HP Brocade 8/12c Fabric OS Encryption Administrator's Guide - Page 151

Steps for connecting to an SKM or ESKM appliance 3 • Different user names and passwords can never be used within the same encryption group, but each encryption group may have its own user name and password. • If you change the user name and password using the -KAClogin option, the keys created by the previous user become inaccessible. The Brocade group user name and password must also be changed to the same values on the SKM/ESKM to make the keys accessible. • When storage is moved from one encryption group to another, and the new encryption group uses a different user name and password, the Brocade group user name and password must also be changed to the same values on the SKM/ESKM to make the keys accessible. SKM or ESKM key vault high availability deployment The SKM/ESKM key vault has high availability clustering capability. SKM/ESKM appliances can be clustered together in a transparent manner to the end user. Encryption keys saved to one key vault are synchronously hardened to the cluster pairs. Please refer to the HP SKM/ESKM appliance user documentation for configuration requirements and procedures. Configured primary and secondary HP SKM/ESKM appliances must be registered with the Brocade encryption switch or blade to begin key operations. The user can register only a single SKM/ESKM if desired. In that case, the HA features are lost, but the archived keys are backed up to any other non-registered cluster members. Beginning with Fabric OS v6.3.0, the primary and secondary appliances must be clustered. Both the SKM/ESKM appliances in the cluster can be registered using the following command. cryptocfg --reg -keyvault Disk keys and tape pool keys support DEK creation, retrieval, and update for disk and tape pool keys are as follows: • DEK creation - The DEK is first archived to the virtual IP address of the SKM/ESKM cluster. The request gets routed to the primary or secondary SKM/ESKM, and is synchronized with other SKMs/ESKMs in the cluster. If archival is successful, the DEK is read from both the primary or secondary SKMs/ESKMs in the cluster until the DEK is read successfully from both. If successful, then the DEK created can be used for encrypting disk LUNs or tape pool in Brocade native mode. If key archival of the DEK to the SKM/ESKM cluster fails, an error is logged and the operation is retried. If the failure happens after archival to one of the SKMs/ESKMs, but synchronization to all SKMs/ESKMs in the cluster times out, then an error is logged and the operation is retried. Any DEK archived in this case is not used. • DEK retrieval - The DEK is retrieved from the SKM/ESKM cluster using the cluster's virtual IP address. if DEK retrieval fails, it is retried. • DEK Update - DEK Update behavior is same as DEK Creation. Fabric OS Encryption Administrator's Guide 131 53-1002159-03