SECURING FIBRE CHANNEL FABRICS - Brocade

Design and Implementation Best PracticesEncrypting Disk StorageData can be encrypted on disk storage at the LUN level. One single keyis used to encrypt the data on a LUN except during a rekey operation,which requires two keys. LUNs on a disk array are discovered throughthe standard SCSI LUN Discovery process.PerformanceAs explained earlier, the latency of the Brocade encryption devices ispractically negligible compared to the time it takes to complete an I/Ooperation. However, a complex fabric may have multiple ISLs and offermany paths between the various devices within the fabric. As discussedearlier, the frame redirection feature can automatically redirectframes to the encryption device regardless of where it is located in thefabric. However, certain locations for the encryption devices offer thebest performance.The basic concept of locality applies to the encryption solution as wellas standard FC fabric designs. Locality simply states that a host and itsstorage devices should be located as closely as possible to one another,given a specific architecture. For example, the highest locality occurswhen a host and its associated storage device are connected to thesame switch in a fabric or the same blade in a director or backbone.Essentially, SAN placement of the encryption devices should be done asclose as possible between the host and its storage devices.To avoid forcing traffic to pass through ISLs, a backbone can be used toconsolidate multiple switches. The Brocade FS8-18 Encryption Blade ina Brocade DCX 8510, DCX or DCX-4S does not require ISLs to performthe encryption and all traffic destined for encryption passes throughthe backplane.First-Time Encryption and Rekeying OperationsMany organizations have a policy regarding a sensitive operation suchas a data migration or encryption of data on a LUN to quiesce the environmentfirst and then perform this operation offline. Otherorganizations cannot tolerate downtime and must perform an FTE orrekey operation online.The Brocade encryption solution allows for online or offline FTE orrekey operations. An online FTE or rekey operation may result in performancedegradation of the applications accessing the LUN as a resultof I/O contention between the application requirements and the FTE orrekey operation.Securing Fibre Channel Fabrics 193