Users Guide

Check consistency
The Check Consistency task verifies the accuracy of the redundant (parity) information. This task only applies to redundant
virtual disks. When necessary, the Check Consistency task rebuilds the redundant data. If the virtual disk is in a Failed
Redundancy state, running a check consistency may be able to return the virtual disk to a Ready state.
The check consistency rate, configurable between 0% and 100%, represents the percentage of the system resources dedicated
to running the check consistency task. At 0%, the check consistency has the lowest priority for the controller, takes the most
time to complete, and is the setting with the least impact to system performance. A check consistency rate of 0% does not
mean that the check consistency is stopped or paused. At 100%, the check consistency is the highest priority for the controller.
The check consistency time is minimized and is the setting with the most impact to system performance.
Create or change security keys
When configuring the controller properties, you can create or change the security keys. The controller uses the encryption key
to lock or unlock access to SED. You can create only one encryption key for each encryption-capable controller. The security
key is managed using following features:
1. Local Key Management (LKM) System - LKM is used to generate the key ID and the password or key required to secure
the virtual disk. If you are using LKM, you must create the encryption key by providing the Security Key Identifier and the
Passphrase.
2. Secure Enterprise Key Manager (SEKM) - This feature is used to generate the key using the Key Management Server
(KMS). If you are using SEKM, you must configure iDRAC with KMS information as well as SSL/TLS related configuration.
NOTE:
● This task is not supported on PERC hardware controllers running in eHBA mode.
● If you create the security key-in Add to Pending Operation mode and a job is not created, and then if you delete the
security key, the create security key pending operation is cleared.
NOTE:
● For enabling SEKM, ensure that the supported PERC firmware is installed.
● Only TLS 1.2 is supported for SEKM.
● You cannot downgrade the PERC firmware to the previous version if SEKM is enabled. Downgrading of other PERC
controller firmware in the same system which is not in SEKM mode may also fail. To downgrade the firmware for the
PERC controllers that are not in SEKM mode, you can use OS DUP update method, or disable SEKM on the controllers
and then retry the downgrade from iDRAC.
NOTE: When importing a hot plugged locked volume from one server to another, you will see CTL entries for Controller
attributes being applied in the LC Log.
Open Manage Secure Enterprise Key Manager
The key management functionality on iDRAC is provided using a client server architecture. The two key components that
are involved in providing SEKM functionality are - the Key Management Server (KMS) which is external to the iDRAC and
the client which is the Key Management Service on the iDRAC. These two entities communicate using the Key Management
Interoperability Protocol (KMIP) over SSL/TLS. For the Key Management Service on the iDRAC to communicate with the KMS
using the KMIP protocol, iDRAC needs to be configured with the KMS information as well as SSL/TLS related configuration.
Configuring SEKM
To configure SEKM:
1. Click Configuration > Storage Configuration > Controller Configuration.
2. In Security (Encryption) field, Select Secure Enterprise Key Manager from the drop down.
3. Configure Secure Enterprise Key Manager window will be displayed.
4. Specify the required fields in this window.
NOTE: For more details on the fields, see the iDRAC Online Help.
5. After filling the information for all the fields, click Finish.
Managing storage devices
231