Fabric OS Encryption Administrator's Guide v6.4.0 (53-1001864-01, June 2010)

174 Fabric OS Encryption Administrator’s Guide
53-1001864-01
Configuring CryptoTarget containers and LUNs
5
Configuring CryptoTarget containers and LUNs
The following are best practices to follow when configuring CryptoTarget containers and crypto
LUNs:
• Host a target port on only one encryption switch, or one HA cluster. All LUNs visible through the
target port are hosted on the same encryption switch, and are available for storing cipher text.
• Be sure all nodes in a given DEK or HA cluster are up and enabled before creating an
encrypted LUN. If a node in the DEK or HA cluster is down, or the encryption engine is down or
not enabled when an encrypted LUN is added to the CryptoTarget container, write operations
will hang when writing metadata to the LUN, and I/O will timeout. Data integrity is not
guaranteed in this condition.
• Before committing CryptoTarget container or LUN configurations or modifications on an
encryption switch or FS8-18 blade, make sure that there are no outstanding zoning
transactions in the switch or fabric. If there is an outstanding zoning transaction, the commit
operation will fail and result in disabling the LUN. You can check for outstanding zoning
transactions by issuing cfgtransshow CLI command.
• LUNs are uniquely identified by the encryption switch or FS8-18 blade using the LUN serial
number. The LUN serial number must be unique for LUNs exposed from the same target port.
The LUN serial number must be unique for LUNs belonging to different target ports in
non-multipathing configurations. Failure to ensure that the serial numbers are unique will
result in undefined behavior and may result in faulting the encryption switch or FS8-18 blade.
• To enable host MPIO, LUNs must also be available through a second target port, hosted on a
second encryption switch. The second encryption switch could be in the same fabric, or a
different fabric.
• Hosts should be able to access LUNs through multiple ports for redundancy.
• For high availability and failover within the fabric, implement an HA cluster of two encryption
switches, and host the target port as a virtual target on one of the switches.
• Don't change the WWN of any node after it has been deployed in an encryption group.
• To minimize host IO disruption or time-outs during CryptoTarget container failover, it is
recommended that the devices (hosts, target ports) are connected to an edge switch in a
fabric, and not directly to Encryption switch/blade ports.
• Always use this two step process when configuring the LUN for encryption, unless the LUN was
previously encrypted.
1. Add the LUN as cleartext to the CryptoTarget container.
2. When the LUN comes online and Host I/O starts flowing through the LUN as cleartext, then
modify the LUN from cleartext to encrypt and enable_encexistingdata options to convert the
LUN to encryption.
An exception to this LUN configuration process is that if the LUN was previously encrypted by
the encryption switch or FS8-18 blade, then the LUN can be added to the CryptoTarget
Container with the –encrypt and –lunstate encrypted options.