What You Will Learn
1. Suspend any backup applications and jobs.
The migration procedure temporarily suspends access to keys, so the execution of backup operations must be suspended until the migration is completed.
2. Back up the key database.
It is a good practice to back up the key database before performing the migration. The backup procedure should have been previously tested to help ensure the correct restoration of the keys in case any problems arise during migration.
3. Export all volume group keys in the cluster. Each volume group export will generate a separate password-protected file.
The password-protected files contain the keys to be imported in RKM.
4. Shut down the Cisco Fabric Manager and consequently the Cisco KMC.
This step prevents any key operation from being performed during migration.
5. Run the appropriate database script from the database administrative console as shown here. These scripts are packaged in Cisco Fabric Manager CD starting SAN-OS Software Release 4.1(1).
• Key catalog on PostgresSQL:
– Script: postgres-kmc-rkm-pre-migrate.sql
• Key catalog on Oracle Express:
– Script: oracle-kmc-rkm-pre-migrate.sql
6. Install RKM on the computer allocated for this purpose.
RKM can be installed and configured separately. RKM should be ready prior to the start of the migration to decrease downtime.
7. Refer to the "Cisco MDS 9000 Family Storage Media Encryption Configuration Guide" to configure the certificates for RKM and identify the two certificate files:
8. Copy these two certificate files on the Cisco Fabric Manager Server computer.
Copy the two files in the certificate store directory. The actual directory is displayed on the Cisco Fabric Manager web client (on the SME tab, choose Key Manager Settings).
Note: The default certificate store (Windows) is at C:\Program Files\Cisco Systems\MDS 9000\conf\cert\.
9. Start Cisco Fabric Manager and consequently Cisco KMC.
10. Specify the new key manager on the Cisco Fabric Manager web client (on the SME tab, choose Key Manager Settings.
Select RSA as the key manager and configure the IP address and port for RKM.
11. Using the Cisco Fabric Manager web client, monitor the Cisco SME log until the message "Synchronization Complete for Cluster" is displayed.
12. Create and import all volume group keys from the password-protected files.
13. Run the post-migration scripts to delete the keys in the Cisco KMC key database. These scripts are packaged in Cisco Fabric Manager CD starting SAN-OS Software Release 4.1(1).
• Key catalog previously on PostgresSQL:
– Script: postgres-kmc-rkm-post-migrate.sql
• Key catalog previously on Oracle Express:
– Script: oracle-kmc-rkm-post-migrate.sql
14. Restart any backup applications and jobs that were deactivated or suspended before the migration.
For More Information