Fabric OS Encryption Administrator's Guide v6.4.0 (53-1001864-01, June 2010)

Fabric OS Encryption Administrator’s Guide 193

53-1001864-01

Encryption group and HA cluster maintenance

• Each encryption group registers the missing members as “offline”.

• The isolation of N3 from the original encryption group breaks the HA cluster and failover

capability between N3 and N1.

• You cannot configure any CryptoTargets, LUN policies, tape pools, or security parameters on

any of the group leaders. This would require communication with the “offline” member nodes.

You cannot start any re-key operations (auto or manual) on any of the nodes. Refer to the

section“Configuration impact of encryption group split or node isolation” on page 194 for more

information on which configuration changes are allowed.

Recovery

1. Restore the connection between the nodes in the separate encryption group islands, that is,

between nodes N3, N4 and between nodes N1 and N2.

When the lost connection is restored, an automatic split recovery process begins. The two

group leaders (N3 and N2 in this example) arbitrate the recovery, and the group leader node

with the highest WWN becomes group leader. If the number of nodes in each group is not

equal, the group leader for the group with the largest number of members becomes group

leader.

2. After the encryption group enters the converged state, execute the cryptocfg

--commit

command on the group leader node to distribute the crypto-device configuration from the

group leader to all member nodes.