Chapter 1
Storage Media Encryption Overview
Single-Fabric Topology for Disk
A single-fabric topology in which the data from the HR server is forwarded to the Cisco MSM-18/4
module, Cisco MDS 922i switch or SSN-16 module. The Cisco MSM-18/4 module, Cisco MDS 9222i
switch or SSN-16 module can be anywhere in the fabric. SME does a one-to-one mapping of the
information from the host to the target and forwards the encrypted data to the dedicated HR disk.
SME disk also supports dual-fabric topology with which the data can be encrypted on all the paths.
Note
Disk devices should be connected to core switches, such as an MDS 9500 Series switch or an MDS 9222i
switch, running on Cisco NX-OS Release 5.2(1) or later.
Encryptions are transparent to the hosts and storage devices. These services are available for devices in
any virtual SANs (VSANs) in a physical fabric and can be used without rezoning.
In-Service Software Upgrade in SME
In-Service Software Upgrade (ISSU) is a comprehensive, transparent software upgrade capability that
allows you to add new features and services without any disruption to the traffic.
In a cluster, which has the MDS 9222i switch as nodes, if the nodes are not able to communicate, then
the node having the lowest node identifier (node ID) remains in the cluster while the other node leaves
the cluster. However, when an ISSU is performed on a node having the lowest node identifier, a complete
loss of the cluster results since both the nodes leave the cluster.
This undesirable situation is addressed in a two-node cluster as follows:
•
•
•
SME disk has disk-specific ISSU restrictions and limitations. For more information about these
restrictions, see
This feature is tied to the internals of ISSU logic and no additional command needs to be executed for
Note
this purpose.
About MIBs
The MIB module manages SME service. SME is an encryption service provided by an encryption node
residing on a line card in a storage device. It receives clear-text data from the host, encrypts and then
sends it to be written to tape or disk. It does the reverse in the opposite direction so the service is
completely transparent to the host. The purpose of this service is to enhance data security in case the
tape or disk is lost or stolen.
OL-29289-01
The upgrading node sends a message to the other node of the intent to leave the cluster. The
upgrading node can either be a master node or a slave node.
The remaining node remains in the cluster and performs the role of the master node if it was a slave
node. This node continues to remain in the cluster with the quorum intact.
After the ISSU is completed and the switches boots up, the upgraded node rejoins the cluster as a
slave node.
Chapter 6, "Configuring SME Disks."
Cisco MDS 9000 Family NX-OS Storage Media Encryption Configuration Guide
About MIBs
1-9
Halaman Cetak