The following table shows the encryption parameters and policies that can be specified for a disk or tape LUN, during LUN configuration (with the cryptocfg --add -LUN command). Some policies are applicable only to disk LUNs, and some policies are applicable only to tape LUNs. It is recommended that you plan to configure all the LUN state and encryption policies with the cryptocfg --add -LUN command. You can use the cryptocfg --modify -LUN command to change some of the settings, but not all options can be modified.
NOTE
LUN policies are configured at the LUN level, but apply to the entire HA or DEK cluster. For multi-path LUNs that are exposed through multiple target ports and thus configured on multiple CryptoTarget containers on different encryption engines in an HA cluster or DEK cluster, the same LUN policies must be configured. Failure to do so results in unexpected behavior and may lead to data corruption.
The tape policies specified at the LUN configuration level take effect if you do not create tape pools or configure policies at the tape pool level. The Brocade encryption solutions supports up to a 1 MB block size for tape encryption. Also, the Logical Block Address (LBA) 0 block size (I/O size from the host)
Crypto LUN parameters and policies
must be at least 1 K less than the maximum supported backend block size (usually 1 MB). This is typically the case, as label operations are small I/O operations. If this support requirement is not met, the Brocade encryption solution will not allow the backup operation to start to that tape.
NOTE
LBA 0 is not encrypted. Data sent to this block address is always sent as clear text.
LUN parameters and policies TABLE 6
Policy name Command parameters Description
LUN state Disk LUN: Yes Tape LUN: No Modify? No
-lunstate encrypted | cleartext Sets the Encryption state for the LUN. Valid values are:
• cleartext - Default LUN state.
Refer to policy configuration considerations for compatibility with other policy settings.
• encrypted - Metadata on the LUN containing the key ID of the DEK that was used for encrypting the LUN is used to retrieve the DEK from the key vault. DEKs are used for encrypting and
-keyID Key_ID Specifies the key ID. Use this option only if the LUN was encrypted but does not include the metadata containing the key ID for the LUN.
This is a rare case for LUNs encrypted in Native (Brocade)
-encryption_format native Sets the encryption format. Valid values are:
• Native - The LUN is encrypted or decrypted using the Brocade encryption format (metadata format and algorithm). This is the default setting.
Encryption policy Disk LUN: Yes Tape LUN: Yes Modify? Yes
-encrypt | -cleartext Enables or disables a LUN for encryption. Valid values are:
• cleartext - Encryption is disabled.
This is the default setting. When the LUN policy is set to cleartext the following policy parameters are invalid and generate errors when executed:
enable_encexistingdata, -enable_rekey, and -key_lifespan.
• encrypt - The LUN is enabled to perform encryption.
Configuring Encryption Using the CLI
LUN parameters and policies (Continued) TABLE 6
Policy name Command parameters Description
Existing data encryption
Specifies whether existing data on the LUN should be encrypted. By default, encryption of existing data is disabled. Encryption policy must be set to -enable_encexistingdata, and the LUN state must be set to cleartext (default). If the encryption policy is cleartext, the existing data on the LUN will be overwritten.
Rekey policy Disk LUN: Yes Tape LUN: No Modify? Yes
enable_rekey time_period days | -disable_rekey
Enables or disables the auto rekeying feature on a specified disk LUN. This policy is not valid for tape LUNs. By Default, the automatic rekey feature is disabled. Enabling automatic rekeying is valid only if the LUN policy is set to -encrypt.
You must specify a time period in days when enabling Auto Rekey to indicate the interval at which automatic rekeying should take
-key_lifespan time_in_days | none Specifies the life span of the encryption key in days. The key will expire after the specified number of days. Accepted values are integers from 1 to 2982616. The default value is none, which means the key does not expire. On tape LUNs, the key life span cannot be modified after it is set.
Write Early Ack Disk LUN: No Tape LUN: Yes Modify? Tape Only. Disk:
No
-write_early_ack disable | enable Specifies the Tape Write pipelining mode of the LUN. Two Write Pipelining modes are supported:
• disable - Early acknowledgement of commands (internal buffering) for a tape lun is disabled.
• enable - Early acknowledgement of commands (internal buffering) for a tape lun is enabled. The default value is enable.
Read Ahead Disk LUN: No Tape LUN: Yes Modify? Tape Only. Disk:
No
-read_ahead disable | enable Specifies the Tape Read Ahead mode of the LUN. Two Read Ahead modes are supported:
• disable - The LUN disables the Tape read ahead and Tape LUN will be operated in unbuffered mode.
• enable - The LUN enables the Tape read ahead and Tape LUN will be operated in buffered mode. The default value is enable.