HP 8/8 Fabric OS Encryption Administrator's Guide v6.4.0 (53-1001864-01, June - Page 192

5 Configuring CryptoTarget containers and LUNs Configuring CryptoTarget containers and LUNs The following are best practices to follow when configuring CryptoTarget containers and crypto LUNs: • Host a target port on only one encryption switch, or one HA cluster. All LUNs visible through the target port are hosted on the same encryption switch, and are available for storing cipher text. • Be sure all nodes in a given DEK or HA cluster are up and enabled before creating an encrypted LUN. If a node in the DEK or HA cluster is down, or the encryption engine is down or not enabled when an encrypted LUN is added to the CryptoTarget container, write operations will hang when writing metadata to the LUN, and I/O will timeout. Data integrity is not guaranteed in this condition. • Before committing CryptoTarget container or LUN configurations or modifications on an encryption switch or FS8-18 blade, make sure that there are no outstanding zoning transactions in the switch or fabric. If there is an outstanding zoning transaction, the commit operation will fail and result in disabling the LUN. You can check for outstanding zoning transactions by issuing cfgtransshow CLI command. • LUNs are uniquely identified by the encryption switch or FS8-18 blade using the LUN serial number. The LUN serial number must be unique for LUNs exposed from the same target port. The LUN serial number must be unique for LUNs belonging to different target ports in non-multipathing configurations. Failure to ensure that the serial numbers are unique will result in undefined behavior and may result in faulting the encryption switch or FS8-18 blade. • To enable host MPIO, LUNs must also be available through a second target port, hosted on a second encryption switch. The second encryption switch could be in the same fabric, or a different fabric. • Hosts should be able to access LUNs through multiple ports for redundancy. • For high availability and failover within the fabric, implement an HA cluster of two encryption switches, and host the target port as a virtual target on one of the switches. • Don't change the WWN of any node after it has been deployed in an encryption group. • To minimize host IO disruption or time-outs during CryptoTarget container failover, it is recommended that the devices (hosts, target ports) are connected to an edge switch in a fabric, and not directly to Encryption switch/blade ports. • Always use this two step process when configuring the LUN for encryption, unless the LUN was previously encrypted. 1. Add the LUN as cleartext to the CryptoTarget container. 2. When the LUN comes online and Host I/O starts flowing through the LUN as cleartext, then modify the LUN from cleartext to encrypt and enable_encexistingdata options to convert the LUN to encryption. An exception to this LUN configuration process is that if the LUN was previously encrypted by the encryption switch or FS8-18 blade, then the LUN can be added to the CryptoTarget Container with the -encrypt and -lunstate encrypted options. 174 Fabric OS Encryption Administrator's Guide 53-1001864-01