Home » HP Manuals » Servers » HP Brocade 8/12c » Manual Viewer

HP Brocade 8/12c Fabric OS Encryption Administrator's Guide - Page 137

Special consideration for blades, IP Address change of a node within an encryption group

Add to My Manuals
Save this manual to your list of manuals

Page 137 highlights

Configuring cluster links 3 Special consideration for blades HA clusters of FS8-18 blades should not include blades in the same DCX chassis. For FS8-18 blades, the slot number must also be included in the ipaddrset command, for example: switch:admin> ipaddrset -slot 7 -eth0 --add 10.32.33.34/23 switch:admin> ipaddrset -slot 7 -gate --add 10.32.1.1 There are additional considerations if blades are removed and replaced, or moved to a different slot. On chassis-based systems, IP addresses are assigned to the slot rather than the blade, and are saved in non-volatile storage on the control processor blades. IP addresses may be assigned even if no blade is present. If an FS8-18 blade is installed in a slot that was previously configured for a different type of blade with two IP ports (an FC4-16E blade, for example), the FS8-18 blade is assigned the address specified for -eth0 in that slot. To be sure the correct IP addresses are assigned, use the ipaddrshow command to display the IP address assignments, as shown in the following example: switch:admin> ipaddrshow -slot 7 SWITCH Ethernet IP Address: 10.33.54.207 Ethernet Subnetmask: 255.255.240.0 Fibre Channel IP Address: none Fibre Channel Subnetmask: none Gateway IP Address: 10.33.48.1 DHCP: Off eth0: 10.33.54.208/20 eth1: none/none Gateway: 10.33.48.1 NOTE The IP address of the cluster link should be configured before enabling the encryption engine for encryption. If the IP address is configured after the encryption engine is enabled for encryption, or if the IP address of the cluster link ports is modified after the encryption engine is enabled for encryption, the encryption switch must be rebooted, and the encryption blade must be powered off and powered on (slotpoweroff/slotpoweron) for the IP address configuration to take effect. Failure to do so will result in the re-key operation not starting in the encryption group or high availability (HA) cluster. IP Address change of a node within an encryption group Modifying the IP address of a node that is part of an encryption group is disruptive in terms of cluster operation. The change causes the encryption group to split, and if the node was part of an HA cluster, failover/failback capability is lost. The ipaddrset command issues no warning and you are not prevented from changing a node IP address that is part of a configured encryption group or HA cluster. The recommended steps for modifying the IP address of a node are provided below. the procedures are based on whether the node is a group leader or a member node. Fabric OS Encryption Administrator's Guide 117 53-1002159-03

Section	Page
Contents	5
About This Document	15
In this chapter	15
How this document is organized	15
Supported hardware and software	16
What’s new in this document	16
Document conventions	16
Text formatting	16
Command syntax conventions	17
Notes, cautions, and warnings	17
Key terms	17
Notice to the reader	18
Additional information	18
Brocade resources	18
Other industry resources	19
Getting technical help	19
Document feedback	20
Encryption Overview	21
In this chapter	21
Host and LUN considerations	21
Terminology	22
The Brocade Encryption Switch	24
The FS8-18 blade	25
FIPS mode	25
Performance licensing	25
Adding a license	25
Licensing best practices	25
Recommendation for connectivity	26
Usage limitations	26
Brocade encryption solution overview	27
Data flow from server to storage	28
Data encryption key life cycle management	29
Master key management	30
Master key generation	30
Master key backup	30
Support for Virtual Fabrics	31
Cisco Fabric Connectivity support	31
Encryption configuration	33
In this chapter	33
Encryption Center features	34
Encryption user privileges	35
Smart card usage	36
Registering authentication cards from a card reader	36
Registering authentication cards from the database	38
Deregistering an authentication card	39
Using authentication cards	40
Enabling or disabling the system card requirement	40
Registering system cards from a card reader	41
Deregistering a system card	41
Tracking smart cards	42
Editing smart cards	43
Network connections	44
Configuring blade processor links	44
Encryption node initialization and certificate generation	45
Steps for connecting to an SKM or ESKM appliance	46
Configuring a Brocade group on SKM or ESKM	47
Registering the SKM or ESKM Brocade group user name and password	48
Setting up the local Certificate Authority (CA) on SKM or ESKM	49
Downloading the local CA certificate from SKM or ESKM	50
Creating and installing the SKM or ESKM server certificate	50
Enabling SSL on the Key Management System (KMS) Server	51
Creating an SKM or ESKM High Availability cluster	52
Copying the local CA certificate for a clustered SKM or ESKM appliance	53
Adding SKM or ESKM appliances to the cluster	53
Signing the Brocade encryption node KAC certificates	54
Importing a signed KAC certificate into a switch	55
SKM or ESKM key vault high availability deployment	56
Steps for Migrating from SKM to ESKM	56
Steps required from the BES CLI	56
Steps required using Brocade Management application	57
Encryption preparation	58
Creating a new encryption group	58
Understanding configuration status results	66
Adding a switch to an encryption group	67
Replacing an encryption engine in an encryption group	73
Creating high availability (HA) clusters	74
Removing engines from an HA cluster	75
Swapping engines in an HA cluster	75
Failback option	76
Invoking failback	77
Adding encryption targets	77
Configuring hosts for encryption targets	84
Adding target disk LUNs for encryption	85
Configuring Storage Arrays	88
Adding target tape LUNs for encryption	88
Tape LUN write early and read ahead	91
Enabling and disabling tape LUN write early and read ahead	91
Tape LUN statistics	93
Viewing and clearing tape container statistics	93
Viewing and clearing tape LUN statistics for a container	94
Viewing and clearing statistics for specific tape LUNs	95
Re-balancing the encryption engine	97
Master keys	98
Active master key	98
Alternate master key	98
Master key actions	99
Reasons master keys can be disabled	99
Saving the master key to a file	99
Saving a master key to a key vault	101
Saving a master key to a smart card set	102
Restoring a master key from a file	104
Restoring a master key from a key vault	105
Restoring a master key from a smart card set	106
Creating a new master key	107
Viewing master key IDs	108
Zeroizing an encryption engine	108
Using the Encryption Targets dialog box	110
Redirection zones	111
Re-keying all disk LUNs manually	111
Viewing the progress of manual re-key operations	113
Viewing time left for auto re-key	114
Viewing and editing switch encryption properties	115
Exporting the public key certificate signing request (CSR) from Properties	117
Importing a signed public key certificate from Properties	117
Enabling and disabling the encryption engine state from Properties	117
Viewing and editing group properties	118
General tab	119
Members tab	120
Consequences of removing an encryption switch	121
Security tab	123
HA Clusters tab	124
Tape Pools tab	125
Engine Operations tab	127
Encryption-related acronyms in log messages	129
Configuring Brocade Encryption Using the CLI	131
In this chapter	131
Overview	132
Command validation checks	132
Command RBAC permissions and AD types	133
Cryptocfg Help command output	135
Management LAN configuration	136
Configuring cluster links	136
Special consideration for blades	137
IP Address change of a node within an encryption group	137
Steps for connecting to an SKM or ESKM appliance	139
Configuring a Brocade group	139
Setting up the local Certificate Authority (CA)	140
Downloading the local CA certificate	141
Creating and installing the SKM or ESKM server certificate	142
Enabling SSL on the Key Management System (KMS) Server	143
Creating an SKM or ESKM high availability cluster	144
Copying the local CA certificate	144
Adding SKM or ESKM appliances to the cluster	145
Initializing the Brocade encryption engines	146
Signing the Brocade encryption node KAC certificates	147
Registering SKM or ESKM on a Brocade encryption group leader	148
Registering the SKM or ESKM Brocade group user name and password	150
SKM or ESKM key vault high availability deployment	151
Adding a member node to an encryption group	152
Generating and backing up the master key	155
High availability cluster configuration	157
HA cluster configuration rules	157
Creating an HA cluster	158
Adding an encryption engine to an HA cluster	159
Failover/failback policy configuration	159
Re-exporting a master key	160
Exporting an additional key ID	161
Viewing the master key IDs	162
Enabling the encryption engine	163
Checking encryption engine status	163
Zoning considerations	164
Setting default zoning to no access	164
Frame redirection zoning	165
Creating an initiator - target zone	165
CryptoTarget container configuration	167
LUN re-balancing when hosting both disk and tape targets	168
Gathering information	169
Creating a CryptoTarget container	169
Removing an initiator from a CryptoTarget container	171
Deleting a CryptoTarget container	172
Moving a CryptoTarget container	173
Crypto LUN configuration	173
Discovering a LUN	174
Configuring a Crypto LUN	174
Crypto LUN parameters and policies	176
Configuring a tape LUN	178
Removing a LUN from a CryptoTarget container	179
Modifying Crypto LUN parameters	180
LUN modification considerations	181
Impact of tape LUN configuration changes	181
Force-enabling a disabled disk LUN for encryption	182
Tape pool configuration	182
Tape pool labeling	182
Creating a tape pool	184
Deleting a tape pool	185
Modifying a tape pool	185
Impact of tape pool configuration changes	186
Configuring a multi-path Crypto LUN	186
Multi-path LUN configuration example	186
First-time encryption	189
Resource allocation	190
First time encryption modes	190
Configuring a LUN for first time encryption	190
Data re-keying	190
Resource Allocation	191
Re-keying modes	191
Configuring a LUN for automatic re-keying	191
Initiating a manual re-key session	192
Suspension and resumption of re-keying operations	193
Deployment Scenarios	195
In this chapter	195
Single encryption switch, two paths from host to target	196
Single fabric deployment - HA cluster	197
Single fabric deployment - DEK cluster	198
Dual fabric deployment - HA and DEK cluster	199
Multiple paths, one DEK cluster, and two HA clusters	200
Multiple paths, DEK cluster, no HA cluster	202
Deployment in Fibre Channel routed fabrics	203
Deployment as part of an edge fabric	205
Deployment with FCIP extension switches	206
VMware ESX server deployments	207
Best Practices and Special Topics	209
In this chapter	209
Firmware download considerations	210
Firmware upgrades and downgrades	210
Data-at-rest encryption support for IBM SVC LUNs configuration	211
Specific guidelines for HA clusters	211
Configuration upload and download considerations	212
Configuration upload at an encryption group leader node	212
Configuration upload at an encryption group member node	213
Information not included in an upload	213
Steps before configuration download	213
Configuration download at the encryption group leader	214
Configuration download at an encryption group member	214
Steps after configuration download	214
HP-UX considerations	215
AIX Considerations	215
Enable of a disabled LUN	215
Disk metadata	215
Tape metadata	216
Tape data compression	216
Tape pools	216
Tape block zero handling	217
Tape key expiry	217
Configuring CryptoTarget containers and LUNs	217
Redirection zones	218
Deployment with Admin Domains (AD)	219
Do not use DHCP for IP interfaces	219
Ensure uniform licensing in HA clusters	219
Tape library media changer considerations	219
Turn off host-based encryption	219
Avoid double encryption	219
PID failover	220
Turn off compression on extension switches	220
Re-keying best practices and policies	220
Manual re-key	220
Latency in re-key operations	220
Allow re-key to complete before deleting a container	221
Re-key operations and firmware upgrades	221
Do not change LUN configuration while re-keying	221
Recommendation for Host I/O traffic during online rekeying and first time encryption	221
KAC certificate registration expiry	221
Changing IP addresses in encryption groups	222
Disabling the encryption engine	222
Recommendations for Initiator Fan-Ins	222
Best practices for host clusters in an encryption environment	224
HA Cluster deployment considerations and best practices	224
Key Vault Best Practices	224
Tape Device LUN Mapping	224
Maintenance and Troubleshooting	225
In this chapter	225
Encryption group and HA cluster maintenance	225
Displaying encryption group configuration or status information	225
Removing a member node from an encryption group	226
Deleting an encryption group	228
Removing an HA cluster member	228
Displaying the HA cluster configuration	228
Replacing an HA cluster member	229
Deleting an HA cluster member	231
Performing a manual failback of an encryption engine	232
Encryption group merge and split use cases	233
A member node failed and is replaced	233
A member node reboots and comes back up	234
A member node lost connection to the group leader	235
A member node lost connection to all other nodes in the encryption group	235
Several member nodes split off from an encryption group	236
Adjusting heartbeat signaling values	237
EG split possibilities requiring manual recovery	237
Configuration impact of encryption group split or node isolation	242
Encryption group database manual operations	243
Manually synchronizing the encryption group database	243
Manually synchronizing the security database	243
Aborting a pending database transaction	243
Key vault diagnostics	243
General encryption troubleshooting	246
Troubleshooting examples using the CLI	249
Encryption Enabled Crypto Target LUN	249
Encryption Disabled Crypto Target LUN	250
Management application encryption wizard troubleshooting	251
Errors related to adding a switch to an existing group	251
Errors related to adding a switch to a new group	252
General errors related to the Configure Switch Encryption wizard	253
LUN policy troubleshooting	254
Loss of encryption group leader after power outage	255
MPIO and internal LUN states	256
Suspension and resumption of re-keying operations	256
FS8-18 blade removal and replacement	257
BES removal and replacement	258
Multi Node EG Case	258
Single Node EG Replacement	262
Reclaiming the WWN base of a failed Brocade Encryption Switch	264
Splitting an encryption group into two encryption groups	264
Moving a blade from one EG to another EG in the same fabric	265
Moving a BES from one EG to another EG in the same fabric	266
Removing stale rekey information for a LUN	267
State and Status Information	269
In this appendix	269
Encryption engine security processor (SP) states	269
Security processor KEK status	270
Encrypted LUN states	270

Match case Limit results 1 per page

Fabric OS Encryption Administrator’s Guide

117

53-1002159-03

Configuring cluster links

Special consideration for blades

HA clusters of FS8-18 blades should not include blades in the same DCX chassis.

For FS8-18 blades, the slot number must also be included in the

ipaddrset

command, for example:

switch:admin>

ipaddrset -slot 7 -eth0 --add 10.32.33.34/23

switch:admin>

ipaddrset -slot 7 -gate --add 10.32.1.1

There are additional considerations if blades are removed and replaced, or moved to a different

slot. On chassis-based systems, IP addresses are assigned to the slot rather than the blade, and

are saved in non-volatile storage on the control processor blades. IP addresses may be assigned

even if no blade is present. If an FS8-18 blade is installed in a slot that was previously configured

for a different type of blade with two IP ports (an FC4-16E blade, for example), the FS8-18 blade is

assigned the address specified for -eth0 in that slot.

To be sure the correct IP addresses are assigned, use the

ipaddrshow

command to display the

IP address assignments, as shown in the following example:

switch:admin>

ipaddrshow -slot 7

SWITCH

Ethernet IP Address: 10.33.54.207

Ethernet Subnetmask: 255.255.240.0

Fibre Channel IP Address: none

Fibre Channel Subnetmask: none

Gateway IP Address: 10.33.48.1

DHCP: Off

eth0: 10.33.54.208/20

eth1: none/none

Gateway: 10.33.48.1

NOTE

The IP address of the cluster link should be configured before enabling the encryption engine for

encryption. If the IP address is configured after the encryption engine is enabled for encryption, or

if the IP address of the cluster link ports is modified after the encryption engine is enabled for

encryption, the encryption switch must be rebooted, and the encryption blade must be powered off

and powered on (slotpoweroff/slotpoweron) for the IP address configuration to take effect. Failure

to do so will result in the re-key operation not starting in the encryption group or high availability (HA)

cluster.

IP Address change of a node within an encryption group

Modifying the IP address of a node that is part of an encryption group is disruptive in terms of

cluster operation. The change causes the encryption group to split, and if the node was part of an

HA cluster, failover/failback capability is lost. The

ipaddrset

command issues no warning and you

are not prevented from changing a node IP address that is part of a configured encryption group or

HA cluster. The recommended steps for modifying the IP address of a node are provided below. the

procedures are based on whether the node is a group leader or a member node.

HP Brocade 8/12c Fabric OS Encryption Administrator&#039;s Guide - Page 137

Special consideration for blades, IP Address change of a node within an encryption group

Page 137 highlights

HP Brocade 8/12c Fabric OS Encryption Administrator's Guide - Page 137