ETERNUS DX disk arrays, what's inside. Part 2
We continue to explore what other mechanisms are present in the ETERNUS DX.
On all ETERNUS DX disk systems, it is possible to organize hardware encryption at the logical volume level with the hardware of the array itself. The option is intended for a scenario when an attacker physically stole hard disks from a disk system and then tries to recover the data. Encryption is performed by the controller itself, and it can be done at the level of one or several logical volumes (LUN). Sometimes it can be much more efficient than buying a whole disk group with SED (Self Encrypted Disk) disks. It may, for example, suddenly need to encrypt data on a single small logical volume - it is enough just to cast this option for a specific volume.
I will immediately answer the questions that are usually asked on this subject: it is possible to import into the territory of the Russian Federation and the countries of the Customs Union, this equipment with this functionality is indicated in the corresponding notification. If this function is suddenly categorically not needed (some CIS countries, or some customers in the Russian Federation, where it is prohibited by their internal service instructions), this option can be disabled by hardware and permanently at the factory. But this point must be indicated at the stage of the order. No engineer can then switch it on. The option itself is completely free, it is present in all ETERNUS DX models.
')
When cloning a logical volume or replicating it, if the source volume is encrypted, then the clone / replica / snapshot will also be encrypted.
Encryption occurs on the disk system controllers, so you should not abuse this option and encrypt everything in succession - a decrease in performance may begin. When creating the first logical volume with the encryption option, the system suggests creating a certain file with a “master key”. It is desirable to do this. If, for example, there was a system with one controller that broke down and had to be replaced, then by entering this “master key”, you can get access to the encrypted data.
With the initial configuration of the project in System Architect, he himself will substitute the recommended number of hot swap drives. This, by the way, should be remembered when you ask, for example, that you need to install an entry-level skid with 8 disks - Architect automatically adds another for Hot Spare (HS). Especially many miracles begin, if you enter 24 disks, and System Architect automatically adds a hot-swap disk, and since there is no free slot, it also adds an expansion shelf. That, of course, is not always necessary.
It is possible to assign Global and Dedicated HS drives. Global will be available for all disk groups in the array, and Dedicated will be available only for the specified ones. If a dedicated disk is used, and in the same group another hot spare disk is needed, it will be taken from the Global pool.
The vast majority of the OS, of course, is supported, and this is indicated in the Datasheet. If you could not find something exotic in the datasheet, it makes sense to contact your partner or Fujitsu representative to check the OS you need in more advanced technical documentation and in the Matrix EP. If nothing could be found there, then if the question is not idle, it makes sense to contact the representative office. There is a practice of organizing requests directly to the development team ETERNUS DX.
If we talk about possible connection interfaces, then everything is really flexible, efficient and convenient. Starting from the system itself, the initial level, and then with all the stops, it is possible to add / change existing connection interfaces.
And, for example, for entry-level systems, for the customer there is a choice of FC, iSCSI, FCoE and SAS. Frankly, we could not recall any other system on the market, which, being sold, for example, with FC, could then expand so flexibly - you can add either FC, or iSCSI, or FCoE, or SAS.
The advantages of this approach are obvious. If, for example, today a system is already needed, and it is known exactly which interface today needs to be accessed, then the choice of agony — whether to expand the number of such interfaces, or add another type or speed of interfaces later — can be left for later. When clarity comes, you can buy and easily add the necessary CA-cards.
Built-in encryption mechanism
On all ETERNUS DX disk systems, it is possible to organize hardware encryption at the logical volume level with the hardware of the array itself. The option is intended for a scenario when an attacker physically stole hard disks from a disk system and then tries to recover the data. Encryption is performed by the controller itself, and it can be done at the level of one or several logical volumes (LUN). Sometimes it can be much more efficient than buying a whole disk group with SED (Self Encrypted Disk) disks. It may, for example, suddenly need to encrypt data on a single small logical volume - it is enough just to cast this option for a specific volume.
I will immediately answer the questions that are usually asked on this subject: it is possible to import into the territory of the Russian Federation and the countries of the Customs Union, this equipment with this functionality is indicated in the corresponding notification. If this function is suddenly categorically not needed (some CIS countries, or some customers in the Russian Federation, where it is prohibited by their internal service instructions), this option can be disabled by hardware and permanently at the factory. But this point must be indicated at the stage of the order. No engineer can then switch it on. The option itself is completely free, it is present in all ETERNUS DX models.
')
When cloning a logical volume or replicating it, if the source volume is encrypted, then the clone / replica / snapshot will also be encrypted.
Encryption occurs on the disk system controllers, so you should not abuse this option and encrypt everything in succession - a decrease in performance may begin. When creating the first logical volume with the encryption option, the system suggests creating a certain file with a “master key”. It is desirable to do this. If, for example, there was a system with one controller that broke down and had to be replaced, then by entering this “master key”, you can get access to the encrypted data.
A few words about hot swap drives
With the initial configuration of the project in System Architect, he himself will substitute the recommended number of hot swap drives. This, by the way, should be remembered when you ask, for example, that you need to install an entry-level skid with 8 disks - Architect automatically adds another for Hot Spare (HS). Especially many miracles begin, if you enter 24 disks, and System Architect automatically adds a hot-swap disk, and since there is no free slot, it also adds an expansion shelf. That, of course, is not always necessary.
It is possible to assign Global and Dedicated HS drives. Global will be available for all disk groups in the array, and Dedicated will be available only for the specified ones. If a dedicated disk is used, and in the same group another hot spare disk is needed, it will be taken from the Global pool.
A few words about supported servers, operating systems and interfaces
The vast majority of the OS, of course, is supported, and this is indicated in the Datasheet. If you could not find something exotic in the datasheet, it makes sense to contact your partner or Fujitsu representative to check the OS you need in more advanced technical documentation and in the Matrix EP. If nothing could be found there, then if the question is not idle, it makes sense to contact the representative office. There is a practice of organizing requests directly to the development team ETERNUS DX.
If we talk about possible connection interfaces, then everything is really flexible, efficient and convenient. Starting from the system itself, the initial level, and then with all the stops, it is possible to add / change existing connection interfaces.
And, for example, for entry-level systems, for the customer there is a choice of FC, iSCSI, FCoE and SAS. Frankly, we could not recall any other system on the market, which, being sold, for example, with FC, could then expand so flexibly - you can add either FC, or iSCSI, or FCoE, or SAS.
The advantages of this approach are obvious. If, for example, today a system is already needed, and it is known exactly which interface today needs to be accessed, then the choice of agony — whether to expand the number of such interfaces, or add another type or speed of interfaces later — can be left for later. When clarity comes, you can buy and easily add the necessary CA-cards.
Source: https://habr.com/ru/post/163515/
All Articles