User manual QUANTUM SCALAR I500 LIBRARY SETTING UP REV 03-2010

[. . . ] Quantum Field Services will schedule an appointment to install the software and configure your servers. Note: Since the i500 library needs to communicate with the Q-EKM server in real time when reading from or writing to an encryption-enabled drive, it is strongly recommended that you use both a primary and secondary Q-EKM server. This way, if the primary server is unavailable at the time the library needs encryption information, the secondary server can handle the request. The Scalar i500 library allows you to configure up to two Q-EKM servers for redundancy/failover purposes. Step 4: Configure Encryption Settings and Key Server Addresses Make sure you complete all steps above before proceeding. 0 1 Unload tape cartridges from all encryption-capable tape drives in the library. [. . . ] 2 If you want to change the encryption method for a partition, make sure that no tape drives in that partition have cartridges loaded in them. If tape drives have cartridges loaded, you cannot change the encryption method. 3 Select an encryption method from the drop-down menu for each partition. (For tape drives that support encryption, the default is Allow Application Managed. ) The Encryption Method applies to all encryption-capable tape drives and media in that partition. Encryption Method Enable Library Managed Allow Application Managed Description For use with Q-EKM. Enables encryption support via a connected Q-EKM server for all encryption-capable tape drives and media assigned to the partition. application to provide encryption support to all encryption-capable tape drives and media within the partition. The library will NOT communicate with the Q-EKM key server on this partition. This is the default setting if you have encryption-capable tape drives in the partition. This option should remain selected unless you are connecting the library to an external Q-EKM server. Not for use with Q-EKM. Allows an external backup Note: If you want an external application to manage encryption, you must specifically configure the application to do so. The library will not participate in performing this type of encryption. Means that no tape drives in that partition support encryption. Unsupported If Unsupported is shown, it will be greyed out and you will not be able to change the setting. 4 Setting Up Q-EKM On the Library Setting Up Quantum Encryption Key Manager on Your Scalar i500 Library Document 6-01601-04 March 2010 4 Click Apply. 5 Save the library configuration (for instructions, see the Scalar i500 User's Guide). Perform EKM Path Diagnostics as described in Using EKM Path Diagnostics on page 5. Run EKM Path Diagnostics0 Using EKM Path Diagnostics The EKM Path Diagnostics consists of a series of short tests to validate whether the key servers are running, connected, and able to serve keys as required. Run the Manual EKM path diagnostics any time you change the key server settings or library encryption settings, and when you replace a tape drive. It is recommended that you test each drive that communicates with key manager servers. The diagnostics consists of the following tests: Note: The tape drive used for the test must be unloaded and online in order to run any of the tests. 0 · · Ping -- Verifies the Ethernet communication link between the library and the key servers. Drive -- Verifies the tape drive's path in the library (communication from library to tape drive sled and from tape drive sled to tape drive). The tape drive must be unloaded, ready, and online in order to run this test. If this test fails, the Path and Config tests are not performed. · · Path -- Verifies that EKM services are running on the key servers. [. . . ] 4 Specify the number of consecutive, missed test intervals required before the library generates a RAS ticket informing you that the test could not be performed within the specified intervals. Backing Up Keystore Data 0 Due to the critical nature of the keys in your keystore, it is vital that you back up your keystore data on a non-encrypted device so that you can recover it as needed and be able to read the tapes that were encrypted using those encryption keys associated with that tape drive or library. Backing Up Keystore Data 7 Setting Up Quantum Encryption Key Manager on Your Scalar i500 Library Document 6-01601-04 March 2010 Viewing Tape Drive Encryption Settings You can view the encryption settings in the following ways: · System Information Report -- To view encryption information on all key servers, partitions, and tape drives, select Reports > System Information from the web client. 0 For more information, see the Scalar i500 User's Guide. · Library Configuration Report -- To view the encryption status of a selected tape drive or tape cartridge, select Reports > Library Configuration from the web client and click a tape drive or slot. For more information, see the Scalar i500 User's Guide. · Partition Encryption -- From the web client, select Setup > Encryption > Partition Configuration to view and change the encryption status of partitions. See Step 5: Configure Partition Encryption on page 4 for more details. Made in the USA. Quantum Corporation provides this publication "as is" without warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability or fitness for a particular purpose. [. . . ]