HP 8/8 Fabric OS Encryption Administrator's Guide v6.4.0 (53-1001864-01, June - Page 166
Initiating a manual re-key session
View all HP 8/8 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 166 highlights
3 Data re-keying Initiating a manual re-key session If auto re-keying is disabled, you can initiate a re-keying session manually at your own convenience. All encryption engines in a given HA cluster, DEK cluster, or encryption group must be online for this operation to succeed. The manual re-keying feature is useful when the key is compromised and you want to re-encrypt existing data on the LUN before taking action on the compromised key. CAUTION Do not commit this operation if there are any changes pending for the container in which the re-key was started. If you attempt to do this, the system displays a warning stating that the encryption engine is busy and a forced commit is required for the changes to take effect. A forced commit in this situation will halt any re-key that is in-progress (in any container) and corrupt any LUN that is running re-key at the time. There is no recovery for this type of failure. 1. Log into the group leader as FabricAdmin. 2. Do LUN discovery by issuing the cryptocfg --discoverLUN command before issuing the manual_rekey command to avoid a potential I/O timeout because of a path state change at the host. 3. Ensure that all encryption engines in the HA cluster, DEK cluster, or encryption group are online by issuing the cryptocfg --show -groupmember -all command. 4. Enter the cryptocfg --manual_rekey command. Specify the CryptoTarget container name, the LUN number and the initiator PWWN. FabricAdmin:switch>cryptocfg --manual_rekey my_disk_tgt 0x0\ 10:00:00:05:1e:53:37:99 Operation Succeeded Please check the status of the operation using "cryptocfg --show -rekey" 5. Check the status of the re-keying session. FabricAdmin:switch> cryptocfg --show -rekey -all Number of rekey session(s):1 Container name:my_disk_tgt EE node:10:00:00:05:1e:53:8b:15 EE slot:0 Target:29:af:00:11:0d:03:00:04 29:af:00:11:0d:03:00:04 Target PID:030e04 VT: 20:14:00:05:1e:53:74:fd 20:14:00:05:1e:53:74:fd VT PID:5e3201 Host: 10:00:00:05:1e:53:37:99 20:00:00:05:1e:53:37:99 Host PID:030a00 VI: 20:20:00:05:1e:53:74:fd 20:21:00:05:1e:53:74:fd VI PID:5e3301 LUN number:0x0 LUN serial number:600110D00004000000000004000000000400000000000000 Rekey session number:5 Percentage complete:10 Rekey state:Write Phase Rekey role:Primary/Active Block size:512 Number of blocks:909312 Current LBA:818704 Operation succeeded. 148 Fabric OS Encryption Administrator's Guide 53-1001864-01