HP 8/8 Fabric OS Encryption Administrator's Guide v6.4.0 (53-1001864-01, June - Page 207

Encryption group merge and split use cases, A member node failed and is replaced

Get HP 8/8 PDF manuals and user guides View all HP 8/8 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 207 highlights

Encryption group and HA cluster maintenance 6 • The failed EE2 has come back online, Failover is still active: SecurityAdmin:switch>cryptocfg --show -hacluster -all Encryption Group Name: brocade Number of HA Clusters: 1 HA cluster name: HAC3 - 2 EE entries Status: Committed WWN Slot Number EE1 => 10:00:00:05:1e:53:89:dd 0 EE2 => 10:00:00:05:1e:53:fc:8a 0 Status Online - Failover active Online • A manual failback is issued. SecurityAdmin:switch>cryptocfg --failback -EE 10:00:00:05:1e:53:89:dd 0 \ 10:00:00:05:1e:53:fc:8a 0 Operation succeeded. • After the failback completes, the -cryptocfg --show -hacluster -all command no longer reports active failover. SecurityAdmin:switch>cryptocfg --show -hacluster -all Encryption Group Name: brocade_1 Number of HA Clusters: 1 HA cluster name: HAC3 - 2 EE entries Status: Committed WWN Slot Number EE1 => 10:00:00:05:1e:53:89:dd 0 EE2 => 10:00:00:05:1e:53:fc:8a 0 Status Online Online Encryption group merge and split use cases This section describes recovery scenarios for the following cases: • "A member node failed and is replaced" on page 189 • "A member node reboots and comes back up" on page 191 • "A member node lost connection to the group leader" on page 191 • "A member node lost connection to all other nodes in the encryption group" on page 192 • "Several member nodes split off from an encryption group" on page 192 A member node failed and is replaced Assumptions N1, N2 and N3 form an encryption group and N2 is the group leader node. N3 and N1 are part of an HA cluster. Assume that N3 failed and you want to replace the failed N3 node with an alternate node N4. Impact When N3 failed, all devices hosted on the encryption engines of this node failed over to the peer encryption engines in N1, and N1 now performs all of the failed node's encryption services. Re-key sessions owned by the failed encryption engine are failed over to N1. Fabric OS Encryption Administrator's Guide 189 53-1001864-01

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
  • 241
  • 242
  • 243
  • 244
  • 245
  • 246
  • 247
  • 248
Fabric OS Encryption Administrator’s Guide
189
53-1001864-01
Encryption group and HA cluster maintenance
6
•
The failed EE2 has come back online, Failover is still active:
SecurityAdmin:switch>
cryptocfg --show -hacluster -all
Encryption Group Name: brocade
Number of HA Clusters: 1
HA cluster name: HAC3 - 2 EE entries
Status:
Committed
WWN
Slot Number
Status
EE1 =>
10:00:00:05:1e:53:89:dd
0
Online - Failover active
EE2 =>
10:00:00:05:1e:53:fc:8a
0
Online
•
A manual failback is issued.
SecurityAdmin:switch>
cryptocfg --failback -EE 10:00:00:05:1e:53:89:dd 0 \
10:00:00:05:1e:53:fc:8a 0
Operation succeeded.
•
After the failback completes, the -
cryptocfg
--
show -hacluster -all
command no longer reports
active failover.
SecurityAdmin:switch>
cryptocfg --show -hacluster -all
Encryption Group Name: brocade_1
Number of HA Clusters: 1
HA cluster name: HAC3 - 2 EE entries
Status:
Committed
WWN
Slot Number
Status
EE1 =>
10:00:00:05:1e:53:89:dd
0
Online
EE2 =>
10:00:00:05:1e:53:fc:8a
0
Online
Encryption group merge and split use cases
This section describes recovery scenarios for the following cases:
•
“A member node failed and is replaced”
on page 189
•
“A member node reboots and comes back up”
on page 191
•
“A member node lost connection to the group leader”
on page 191
•
“A member node lost connection to all other nodes in the encryption group”
on page 192
•
“Several member nodes split off from an encryption group”
on page 192
A member node failed and is replaced
Assumptions
N1, N2 and N3 form an encryption group and N2 is the group leader node. N3 and N1 are part of
an HA cluster. Assume that N3 failed and you want to replace the failed N3 node with an alternate
node N4.
Impact
When N3 failed, all devices hosted on the encryption engines of this node failed over to the peer
encryption engines in N1, and N1 now performs all of the failed node’s encryption services. Re-key
sessions owned by the failed encryption engine are failed over to N1.