Brocade EMC Connectrix San Switch

Transcription

1 EMC Connectrix San Switch Secured by RSA Implementation Guide Last Updated May Partner Information Information Partner Name Web Site Name Version & Platform Description Category BROCADE EMC Connectrix/Brocade Fibre ES-5832B Encryption Switch and FS8-18 Blade FOS FOS7.01-FOS 6.4.1a FOS 6.4.0b (Disk and Tape at the same time)---fos 6.3.0c (Disk or Tape only) ---FOS 6.2.0g (Disk only) The Brocade family of Encryption Switch (BES) and FS8-18 blade is IEEE 1619 compliant, high-speed, highly reliable Storage Area Network (SAN) devices that deliver fabric-based encryption services to secure data assets either selectively or on a comprehensive basis. Disk/Tape Data Encryption

2 Solution Summary Refer to EMC Topology guide for F5 and ADX Load Balancer setup The Brocade Encryption system includes two major components: An Encryption Group (EG), is a collection of one or more Brocade Encryption Switch/FS8-18 devices. These groups share the same key vault and device configurations, and are managed by a single group leader. An RSA Key Manager appliance (RKM), which stores encryption keys. The 2.6/ and above Appliance releases now supports the standard RKM clustering environments based on a load Balancer, and has added Tape support. Brocade's initial design with RKM Appliance 1.6.1, used a dual independent server design. Brocade generates keys and sends them to RKM with Alias and Meta data. This is done with our standard client API's. They have two IP ports, a primary and a secondary on their FC switch. Each IP port connects to an RKM Appliance. Each Appliance is setup as a single Primary RKM Appliance. Every transaction and API call is mirrored to both servers. This means they are both populated with all the same data and keys. In the default mode, if one of the RKM Appliances loses IP connectivity they both will go into a read only mode. This is for Maximum data loss security. They never have a single instance of the data. Page: 2

3 Configuration for Interoperability At a high level, setting up an RKM key vault consists of the following steps: Registering the Encryption Group leader and group member nodes with the RKM key vault by registering their KAC certificates. Registering the RKM key vault with the group leader by registering the key vault s certificate with the group leader. Generating and exporting the master key to a secure location. At install time, the switch generates a private key and CSR and that CSR is exported from the switch for signing. If you replace the switch (or zeroize the same one) it generates a new key and CSR. Either follow the Brocade procedure using the DPM to export and sign the certs or have the certs signed by a third party. The following scenario describes the steps for configuring a primary RKM (opaque) key vault that can be shared by the members of the encryption group "brocade Encryption Switch." The encryption group has one group leader and one member node. Alternatively, reference FOS Encryption Administrator s Guide section Setting up an RKM key vault for the details. RSA Key Manager Configuration Access the RKM GUI TO CREATE IDENTITY GROUP, ADD IDENTITY, AND ADD KAC CERT FILE 1. Go into your windows hosts file and enter the DPM IP and host name. 2. Open a browser and type the following URL: Name>/KMS and login with user kmsadmin and the DPM password 3. In the Identity Group tab, click Create. 4. Type Brocade Encryption Switch in the Name field and create the Identity Group 5. Click the Key Classes tab, and then click Create. Page: 3

4 6. In the Name field, type kcn com.brocade:dek_aes_256_gcm Note: It is mandatory to use this name for the key class field 7. Clear Activated Keys Have Duration. 8. Click Next. The Key Details page appears. 9. Select AES, 256, and CBC from the Algorithm, Key Size, and Mode list boxes, respectively. 10. Click Next for the remaining steps and click Finish. To configure the next key class, repeat above procedure using XTS mode: 11. In the Name field, type kcn com.brocade:dek_aes_256_xts. 12. Clear Activated Keys Have Duration. 13. Click Next. 14. Select AES, 256, and XTS from the Algorithm, Key Size, and Mode list boxes, respectively. 15. Click Next for the remaining steps, and then click Finish. Create identity and add cert Complete the following steps to go to the RKM GUI: 16. Go to the identity tab and Create an identity for bes_top Page: 4

5 NOTE: Must select the previously created group BROCADE ENCRYPTION SWITCH and be operational user 17. Under Authentication->Certificate, Browse to your laptop and load Identity certificate: <path>\ bes_top_kaccert.p12 Note: DPM does not support a client cert with a.p12 extension here. 18. Repeat the above procedure to create an identity for the bes_bot and upload the client cert Page: 5

6 Brocade encryption switch Configuration The Brocade setup for zoning and encryption should be done by an EMC SAN storage rep. below are a few screen shots for reference only. EMC Brocade documentation should be used to complete this process. Note: The BES uses a.csr not a.p12 certificate Complete the following steps to encrypt the Cleartext LUNs: 1. From the Encryption Disk LUN view select a LUN to encrypt. 2. From the Encryption Mode tab, select Native Encryption. This will set all eight paths for that LUN to Native Encryption. Page: 6

7 3. Repeat 1-2 to set the encryption for two more LUNs 4. Click Apply. The software allows for up to 25 simultaneous commit operations to be performed at any given time. With eight paths per LUN to encrypt, LUNs can be encrypted in groups of no more than three at a time. 5. Click yes at the confirmation prompt. The LUNs will undergo First Time Encryption (FTE). 6. Click Refresh to check the progress of the LUN encryption. 7. Repeat 1-6 to select and encrypt three more LUNs until all chosen LUNs are encrypted. 8. Verify that all chosen LUNs appear as Encryption Enabled. Page: 7

8 Certification Checklist for 3 rd Party Applications Date Tested: May Tested RKM DPM Note: SRDF/RecoverPoint and TimeFinder are supported with this release Date Tested: September 30, 2012 Tested RKM DPM 3.2 Note: SRDF/RecoverPoint and TimeFinder are supported with this release Date Tested: October 5, a Tested RKM 2.7SP hotfix Note: SRDF/RecoverPoint and TimeFinder are supported with this release Date Tested: August 30, b Tested RKM 2.7SP1 Hotfixes-KMA,876 required Note: SRDF/RecoverPoint and TimeFinder are supported with this release Date Tested: February 1, c Tested RKM 2.6 Hotfixes KMA,506,433,and 620 required Page: 8

9 Note: The release needs to go through EMC RPQ approval process Hot fixes KMA, 506, 433, and 620 are required Date Tested: June 1, g only Tested RKM Date Tested: June 6, 2012 RSA Java client API Functionality Partner Functions and Tests Key Create N/A Partner Creates Key Utilizes Key caching Partner product encrypts data Create an empty key object N/A Partner product decrypts data Key Archival Partner product will not send any clear text data without the proper key. Key retrieval by key class Key retrieval by key ID Key retrieval by Alias N/A Encrypt data N/A Decrypt data N/A FAL = Pass = Fail N/A = Not Applicable to Integration Page: 9

10 Appendix Document Title Matrix Fabric OS Encryption Administrator Guide EMC Elab Navigator Description Compatible Tape drives and backup software Describe how to implement the Brocade encryption solution. EMC interoperability Matrix Location Encryption_Comp_Matrix_ pdf version_620/53_ _01_fosadminguide_v620.pdf version_630/53_ _02_fosadminguide_v630.pdf Under Other/Encryption device Note: Always check the EMC ELab interoperability ESM and EMC/Brocade admin Guides for the latest updates. Term BES FS8-18 DEK EG SCP Fibre DCFM meaning Brocade Encryption Switch Brocade Encryption Blade for DCX & DCX-4S Backbone Data Encryption key Encryption Group Secure Copy Protocol Fiber Channel Data Interface Data Center Fabric Manager Page: 10