Brocade Fabric OS Encryption Administrator's Guide v7.1.0 (53-1002721-01, March 2013)

x Fabric OS Encryption Administrator’s Guide (SKM/ESKM)
53-1002721-01
Rekeying best practices and policies. . . . . . . . . . . . . . . . . . . . . . . .295
Manual rekey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .295
Latency in rekey operations . . . . . . . . . . . . . . . . . . . . . . . . . . .295
Allow rekey to complete before deleting a container. . . . . . . .295
Rekey operations and firmware upgrades . . . . . . . . . . . . . . . .295
Do not change LUN configuration while rekeying . . . . . . . . . .296
Recommendation for Host I/O traffic during online
rekeying and first- time encryption . . . . . . . . . . . . . . . . . . . . . .296
KAC certificate registration expiry . . . . . . . . . . . . . . . . . . . . . . . . . .296
Changing IP addresses in encryption groups . . . . . . . . . . . . . . . . .296
Disabling the encryption engine . . . . . . . . . . . . . . . . . . . . . . . . . . .297
Recommendations for Initiator Fan-Ins . . . . . . . . . . . . . . . . . . . . . .297
Best practices for host clusters in an encryption environment . . .298
HA Cluster deployment considerations and best practices . . . . . .298
Key Vault Best Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .298
Tape Device LUN Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .299
Chapter 6 Maintenance and Troubleshooting
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .301
Encryption group and HA cluster maintenance. . . . . . . . . . . . . . . .302
Displaying encryption group configuration or status
information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .302
Removing a member node from an encryption group. . . . . . .302
Deleting an encryption group . . . . . . . . . . . . . . . . . . . . . . . . . .305
Removing an HA cluster member . . . . . . . . . . . . . . . . . . . . . . .305
Displaying the HA cluster configuration . . . . . . . . . . . . . . . . . .306
Replacing an HA cluster member . . . . . . . . . . . . . . . . . . . . . . .307
Deleting an HA cluster member . . . . . . . . . . . . . . . . . . . . . . . .309
Performing a manual failback of an encryption engine . . . . .310
Encryption group merge and split use cases . . . . . . . . . . . . . . . . .311
A member node failed and is replaced . . . . . . . . . . . . . . . . . .311
A member node reboots and comes back up . . . . . . . . . . . . .312
A member node lost connection to the group leader . . . . . . .313
A member node lost connection to all other nodes in the
encryption group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .313
Several member nodes split off from an encryption group . .314
Adjusting heartbeat signaling values . . . . . . . . . . . . . . . . . . . .315
EG split possibilities requiring manual recovery . . . . . . . . . . .316
Configuration impact of encryption group split or node
isolation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .320
Encryption group database manual operations . . . . . . . . . . . . . . .321
Manually synchronizing the encryption group database. . . . .321
Manually synchronizing the security database . . . . . . . . . . . .321
Aborting a pending database transaction . . . . . . . . . . . . . . . .322
Key vault diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .322
Measuring encryption performance . . . . . . . . . . . . . . . . . . . . . . . .323