HP StoreEver 1/8 G2 Tape Autoloader and MSL Tape Libraries User and Service Guide Addendum (AK378-96068, September 2013)

4. From the KMIP server find the key that was created in step 2 and temporarily disable the key’s
ability to be exported.
See your server documentation for instructions.
5. Using your backup application, load the same tape into any drive in the partition configured
for KMIP encryption. Read the header of the tape using a media identification or similar
command.
• The backup application should report a failure because the key cannot be exported but
header is encrypted.
• One of the KMIP server logs should show a request for the key and that the request was
denied.
6. Using the backup application, unload the media to a slot.
7. From the KMIP server, re-enable the ability to export the key that was disabled in step 4.
8. Repeat step 5. The command should succeed.
9. Unload the media to a slot.
This concludes the basic encryption test.
Failover test
1. From the basic encryption test, step 8, identify the KMIP server that provided the key. This is
the server that logged the key export.
2. From the KMIP server, temporarily disable that server’s ability to communicate with clients.
See the server documentation for instructions.
3. Repeat step 5 of the basic encryption test.
The command should succeed, with the key provided by a different server. You can identify
the server that exported the key by inspecting each server’s log files.
4. Unload the media to a slot.
5. If there are more than two KMIP servers, continue disabling server-client communications and
repeating this test until every server has successfully served the key.
6. Re-enable the ability of each server to communicate with the clients.
This concludes the failover test.
Configuring the KMIP feature 11