Brocade Fabric OS Encryption Administrator's Guide v7.1.0 (53-1002721-01, March 2013)

Fabric OS Encryption Administrator’s Guide (SKM/ESKM) vii
53-1002721-01
Steps for connecting to an SKM or ESKM appliance . . . . . . . . . . .136
Configuring a Brocade group. . . . . . . . . . . . . . . . . . . . . . . . . . .136
Setting up the local Certificate Authority (CA) . . . . . . . . . . . . .137
Downloading the local CA certificate . . . . . . . . . . . . . . . . . . . .138
Creating and installing the SKM or ESKM server
certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .139
Enabling SSL on the Key Management System (KMS)
Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .140
Creating an SKM or ESKM high availability cluster . . . . . . . . .141
Copying the local CA certificate. . . . . . . . . . . . . . . . . . . . . . . . .141
Adding SKM or ESKM appliances to the cluster . . . . . . . . . . .142
Initializing the Fabric OS encryption engines. . . . . . . . . . . . . .143
Signing the Brocade encryption node KAC certificates. . . . . .144
Registering SKM or ESKM on a Brocade encryption group
leader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .145
Registering the SKM/ESKM Brocade group user name
and password. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .147
SKM or ESKM key vault high availability deployment . . . . . . .148
Adding a member node to an encryption group . . . . . . . . . . .149
Generating and backing up the master key . . . . . . . . . . . . . . . . . .152
High availability cluster configuration . . . . . . . . . . . . . . . . . . . . . . .154
HA cluster configuration rules. . . . . . . . . . . . . . . . . . . . . . . . . .154
Creating an HA cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .155
Adding an encryption engine to an HA cluster . . . . . . . . . . . . .156
Failover/failback policy configuration. . . . . . . . . . . . . . . . . . . .156
Re-exporting a master key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .157
Exporting an additional key ID . . . . . . . . . . . . . . . . . . . . . . . . .158
Viewing the master key IDs . . . . . . . . . . . . . . . . . . . . . . . . . . . .159
Enabling the encryption engine . . . . . . . . . . . . . . . . . . . . . . . . . . . .160
Checking encryption engine status . . . . . . . . . . . . . . . . . . . . .160
Zoning considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .161
Setting default zoning to no access . . . . . . . . . . . . . . . . . . . . .161
Frame redirection zoning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .162
Creating an initiator - target zone . . . . . . . . . . . . . . . . . . . . . . .162
CryptoTarget container configuration . . . . . . . . . . . . . . . . . . . . . . .164
LUN rebalancing when hosting both disk and tape
targets. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .165
Gathering information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .166
Creating a CryptoTarget container . . . . . . . . . . . . . . . . . . . . . .167
Removing an initiator from a CryptoTarget container . . . . . . .168
Deleting a CryptoTarget container . . . . . . . . . . . . . . . . . . . . . .169
Moving a CryptoTarget container . . . . . . . . . . . . . . . . . . . . . . .170