HP 4400 Release Note page 30

exceed 25 LUNs will fail with a warning. Note that there is also a five-second delay
before the commit operation takes effect.
Always ensure that any previously committed LUN configurations or LUN modifications
have taken effect before committing additional LUN configurations or additions. All LUNs
should be in an Encryption Enabled state before committing additional LUN modifications.
A new LUN state is available: Disabled (Key not in sync). This new state indicates
re-keying was started on a remote EE but the local EE is not capable of starting rekey because
it does not have the KeyID that was used by the remote EE in re-keying (that is, the newest
key returned from the key vault does not match with the KeyID used by remote EE). You must
use the cryptocfg --discoverLUN <ContainerName> interface to re-enable the LUN
only after the keys are properly synced between two key vaults.
Both VMware and clustering technologies use SCSI reservations to control host I/O access to
LUNs. When the HP Encryption Switch/HP Encryption Blade is performing a rekeying operation
(first time encryption or otherwise), it accommodates the use of this methodology. In deployments
that have multiple physical initiators accessing a target/LUN from an EE, Fabric OS 6.2x does
not have the ability to failover FTE/rekey operations within the EE. Therefore, during FTE/Rekey
operations in these environments, only one physical initiator can be allowed to access the
target/LUN combination; this is true for all EEs exposing the LUN. If only one initiator has
access to a Target/LUN on a particular EE, no configuration modification is required during
FTE/Rekey operations.
The cryptocfg -manual_rekey -all command should not be used in environments
with multiple encryption engines (encryption blades) installed in a director-class chassis when
more than one encryption engine has access to the same LUN. In such situations, use the
cryptocfg -manual_rekey CTCLUN NumInitiator PWWN command to manually rekey
the LUNs.
Avoid changing the configuration of any LUN that belongs to a Crypto Target Container/LUN
configuration while the rekeying process for that LUN is active. If the user changes the LUN's
settings during manual or auto, rekeying or First Time Encryption, the system reports a warning
message stating that the encryption engine is busy and a forced commit is required for the
changes to take effect. A forced commit command halts all active rekeying processes running
in all Crypto Target Containers and corrupts any LUN engaged in a rekeying operation. There
is no recovery for this type of failure.
To remove access between a given initiator and target, the user must not only remove the
active zoning information between the initiator and target, but must also remove the associated
CTCs, which will in turn remove the associated frame redirection zone information. Make sure
to back up all data before taking this action.
Before committing configurations or modifications to the CTC or LUNs on an HP encryption
switch or encryption blade, make sure that there are no outstanding zoning transactions in
the switch or fabric. Failure to do so results in the commit operation for the Crypto Target or
LUNs failing and may cause the LUNs to be disabled. The user can check for outstanding
zoning transaction by issuing the cfgtransshow CLI command:
DCX_two:root> cfgtransshow
There is no outstanding zoning transaction
Each LUN is uniquely identified by the HP encryption switch or encryption blade using the
LUN's serial number. The LUN serial numbers must be unique for LUNs exposed from the same
target port. The LUN serial numbers must also be unique for LUNs belonging to different target
ports in non-multipathing configurations. Failure to ensure unique LUN serial numbers results
in nondeterministic behavior and may result in faulting of the HP encryption switch or encryption
blade.
30