Brocade Fabric OS Encryption Administrator's Guide v7.1.0 (53-1002721-01, March 2013)

Fabric OS Encryption Administrator’s Guide (SKM/ESKM) 321
53-1002721-01
Encryption group database manual operations
6
Encryption group database manual operations
Manual intervention may be necessary if the encryption group databases or security databases of
encryption group members are not synchronized. The following sections describe manual
operations that enable you to do the following:
• Synchronize the encryption group database.
• Synchronize the security database.
• Abort a pending database transaction.
Manually synchronizing the encryption group database
The --sync -encgroup command manually synchronizes the encryption group database belonging
to the group leader node with the databases of all member nodes that are out of sync. If this
command is invoked when the encryption group databases are in sync, the command is ignored.
NOTE
When the encryption group is out of sync and the group leader reboots, the newly selected group
leader pushes its database information to all other members. The new group leader’s database
information may be different from what was set up before the group leader was rebooted.
Manually synchronizing the security database
This operation can resolve problems with master key propagation (and connectivity issues between
peer node encryption engines in an encryption group). The synchronization occurs every time this
command is executed regardless of whether or not the security database was synchronized across
all nodes in the encryption group.
Use the
--sync -securitydb command to distribute the security database from the group leader
node to all member nodes. This command is valid only on the group leader.
In scenarios where this master key propagation issue still persists, exporting the master key to a
file and recovering it resolves the issue. To do this, use the following commands:
• Use the cryptocfg --exportmasterkey -file option to export the master key to a file.
• Use the cryptocfg --recovermasterkey currentMK -srcfile to recover the master key.
Crypto Device
(target/LUN/tape)
• Creating a CryptoTarget container
• Adding initiators or LUNs to a CryptoTarget container
• Removing initiators or LUNS from a CryptoTarget container
• Modifying LUNs or LUN policies
• Creating or deleting a tape pool
• Modifying a tape pool policy
• Starting a manual rekeying session
• Performing a manual failback of containers
• Deleting a CryptoTarget container
TABLE 8 Disallowed Configuration Changes
Configuration Type Disallowed configuration changes