HP 8/8 Fabric OS Encryption Administrator's Guide v6.4.0 (53-1001864-01, June - Page 24

1 Recommendation for connectivity Recommendation for connectivity In order to achieve high performance and throughput, the encryption engines perform what is referred to as "cut-through" encryption. In simple terms this is achieved by encrypting the data in data frames on a per frame basis. This enables the encryption engine to buffer only a frame, encrypt it and send the frame out to the target on write I/Os. For read I/Os the reverse is done. This puts some constraints on the topology and the container configurations to support acceptable performance for encrypted and decrypted I/O to and from LUNs, and to support acceptable levels of scale in terms of the number of LUNs and the number of flows. The topology and container configuration constraint is stated below: Care must be taken when connecting the encryption engines to the fabric and configuring crypto-target containers to be sure that the traffic flow between the host initiator and the physical storage array LUN through the container flows through only one encryption engine that is hosting the container. This is to avoid crisscrossing of flows to and from virtual entities; that is, from virtual targets and virtual initiators on two different encryption engines over the same path. Although there is considerable flexibility in connecting and configuring the containers for encryption, the following guidelines are the recommended best practices: • Host and Storage Array ports that are not involved in any encryption flow can be connected to any Encryption Engines. • Recommendations for host and target ports with respect to encryption flows are as follows: - Only ISLs are connected to the Brocade Encryption Switch encryption engine in order to connect it to the fabric. No devices (initiators and targets) are connected to it. - Only host ports are connected to the FS8-18 blade encryption engine. and no ISLs are connected to it. Usage limitations There are usage limitations to be aware of when planning an encryption implementation: • Special redirection zones are created to handle data that is redirected to an encryption switch or blade. Quality of Service (QoS) cannot be applied to a redirection zone. • In order for frame redirection to be applied, regular zones for hosts and targets must be defined in the effective configuration. Hosts and targets must be zoned together by worldwide port name (WWPN) rather than worldwide node name (WWNN) in configurations where frame redirection will be used. If hosts or targets are zoned together using worldwide node name, frame redirection will not occur properly. • On tapes written in DataFort format, the encryption switch or blade cannot read and decrypt files with a block size of one MB or greater. • The Top Talker feature is not compatible with redirection zones. The Top Talker feature should not be enabled when an encryption switch or blade is present in the fabric. 6 Fabric OS Encryption Administrator's Guide 53-1001864-01