Oracle Key Manager
 

PLA-Support>Sun Systems>TAPE>Backup Software-Filesystems>SN-TP: Encryption
 

In this Document

Goal

Solution

References

Created from <SR 3-9804857251>

Applies to:

Goal

What is the procedure for joining a KMA to an existing cluster?
 

Solution

This procedure is applicable after a KMA hard drive or system board replacement, a KMA server replacement or when adding a new KMA to the OKM cluster.

1. Prior to the hard drive, system board or server replacement, make sure the KMA is shut down properly.  
    ( Refer to <Document 1019656.1> - How to Correctly Shutdown and Reboot a KMA )

2. On an existing KMA connected to the OKM cluster, bring up the OKM GUI and login with Security Officer role.
    -- Bring up the KMA List.
    -- Note down the management and service network addresses.
    -- Determine the gateway and netmask as this will be needed during QuickStart (when the KMA is re-initialized)

3. If existing, delete the KMA entry of the KMA that will be joining the OKM cluster.

4. Create a new KMA entry.  You may reuse the same name as the deleted KMA ( in step 3 ).
    -- This will require key split quorum authentication ( Key Split Configuration gives info on number of required users to authenticate )
    -- The new KMA id will be all zeros until it joins the cluster again through the QuickStart process.

5. When the KMA is ready to join the cluster,  power up the KMA and login to the system console ( either through the ELOM GUI or CLI ) .
    This should bring up the OKM QuickStart program that will allow you to initialize the KMA.
    --- Provide the management and service network addresses for this KMA; as well as, the gateway and netmask information.
    --- Provide the KMA name created in Step 4.
    ---QuickStart will ask if you would like to create a new cluster or join an existing cluster.
        The KMA should join the existing cluster and the management IP address of the KMA used in Step 2 should be provided.

6. Monitor the progress of the join operation from the OKM GUI's "KMA List" window.
  --- The new KMA will come up as "Locked" and will remain this way until unlocked.

7. Unlock the KMA once the replication lag size becomes 0.
  --- If the replication lag size does not become 0, login to the new KMA's OKM GUI and switch the replication version to a version that is compatible with that of
       the KMA in Step 2. )
  --- Please refer to the References section of this document for current documents related to OKM replication levels

References

This solution has no attachment