User manual QUANTUM ENCRYPTION KEY MANAGER SETTING UP ON SCALAR I500 LIBRARY

[. . . ] Quantum Field Services will schedule an appointment to install the software and configure your servers. Note: Since the i500 library needs to communicate with the Q-EKM server in real time when reading from or writing to an encryption-enabled drive, it is strongly recommended that you use both a primary and secondary Q-EKM server. This way, if the primary server is unavailable at the time the library needs encryption information, the secondary server can handle the request. The Scalar i500 library allows you to configure up to two Q-EKM servers for redundancy/failover purposes. Step 4: Configure Q-EKM Server TCP/IP Addresses 0 Make sure you complete Steps 1 through 3 above before proceeding. [. . . ] You cannot select individual tape drives for encryption; you must select an entire partition to be encrypted. If you encrypt a partition, all Q-EKM-supported tape drives in that partition are enabled for encryption. Any non-Q-EKM-supported tape drives in that partition are not enabled for encryption, and data written to non-supported media is not encrypted. Data written to encryption-supported media in Q-EKM-supported tape drives will be encrypted unless data was previously written to the media in a non-encrypted format. In Setting Up Q-EKM On the Library 3 Setting Up Quantum Encryption Key Manager on Your Scalar i500 Library Document 6-01601-03 October 2008 order for data to be encrypted, the media must be blank or have been written to using library managed encryption at the first write operation at the beginning of tape (BOT). Configure the partition(s) as follows: 1 From the web client, select Setup > Encryption > Partition Configuration. A list of all your partitions displays, along with a drop-down menu displaying the encryption method for each partition. 2 If you want to change the encryption method on a partition, make sure that no tape drives in that partition have cartridges in them. 3 Select an encryption method from the drop-down menu for each partition. (For tape drives that support encryption, the default is Allow Application Managed. ) The Encryption Method applies to all encryption-capable tape drives and media in that partition. Encryption Method Enable Library Managed Allow Application Managed Description For use with Q-EKM. Enables encryption support via a connected Q-EKM server for all encryption-capable tape drives and media assigned to the partition. application to provide encryption support to all encryption-capable tape drives and media within the partition. The library will NOT communicate with the Q-EKM server on this partition. This is the default setting if you have encryption-capable tape drives in the partition. This option should remain selected unless you are connecting the library to an external Q-EKM server. Not for use with Q-EKM. Allows an external backup Note: If you want an external application to manage encryption, you must specifically configure the application to do so. The library will not participate in performing this type of encryption. Means that no tape drives in that partition support encryption. Unsupported If Unsupported is shown, it will be greyed out and you will not be able to change the setting. The Progress Window contains information on the action, elapsed time, and status of the requested operation. Do one of the following: · · If Success appears in the Progress Window, the encryption system settings were successfully configured. If Failure appears in the Progress Window, the encryption system settings were not successfully configured. [. . . ] The Progress Window contains information on the action, elapsed time, and status of the requested operation. 4 The library performs the diagnostics and reports pass/fail results on each of the tests in the Progress Window. Note: The diagnostics tests may take several minutes to complete. 5 If any of the tests fail, try the following resolutions and run the test again to make sure it passes: · · Ping Test Failure -- Verify that the Q-EKM server host is running and accessible from the network the library is on. Drive Test Failure -- Look for any tape drive RAS tickets and follow the resolution instructions in the ticket. Using Q-EKM Path Diagnostics 5 Setting Up Quantum Encryption Key Manager on Your Scalar i500 Library Document 6-01601-03 October 2008 · · Path Test Failure -- Verify that the Q-EKM server is actually running and that the port/SSL settings match the library configuration settings. [. . . ]