HP 4400 HP B-series Fabric OS 7.0.0a Release Notes (5697-0881, June 2011) - Page 43

The Encryption SAN Switch and Encryption FC blade do not support QoS. When using encryption

Get HP 4400 PDF manuals and user guides View all HP 4400 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 43 highlights

• The Encryption SAN Switch and Encryption FC blade do not support QoS. When using encryption or Frame Redirection, participating flows should not be included in QoS Zones. • HP encryption devices can be configured for either disk or tape operation. However, encryption FC blades can be configured to support different media types within a common DC SAN Director/ DC04 SAN Director chassis. The ability to configure multiple Crypto-Target Containers defining different media types on a single encryption engine (Encryption SAN Switch or Encryption FC blade) is supported beginning with Fabric OS 6.4.0. • When the tape key expires in the middle of write operation on the tape, the key is used to append the data on the tape media. When the backup application rewinds the media and starts writing to Block-0 again (and if the key is expired), a new key is created and used henceforth. The expired key is then marked as read only and used only for restoring data from previously encrypted tapes. • Note that the disk device decommission functionality is not currently supported with SKM/ESKM. • SKM/ESKM FIPS Mode Enablement FIPS compliance mode is disabled in SKM/ESKM by default. To enable it, follow the procedure described in the SKM/ESKM user guide, "Configuring the Key Manager for FIPS Compliance" section. NOTE: Per FIPS requirements, you cannot enable or disable FIPS when there are keys on the Key Manager. Therefore, if FIPS enablement is required, HP strongly recommends that it be performed during the initial SKM/ESKM configuration, before any key sharing between the switch and the SKM/ESKM occurs. • SKM/ESKM dual node cluster - Auto failover considerations: In a dual node SKM/ESKM cluster configuration with the encryption switch, ensure that the two SKM/ESKM nodes are always available and online for proper key archival. If one of the SKM/ESKM nodes fails, you cannot use the configuration to create new keys. In other words, adding new targets or LUNs to the encryption path will not work until both the SKM/ESKM nodes are available. However, there will not be any issue for retrieving keys or using the existing setup as long as one SKM/ESKM node is available. The encryption switch makes sure that any new KEY is hardened (archived) to both SKM/ESKM Key Vaults in the SKM/ESKM Cluster before the key gets used for encryption. In the event that one of the SKM/ESKM vaults is down, the key creation will fail because of the hardening check failure. As a result, the new key creation operation will not function. For Key retrieval, this is not the requirement and any one Key Vault being online will get the Key as long as that Key Vault has the Key. • Auto rekeying of encrypted disk LUNs may be delayed when an encryption engine reboots or when HAC failover/failback occurs. Should either of these events delay auto rekeying, use the cryptocfg -manual_rekey command to manually start the rekeying of the affected LUNs. HP B-series Fabric OS 7.0.0a Release Notes 43

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
•
The Encryption SAN Switch and Encryption FC blade do not support QoS. When using encryption
or Frame Redirection, participating flows should not be included in QoS Zones.
•
HP encryption devices can be configured for either disk or tape operation. However, encryption
FC blades can be configured to support different media types within a common DC SAN Director/
DC04 SAN Director chassis. The ability to configure multiple Crypto-Target Containers defining
different media types on a single encryption engine (Encryption SAN Switch or Encryption FC
blade) is supported beginning with Fabric OS 6.4.0.
•
When the tape key expires in the middle of write operation on the tape, the key is used to append
the data on the tape media. When the backup application rewinds the media and starts writing
to Block-0 again (and if the key is expired), a new key is created and used henceforth. The expired
key is then marked as read only and used only for restoring data from previously encrypted tapes.
•
Note that the disk device decommission functionality is not currently supported with SKM/ESKM.
•
SKM/ESKM FIPS Mode Enablement
FIPS compliance mode is disabled in SKM/ESKM by default. To enable it, follow the procedure
described in the SKM/ESKM user guide,
“
Configuring the Key Manager for FIPS Compliance
”
section.
NOTE:
Per FIPS requirements, you cannot enable or disable FIPS when there are keys on the Key Manager.
Therefore, if FIPS enablement is required, HP strongly recommends that it be performed during
the initial SKM/ESKM configuration, before any key sharing between the switch and the
SKM/ESKM occurs.
•
SKM/ESKM dual node cluster - Auto failover considerations:
In a dual node SKM/ESKM cluster configuration with the encryption switch, ensure that the two
SKM/ESKM nodes are always available and online for proper key archival. If one of the
SKM/ESKM nodes fails, you cannot use the configuration to create new keys. In other words,
adding new targets or LUNs to the encryption path will not work until both the SKM/ESKM nodes
are available. However, there will not be any issue for retrieving keys or using the existing setup
as long as one SKM/ESKM node is available.
The encryption switch makes sure that any new KEY is hardened (archived) to both SKM/ESKM
Key Vaults in the SKM/ESKM Cluster before the key gets used for encryption. In the event that
one of the SKM/ESKM vaults is down, the key creation will fail because of the hardening check
failure. As a result, the new key creation operation will not function. For Key retrieval, this is not
the requirement and any one Key Vault being online will get the Key as long as that Key Vault
has the Key.
•
Auto rekeying of encrypted disk LUNs may be delayed when an encryption engine reboots or
when HAC failover/failback occurs. Should either of these events delay auto rekeying, use the
cryptocfg –manual_rekey
command to manually start the rekeying of the affected LUNs.
HP B-series Fabric OS 7.0.0a Release Notes
43