Home » HP Manuals » Storage Devices » HP 8/8 » Manual Viewer

HP 8/8 Fabric OS Encryption Administrator's Guide v6.4.0 (53-1001864-01, June - Page 185

Specific guidelines for HA clusters, Fabric OS, Administrator's Guide

Add to My Manuals
Save this manual to your list of manuals

Page 185 highlights

Firmware download considerations 5 • A firmware consistency check for Fabric OS version 6.4.0 is enforced in an encryption group if any of the Fabric OS version 6.4.0 features are enabled. If any Fabric OS version 6.4.0 feature is in an enabled state then any firmware download to Fabric OS version 6.3.x or earlier versions is blocked. - Do not try to use configupload from Fabric OS version 6.4.0 and then configdownload to Fabric OS version 6.3.x or earlier versions with any Fabric OS version 6.4.0 feature in an enabled state. - Do not try registering a node running Fabric OS version 6.3.x or earlier to an encryption group when all nodes are running Fabric OS version 6.4.0 with one or more Fabric OS version 6.4.0 features enabled. - Disable all Fabric OS version 6.4.0 features before ejecting a node running Fabric OS version 6.4.0 and registering the node as a member of an encryption group with nodes running Fabric OS version 6.3.x or earlier versions. Specific guidelines for HA clusters The following are specific guidelines for a firmware upgrade of the encryption switch or blade when deployed in HA cluster. The guidelines are based on the following scenario: • There are 2 nodes (BES1 and BES2) in the HA cluster. • Each node hosts certain number of CryptoTarget containers and associated LUNs. • node 1 (BES1) needs to be upgraded first. 1. Change the failback mode to manual if it was set to auto by issuing the following command: cryptocfg --set -failback manual 2. On node 1 (BES1), disable the encryption engine to force the failover of CryptoTarget containers and associated LUNs onto the HA cluster peer member node 2 (BES2) by issuing the following command. cryptocfg --disableEE 3. Make sure that these Crypto Target Containers and LUNs actually failover to node 2 (BES2) in the HA cluster. Check for all LUNs in encryption enabled state on node 2 (BES2). This ensures that I/O also fails over to node 2 (BES2) and continues during this process. 4. On node 1 (BES1) enable the Encryption Engine, by issuing the following command. cryptocfg --enableEE 5. Start firmware download (upgrade) on the node 1 (BES1). Refer to the Fabric OS Administrator's Guide if necessary to review firmware download procedures. 6. After firmware download is complete and node 1 (BES1) is back up, make sure the encryption engine is online. 7. On node 1 (BES1) initiate manual failback of CryptoTarget containers and associated LUNs from node 2 (BES2) to node 1 (BES1) by issuing the following command. cryptocfg --failback -EE 8. Check that Crypto Target Containers and associated LUNs fail back successfully on node 1 (BES1) and host I/O also moves from node 2 (BES2) to node 1 (BES1) and continues during the failback process. 9. To upgrade node 2 (BES2), Repeat steps 2 to 8. Fabric OS Encryption Administrator's Guide 167 53-1001864-01

Section	Page
Contents	5
About This Document	13
In this chapter	13
How this document is organized	13
Supported hardware and software	14
What’s new in this document	14
Document conventions	14
Text formatting	14
Command syntax conventions	14
Notes, cautions, and warnings	15
Key terms	15
Notice to the reader	16
Additional information	16
Brocade resources	16
Other industry resources	16
Getting technical help	17
Document feedback	18
Encryption overview	19
In this chapter	19
Host and LUN considerations	19
Terminology	20
The Brocade encryption switch	22
The FS8-18 blade	23
Performance licensing	23
Adding a license	23
Licensing best practices	23
Recommendation for connectivity	24
Usage limitations	24
Brocade encryption solution overview	25
Data flow from server to storage	26
Data encryption key life cycle management	27
Key management systems	29
Master key management	29
Master key generation	29
Master key backup	29
Support for Virtual Fabrics	30
Encryption configuration using the Management application	31
In this chapter	31
Encryption Center features	32
Encryption user privileges	33
Smart card usage	34
Registering authentication cards from a card reader	34
Registering authentication cards from the database	35
De-registering an authentication card	36
Using authentication cards	36
Enabling or disabling the system card requirement	37
Registering system cards from a card reader	37
De-registering a system card	38
Tracking smart cards	38
Editing smart cards	39
Network connections	40
Configuring blade processor links	40
Encryption node initialization and certificate generation	41
Steps for connecting to an SKM appliance	42
Configuring a Brocade group on SKM	43
Registering the SKM Brocade group user name and password	44
Setting up the local Certificate Authority (CA) on SKM	45
Downloading the local CA certificate from SKM	46
Creating and installing the SKM server certificate	46
Enabling SSL on the Key Management System (KMS) Server	47
Creating an SKM High Availability cluster	48
Copying the local CA certificate for a clustered SKM appliance	48
Adding SKM appliances to the cluster	49
Signing the Brocade encryption node KAC certificates	50
Importing a signed KAC certificate into a switch	50
Gathering information	51
Creating a new encryption group	52
Adding a switch to an encryption group	59
Replacing an encryption engine in an encryption group	63
Creating high availability (HA) clusters	64
Removing engines from an HA cluster	65
Swapping engines in an HA cluster	66
Failback option	66
Invoking failback	66
Adding encryption targets	67
Configuring hosts for encryption targets	74
Adding target disk LUNs for encryption	75
Adding Target Tape LUNs for encryption	77
Re-balancing the encryption engine	78
Master keys	79
Active master key	79
Alternate master key	79
Master key actions	79
Reasons master keys can be disabled	80
Saving the master key to a file	80
Saving a master key to a key vault	82
Saving a master key to a smart card set	83
Restoring a master key from a file	85
Restoring a master key from a key vault	86
Restoring a master key from a smart card set	87
Creating a new master key	88
Zeroizing an encryption engine	89
Encryption Targets dialog box	90
Disk device decommissioning	93
Decommissioning LUNs	93
Displaying and deleting decommissioned key IDs	94
Viewing and editing switch encryption properties	94
Exporting the public key certificate signing request (CSR) from Properties	97
Importing a signed public key certificate from Properties	97
Enabling the encryption engine state from Properties	98
Disabling the encryption engine state from Properties	98
Viewing and editing group properties	98
General tab	99
Members tab	100
Consequences of removing an encryption switch	101
Security tab	103
HA Clusters tab	104
Engine Operations tab	104
Tape Pools tab	105
Encryption-related acronyms in log messages	107
Configuring Brocade encryption using the CLI	109
In this chapter	109
Overview	109
Command validation checks	110
Command RBAC permissions and AD types	111
Cryptocfg Help command output	114
Management LAN configuration	115
Configuring cluster links	116
Special consideration for blades	116
IP Address change of a node within an encryption group	117
Steps for connecting to an SKM appliance	118
Configuring a Brocade group	118
Setting up the local Certificate Authority (CA)	118
Downloading the local CA certificate	120
Creating and installing the SKM server certificate	120
Enabling SSL on the Key Management System (KMS) Server	121
Creating an SKM High Availability cluster	122
Copying the local CA certificate	122
Adding SKM appliances to the cluster	123
Initializing the Brocade encryption engines	124
Registering the SKM Brocade group user name and password	125
Signing the Brocade encryption node KAC certificates	126
Registering SKM on a Brocade encryption group leader	127
Generating and backing up the master key	129
High Availability (HA) cluster configuration	131
HA cluster configuration rules	131
Creating an HA cluster	131
Adding an encryption engine to an HA cluster	132
Failover/failback policy configuration	133
Enabling the encryption engine	134
Checking encryption engine status	134
Zoning considerations	135
Setting default zoning to no access	135
Frame redirection zoning	136
Creating an initiator - target zone	136
CryptoTarget container configuration	139
LUN re-balancing when hosting both disk and tape	140
Creating a CryptoTarget container	141
Removing an initiator from a CryptoTarget container	143
Deleting a CryptoTarget container	143
Moving a CryptoTarget container	144
Crypto LUN configuration	145
Discovering a LUN	145
Configuring a Crypto LUN	146
Crypto LUN parameters and policies	147
Configuring a tape LUN	149
Modify example	150
Removing a LUN from a CryptoTarget container	151
Modifying Crypto LUN parameters	152
LUN modification considerations	152
Impact of tape LUN configuration changes	153
Force-enabling a disabled disk LUN for encryption	153
Decommissioning LUNs	153
Tape pool configuration	155
Tape pool labeling	155
Creating a tape pool	157
Deleting a tape pool	158
Modifying a tape pool	158
Impact of tape pool configuration changes	158
Configuring a multi-path Crypto LUN	159
Multi-path LUN configuration example	159
First time encryption	163
Resource allocation	163
First time encryption modes	163
Configuring a LUN for first time encryption	163
Data re-keying	164
Resource Allocation	164
Re-keying modes	164
Configuring a LUN for automatic re-keying	165
Initiating a manual re-key session	166
Suspension and resumption of re-keying operations	167
Deployment Scenarios	169
In this chapter	169
Single encryption switch, two paths from host to target	170
Single fabric deployment - HA cluster	171
Single fabric deployment - DEK cluster	172
Dual fabric deployment - HA and DEK cluster	173
Multiple paths, one DEK cluster, and two HA clusters	174
Multiple paths, DEK cluster, no HA cluster	176
Deployment in Fibre Channel routed fabrics	177
Deployment as part of an edge fabric	179
Deployment with FCIP extension switches	180
VmWare ESX server deployments	181
Best Practices and Special Topics	183
In this chapter	183
Firmware download considerations	184
Firmware Upgrades and Downgrades	184
Specific guidelines for HA clusters	185
Configuration upload and download considerations	186
Configuration Upload at an encryption group leader node	186
Configuration upload at an encryption group member node	186
Information not included in an upload	186
Steps before configuration download	187
Configuration download at the encryption group leader	187
Configuration download at an encryption group member	187
Steps after configuration download	188
HP-UX considerations	189
Enable of a disabled LUN	189
Disk metadata	189
Tape metadata	189
Tape data compression	190
Tape pools	190
Tape block zero handling	190
Tape key expiry	191
DF compatibility for tapes	191
DF compatibility for disk LUNs	191
Configuring CryptoTarget containers and LUNs	192
Redirection zones	193
Deployment with Admin Domains (AD)	193
Master key usage	193
Do not use DHCP for IP interfaces	193
Ensure uniform licensing in HA clusters	193
Tape library media changer considerations	194
Turn off host-based encryption	194
Avoid double encryption	194
PID failover	194
Turn off compression on extension switches	194
Re-keying best practices and policies	195
Manual re-key	195
Latency in re-key operations	195
Allow re-key to complete before deleting a container	195
Re-key operations and firmware upgrades	195
Do not change LUN configuration while re-keying	196
Brocade native mode in LKM installations	196
Recommendation for Host I/O traffic during online rekeying and first time encryption	196
Changing IP addresses in encryption groups	196
Disabling the encryption engine	196
Recommendations for Initiator Fan-Ins	197
Best practices for host clusters in an encryption environment	198
HA Cluster Deployment Considerations and Best Practices	198
Maintenance and Troubleshooting	199
In this Chapter	199
Encryption group and HA cluster maintenance	199
Removing a node from an encryption group	199
Deleting an encryption group	201
Removing an HA cluster member	202
Displaying the HA cluster configuration	202
Replacing an HA cluster member	203
Deleting an HA cluster member	206
Performing a manual failback of an encryption engine	206
Encryption group merge and split use cases	207
Configuration impact of encryption group split or node isolation	212
General encryption troubleshooting I	213
Troubleshooting examples using the CLI	216
Encryption Enabled Crypto Target LUN	216
Encryption Disabled Crypto Target LUN	217
Management application encryption wizard troubleshooting	218
Errors related to adding a switch to an existing group	218
Errors related to adding a switch to a new group	219
General errors related to the Configure Switch Encryption wizard	221
LUN policy troubleshooting	222
Loss of encryption group leader after power outage	223
MPIO and internal LUN states	224
Suspension and resumption of re-keying operations	224
State and Status Information	227
In this appendix	227
Encryption engine security processor (SP) states	227
Security processor KEK status	228
Encrypted LUN states	228
LUN Policies	233
In this appendix	233
DF-compatibility support for disk LUNs	233
DF-compatibility support for tape LUNs	237
NS-Based Transparent Frame Redirection	239

Match case Limit results 1 per page

Fabric OS Encryption Administrator’s Guide

167

53-1001864-01

Firmware download considerations

•

A firmware consistency check for Fabric OS version 6.4.0 is enforced in an encryption group if

any of the Fabric OS version 6.4.0 features are enabled. If any Fabric OS version 6.4.0 feature

is in an enabled state then any firmware download to Fabric OS version 6.3.x or earlier versions

is blocked.

Do not try to use configupload from Fabric OS version 6.4.0 and then configdownload to

Fabric OS version 6.3.x or earlier versions with any Fabric OS version 6.4.0 feature in an

enabled state.

Do not try registering a node running Fabric OS version 6.3.x or earlier to an encryption

group when all nodes are running Fabric OS version 6.4.0 with one or more Fabric OS

version 6.4.0 features enabled.

Disable all Fabric OS version 6.4.0 features before ejecting a node running Fabric OS

version 6.4.0 and registering

the node as a member of an encryption group with nodes

running Fabric OS version 6.3.x or earlier versions.

Specific guidelines for HA clusters

The following are specific guidelines for a firmware upgrade of the encryption switch or blade when

deployed in HA cluster. The guidelines are based on the following scenario:

•

There are 2 nodes (BES1 and BES2) in the HA cluster.

•

Each node hosts certain number of CryptoTarget containers and associated LUNs.

•

node 1 (BES1) needs to be upgraded first.

Change the failback mode to manual if it was set to auto by issuing the following command:

cryptocfg --set -failback manua

On node 1 (BES1), disable the encryption engine to force the failover of CryptoTarget

containers and associated LUNs onto the HA cluster peer member node 2 (BES2) by issuing

the following command.

cryptocfg --disableEE

Make sure that these Crypto Target Containers and LUNs actually failover to node 2 (BES2) in

the HA cluster. Check for all LUNs in encryption enabled state on node 2 (BES2). This ensures

that I/O also fails over to node 2 (BES2) and continues during this process.

On node 1 (BES1) enable the Encryption Engine, by issuing the following command.

cryptocfg --enableEE

Start firmware download (upgrade) on the node 1 (BES1). Refer to the

Fabric OS

Administrator’s Guide

if necessary to review firmware download procedures.

After firmware download is complete and node 1 (BES1) is back up, make sure the encryption

engine is online.

On node 1 (BES1) initiate manual failback of CryptoTarget containers and associated LUNs

from node 2 (BES2) to node 1 (BES1) by issuing the following command.

cryptocfg --failback -EE

Check that Crypto Target Containers and associated LUNs fail back successfully on node 1

(BES1) and host I/O also moves from node 2 (BES2) to node 1 (BES1) and continues during

the failback process.

To upgrade node 2 (BES2), Repeat steps 2 to 8.