IBM FlashSystem

Hi,

We have an FS7300 with 38.4TB FCM3 modules configured in a standard pool.

As I understand these FCMs are self-encrypting and this encryption is always active.

But the recommendation in the product guide is to also activate the encryption feature on the storage to allow locking the drives

when the storage is powered off. If activating and enabling the encryption feature after initial setup, will this be enough

to enable automatic locking and unlocking of the drives, or will the array containing the drives have to be destroyed and

recreated with encryption enabled ?

A  related question: adding an encryption license to a pre-existing system with a standard pool containing an array with SEDs; creating an encrypted child pool in the non-encrypted parent pool is not possible when the pool uses SEDs ? 

Hi,

We have an FS7300 with 38.4TB FCM3 modules configured in a standard pool.

As I understand these FCMs are self-encrypting and this encryption is always active.

But the recommendation in the product guide is to also activate the encryption feature on the storage to allow locking the drives

when the storage is powered off. If activating and enabling the encryption feature after initial setup, will this be enough

to enable automatic locking and unlocking of the drives, or will the array containing the drives have to be destroyed and

recreated with encryption enabled ?

A  related question: adding an encryption license to a pre-existing system with a standard pool containing an array with SEDs; creating an encrypted child pool in the non-encrypted parent pool is not possible when the pool uses SEDs ? 

Hi,

We have an FS7300 with 38.4TB FCM3 modules configured in a standard pool.

As I understand these FCMs are self-encrypting and this encryption is always active.

But the recommendation in the product guide is to also activate the encryption feature on the storage to allow locking the drives

when the storage is powered off. If activating and enabling the encryption feature after initial setup, will this be enough

to enable automatic locking and unlocking of the drives, or will the array containing the drives have to be destroyed and

recreated with encryption enabled ?

Hello Zaki-  

The encryption is at the pool level-so it'd need to be destroyed. Also, the parent pool needs to be encrypted, so for you other question, it'd also need to be recreated. 

Bob Mayotte

------------------------------
Bob Mayotte

Original Message:
Sent: Mon June 12, 2023 11:36 AM
From: Zaki Jääskeläinen
Subject: FS7300 with FCM3 - encryption enablement with SEDs ?

A  related question: adding an encryption license to a pre-existing system with a standard pool containing an array with SEDs; creating an encrypted child pool in the non-encrypted parent pool is not possible when the pool uses SEDs ? 

Hi,

We have an FS7300 with 38.4TB FCM3 modules configured in a standard pool.

As I understand these FCMs are self-encrypting and this encryption is always active.

But the recommendation in the product guide is to also activate the encryption feature on the storage to allow locking the drives

when the storage is powered off. If activating and enabling the encryption feature after initial setup, will this be enough

to enable automatic locking and unlocking of the drives, or will the array containing the drives have to be destroyed and

recreated with encryption enabled ?

Not entirely true - Software Level encryption is at the pool, however, on the NVMe based boxes with SEDs, we provide HW encryption on the raid array level. (hence the mkarry -encrypted option

Hello Zaki-  

The encryption is at the pool level-so it'd need to be destroyed. Also, the parent pool needs to be encrypted, so for you other question, it'd also need to be recreated. 

Bob Mayotte

------------------------------
Bob Mayotte

Original Message:
Sent: Mon June 12, 2023 11:36 AM
From: Zaki Jääskeläinen
Subject: FS7300 with FCM3 - encryption enablement with SEDs ?

A  related question: adding an encryption license to a pre-existing system with a standard pool containing an array with SEDs; creating an encrypted child pool in the non-encrypted parent pool is not possible when the pool uses SEDs ? 

Hi,

We have an FS7300 with 38.4TB FCM3 modules configured in a standard pool.

As I understand these FCMs are self-encrypting and this encryption is always active.

But the recommendation in the product guide is to also activate the encryption feature on the storage to allow locking the drives

when the storage is powered off. If activating and enabling the encryption feature after initial setup, will this be enough

to enable automatic locking and unlocking of the drives, or will the array containing the drives have to be destroyed and

recreated with encryption enabled ?

A  related question: adding an encryption license to a pre-existing system with a standard pool containing an array with SEDs; creating an encrypted child pool in the non-encrypted parent pool is not possible when the pool uses SEDs ? 

Hi,

We have an FS7300 with 38.4TB FCM3 modules configured in a standard pool.

As I understand these FCMs are self-encrypting and this encryption is always active.

But the recommendation in the product guide is to also activate the encryption feature on the storage to allow locking the drives

when the storage is powered off. If activating and enabling the encryption feature after initial setup, will this be enough

to enable automatic locking and unlocking of the drives, or will the array containing the drives have to be destroyed and

recreated with encryption enabled ?

Hello,

I have IBM FS7300 storage. Encryption license is activated. But I want to see that Storage POOL and MDISK are encrypted or not? Can any once advise how we can confirm.

Thanks & Regards

HUJEFA

A  related question: adding an encryption license to a pre-existing system with a standard pool containing an array with SEDs; creating an encrypted child pool in the non-encrypted parent pool is not possible when the pool uses SEDs ? 

Hi,

We have an FS7300 with 38.4TB FCM3 modules configured in a standard pool.

As I understand these FCMs are self-encrypting and this encryption is always active.

But the recommendation in the product guide is to also activate the encryption feature on the storage to allow locking the drives

when the storage is powered off. If activating and enabling the encryption feature after initial setup, will this be enough

to enable automatic locking and unlocking of the drives, or will the array containing the drives have to be destroyed and

recreated with encryption enabled ?

Hello,

I have IBM FS7300 storage. Encryption license is activated. But I want to see that Storage POOL and MDISK are encrypted or not? Can any once advise how we can confirm.

Thanks & Regards

HUJEFA

A  related question: adding an encryption license to a pre-existing system with a standard pool containing an array with SEDs; creating an encrypted child pool in the non-encrypted parent pool is not possible when the pool uses SEDs ? 

Hi,

We have an FS7300 with 38.4TB FCM3 modules configured in a standard pool.

As I understand these FCMs are self-encrypting and this encryption is always active.

But the recommendation in the product guide is to also activate the encryption feature on the storage to allow locking the drives

when the storage is powered off. If activating and enabling the encryption feature after initial setup, will this be enough

to enable automatic locking and unlocking of the drives, or will the array containing the drives have to be destroyed and

recreated with encryption enabled ?

Hello,

I have IBM FS7300 storage. Encryption license is activated. But I want to see that Storage POOL and MDISK are encrypted or not? Can any once advise how we can confirm.

Thanks & Regards

HUJEFA

A  related question: adding an encryption license to a pre-existing system with a standard pool containing an array with SEDs; creating an encrypted child pool in the non-encrypted parent pool is not possible when the pool uses SEDs ? 

Hi,

We have an FS7300 with 38.4TB FCM3 modules configured in a standard pool.

As I understand these FCMs are self-encrypting and this encryption is always active.

But the recommendation in the product guide is to also activate the encryption feature on the storage to allow locking the drives

when the storage is powered off. If activating and enabling the encryption feature after initial setup, will this be enough

to enable automatic locking and unlocking of the drives, or will the array containing the drives have to be destroyed and

recreated with encryption enabled ?

Hi Hujefa,

From the GUI:

Go to Pools, select the pool in question, the actions and Properties.  It will bring up the Properties modal (depending on version level it will look like this)

Or you can do it from the CLI as per Ian's suggestion - (man lsmdiskgrp or lsmdiskgrp -help for more information on all the fields provided), or via the RestAPI (https://www.ibm.com/docs/en/flashsystem-7x00/8.7.x?topic=api-storage-virtualize-rest)

I hope this helps!

Hello,

I have IBM FS7300 storage. Encryption license is activated. But I want to see that Storage POOL and MDISK are encrypted or not? Can any once advise how we can confirm.

Thanks & Regards

HUJEFA

A  related question: adding an encryption license to a pre-existing system with a standard pool containing an array with SEDs; creating an encrypted child pool in the non-encrypted parent pool is not possible when the pool uses SEDs ? 

Hi,

We have an FS7300 with 38.4TB FCM3 modules configured in a standard pool.

As I understand these FCMs are self-encrypting and this encryption is always active.

But the recommendation in the product guide is to also activate the encryption feature on the storage to allow locking the drives

when the storage is powered off. If activating and enabling the encryption feature after initial setup, will this be enough

to enable automatic locking and unlocking of the drives, or will the array containing the drives have to be destroyed and

recreated with encryption enabled ?