background image

1-12

Cisco MDS 9000 Family NX-OS Storage Media Encryption Configuration Guide

OL-29289-01

Chapter 1      Storage Media Encryption Overview

Software and Hardware Requirements

Cisco MDS 16-Port Storage Services Node

The Cisco MDS 9000 Family 16-Port Storage Services Node (SSN-16) hosts four independent service 
engines which can be individually and incrementally enabled to scale as business requirements grow. 
The SSN-16 configuration is based on the single service engine of the Cisco MDS 9000 Family 18/4-Port 
Multiservice module and the four-to-one consolidation provides hardware savings and frees up slots in 
the MDS 9500 series chassis.

The SSN-16 seamlessly integrates into the Cisco MDS 9500 Series Multilayer directors and the Cisco 
MDS 9222i Multiservice Modular switch. Each of the four service engines supports four Gigabit 
Ethernet IP storage services ports for a total of 16 ports of Fibre Channel over IP (FCIP) connectivity. 
The traffic can be switched between an IP port and any Fibre Channel port on Cisco MDS 9000 Family 
switches. 

The SSN-16 supports the full range of services available on other Cisco MDS 9000 Family modules 
including VSAN, security, and traffic management. Features such as I/O Accelerator (IOA), SME Disk 
and Tape, and FCIP can be configured in different octeons in a single SSN-16 module.

By running four separate, concurrent applications on one module, SSN-16 provides the following 
functions:

Provides better disaster recovery and continuity solutions for mission critical applications.

Minimizes the number of devices required, which improves the reliability.

Consolidates the management with a single module, which provides end-to-end visibility.

Facilitates solution-level performance optimization. 

The SSN-16 module provides transparent services to any port in a fabric and does not require additional 
SAN reconfiguration and rewiring. The module does not require the host or target to be directly attached 
and is available with multimodule clustering and balancing. 

The SSN-16 module supports up to four SME interfaces per module and provides higher scalability and 
improved performance of up to 20 percent on the MSM-18/4 module and 9222i switches. 

Note

Cisco MDS 9500 Series switches running Cisco NX-OS Release 4.2(1) or later support the SSN-16.

For additional information, refer to the 

Cisco MDS 9500 Series Hardware Installation Guide

.

FC-Redirect-Capable Switches

Note

In Cisco MDS NX-OS Release 5.2(x), you cannot install a FCoE module in a switch that is running 
DMM, SME, or IOA.

SME requires that each target switch be FC-Redirect capable. FC-Redirect is not supported on the 
following switches:

Cisco MDS 9120 switch

Cisco MDS 9140 switch

Cisco MDS 9124 switch

Cisco MDS 9134 switch

Cisco MDS 9020 switch

Содержание MDS 9120 - Fabric Switch

Страница 1: ...n is a comprehensive network integrated encryption service with enterprise class key management that works transparently with existing and new SANs The innovative Cisco network integrated solution has numerous advantages over competitive solutions available today SME installation and provisioning are both simple and nondisruptive Unlike other solutions SME does not require rewiring or SAN reconfig...

Страница 2: ...rprise class Fibre Channel storage area network SAN fabric services Cisco has integrated encryption for data at rest as a transparent fabric service to take full advantage of this platform SME is a standards based encryption solution for heterogeneous disks tape libraries and virtual tape libraries SME is managed with Cisco DCNM SAN and a command line interface CLI for unified SAN management and s...

Страница 3: ...ion as an Approved Mode of Operation for FIPS 140 2 certification It uses a narrow block encryption algorithm and the standardization process for a wide block algorithm is currently in progress as 1619 2 Other encryption algorithms for consideration are LRW AES and AES CBS Draft versions of the IEEE 1619 standard had used LRW AES which was later replaced by XTS AES SME Roles SME services include t...

Страница 4: ...uired to recover the master key based on the user selection Unique key per tape for an SME tape cluster Unique key per LUN for an SME disk cluster Keys reside in clear text only inside a FIPS boundary Tape keys and intermediate keys are wrapped by the master key and deactivated in the CKMC Disk keys are wrapped by the cluster master key and deactivated in the CKMC Option to store tape keys on tape...

Страница 5: ... and the clusters that are not connected but are not deactivated appear as offline The SME clusters that are deleted from the fabric appear as deactivated The high availability Cisco KMC server consists of a primary server and a secondary server When the primary server is unavailable the cluster connects to the secondary server and fails over to the primary server once the primary server is availa...

Страница 6: ...is considered when choosing a SME interface for a target If a target is connected to a switch that has no SME interface then the target is assigned to the least loaded available interface in the SME cluster In target based load balancing the load on an interface refers to the number of targets assigned to that interface Caution SME provides a load balancing CLI that allows you to rebalance the tar...

Страница 7: ... the SME operations and the SME KMC Administrator role where the administrator is responsible for the SME key management operations Storage Administrator An administrator who manages the SME operations SME KMC Administrator An administrator who is responsible for the SME key management operations SME Recovery Officer A data security officer entrusted with smart cards and the associated PINs Each s...

Страница 8: ...server is compressed and stored in the HR tape library Data from the email server is not encrypted when backed up to the dedicated email tape library Figure 1 3 SME Single Fabric Topology Note Tape devices should be connected to core switches such as an MDS 9500 Series switch or MDS 9222i switch running Cisco SAN OS Release 3 2 2c or later or Cisco NX OS Release 4 x or later Encryption and compres...

Страница 9: ...te then the node having the lowest node identifier node ID remains in the cluster while the other node leaves the cluster However when an ISSU is performed on a node having the lowest node identifier a complete loss of the cluster results since both the nodes leave the cluster This undesirable situation is addressed in a two node cluster as follows The upgrading node sends a message to the other n...

Страница 10: ...ater or Cisco NX OS Release 4 x or later for SME Tape All switches that include MSM 18 4 modules must be running Cisco SAN OS Release 3 2 2c or later or Cisco NX OS Release 4 x or later software for SME Tape DCNM SAN must be running Cisco NX OS Release 5 2 1 for SME Disk All Cisco MDS switches in the SME cluster enabled for disks must be running Cisco NX OS Release 5 2 1 All switches that include ...

Страница 11: ...signed to a single Fibre Channel Port The MSM 18 4 provides intelligent diagnostics protocol decoding and network analysis tools with the integrated Call Home capability Note Cisco MDS 9000 Series switches running Cisco SAN OS Release 3 2 2c or later or Cisco NX OS Release 4 x or later support the MSM 18 4 module for SME tape Cisco MDS 9000 Series switches running Cisco NX OS Release 5 2 1 support...

Страница 12: ...d in different octeons in a single SSN 16 module By running four separate concurrent applications on one module SSN 16 provides the following functions Provides better disaster recovery and continuity solutions for mission critical applications Minimizes the number of devices required which improves the reliability Consolidates the management with a single module which provides end to end visibili...

Страница 13: ...e SME cluster The smart card reader requires the smart card drivers that are included on the installation CD These must be installed on the management workstation where the reader is attached Note The smart card reader is supported on Windows only platforms This support includes only the Windows 4 64 bit and Windows XP 32 bit platforms For the newly installed smart card drivers to work efficiently...

Страница 14: ...cal unit number LUN zoning and read only LUNs must not be used for FC Redirect hosts and targets SME Security Overview SME transparently encrypts and decrypts data inside the storage environment without slowing or disrupting business critical applications In SME Tape SME generates a master key tape volume keys and tape keys The keys are encrypted in a hierarchical order the master key encrypts the...

Страница 15: ...n For example RADIUS and TACACS servers can be used to authenticate authorize and provide accounting AAA for SME administrators Management of SME can be limited to authorized administrators using role based access controls RBACs When communication occurs from the DCNM SAN to cluster nodes the secure shell SSHv2 protocol provides message integrity and privacy PKI certificates can be configured in t...

Страница 16: ...1 16 Cisco MDS 9000 Family NX OS Storage Media Encryption Configuration Guide OL 29289 01 Chapter 1 Storage Media Encryption Overview SME Security Overview ...

Отзывы: