Brocade Communications Systems StoreFabric SN6500B Service manual

53-1002721-01
14 December 2012
®
53-1002721-01
Fabric OS Encryption
Administrator’s Guide Supporting
HP Secure Key Manager (SKM) and HP
Enterprise Secure Key Manager (ESKM)
Environments
Supporting Fabric OS v7.1.0

Copyright © 2011 - 2012 Brocade Communications Systems, Inc. All Rights Reserved.
Brocade, Brocade Assurance, the B-wing symbol, BigIron, DCX, Fabric OS, FastIron, MLX, NetIron, SAN Health, ServerIron,
TurboIron, VCS, and VDX are registered trademarks, and AnyIO, Brocade One, CloudPlex, Effortless Networking, ICX, NET Health,
OpenScript, and The Effortless Network are trademarks of Brocade Communications Systems, Inc., in the United States and/or in
other countries. Other brands, products, or service names mentioned may be trademarks of their respective owners.
Notice: This document is for informational purposes only and does not set forth any warranty, expressed or implied, concerning
any equipment, equipment feature, or service offered or to be offered by Brocade. Brocade reserves the right to make changes to
this document at any time, without notice, and assumes no responsibility for its use. This informational document describes
features that may not be currently available. Contact a Brocade sales office for information on feature and product availability.
Export of technical data contained in this document may require an export license from the United States government.
The authors and Brocade Communications Systems, Inc. shall have no liability or responsibility to any person or entity with
respect to any loss, cost, liability, or damages arising from the information contained in this book or the computer programs that
accompany it.
The product described by this document may contain “open source” software covered by the GNU General Public License or other
open source license agreements. To find out which open source software is included in Brocade products, view the licensing
terms applicable to the open source software, and obtain a copy of the programming source code, please visit
http://www.brocade.com/support/oscd.
Brocade Communications Systems, Incorporated
Document History
Corporate and Latin American Headquarters
Brocade Communications Systems, Inc.
130 Holger Way
San Jose, CA 95134
Tel: [phone]
Fax: [phone]
E-mail: [e-mail]
Asia-Pacific Headquarters
Brocade Communications Systems China HK, Ltd.
No. 1 Guanghua Road
Chao Yang District
Units 2718 and 2818
Beijing 100020, China
Tel: [phone]
Fax: [phone]
E-mail: [email protected]
European Headquarters
Brocade Communications Switzerland Sàrl
Centre Swissair
Tour B - 4ème étage
29, Route de l'Aéroport
Case Postale 105
CH-1215 Genève 15
Switzerland
Tel: [phone]
Fax: [phone]
E-mail: [e-mail]
Asia-Pacific Headquarters
Brocade Communications Systems Co., Ltd. (Shenzhen WFOE)
Citic Plaza
No. 233 Tian He Road North
Unit 1308 – 13th Floor
Guangzhou, China
Tel: [phone]
Fax: [phone]
E-mail: [email protected]
Title Publication number Summary of changes Date
Fabric OS Administrator’s Guide Supporting
HP Secure Key Manager (SKM) and HP
Enterprise Secure Key Manager (ESKM)
Environments
53-1002721-01 New product release December 2012

Fabric OS Encryption Administrator’s Guide (SKM/ESKM) iii
53-1002721-01
Contents
About This Document
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii
How this document is organized . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii
Supported hardware and software . . . . . . . . . . . . . . . . . . . . . . . . . . xiv
What’s new in this document. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv
Document conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv
Text formatting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv
Command syntax conventions . . . . . . . . . . . . . . . . . . . . . . . . . . xv
Notes, cautions, and warnings . . . . . . . . . . . . . . . . . . . . . . . . . . xv
Key terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv
Notice to the reader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi
Additional information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi
Brocade resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi
Other industry resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii
Getting technical help. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xvii
Document feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xviii
Chapter 1 Encryption Overview
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Host and LUN considerations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
The Brocade Encryption Switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
The FS8-18 blade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
FIPS mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Performance licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Adding a license. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Licensing best practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Recommendation for connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Usage limitations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Brocade encryption solution overview. . . . . . . . . . . . . . . . . . . . . . . . . 7
Data flow from server to storage . . . . . . . . . . . . . . . . . . . . . . . . . 8
Data encryption key life cycle management . . . . . . . . . . . . . . . . . . . . 9
Master key management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Master key generation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Master key backup. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

iv Fabric OS Encryption Administrator’s Guide (SKM/ESKM)
53-1002721-01
Support for virtual fabrics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Cisco Fabric Connectivity support . . . . . . . . . . . . . . . . . . . . . . . . . . .12
Chapter 2 Configuring Encryption Using the Management Application
Encryption Center features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Encryption user privileges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Smart card usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Using authentication cards with a card reader . . . . . . . . . . . . . 16
Registering authentication cards from a card reader . . . . . . . . 17
Registering authentication cards from the database . . . . . . . .19
Deregistering an authentication card. . . . . . . . . . . . . . . . . . . . .20
Setting a quorum for authentication cards . . . . . . . . . . . . . . . .20
Using system cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Enabling or disabling the system card requirement . . . . . . . . . 22
Registering systems card from a card reader . . . . . . . . . . . . . . 22
Deregistering system cards. . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
Using smart cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
Tracking smart cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Editing smart cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Network connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Blade processor links . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Configuring blade processor links . . . . . . . . . . . . . . . . . . . . . . . 28
Encryption node initialization and certificate generation. . . . . . . . .28
Setting encryption node initialization . . . . . . . . . . . . . . . . . . . . .29
Steps for connecting to an ESKM/SKM appliance . . . . . . . . . . . . . .29
Configuring a Brocade group on ESKM/SKM . . . . . . . . . . . . . . 30
Registering the ESKM/SKM Brocade group user name
and password. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30
Setting up the local Certificate Authority (CA) on
ESKM/SKM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Downloading the local CA certificate from ESKM/SKM . . . . . .33
Creating and installing the ESKM/SKM server certificate . . . . 34
Enabling SSL on the Key Management System (KMS)
Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .35
Creating an ESKM/SKM High Availability cluster . . . . . . . . . . .35
Copying the local CA certificate for a clustered ESKM/SKM
appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Adding ESKM/SKM appliances to the cluster . . . . . . . . . . . . . . 36
Signing the encryption node KAC certificates . . . . . . . . . . . . . . 37
Importing a signed KAC certificate into a switch . . . . . . . . . . . . 38
ESKM/SKM key vault high availability deployment . . . . . . . . . . 38
Encryption preparation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .40
Creating a new encryption group . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Configuring key vault settings for HP Enterprise Secure
Key Manager (ESKM/SKM). . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Understanding configuration status results. . . . . . . . . . . . . . . . 49
Adding a switch to an encryption group. . . . . . . . . . . . . . . . . . . . . . .50

Fabric OS Encryption Administrator’s Guide (SKM/ESKM) v
53-1002721-01
Replacing an encryption engine in an encryption group . . . . . . . . .55
High availability (HA) clusters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Creating High availability (HA) clusters. . . . . . . . . . . . . . . . . . . . 56
Removing engines from an HA cluster . . . . . . . . . . . . . . . . . . . . 57
Swapping engines in an HA cluster . . . . . . . . . . . . . . . . . . . . . . 58
Failback option. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Invoking failback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Configuring encryption storage targets . . . . . . . . . . . . . . . . . . . . . . .59
Adding an encryption target . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Configuring hosts for encryption targets . . . . . . . . . . . . . . . . . . . . . . 67
Adding target disk LUNs for encryption . . . . . . . . . . . . . . . . . . . . . . . 69
Configuring storage arrays . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Adding target tape LUNs for encryption. . . . . . . . . . . . . . . . . . . . . . .75
Moving Targets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Configuring encrypted tape storage in a multi-path
environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Tape LUN write early and read ahead . . . . . . . . . . . . . . . . . . . . . . . .79
Enabling and disabling tape LUN write early and read
ahead . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Tape LUN statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Viewing and clearing tape container statistics . . . . . . . . . . . . . 81
Viewing and clearing tape LUN statistics for specific
tape LUNs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
Viewing and clearing statistics for tape LUNs in a
container . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .84
Encryption engine rebalancing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Rebalancing an encryption engine . . . . . . . . . . . . . . . . . . . . . . .86
Master keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Active master key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Alternate master key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Master key actions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Saving the master key to a file . . . . . . . . . . . . . . . . . . . . . . . . . .88
Saving a master key to a key vault . . . . . . . . . . . . . . . . . . . . . . .89
Saving a master key to a smart card set . . . . . . . . . . . . . . . . . .90
Restoring a master key from a file . . . . . . . . . . . . . . . . . . . . . . . 92
Restoring a master key from a key vault . . . . . . . . . . . . . . . . . .93
Restoring a master key from a smart card set. . . . . . . . . . . . . .94
Creating a new master key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Security Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .96
Zeroizing an encryption engine . . . . . . . . . . . . . . . . . . . . . . . . . . . . .96
Setting zeroization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Using the Encryption Targets dialog box . . . . . . . . . . . . . . . . . . . . . .98
Redirection zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

vi Fabric OS Encryption Administrator’s Guide (SKM/ESKM)
53-1002721-01
Disk device decommissioning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .99
Decommissioning Disk LUNs . . . . . . . . . . . . . . . . . . . . . . . . . .100
Displaying and deleting decommissioned key IDs. . . . . . . . . .100
Displaying Universal IDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .102
Rekeying all disk LUNs manually . . . . . . . . . . . . . . . . . . . . . . . . . . .102
Setting disk LUN Re-key All . . . . . . . . . . . . . . . . . . . . . . . . . . . .103
Viewing disk LUN rekeying details . . . . . . . . . . . . . . . . . . . . . .104
Viewing the progress of manual rekey operations. . . . . . . . . .105
Thin provisioned LUNs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .107
Viewing time left for auto rekey . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Viewing and editing switch encryption properties . . . . . . . . . . . . .108
Exporting the public key certificate signing request (CSR)
from properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .111
Importing a signed public key certificate from properties . . .111
Enabling and disabling the encryption engine state from
properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .111
Viewing and editing encryption group properties . . . . . . . . . . . . . .112
General tab. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .114
Members tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .115
Consequences of removing an encryption switch . . . . . . . . . .117
Security tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .118
HA Clusters tab. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .120
Tape Pools tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .122
Engine Operations tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .124
Encryption-related acronyms in log messages . . . . . . . . . . . . . . . .125
Chapter 3 Configuring Encryption Using the CLI
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .127
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .128
Command validation checks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .128
Command RBAC permissions and AD types . . . . . . . . . . . . . . . . . .129
Cryptocfg Help command output . . . . . . . . . . . . . . . . . . . . . . . . . . .132
Management LAN configuration . . . . . . . . . . . . . . . . . . . . . . . . . . .132
Configuring cluster links . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .133
Special consideration for blades . . . . . . . . . . . . . . . . . . . . . . .133
IP Address change of a node within an encryption group. . . .134
Setting encryption node initialization . . . . . . . . . . . . . . . . . . . . . . .135

Fabric OS Encryption Administrator’s Guide (SKM/ESKM) vii
53-1002721-01
Steps for connecting to an SKM or ESKM appliance . . . . . . . . . . .136
Configuring a Brocade group. . . . . . . . . . . . . . . . . . . . . . . . . . .136
Setting up the local Certificate Authority (CA) . . . . . . . . . . . . .137
Downloading the local CA certificate . . . . . . . . . . . . . . . . . . . .138
Creating and installing the SKM or ESKM server
certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .139
Enabling SSL on the Key Management System (KMS)
Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .140
Creating an SKM or ESKM high availability cluster . . . . . . . . . 141
Copying the local CA certificate. . . . . . . . . . . . . . . . . . . . . . . . .141
Adding SKM or ESKM appliances to the cluster . . . . . . . . . . .142
Initializing the Fabric OS encryption engines. . . . . . . . . . . . . .143
Signing the Brocade encryption node KAC certificates. . . . . .144
Registering SKM or ESKM on a Brocade encryption group
leader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .145
Registering the SKM/ESKM Brocade group user name
and password. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
SKM or ESKM key vault high availability deployment . . . . . . .148
Adding a member node to an encryption group . . . . . . . . . . .149
Generating and backing up the master key . . . . . . . . . . . . . . . . . .152
High availability cluster configuration . . . . . . . . . . . . . . . . . . . . . . .154
HA cluster configuration rules. . . . . . . . . . . . . . . . . . . . . . . . . .154
Creating an HA cluster. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .155
Adding an encryption engine to an HA cluster. . . . . . . . . . . . .156
Failover/failback policy configuration. . . . . . . . . . . . . . . . . . . .156
Re-exporting a master key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .157
Exporting an additional key ID . . . . . . . . . . . . . . . . . . . . . . . . .158
Viewing the master key IDs . . . . . . . . . . . . . . . . . . . . . . . . . . . .159
Enabling the encryption engine . . . . . . . . . . . . . . . . . . . . . . . . . . . .160
Checking encryption engine status . . . . . . . . . . . . . . . . . . . . .160
Zoning considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .161
Setting default zoning to no access . . . . . . . . . . . . . . . . . . . . . 161
Frame redirection zoning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .162
Creating an initiator - target zone . . . . . . . . . . . . . . . . . . . . . . .162
CryptoTarget container configuration . . . . . . . . . . . . . . . . . . . . . . .164
LUN rebalancing when hosting both disk and tape
targets. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .165
Gathering information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .166
Creating a CryptoTarget container . . . . . . . . . . . . . . . . . . . . . .167
Removing an initiator from a CryptoTarget container . . . . . . .168
Deleting a CryptoTarget container . . . . . . . . . . . . . . . . . . . . . .169
Moving a CryptoTarget container . . . . . . . . . . . . . . . . . . . . . . .170

viii Fabric OS Encryption Administrator’s Guide (SKM/ESKM)
53-1002721-01
Crypto LUN configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .170
Discovering a LUN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
Configuring a Crypto LUN . . . . . . . . . . . . . . . . . . . . . . . . . . . . .172
Crypto LUN parameters and policies . . . . . . . . . . . . . . . . . . . .173
Configuring a tape LUN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .175
Removing a LUN from a CryptoTarget container . . . . . . . . . . .177
Modifying Crypto LUN parameters . . . . . . . . . . . . . . . . . . . . . . 177
LUN modification considerations . . . . . . . . . . . . . . . . . . . . . . .178
Impact of tape LUN configuration changes. . . . . . . . . . . . . . . . . . .179
Configuring a multi-path Crypto LUN . . . . . . . . . . . . . . . . . . . . . . . .179
Multi-path LUN configuration example . . . . . . . . . . . . . . . . . . .180
Decommissioning LUNs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .183
Decommissioning replicated LUNs . . . . . . . . . . . . . . . . . . . . . . . . .185
Decommissioning primary LUNs only . . . . . . . . . . . . . . . . . . . .185
Decommissioning secondary LUNs only . . . . . . . . . . . . . . . . .185
Decommissioning primary and secondary LUN pairs . . . . . . .186
Force-enabling a decommissioned disk LUN for encryption . . . . .186
Force-enabling a disabled disk LUN for encryption . . . . . . . . . . . .187
Tape pool configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .188
Tape pool labeling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .188
Creating a tape pool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .190
Deleting a tape pool. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .191
Modifying a tape pool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .191
Impact of tape pool configuration changes . . . . . . . . . . . . . . .191
First-time encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .192
Resource allocation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .192
First-time encryption modes . . . . . . . . . . . . . . . . . . . . . . . . . . .192
Configuring a LUN for first-time encryption . . . . . . . . . . . . . . .192
Thin provisioned LUNs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .193
Space reclamation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .194
Data rekeying. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .195
Resource allocation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .195
Rekeying modes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .195
Configuring a LUN for automatic rekeying . . . . . . . . . . . . . . . .196
Initiating a manual rekey session . . . . . . . . . . . . . . . . . . . . . . .197
Suspension and resumption of rekeying operations. . . . . . . .198
Chapter 4 Deployment Scenarios
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .199
Single encryption switch, two paths from host to target . . . . . . . .200
Single fabric deployment - HA cluster . . . . . . . . . . . . . . . . . . . . . . .201
Single fabric deployment - DEK cluster . . . . . . . . . . . . . . . . . . . . . .202
Dual fabric deployment - HA and DEK cluster. . . . . . . . . . . . . . . . .203
Multiple paths, one DEK cluster, and two HA clusters . . . . . . . . . .204
Multiple paths, DEK cluster, no HA cluster . . . . . . . . . . . . . . . . . . .206

Fabric OS Encryption Administrator’s Guide (SKM/ESKM) ix
53-1002721-01
Deployment in Fibre Channel routed fabrics. . . . . . . . . . . . . . . . . .207
Deployment as part of an edge fabric . . . . . . . . . . . . . . . . . . . . . . .209
Deployment with FCIP extension switches . . . . . . . . . . . . . . . . . . .210
VMware ESX server deployments. . . . . . . . . . . . . . . . . . . . . . . . . . .211
Chapter 5 Best Practices and Special Topics
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .283
Firmware upgrade and downgrade considerations . . . . . . . . . . . .284
General guidelines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .285
Specific guidelines for HA clusters . . . . . . . . . . . . . . . . . . . . . .286
Configuration upload and download considerations . . . . . . . . . . .287
Configuration upload at an encryption group leader
node . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .287
Configuration upload at an encryption group member
node . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .287
Information not included in an upload . . . . . . . . . . . . . . . . . . .287
Steps before configuration download. . . . . . . . . . . . . . . . . . . .288
Configuration download at the encryption group leader. . . . .288
Configuration download at an encryption group member . . .288
Steps after configuration download . . . . . . . . . . . . . . . . . . . . .288
HP-UX considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .289
AIX Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .290
Enabling a disabled LUN. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .290
Disk metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .290
Tape metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .290
Tape data compression . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .290
Tape pools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .291
Tape block zero handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .292
Tape key expiry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .292
Configuring CryptoTarget containers and LUNs . . . . . . . . . . . . . . .292
Redirection zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .293
Deployment with Admin Domains (AD) . . . . . . . . . . . . . . . . . . . . . .293
Do not use DHCP for IP interfaces . . . . . . . . . . . . . . . . . . . . . . . . . .293
Ensure uniform licensing in HA clusters . . . . . . . . . . . . . . . . . . . . .294
Tape library media changer considerations . . . . . . . . . . . . . . . . . .294
Turn off host-based encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . .294
Avoid double encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .294
PID failover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .294
Turn off compression on extension switches . . . . . . . . . . . . . . . . .295

xFabric OS Encryption Administrator’s Guide (SKM/ESKM)
53-1002721-01
Rekeying best practices and policies. . . . . . . . . . . . . . . . . . . . . . . .295
Manual rekey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .295
Latency in rekey operations . . . . . . . . . . . . . . . . . . . . . . . . . . .295
Allow rekey to complete before deleting a container. . . . . . . .295
Rekey operations and firmware upgrades . . . . . . . . . . . . . . . .295
Do not change LUN configuration while rekeying . . . . . . . . . .296
Recommendation for Host I/O traffic during online
rekeying and first- time encryption . . . . . . . . . . . . . . . . . . . . . .296
KAC certificate registration expiry . . . . . . . . . . . . . . . . . . . . . . . . . .296
Changing IP addresses in encryption groups . . . . . . . . . . . . . . . . .296
Disabling the encryption engine . . . . . . . . . . . . . . . . . . . . . . . . . . .297
Recommendations for Initiator Fan-Ins . . . . . . . . . . . . . . . . . . . . . .297
Best practices for host clusters in an encryption environment . . .298
HA Cluster deployment considerations and best practices . . . . . .298
Key Vault Best Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .298
Tape Device LUN Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .299
Chapter 6 Maintenance and Troubleshooting
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .301
Encryption group and HA cluster maintenance. . . . . . . . . . . . . . . .302
Displaying encryption group configuration or status
information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .302
Removing a member node from an encryption group. . . . . . .302
Deleting an encryption group . . . . . . . . . . . . . . . . . . . . . . . . . .305
Removing an HA cluster member . . . . . . . . . . . . . . . . . . . . . . .305
Displaying the HA cluster configuration . . . . . . . . . . . . . . . . . .306
Replacing an HA cluster member . . . . . . . . . . . . . . . . . . . . . . .307
Deleting an HA cluster member . . . . . . . . . . . . . . . . . . . . . . . .309
Performing a manual failback of an encryption engine . . . . .310
Encryption group merge and split use cases . . . . . . . . . . . . . . . . .311
A member node failed and is replaced . . . . . . . . . . . . . . . . . .311
A member node reboots and comes back up . . . . . . . . . . . . .312
A member node lost connection to the group leader . . . . . . .313
A member node lost connection to all other nodes in the
encryption group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .313
Several member nodes split off from an encryption group . .314
Adjusting heartbeat signaling values . . . . . . . . . . . . . . . . . . . .315
EG split possibilities requiring manual recovery . . . . . . . . . . .316
Configuration impact of encryption group split or node
isolation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .320
Encryption group database manual operations . . . . . . . . . . . . . . .321
Manually synchronizing the encryption group database. . . . .321
Manually synchronizing the security database . . . . . . . . . . . .321
Aborting a pending database transaction . . . . . . . . . . . . . . . .322
Key vault diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .322
Measuring encryption performance . . . . . . . . . . . . . . . . . . . . . . . .323

Fabric OS Encryption Administrator’s Guide (SKM/ESKM) xi
53-1002721-01
General encryption troubleshooting . . . . . . . . . . . . . . . . . . . . . . . .325
Troubleshooting examples using the CLI . . . . . . . . . . . . . . . . . . . . .328
Encryption Enabled CryptoTarget LUN . . . . . . . . . . . . . . . . . . .328
Encryption Disabled CryptoTarget LUN. . . . . . . . . . . . . . . . . . .329
Management application encryption wizard troubleshooting . . . .330
Errors related to adding a switch to an existing group . . . . . .330
Errors related to adding a switch to a new group . . . . . . . . . .331
General errors related to the Configure Switch Encryption
wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .332
LUN policy troubleshooting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .333
Loss of encryption group leader after power outage . . . . . . . . . . .334
MPIO and internal LUN states . . . . . . . . . . . . . . . . . . . . . . . . . . . . .335
Suspension and resumption of rekeying operations. . . . . . . .335
FS8-18 blade removal and replacement. . . . . . . . . . . . . . . . . . . . .336
Multi-node EG replacement . . . . . . . . . . . . . . . . . . . . . . . . . . .336
Single-node EG replacement. . . . . . . . . . . . . . . . . . . . . . . . . . .338
Brocade Encryption Switch removal and replacement. . . . . . . . . .339
Multi-node EG Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .339
Single-node EG Replacement . . . . . . . . . . . . . . . . . . . . . . . . . .342
Reclaiming the WWN base of a failed Brocade Encryption
Switch. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .344
Removing stale rekey information for a LUN. . . . . . . . . . . . . . . . . .345
Downgrading firmware from Fabric OS 7.1.0. . . . . . . . . . . . . . . . . .345
Fabric OS and ESKM compatibility matrix. . . . . . . . . . . . . . . . . . . .346
Splitting an encryption group into two encryption groups . . . . . . .347
Moving an encryption blade from one EG to another in the
same fabric . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .348
Moving an encryption switch from one EG to another in the
same fabric . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .348
Appendix A State and Status Information
In this appendix. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .351
Encryption engine security processor (SP) states. . . . . . . . . . . . . .301
Security processor KEK status. . . . . . . . . . . . . . . . . . . . . . . . . . . . .352
Encrypted LUN states . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .352

xii Fabric OS Encryption Administrator’s Guide (SKM/ESKM)
53-1002721-01

Fabric OS Encryption Administrator’s Guide (SKM/ESKM) xiii
53-1002721-01
About This Document
In this chapter
•How this document is organized . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii
•Supported hardware and software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv
•What’s new in this document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv
•Document conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv
•Text formatting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv
•Command syntax conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv
•Key terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv
•Notice to the reader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi
•Additional information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi
•Brocade resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi
•Other industry resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii
•Getting technical help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii
•Document feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xviii
How this document is organized
.This document is organized to help you find the information that you want as quickly and easily as
possible.
The document contains the following components:
•Chapter 1, “Encryption Overview,” provides a task matrix, an overview of the data encryption
switch and the encryption solution, and the terminology used in this document.
•Chapter 2, “Configuring Encryption Using the Management Application”describes how to
configure and manage encryption features using Brocade Network Advisor.
•Chapter 3, “Configuring Encryption Using the CLI,” describes how to configure and manage
encryption features using the command line interface.
•Chapter 4, “Deployment Scenarios,” describes SAN configurations in which encryption may be
deployed.
•Chapter 5, “Best Practices and Special Topics,” summarizes best practices and addresses
special topics relevant to the implementation of encryption features.

xiv Fabric OS Encryption Administrator’s Guide (SKM/ESKM)
53-1002721-01
•Chapter 6, “Maintenance and Troubleshooting,” provides information on troubleshooting and
the most common commands and procedures to use to diagnose and recover from problems.
•Appendix A, “State and Status Information,” lists the encryption engine security processor (SP)
states, security processor key encryption key (KEK) status information, and encrypted LUN
states.
Supported hardware and software
.The following hardware platforms support data encryption as described in this manual.
•Brocade DCX Backbone series chassis with an FS8-18 encryption blade.
•Brocade Encryption Switch.
What’s new in this document
This document identifies any encryption changes that support Fabric OS 7.1.0.
Document conventions
This section describes text formatting conventions and important notice formats used in this
document.
Text formatting
The narrative-text formatting conventions that are used are as follows:
bold text Identifies command names
Identifies the names of user-manipulated GUI elements
Identifies keywords and operands
Identifies text to enter at the GUI or CLI
italic text Provides emphasis
Identifies variables
Identifies paths and Internet addresses
Identifies document titles
code text Identifies CLI output
Identifies command syntax examples
For readability, command names in the narrative portions of this guide are presented in mixed
lettercase: for example, switchShow. In actual examples, command lettercase is often all
lowercase. Otherwise, this manual specifically notes those cases in which a command is case
sensitive.

Fabric OS Encryption Administrator’s Guide (SKM/ESKM) xv
53-1002721-01
Command syntax conventions
Command syntax in this manual follows these conventions:
Notes, cautions, and warnings
The following notices and statements are used in this manual. They are listed below in order of
increasing severity of potential hazards.
NOTE
A note provides a tip, guidance or advice, emphasizes important information, or provides a reference
to related information.
ATTENTION
An Attention statement indicates potential damage to hardware or data.
CAUTION
A Caution statement alerts you to situations that can cause damage to hardware, firmware,
software, or data.
DANGER
A Danger statement indicates conditions or situations that can be potentially lethal or extremely
hazardous to you. Safety labels are also attached directly to products to warn of these conditions
or situations.
Key terms
For definitions specific to Brocade and Fibre Channel, see the technical glossaries on Brocade
Connect. See “Brocade resources” on page xvi for instructions on accessing MyBrocade.
command Commands are printed in bold.
--option, option Command options are printed in bold.
-argument, arg Arguments.
[ ] Optional element.
variable Variables are printed in italics. In the help pages, variables are underlined or
enclosed in angled brackets < >.
... Repeat the previous element, for example “member[;member...]”
value Fixed values following arguments are printed in plain font. For example,
--show WWN
| Boolean. Elements are exclusive. Example: --show -mode egress | ingress
\ Backslash. Indicates that the line continues through the line break. For
command line input, type the entire line without the backslash.

xvi Fabric OS Encryption Administrator’s Guide (SKM/ESKM)
53-1002721-01
For definitions specific to this document, see “Terminology” on page 2.
For definitions of SAN-specific terms, visit the Storage Networking Industry Association online
dictionary at:
http://www.snia.org/education/dictionary
Notice to the reader
This document may contain references to the trademarks of the following corporations. These
trademarks are the properties of their respective companies and corporations.
These references are made for informational purposes only.
Additional information
This section lists additional Brocade and industry-specific documentation that you might find
helpful.
Brocade resources
To get up-to-the-minute information, go to http://my.brocade.com and register at no cost for a user
ID and password.
For practical discussions about SAN design, implementation, and maintenance, you can obtain
Building SANs with Brocade Fabric Switches through:
http://www.amazon.com
Corporation Referenced Trademarks and Products
CommVault CommVault Galaxy Data Protection
EMC RSA Key Manager (RKM)
EMC RSA Data Protection Manager (DPM)
EMC EMC Networker
Hewlett Packard Secure Key Manager (SKM)
Hewlett Packard Enterprise Secure Key Manager (ESKM)
IBM Tivoli Key Lifecycle Manager (TKLM)
IBM IBM Tivoli Storage Manager (TSM)
Microsoft Corporation Windows, Windows NT, Internet Explorer
Net App Lifetime Key Manager (LKM)
SafeNet SafeNet
Symantec Symantec Veritas NetBackup Enterprise Server
Thales Thales Encryption Manager for Storage (TEMS)
Thales Thales e-Security keyAuthority (TEKA)

Fabric OS Encryption Administrator’s Guide (SKM/ESKM) xvii
53-1002721-01
For additional Brocade documentation, visit the Brocade SAN Info Center and click the Resource
Library location:
http://www.brocade.com
Release notes are available on the MyBrocade website and are also bundled with the Fabric OS
firmware.
Other industry resources
•White papers, online demos, and data sheets are available through the Brocade website at
http://www.brocade.com/products-solutions/products/index.page.
•Best practice guides, white papers, data sheets, and other documentation is available through
the Brocade Partner website.
For additional resource information, visit the Technical Committee T11 Web site. This website
provides interface standards for high-performance and mass storage applications for Fibre
Channel, storage management, and other applications:
http://www.t11.org
For information about the Fibre Channel industry, visit the Fibre Channel Industry Association
website:
http://www.fibrechannel.org
For information about the Key Management Interoperability Protocol standard, visit the OASIS KMIP
Technical Committee website:
https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=kmip
Getting technical help
Contact your switch support supplier for hardware, firmware, and software support, including
product repairs and part ordering. To expedite your call, have the following information available:
1. General Information
•Switch model
•Switch operating system version
•Error numbers and messages received
•supportSave command output
•Detailed description of the problem, including the switch or fabric behavior immediately
following the problem, and specific questions
•Description of any troubleshooting steps already performed and the results
•Serial console and Telnet session logs
•syslog message logs
2. Switch Serial Number

xviii Fabric OS Encryption Administrator’s Guide (SKM/ESKM)
53-1002721-01
The switch serial number and corresponding bar code are provided on the serial number label,
as illustrated below.:
The serial number label is located as follows:
•Brocade Encryption Switch—On the switch ID pull-out tab located inside the chassis on the
port side of the switch on the left.
•Brocade DCX—On the bottom right on the port side of the chassis
•Brocade DCX-4S—On the bottom right on the port side of the chassis, directly above the
cable management comb.
•Brocade DCX 8510-8—On the port side of the chassis, on the lower right side, and directly
above the cable management comb.
•Brocade DCX 8510-4—On the port side of the chassis, on the lower right side and directly
above the cable management comb.
3. World Wide Name (WWN)
Use the licenseIdShow command to display the WWN of the chassis.
If you cannot use the licenseIdShow command because the switch is inoperable, you can get
the WWN from the same place as the serial number, except for the Brocade DCX. For the
Brocade DCX, access the numbers on the WWN cards by removing the Brocade logo plate at
the top of the non-port side of the chassis.
Document feedback
Quality is our first concern at Brocade and we have made every effort to ensure the accuracy and
completeness of this document. However, if you find an error or an omission, or you think that a
topic needs further development, we want to hear from you. Forward your feedback to:
[e-mail]
Provide the title and version number of the document and as much detail as possible about your
comment, including the topic heading and page number and your suggestions for improvement.
*FT00X0054E9*
FT00X0054E9

Fabric OS Encryption Administrator’s Guide (SKM/ESKM) 1
53-1002721-01
Chapter
1
Encryption Overview
In this chapter
•Host and LUN considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
•Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
•The Brocade Encryption Switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
•The FS8-18 blade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
•FIPS mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
•Performance licensing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
•Recommendation for connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
•Usage limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
•Brocade encryption solution overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
•Data encryption key life cycle management . . . . . . . . . . . . . . . . . . . . . . . . . . 9
•Master key management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
•Support for virtual fabrics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
•Cisco Fabric Connectivity support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Host and LUN considerations
Encrypting data-at-rest provides peace of mind in terms of protecting data from loss or theft, but
very careful planning must be done to ensure encrypted data is handled correctly. Much of the
planning must come from careful evaluation of host application and LUN resources, and of the
path that the data will take to get from one or more hosts to a LUN.
CAUTION
When implementing encryption for data-at-rest, all hosts that access a LUN that is to hold
encrypted data need to be configured for encryption to avoid data corruption. If a host, possibly in
another fabric, writes cleartext to an encrypted LUN, the data on the LUN will be lost. The user
must ensure that all hosts that can access a LUN are configured in the same manner.

2Fabric OS Encryption Administrator’s Guide (SKM/ESKM)
53-1002721-01
Terminology
1
Terminology
The following are definitions of terms used extensively in this document.
ciphertext Encrypted data.
cleartext Unencrypted data.
CryptoModule The secure part of an encryption engine that is protected to the FIPS 140-2 level 3
standard. The term CryptoModule is used primarily in the context of FIPS
authentication.
Data Encryption Key (DEK) An encryption key generated by the encryption engine. The DEK is used to encrypt
cleartext received from a host before it is sent to a target LUN, and to decrypt that data
when it is retrieved by the host.
Data Encryption Key Cluster
(DEK Cluster)
A cluster of encryption engines which can host all paths to a LUN and share the same
data encryption key (DEK) set. The encryption engines can be in the same or different
fabrics. DEK clusters enable host MPIO failover.
Encryption Engine The entity within a node that performs encryption operations, including the generation
of Data Encryption Keys.
Encryption Group A collection of one or more DEK clusters, HA clusters, or both, which share the same key
vault and device configuration, and is managed as a single group.
Failback In the context of this implementation of encryption, failback refers to behavior after a
failed encryption switch recovers. Devices that were transferred to another switch by
failover processing may automatically be transferred back, or they may be manually
switched back. This is determined as a configuration option.
Failover In the context of this implementation of encryption, failover refers to the automatic
transfer of devices hosted by one encryption switch to another encryption switch within
a high availability cluster (HA cluster).
Group Leader A group leader is a special node within an encryption group which acts as a group and
cluster manager, and manages and distributes all group-wide and cluster-wide
configurations to all members of the group or cluster.
High Availability Cluster
(HA Cluster)
A collection of peer-level encryption engines that provide failover capabilities within a
fabric.
Key Encryption Key A key used to encrypt and decrypt Data Encryption Keys (DEKs) within encryption
devices so that DEKs are transmitted in a secure manner outside of the encryption
engines, and stored persistently inside key vaults.
Link Key A shared secret exchanged between an encryption engine and a FIPS 140-2 level 3
certified key management appliance and key vault. The link key is an Key Encryption
Key (KEK) that is used to encrypt Data Encryption Keys (DEKs) in transit over a secure
connection to and from the key vault. The key management appliance decrypts the
DEKs and stores them encrypted with its own master key.
Logical Unit Number (LUN) The identifier of a SCSI logical unit.
Master Key A Key Encryption Key (KEK) used to encrypt and decrypt DEKs when storing DEKs in
opaque key vaults. There is one master key per encryption group. That means all node
encryption engines within an encryption group use the same master key to encrypt and
decrypt the DEKs.
Node In terms of encryption, a Brocade Encryption Switch, DCX, or DCX-4S through which
users can manage an encryption engine.