Lun Policy Troubleshooting - Brocade Communications Systems Brocade 8/12c Administrator's Manual

6

LUN policy troubleshooting

LUN policy troubleshooting

Table 14
TABLE 14
LUN policy troubleshooting
Case Reasons for the LUN getting disabled by
the encryption switch
1 The LUN was modified from encrypt
policy to cleartext policy but metadata
exists.
2 The LUN was set up with an encrypt
policy and the LUN was encrypted
(metadata is present on the LUN), but
the DEK for the key ID present in the
metadata does not exist in the key
vault.
3 The LUN was set up with an encrypt
policy and the LUN was encrypted
(metadata is present on the LUN), but
the current state of the LUN is
cleartext instead of encrypted.
234
may be used as an aid in troubleshooting problems related to LUN policies.
Action taken
LUN is disabled.
Reason code:
Metadata exists
but the LUN
policy is cleartext.
LUN is disabled.
Reason code:
Metadata exists
but the DEK for
the key ID from
the metadata
does not exist.
LUN is disabled.
Reason code:
Metadata exists,
but the LUN
policy is indicated
as cleartext.
If you do not need to save the data:
Issue the cryptocfg --enable -LUN
command on one path of the LUN.
This erases the metadata on the
LUN and the LUN is then enabled
with cleartext policy. Issue the
cryptocfg --discoverLUN
command on other paths of the
LUN in the DEK cluster to enable
the LUN.
Modify the LUN policy to cleartext.
The subsequent handling is same
as in case 1.
Modify the LUN policy to cleartext.
The subsequent handling is the
same as in case 1.
Fabric OS Encryption Administrator's Guide
If you need to save the data:
Modify the LUN back to encrypt
policy.
Make sure the key vault has the
DEK and when the DEK gets
restored to the key vault, perform
one of the following tasks on one
of the paths of the LUN to enable
the LUN:
•
Issue the cryptocfg
--discoverLUN command
•
Remove the LUN from the
container and then add it
back
•
Bounce the target port
Then issue the cryptocfg
--discoverLUN command on
other paths of the LUN in the
DEK cluster.
Remove the LUN from the
container and then add the LUN
back with the LUN state as
encrypted, or issue the cryptocfg
--enable -LUN command on one
of the paths of the LUN which will
enable the LUN by using the
appropriate key. Then issue the
cryptocfg --discoverLUN
command on other paths of the
LUN in the DEK cluster to enable
the LUN.
53-1002159-03