Document Outline

• Contents
• About This Document
  • In this chapter
  • How this document is organized
  • Supported hardware and software
  • What’s new in this document
  • Document conventions
    • Text formatting
    • Command syntax conventions
    • Notes, cautions, and warnings
    • Key terms
  • Additional information
    • Brocade resources
    • Other industry resources
  • Getting technical help
  • Document feedback
• Encryption Overview
  • In this chapter
  • Host and LUN considerations
  • Terminology
  • The Brocade Encryption Switch
  • The FS8-18 blade
  • FIPS mode
  • Performance licensing
    • Adding a license
    • Licensing best practices
  • Recommendation for connectivity
  • Usage limitations
  • Brocade encryption solution overview
    • Data flow from server to storage
  • Data encryption key life cycle management
  • Master key management
    • Master key generation
    • Master key backup
  • Support for virtual fabrics
  • Cisco Fabric Connectivity support
• Configuring Encryption Using the Management Application
  • In this chapter
  • Encryption Center features
  • Encryption user privileges
  • Smart card usage
    • Using authentication cards with a card reader
    • Registering authentication cards from a card reader
    • Registering authentication cards from the database
    • Deregistering an authentication card
    • Setting a quorum for authentication cards
    • Using system cards
    • Enabling or disabling the system card requirement
    • Registering systems card from a card reader
    • Deregistering system cards
    • Using smart cards
    • Tracking smart cards
    • Editing smart cards
  • Network connections
  • Blade processor links
    • Configuring blade processor links
  • Encryption node initialization and certificate generation
    • Setting encryption node initialization
  • Steps for connecting to a DPM appliance
    • Exporting the KAC certificate signing request (CSR)
    • Submitting the CSR to a certificate authority
    • KAC certificate registration expiry
    • Importing the signed KAC certificate
    • Uploading the CA certificate onto the DPM appliance (and first-time configurations)
    • Uploading the KAC certificate onto the DPM appliance (manual identity enrollment)
    • DPM key vault high availability deployment
    • Loading the CA certificate onto the encryption group leader
  • Encryption preparation
  • Creating an encryption group
    • Configuring key vault settings for RSA Data Protection Manager (DPM)
    • Understanding configuration status results
  • Adding a switch to an encryption group
  • Replacing an encryption engine in an encryption group
  • High availability clusters
    • HA cluster configuration rules
    • Creating HA clusters
    • Removing engines from an HA cluster
    • Swapping engines in an HA cluster
    • Failback option
    • Invoking failback
  • Configuring encryption storage targets
    • Adding an encryption target
  • Configuring hosts for encryption targets
  • Adding target disk LUNs for encryption
    • Configuring storage arrays
    • Remote replication LUNs
    • SRDF pairs
    • Metadata requirements and remote replication
  • Adding target tape LUNs for encryption
  • Moving targets
  • Tape LUN write early and read ahead
    • Enabling and disabling tape LUN write early and read ahead
  • Tape LUN statistics
    • Viewing and clearing tape container statistics
    • Viewing and clearing tape LUN statistics for specific tape LUNs
    • Viewing and clearing statistics for tape LUNs in a container
  • Encryption engine rebalancing
    • Rebalancing an encryption engine
  • Master keys
    • Active master key
    • Alternate master key
    • Master key actions
    • Saving the master key to a file
    • Saving a master key to a key vault
    • Saving a master key to a smart card set
      • Overview of saving a master key to a smart card set
    • Restoring a master key from a file
    • Restoring a master key from a key vault
    • Restoring a master key from a smart card set
    • Creating a master key
  • Security settings
  • Zeroizing an encryption engine
    • Setting zeroization
  • Using the Encryption Targets dialog box
  • Redirection zones
  • Disk device decommissioning
    • Decommissioning disk LUNs
    • Displaying and deleting decommissioned key IDs
    • Displaying Universal IDs
  • Rekeying all disk LUNs manually
    • Setting disk LUN Re-key All
    • Viewing disk LUN rekeying details
    • Viewing the progress of manual rekey operations
  • Thin provisioned LUNs
    • Thin Provisioning support
  • Viewing time left for auto rekey
  • Viewing and editing switch encryption properties
    • Exporting the public key certificate signing request from properties
    • Importing a signed public key certificate from properties
    • Enabling and disabling the encryption engine state from properties
  • Viewing and editing encryption group properties
    • General tab
    • Members tab
      • Members tab Remove button
    • Consequences of removing an encryption switch
    • Security tab
    • HA Clusters tab
    • Tape Pools tab
      • Tape pools overview
      • Adding tape pools
    • Engine Operations tab
  • Encryption-related acronyms in log messages
• Configuring Encryption Using the CLI
  • In this chapter
  • Overview
  • Command validation checks
  • Command RBAC permissions and AD types
  • Cryptocfg Help command output
  • Management LAN configuration
  • Configuring cluster links
    • Special consideration for blades
    • IP Address change of a node within an encryption group
      • Node is a group leader node
      • Node is a member node
  • Setting encryption node initialization
  • Steps for connecting to a DPM appliance
    • Initializing the Fabric OS encryption engines
    • Exporting the KAC certificate signing request (CSR)
    • Submitting the CSR to a CA
    • Importing the signed KAC certificate
    • Uploading the CA certificate onto the DPM appliance (and first-time configurations)
    • Uploading the KAC certificate onto the DPM apliance (manual identity enrollment)
    • Creating a Brocade encryption group
    • Client registration for manual enrollment
    • DPM key vault high availability deployment
    • Setting heartbeat signaling values
  • Adding a member node to an encryption group
    • Registering DPM on a Fabric OS encryption group leader
  • Generating and backing up the master key
  • High availability clusters
    • HA cluster configuration rules
    • Creating an HA cluster
    • Adding an encryption engine to an HA cluster
    • Removing engines from an HA cluster
    • Swapping engines in an HA cluster
    • Failover/failback policy configuration
      • Policy Configuration Examples
  • Re-exporting a master key
    • Exporting an additional key ID
    • Viewing the master key IDs
  • Enabling the encryption engine
    • Checking encryption engine status
  • Zoning considerations
    • Setting default zoning to no access
    • Frame redirection zoning
    • Creating an initiator - target zone
  • CryptoTarget container configuration
    • LUN rebalancing when hosting both disk and tape targets
    • Gathering information
    • Creating a CryptoTarget container
    • Removing an initiator from a CryptoTarget container
    • Deleting a CryptoTarget container
    • Moving a CryptoTarget container
  • Crypto LUN configuration
    • Discovering a LUN
    • Configuring a Crypto LUN
    • Crypto LUN parameters and policies
    • Configuring a tape LUN
    • Removing a LUN from a CryptoTarget container
    • Modifying Crypto LUN parameters
    • LUN modification considerations
  • Impact of tape LUN configuration changes
  • Decommissioning LUNs
  • Decommissioning replicated LUNs
    • Decommissioning primary R1 LUNs only
    • Decommissioning mirror R2 LUNs only
    • Decommissioning primary R1 and mirror R2 LUN pairs
  • Force-enabling a decommissioned disk LUN for encryption
  • Force-enabling a disabled disk LUN for encryption
  • SRDF LUNs
    • SRDF pairs
    • Enabling remote replication mode
    • Adding replication LUNs
    • Rekey operations for replicated LUNs
    • Reading metadata after sync
  • Using SRDF, TimeFinder and RecoverPoint with encryption
    • RecoverPoint Configuration Restrictions
    • Initial Configuration Requirements
    • SRDF/RP initial setup at the source (R1) site
    • SRDF/RecoverPoint remote target (R2) site
  • Configuring LUNs for SRDF/TF or RP deployments
    • Creating new source LUNs that can later be replicated
    • Migrating LUNs with existing data to LUNs that can be replicated
      • OPTION 1 (data migration for encrypted source LUNs)
      • OPTION 2 (data migration for cleartext source LUNs)
    • Synchronizing source and target LUN SRDF/RP pairs
    • Configuring TimeFinder target devices
    • Configuring SRDF Gatekeeper LUNs
  • SRDF/TF/RP manual rekeying procedures
    • TF snapshot rekeying details
    • TF clone/mirror rekeying details
    • Rekeying local site (R1) SRDF LUNs
    • Rekeying LUNs for RP deployments - local site
    • Rekeying remote site (R2) SRDF LUNs
    • Rekeying LUNs for RP deployments - remote site
    • Behavior with Hosts writing beyond reported capacity
  • Tape pool configuration
    • Tape pool labeling
      • CommVault Galaxy labeling
      • NetBackup labeling
      • NetWorker labeling
    • Creating a tape pool
    • Deleting a tape pool
    • Modifying a tape pool
    • Impact of tape pool configuration changes
  • Configuring a multi-path Crypto LUN
    • Multi-path LUN configuration example
  • First-time encryption
    • Resource allocation
    • First-time encryption modes
    • Configuring a LUN for first-time encryption
  • Thin provisioned LUNs
    • Space reclamation
    • Supported operations on thin provisioned LUNs
  • Data rekeying
    • Thin provisioned LUN limitations during rekey
    • Resource allocation
    • Rekeying modes
    • Configuring a LUN for automatic rekeying
    • Initiating a manual rekey session
    • Suspension and resumption of rekeying operations
• Deployment Scenarios
  • In this chapter
  • Single encryption switch, two paths from host to target
  • Single fabric deployment - HA cluster
  • Single fabric deployment - DEK cluster
  • Dual fabric deployment - HA and DEK cluster
  • Multiple paths, one DEK cluster, and two HA clusters
  • Multiple paths, DEK cluster, no HA cluster
  • Deployment in Fibre Channel routed fabrics
  • Deployment as part of an edge fabric
  • Deployment with FCIP extension switches
  • Data mirroring deployment
    • If metadata is not present on the LUN
  • VMware ESX server deployments
• Best Practices and Special Topics
  • In this chapter
  • Firmware upgrade and downgrade considerations
    • General guidelines
    • Specific guidelines for HA clusters
  • Configuration upload and download considerations
    • Configuration upload at an encryption group leader node
    • Configuration upload at an encryption group member node
    • Information not included in an upload
    • Steps before configuration download
    • Configuration download at the encryption group leader
    • Configuration download at an encryption group member
    • Steps after configuration download
  • HP-UX considerations
  • AIX considerations
  • Enabling a disabled LUN
  • Decommissioning in an EG containing mixed modes
  • Decommissioning a multi-path LUN
  • Disk metadata
  • Tape metadata
  • Tape data compression
  • Tape pools
  • Tape block zero handling
  • Tape key expiry
  • Configuring CryptoTarget containers and LUNs
  • Redirection zones
  • Deployment with Admin Domains (AD)
  • Do not use DHCP for IP interfaces
  • Ensure uniform licensing in HA clusters
  • Tape library media changer considerations
  • Turn off host-based encryption
  • Avoid double encryption
  • PID failover
  • Turn off compression on extension switches
  • Rekeying best practices and policies
    • Manual rekey
    • Latency in rekey operations
    • Allow rekey to complete before deleting a container
    • Rekey operations and firmware upgrades
    • Do not change LUN configuration while rekeying
    • Recommendation for Host I/O traffic during online rekeying and first- time encryption
  • KAC certificate registration expiry
  • Changing IP addresses in encryption groups
  • Disabling the encryption engine
  • Recommendations for Initiator Fan-Ins
  • Best practices for host clusters in an encryption environment
  • HA Cluster deployment considerations and best practices
  • Key vault best practices
  • Tape device LUN mapping
• Maintenance and Troubleshooting
  • In this chapter
  • Encryption group and HA cluster maintenance
    • Displaying encryption group configuration or status information
    • Removing a member node from an encryption group
    • Deleting an encryption group
    • Removing an HA cluster member
    • Displaying the HA cluster configuration
    • Replacing an HA cluster member
      • Case 1: Replacing a failed encryption engine in an HA cluster
    • Deleting an HA cluster member
    • Performing a manual failback of an encryption engine
      • Failover/failback example
  • Encryption group merge and split use cases
    • A member node failed and is replaced
      • Impact
      • Recovery
    • A member node reboots and comes back up
      • Impact
      • Recovery
    • A member node lost connection to the group leader
      • Impact
      • Recovery
    • A member node lost connection to all other nodes in the encryption group
      • Impact
      • Recovery
    • Several member nodes split off from an encryption group
      • Impact
      • Recovery
    • Adjusting heartbeat signaling values
    • EG split possibilities requiring manual recovery
      • EG split manual recovery steps
      • Two node EG split manual recovery example
    • Configuration impact of encryption group split or node isolation
  • Encryption group database manual operations
    • Manually synchronizing the encryption group database
    • Manually synchronizing the security database
    • Aborting a pending database transaction
  • Key vault diagnostics
    • Key vault connectivity
  • Measuring encryption performance
  • General encryption troubleshooting
  • Troubleshooting examples using the CLI
    • Encryption Enabled CryptoTarget LUN
    • Encryption Disabled CryptoTarget LUN
  • Management application encryption wizard troubleshooting
    • Errors related to adding a switch to an existing group
    • Errors related to adding a switch to a new group
    • General errors related to the Configure Switch Encryption wizard
  • LUN policy troubleshooting
  • Loss of encryption group leader after power outage
  • MPIO and internal LUN states
    • Suspension and resumption of rekeying operations
  • FS8-18 blade removal and replacement
    • Multi-node EG replacement
    • Single-node EG replacement
  • Brocade Encryption Switch removal and replacement
    • Multi-node EG Case
    • Single-node EG Replacement
  • Deregistering a DPM key vault
  • Reclaiming the WWN base of a failed Brocade Encryption Switch
  • Removing stale rekey information for a LUN
  • Downgrading firmware from Fabric OS 7.1.0
  • Fabric OS and DPM Compatibility Matrix
  • Splitting an encryption group into two encryption groups
  • Moving an encryption blade from one EG to another in the same fabric
  • Moving an encryption switch from one EG to another in the same fabric
• State and Status Information
  • In this appendix
  • Encryption engine security processor (SP) states
  • Security processor KEK status
  • Encrypted LUN states
• Index