SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 11: Brocade Data Encryption ProductsAvailabilityAs with any IT solution, there are many ways to ensure availability.Selecting the best method to maintain availability depends on the valueof the information (and impact of a loss of availability), the risk andprobability of disruption, and the cost of implementing high availability.ClusteringClustering is a commonly used method to ensure protection againsthardware failure. There are two types of cluster for Brocade encryptionsolutions, which can be used independently or simultaneously. Thehigh availability (HA) cluster provides hardware redundancy for theencryption devices. The data encryption key (DEK) cluster allows twoor more encryption devices to share the same keys.For tape encryption using a single fabric, a single encryption devicecould be sufficient, since tape drives are single attached devices(actively attached devices). However, some organizations consider thebackup application as mission-critical or high priority due to a servicelevelagreement that must be respected. If this is the scenario, a businesscase can be made to justify the use of a second encryptiondevice to form a HA cluster.For disk encryption using a dual-fabric configuration, the minimumrequirement is for one encryption device per fabric. In the event of thefailure of one encryption device, the MPIO software on the host automaticallyfails over the traffic to the remaining path. This may result indegraded performance in some heavily used systems, which may ormay not be acceptable. If it is not acceptable, then add a secondencryption device in each fabric to form two HA clusters.For redundancy, it is good practice to implement more than one pathfrom the disk storage device to the fabric. If more than one path existsin the same fabric from a host to a LUN, then it is important to use FOS6.3 or later when performing a first-time-encryption or a rekey operation.Multipath rekeying operations through a single encryption engineare not supported prior to FOS 6.3.Redundant Key VaultsKey vaults can also be configured in a clustered configuration to provideredundancy. Each key management solution vendor offersdifferent clustering features and functionality, but all of them providesome form of clustering capability. Although clustering the key vault isan optional feature, it is certainly recommended as a best practice.Ideally, a key vault should be located in at least two separate locationsto provide the maximum redundancy.192 Securing Fibre Channel Fabrics