Fabric OS Encryption Administrator's Guide v6.4.0 (53-1001864-01, June 2010)

Fabric OS Encryption Administrator’s Guide 131
53-1001864-01
Crypto LUN configuration
3
Configuring a tape LUN
This example shows how to configure a tape storage device. The basic setup procedure is the same
as for disk devices. Only a subset of configuration options and policy settings are available for tape
LUNs. Refer to Table 6 on page 130 for tape LUN configuration options.
1. Create a zone that includes the initiator (host) and the target port. Refer to the section
“Creating an initiator - target zone” on page 118 for instructions.
2. Create a CryptoTarget container of type tape. Refer to the section “Creating a CryptoTarget
container” on page 123 for instructions.
a. Create the container, allowing the encryption format to default to Native.
FabricAdmin:switch>cryptocfg --create -container tape my_tape_tgt \
10:00:00:05:1e:41:9a:7e 20:0c:00:06:2b:0f:72:6d 20:00:00:06:2b:0f:72:6d
Operation Succeeded
b. Add an initiator to the CryptoTarget container “my_tape_tgt”.
FabricAdmin:switch>cryptocfg --add -initiator my_tape_tgt \
10:00:00:00:c9:2b:c9:3a 20:00:00:00:c9:2b:c9:3a
Operation Succeeded
c. Commit the transaction.
FabricAdmin:switch>cryptocfg --commit
Operation Succeeded
3. Configure the Crypto tape LUN. Refer to the section “Configuring a Crypto LUN” on page 128
for instructions.
a. Discover the LUN.
FabricAdmin:switch>cryptocfg --discoverLUN my_tape_tgt
Container name: my_tape_tgt
Number of LUN(s): 1
Host: 10:00:00:00:c9:2b:c9:3a
LUN number: 0x0
LUN serial number:
Key ID state: Key ID not Applicable
b. Add the LUN to the tape CryptoTarget container. The following example enables the LUN for
encryption. There is a maximum of eight tape LUNs per Initiator in a container.
FabricAdmin:switch>cryptocfg --add -LUN my_tape_tgt 0x0 \
Re-key policy
Disk LUN: yes
Tape LUN: No
Modify? Yes
-enable_rekey time_period
<days>| -disable_rekey
Enables or disables the auto re-keying feature on a specified disk
LUN. This policy is not valid for tape LUNs. By Default, the
automatic re-key feature is disabled. Enabling automatic re-keying
is valid only if the LUN policy is set to -encrypt. You must specify a
time period in days when enabling Auto Re-keying to indicate the
interval at which automatic re-keying should take place.
Key lifespan
Disk LUN: No
Tape LUN: Yes
Modify? Disks
only. Tape: No
-key_lifespan time_in_days
| none
Specifies the life span of the encryption key in days. The key will
expire after the specified number of days. Accepted values are
integers from 1 to 2982616. The default value is none, which
means the key does not expire. On tape LUNs, the key life span
cannot be modified after it is set.
TABLE 6 LUN parameters and policies (Continued)
Policy name Command parameters Description