Guarding a CTE-Efficient Storage Device with Multiple IO Paths on Linux

Each individual IO path from a server node to a storage controller is treated as a separate device on the host. DM-Multipath on a Linux host provides a management framework to group the individual IO paths to the same LUN into a single multipath device. If you use DM-Multipath to manage devices on the protected host, the individual devices that correspond to each IO path to the LUN cannot be configured for guarding as ES GuardPoints, as those devices are under control of DM-Multipath. To guard such devices, you must guard the device mapper generated by DM-Multipath (multipathd) under the /dev/mapper directory.

Note

CTE-Efficient Storage is the only feature of CTE that exclusively supports guarding of device mapper generated devices under DM-Multipath framework.

The following example illustrates the procedure for guarding a device mapper generated device with the alias name /dev/mapper/mpathA.

1. Create a standard policy using an XTS key as the key rule.

2. On the host, prepare the device to be configured as ESG using the voradmin command with new or xform option. For example:

   voradmin esg config new /dev/mapper/mpathA

   Copy

3. On the CipherTrust Manager, guard /dev/mapper/mpathA as Device GuardPoint using the policy created above. Be sure to check the Efficient Storage check box.

4. For Manual-Guard configuration, enable the GuardPoint using the secfsd command as follows:

   secfsd -guard /dev/mapper/mpathA

   Copy

5. For Auto-Guard, wait for the /dev/mapper/mpathA device to be guarded on the protected host.

6. Once the device is guarded, provide the pathname of the secvm device to applications and/or file system operations. For example, /dev/secvm/dev/mapper/mpathA.