Fabric OS Encryption Administrator's Guide

148 Fabric OS Encryption Administrator’s Guide
53-1002159-03
CryptoTarget container configuration
3
FIGURE 94 Relationship between initiator, virtual target, virtual initiator and target
CAUTION
When configuring a LUN with multiple paths, there is a considerable risk of ending up with
potentially catastrophic scenarios where different policies exist for each path of the LUN, or a
situation where one path ends up being exposed through the encryption switch and another path
has direct access to the device from a host outside the secured realm of the encryption platform.
Failure to follow correct configuration procedures for multi-path LUNs results in data corruption. If
you are configuring multi-path LUNs as part of an HA cluster or DEK cluster or as a stand-alone
LUN accessed by multiple hosts, follow the instructions described in the section “Configuring a
multi-path Crypto LUN” on page 166.
LUN re-balancing when hosting both disk and tape targets
If you are currently using encryption and running Fabric OS v6.3.x or earlier, you are hosting tape
and disk target containers on different encryption switches or blades. Beginning with Fabric OS
v6.4, disk and tape target containers can be hosted on the same switch or blade. Hosting both
disk and tape target containers on the same switch or blade may result in a drop in throughput, but
it can reduce cost by reducing the number of switches or blades needed to support encrypted I/O
in environments that use both disk and tape.
The throughput drop can be mitigated by re-balancing the tape and disk target containers across
the encryption engine. This ensures that the tape and disk target containers are distributed within
the encryption engine for maximum throughput.
All nodes within an encryption group must be upgraded to Fabric OS v6.4 or a later release to
support hosting disk and tape target containers on the same encryption engine. If any node within
an encryption group is running an earlier release, disk and tape containers must continue to be
hosted on separate encryption engines.
If tape backup or restore jobs are in progress, quiesce the host I/Os for the disk LUNs for which
re-key or first-time encryption needs to be performed before rebalancing.
During rebalancing operations, be aware of the following:
• You may notice a slight disruption in Disk I/O. In some cases, manual intervention may be
needed.
• Backup jobs to tapes may need to be restarted after rebalancing completes.