Fabric OS Encryption Administrator's Guide v6.4.0 (53-1001864-01, June 2010)

170 Fabric OS Encryption Administrator’s Guide

53-1001864-01

Configuration upload and download considerations

Steps after configuration download

For all key vaults except LKM, restore or generate and backup the master key. In cluster

environments, the master key is propagated from group leader node.

1. Use the following command to enable the encryption engine.

cryptocfg --enableEE [slot num]

2. Commit the configuration.

cryptocfg --commit

3. If there are containers that belonged to the old encryption switch or blade, then after

configdownload is run, use the following command to change the ownership of containers to

the new encryption switch or blade, assuming the host and target physical zone exists.

cryptocfg –replace <old EE WWN> <new EE WWN>

4. Commit the configuration.

cryptocfg --commit

5. Use the following command to check if the switch or blade has the master key.

cryptocfg --show -groupmember <switch WWN>

6. If a master key is not present, restore the master key from backed up copy. Procedures will

differ depending on the backup media used (from recovery smart cards, from the key vault,

from a file on the network or a file on a USB-attached device). If new master key needs to be

generated, generate the master key and back it up.

For LKM key vaults, establish the trusted link with the LKM appliance.

If authentication cards are used, set the authentication quorum size from the encryption group

leader node, after importing and registering the necessary number of Authentication Card

certificates.