Brocade Fabric OS Encryption Administrator's Guide v7.1.0 (53-1002721-01, March 2013)

178 Fabric OS Encryption Administrator’s Guide (SKM/ESKM)
53-1002721-01
Crypto LUN configuration
3
FabricAdmin:switch> cryptocfg --modify -LUN my_disk_tgt 0x0
10:00:00:00:c9:2b:c9:3a -disable_rekey
Operation Succeeded
3. Commit the configuration.
FabricAdmin:switch> cryptocfg --commit
Operation Succeeded
CAUTION
When configuring a LUN with multiple paths, do not commit the configuration before you have
modified all the LUNs with identical policy settings and in sequence for each of the CryptoTarget
containers for each of the paths accessing the LUNs. Failure to do so results in data corruption.
Refer to the section “Configuring a multi-path Crypto LUN” on page 179.
LUN modification considerations
Make sure you understand the ramifications of modifying LUN policy parameters (such as
encrypt/cleartext) for LUNs that are online and already being utilized. The following restrictions
apply when modifying LUN policy parameters for disk LUNs:
• When you change LUN policy from encrypt to cleartext, you wipe out all encrypted data stored
on the LUN the next time data is written to that LUN. The following policy parameters are
disabled:
-enable_encexistingdata, -enable_rekey.
• When you change the LUN policy back to encrypt, for example, by force-enabling the LUN,
-enable_encexistingdata and
-enable_rekey are disabled by default, and you must configure
both options again.
• When you add a LUN as cleartext and later you want to change the LUN policy from cleartext to
encrypt, you must set the
-enable_encexistingdata option. If you do not, all data on that LUN
is lost, and cannot be recovered.
For tape LUNs, the
-enable_encexistingdata, -enable_rekey, and -key_lifespan options are not
valid and therefore cannot be modified. When you attempt to execute these parameters while
modifying a tape LUN, the system returns an error. Disabling
-write_early ack or -read_ahead for
tape LUN will result in lower total throughput depending on the number of flows per encryption
engine.
NOTE
Make sure all the outstanding backup and recovery operations on the media are completed before
changing the LUN configuration.
For Disk LUNs
-write_early_ack and -read_ahead are not valid and therefore cannot be modified.
When you attempt to execute these parameters while modifying a disk LUN, the system returns an
error.