
  • PID failover
  • Turn off compression on extension switches
  • Rekeying best practices and policies
    • Manual rekey
    • Latency in rekey operations
    • Allow rekey to complete before deleting a container
    • Rekey operations and firmware upgrades
    • Do not change LUN configuration while rekeying
    • Recommendation for Host I/O traffic during online rekeying and first- time encryption
  • KAC certificate registration expiry
  • Changing IP addresses in encryption groups
  • Disabling the encryption engine
  • Recommendations for Initiator Fan-Ins
  • Best practices for host clusters in an encryption environment
  • HA Cluster deployment considerations and best practices
  • Key Vault Best Practices
  • Tape Device LUN Mapping
• Maintenance and Troubleshooting
  • In this chapter
  • Encryption group and HA cluster maintenance
    • Displaying encryption group configuration or status information
    • Removing a member node from an encryption group
    • Deleting an encryption group
    • Removing an HA cluster member
    • Displaying the HA cluster configuration
    • Replacing an HA cluster member
      • Case 1: Replacing a failed encryption engine in an HA cluster
    • Deleting an HA cluster member
    • Performing a manual failback of an encryption engine
      • Failover/failback example
  • Encryption group merge and split use cases
    • A member node failed and is replaced
      • Impact
      • Recovery
    • A member node reboots and comes back up
      • Impact
      • Recovery
    • A member node lost connection to the group leader
      • Impact
      • Recovery
    • A member node lost connection to all other nodes in the encryption group
      • Impact
      • Recovery
    • Several member nodes split off from an encryption group
      • Impact
      • Recovery
    • Adjusting heartbeat signaling values
    • EG split possibilities requiring manual recovery
      • EG split manual recovery steps
      • Two node EG split manual recovery example
    • Configuration impact of encryption group split or node isolation
  • Encryption group database manual operations
    • Manually synchronizing the encryption group database
    • Manually synchronizing the security database
    • Aborting a pending database transaction
  • Key vault diagnostics
    • Key vault connectivity
  • Measuring encryption performance
  • General encryption troubleshooting
  • Troubleshooting examples using the CLI
    • Encryption Enabled CryptoTarget LUN
    • Encryption Disabled CryptoTarget LUN
  • Management application encryption wizard troubleshooting
    • Errors related to adding a switch to an existing group
    • Errors related to adding a switch to a new group
    • General errors related to the Configure Switch Encryption wizard
  • LUN policy troubleshooting
  • Loss of encryption group leader after power outage
  • MPIO and internal LUN states
    • Suspension and resumption of rekeying operations
  • FS8-18 blade removal and replacement
    • Multi-node EG replacement
    • Single-node EG replacement
  • Brocade Encryption Switch removal and replacement
    • Multi-node EG Case
    • Single-node EG Replacement
  • Reclaiming the WWN base of a failed Brocade Encryption Switch
  • Removing stale rekey information for a LUN
  • Downgrading firmware from Fabric OS 7.1.0
  • Splitting an encryption group into two encryption groups
  • Moving an encryption blade from one EG to another in the same fabric
  • Moving an encryption switch from one EG to another in the same fabric
• State and Status Information
  • In this appendix
  • Encryption engine security processor (SP) states
  • Security processor KEK status
  • Encrypted LUN states
• Index