IBM System Storage TS3310 Tape Library

The TS3310 Tape Library is a highly expandable Ultrium LTO library that allows you to start small with a 5U base unit (Model L5B), available in desktop or rack-mounted configurations, which contains the library control module, fixed tape cartridge storage of 35 slots, a

configurable I/O station of 6 slots, a touchscreen display, cartridge-handling robotics, and up to two LTO Ultrium 5, Ultrium 4, or Ultrium 3 Tape Drives.

Over time, as your need for tape backup increases, you can add additional 9U Model E9U expansion modules. Each E9U expansion module can accommodate up to four LTO Ultrium 5, Ultrium 4, or Ultrium 3 Tape Drives, additional storage slots, a configurable I/O station of 12 slots, and a redundant power supply. The entire system grows vertically. Currently available configurations include the 5U base library module, alone or with up to four 9U modules.

The TS3310 Tape Library offers a broad range of configuration possibilities. The smallest configuration includes a base unit with one to two LTO3, LTO4, or LTO5 tape drives, 52.5 TB of native tape storage (35 slots), and 6 I/O slots. This configuration will be upgradeable to a fully configured rack-mounted library 41U high with up to 18 LTO3, LTO4, or LTO5 tape drives with over 603 TB of native tape storage and up to 54 I/O slots.

The new Serial Attached SCSI (SAS) IBM Ultrium Tape Drive is also supported in the TS3310.

The IBM Ultrium LTO5 and LTO4 Fibre Channel and the LTO4 Serial Attached SCSI (SAS) tape drives available in the TS3310 configuration are encryption-capable and support application-managed, system-managed, and library-managed encryption.

The TS3310 library supports host application-managed, system-managed, and library-managed encryption for SAS and Fibre Channel drives only. Data encryption is supported with LTO Ultrium 5 and Ultrium 4 Data Cartridges only.

The installation of an IBM Ultrium 5 Tape Drive with encryption might require code updates for System p and supported open systems device drivers or storage management software. For details about supported software versions and release levels for the Ultrium 5 Tape Drive, as well as hardware support information, refer to the following website:

http://www.ibm.com/storage/tape

Note: The optional Transparent Encryption Key feature enabling system-managed and library-managed encryption is not available on a TS3200 model purchased through High Volume channels.

Application-managed encryption is available at no charge, and at the time of this writing, Tivoli Storage Manager was the only application that supports AME.

System-managed encryption and library-managed encryption both need FC5900 and FC9900. FC5900 is a Transparent LTO Encryption feature, which provides a license key to enable SME and LME. FC9900 is a feature that must be ordered when encryption will be used in the TS3310. It includes publication updates with information about enabling and configuring the TS3310 to support Encryption. This feature also provides the Encryption Key Manager (EKM) publications.

Before setting up Tape Encryption on the TS3310, you must already have installed your EKM on a server in your network. An EKM is needed when SME or LME will be configured.

Encryption can be set up for each logical library. To configure encryption, log into the TS3310 using the web user interface. Select Manage Library Logical Library, select the logical library that you want to modify, and click Go. After selecting the logical library in the pull-down menu, select Modify Encryption Method, select your preferred method, and click OK.

Figure 3-13 and Figure 3-14 show the types of encryption methods that you can select.

Figure 3-13 TS3310 Logical Library Encryption

Note: For LTO Ultrium 5, the IBM Tivoli Key Lifecycle Manager v1.0 or later is required to enable system-managed and library-managed encryption.

Chapter 3. IBM System Storage tape and tape automation for encryption 55 Figure 3-14 Modify Encryption Method

Valid methods for the TS3310 Encryption are Application Managed Encryption (AME), System Managed Encryption (SME), and Library Managed Encryption (LME); SME and LME require an additional license key.

The Logical Library library Encryption Settings field includes two settings:

򐂰 Encryption method:

– None: No encryption is used.

– Application-managed encryption: Encryption in operating environments that run an application capable of generating and managing encryption policies and keys. If you select application-managed encryption, no further configuration steps are necessary.

AME is standard for all Ultrium 4 and Ultrium 5 drives in this library. At the time of this writing, only Tivoli Storage Manager is capable of application-managed encryption.

– System-managed encryption: Encryption in operating environments where no application is capable of key management runs, and encryption is set up implicitly through each instance of the IBM device driver.

– Library-managed encryption: Transparent encryption by the TS3310 Tape Library tape drive.

򐂰 The Encryption Policy pull-down menu is only visible when Library Managed Encryption is selected. The available options are:

– Encrypt All

– Internal Label - Selective Encryption – Internal Label - Encrypt All

Note: If you do not have an installed encryption license key, you will not be able to choose SME or LME methods. If you attempt to choose either of these methods without an installed encryption key, an error message displays and the encryption method defaults to None.

The Advanced Encryption Settings fields are for Engineering Support use only. These settings are for use only by IBM support personnel, and only under the direction of the drive development team. Their use is limited to solving unforeseen problem or to support a unique configuration. These options are not intended for use by the client without the guidance of IBM support.

The Encryption Key Management Server Settings field includes the following options:

򐂰 Primary IP address (IPv4): The primary internet protocol address of the encryption server

򐂰 Primary TCP port number: The primary port for the encryption server

򐂰 Secondary IP address (IPv4): The secondary internet protocol address of the encryption server

򐂰 Secondary TCP port number: The secondary port for the encryption server

򐂰 Enable SSL for Encryption: Select this check box if you want to allow the security feature SSL when using the web user interface.

For more detailed information about how to set up encryption on the TS3310, refer to IBM System Storage TS3310 Tape Library Setup and Operator Guide, GA32-0477.

Encryption requires the latest device drivers, which are available on the ftp download website:

ftp://ftp.software.ibm.com/storage/devdrvr/