User manual QUANTUM Q-EKM 2.0 RELEASE NOTES

[. . . ] Visit www. quantum. com for a complete description and information about Q-EKM. ©August 20, 2010 Quantum Corporation. All rights reserved. Document 6-01884-02 Rev A Quantum, the Quantum logo, and Scalar are all registered trademarks of Quantum Corporation. Other trademarks may be mentioned herein which belong to other companies. Quantum Encryption Key Manager Release Notes Document 6-01884-02 Rev A August 20, 2010 New Features and Enhancements This version of firmware supports the following new features and enhancements: · · Support for IBM LTO-5 Fibre Channel tape drives. 0 Ability to import and export encryption keys -- Q-EKM now supports importing and exporting encryption certificates and keys. [. . . ] You must upgrade to Scalar i6000 in order to use Q-EKM 2. 0 with LTO-5 tape drives. Do not change the encryption method on a tape once write operations have begun on that tape. The library applies encryption (or non-encryption) to a tape in its entirety. Whichever encryption method is selected when write operations begin on a given tape will continue throughout the entire tape, regardless of whether you change the encryption method before that tape is filled. For Q-EKM best practices and guidelines, see the Quantum Encryption Key Manager User's Guide and the Q-EKM section of your library user's guide. · 2 New Features and Enhancements Quantum Encryption Key Manager Release Notes Document 6-01884-02 Rev A August 20, 2010 Compatibility Matrix Q-EKM supports the following tape libraries, tape drives, and firmware: Libraries and Tape Drives Scalar i500: 0 · IBM LTO-4 (Fibre Channel and SAS) · IBM LTO-5 (Fibre Channel) Scalar i2000: · IBM LTO-4 (Fibre Channel) Scalar i6000: · IBM LTO-4 (Fibre Channel) · IBM LTO-5 (Fibre Channel) Library Firmware It is recommended that you upgrade library firmware to the latest released version. The minimum library firmware required to run Q-EKM 2. 0 with LTO-5 drive is: · Scalar i500: Version 585G · Scalar i2000: must upgrade to Scalar i6000 · Scalar i6000: Version 605A Tape Drive Firmware Install the latest version of tape drive firmware that is qualified for the library firmware installed on your library. Refer to the library release notes for the correct version of tape drive firmware. Compatibility Matrix 3 Quantum Encryption Key Manager Release Notes Document 6-01884-02 Rev A August 20, 2010 Qualified Backup Applications Q-EKM 2. 0 has been tested with the following backup applications. Other applications that are not listed may also work. 0 Backup Application CA ARCserve® CommVault® Simpana® EMC® NetWorker® HP Data Protector IBM® Tivoli® Storage Manager SymantecTM Backup ExecTM Symantec NetBackupTM Supported Versions 11. 5 and later 7 and later 7. 5 and later 6. 1 and later 5. 5 and later 12. 5 and later 6. 5 and later Resolved Issues This release of Q-EKM software resolved the following issues: Change Request Number 16991 (formerly 70414) 16995 (formerly 70519) 17003 (formerly 70059) Service Request Number 0 Description The error "Process message failed;type=file" repeatedly appears in kms_audit. log. Solution Fixed. The error no longer appears in the audit log. Read/Write SCSI commands time out after 12 minutes but Q-EKM/LME key server request times out after 2-3 minutes. Media is marked bad and becomes unusable if you perform an erase media operation with LME enabled while the Q-EKM server is not accessible. Fixed. Fixed. 4 Qualified Backup Applications Quantum Encryption Key Manager Release Notes Document 6-01884-02 Rev A August 20, 2010 Change Request Number 17004 (formerly 70651) Service Request Number Description The syncQEKMServer command does not perform an "instant" or "manual" synchronization. It takes one hour for the first synchronization to occur; then, automatic synchronization occurs at onehour intervals. This may cause the user to think that the sync operation did not work. Solution Fixed. The first synchronization occurs immediately after synchronization is set up, followed by regular synchronization at onehour intervals. Additionally, any time you change the configuration (for example, changing passwords, changing port numbers, turning debug logging on/off), an immediate synchronization takes place. Note: Q-EKM 2. 0 no longer uses the syncQEKMServer command. The sync command appears on the Q-EKM Commands menu. 17030 (formerly 70471) 17049 (formerly 70618) Drive WWNs listed in KMS_audit. log do not match the numbers in EKMData. xml. Fixed. Currently, there is no length check on WWN number during Q-EKM server installation. You can enter any number of characters without receiving an error message, but if length is not exactly 6 characters, the Q-EKM server will not start. [. . . ] There is currently no way to change the keystore password once it is configured at the initial install. If the password becomes lost or forgotten, you can still encrypt tapes and read from and write to your encrypted tapes. However, you will not be able to import or export keys and certificates, which means you cannot share encrypted tapes with other parties using a different Q-EKM server to encrypt tapes. [. . . ]