Technical data

Fabric OS Encryption Administrator’s Guide (DPM) 173
53-1002720-02
Crypto LUN configuration
3
Removing a LUN from a CryptoTarget container
You can remove a LUN from a given CryptoTarget container if it is no longer needed. Stop all traffic
I/O from the initiators accessing the LUN before removing the LUN to avoid I/O failure between the
initiators and the LUN. If the LUN is exposed to more than one initiator under different LUN
Numbers, remove all exposed LUN Numbers.
1. Log in to the group leader as Admin or FabricAdmin.
2. Enter the cryptocfg
--remove -LUN command followed by the CryptoTarget container name,
the LUN Number, and the initiator PWWN.
FabricAdmin:switch> cryptocfg --remove -LUN my_disk_tgt 0x0
10:00:00:00:c9:2b:c9:3a
Operation Succeeded
3. Commit the configuration with the -force option to completely remove the LUN and all
associated configuration data in the configuration database. The data remains on the removed
LUN in an encrypted state.
FabricAdmin:switch> cryptocfg --commit -force
Operation Succeeded
CAUTION
In case of multiple paths for a LUN, each path is exposed as a CryptoTarget container in the same
encryption switch or blade or on different encryption switches or blades within the encryption
group. In this scenario you must remove the LUNs from all exposed CryptoTarget containers
before you commit the transaction. Failure to do so may result in a potentially catastrophic
situation where one path ends up being exposed through the encryption switch and another path
has direct access to the device from a host outside the protected realm of the encryption
platform. Refer to the section “Configuring a multi-path Crypto LUN” on page 198 for more
information.
Modifying Crypto LUN parameters
You can modify one or more policies of an existing Crypto LUN with the cryptocfg --modify -LUN
command.
A maximum of 25 disk LUNs can be added or modified in a single commit operation through the
CLI. Attempts to commit configurations or modifications that exceed the maximum commit allowed
will fail with a warning. There is a five second delay before the commit operation takes effect.
Make sure the LUNs in previously committed LUN configurations and LUN modifications have a
LUN state of Encryption Enabled before creating and committing another batch of LUN
configurations or modifications.
The following example disables automatic rekeying operations on the disk LUN “my_disk_tgt.”
1. Log in to the group leader as Admin or FabricAdmin.
2. Enter the cryptocfg
--modify -LUN command followed by the CryptoTarget container name,
the LUN Number, the initiator PWWN, and the parameter you want to modify.
FabricAdmin:switch> cryptocfg --modify -LUN my_disk_tgt 0x0
10:00:00:00:c9:2b:c9:3a -disable_rekey