Brocade Communications Systems Network Advisor 12.0.0, User Manual

Page: 601 / 1505

Brocade Network Advisor SAN User Manual 553
53-1002696-01
Steps for connecting to an LKM/SSKM appliance
20
When dual LKM/SSKMs are used with the encryption switch or blade, the dual LKM/SSKMs must
be clustered. There is no enforcement done at the encryption switch or blade to verify whether or
not the dual LKM/SSKMs are clustered, but key creation operations will fail if you register
non-clustered dual LKM/SSKMs with the encryption switch or blade.
Regardless of whether you deploy a single LKM/SSKM or clustered dual LKM/SSKMs, register only
the primary key vault with the encryption switch or blade. You do not need to register a secondary
key vault.
Disk keys and tape pool keys (Brocade native mode support)
DEK creation, retrieval, and update for disk and tape pool keys in Brocade native mode are as
follows:
•
DEK creation: The DEK is archived into the primary LKM/SSKM. Upon successful archival of
the DEK onto the primary LKM/SSKM, the DEK is read from the secondary LKM/SSKM until it
is either synchronized to the secondary LKM/SSKM, or a timeout of 10 seconds occurs (2
seconds with 5 retries).
•
If key archival of the DEK to the primary LKM/SSKM is successful, the DEK that is created
can be used for encrypting disk LUNs or tape pools in Brocade native mode.
•
If key archival of the DEK to the primary LKM/SSKM fails, an error is logged and the
operation is retried. If the failure occurs after archival of the DEK to the primary
LKM/SSKM, but before synchronization to the secondary LKM/SSKM, a VAULT_OFFLINE
error is logged and the operation is retried. Any DEK archived to the primary LKM/SSKM in
this case is not used.
•
DEK retrieval: The DEK is retrieved from the primary LKM/SSKM if the primary LKM/SSKM is
online and reachable. If the registered primary LKM/SSKM is not online or not reachable, the
DEK is retrieved from a clustered secondary LKM/SSKM.
•
DEK Update: DEK update behavior is the same as DEK creation.
Tape LUN and DF -compatible tape pool support
•
DEK creation: The DEK is created and archived to the primary LKM/SSKM only. Upon
successful archival of the DEK to the primary LKM/SSKM, the DEK can be used for encryption
of a Tape LUN or DF-Compatible tape pool. The DEK is synchronized to a secondary
LKM/SSKM through LKM/SSKM clustering.
If DEK archival onto the primary LKM/SSKM fails, DEK archival is retried to the clustered
secondary LKM/SSKM. If DEK archival also fails to the secondary LKM/SSKM, an error is
logged and the operation is retried.
•
DEK retrieval: The DEK is retrieved from the primary LKM/SSKM if the primary LKM/SSKM is
online and reachable. If the primary LKM/SSKM is not online or reachable, the DEK is
retrieved from the clustered secondary LKM/SSKM.
•
DEK update: DEK update behavior is the same as DEK creation.