HP Cisco MDS 9120 Cisco MDS 9000 Family Storage Media Encryption Configuration - Page 263

Appendix D RSA Key Manager and Cisco SME Migrating From Cisco KMC to RKM Send documentation comments to [email protected] Step 5 Step 6 Step 7 Run the following database scripts from the database administrative console: • For the key catalog on PostgresSQL, run postgres-kmc-rkm-pre-migrate.sql. • For the key catalog on Oracle Express, run oracle-kmc-rkm-pre-migrate.sql. These scripts are packaged in Cisco Fabric Manager CD as of NX-OS Software Release 4.1(1). Install RKM on the system allocated for this purpose. RKM can be installed and configured separately. Ensure that RKM is ready prior to the start of the migration in order to decrease downtime. Configure the certificates for RKM and identify the following certificate files: • sme_rkm_client.jks • sme_rkm_trust.jks Copy the two certificate files on the Cisco Fabric Manager Server system. Copy the two files in the certificate store directory. Go to the SME tab on the Fabric Manager Web Client and choose Key Manager Settings to view the actual directory. Note The default certificate store (Windows) is at C:\Program Files\Cisco Systems\MDS 9000\conf\cert\. Step 8 Step 9 Step 10 Step 11 Step 12 Step 13 Step 14 Start Cisco Fabric Manager, which starts Cisco KMC. Go to the SME tab on the Fabric Manager Web Client and choose Key Manager Settings. Select RSA as the key manager and configure the IP address and port for RKM. Go to the Accounting Log and monitor the log messages until "Synchronization Complete for Cluster" is displayed. Create and import all the volume group keys from the password-protected files. Run the following post-migration scripts to delete the keys in the Cisco KMC key database: • For the key catalog previously on PostgresSQL, run postgres-kmc-rkm-post-migrate.sql • For the key catalog previously on Oracle Express, run oracle-kmc-rkm-post-migrate.sql These scripts are packaged in the Cisco Fabric Manager CD as of NX-OS Software Release 4.1(1) Restart any backup applications and jobs that were deactivated or suspended before the migration. Note In Cisco MDS 9000 SAN-OS Software Releases 3.2(3a) and 3.3(1a), the importing of the volume group leaves all the keys in a deactivated (archived) state, and after the migration, the tapes can be restored but cannot be used for active encryption. Note In Cisco MDS 9000 NX-OS Software Release 4.1(1c) and later, the keys are restored in the same state (active or deactivated) as before the migration. OL-18091-01, Cisco MDS NX-OS Release 4.x Cisco MDS 9000 Family Storage Media Encryption Configuration Guide D-9