Designation of Primary role and Primary Set in an LDT GuardPoint Group
The first host that enables a GuardPoint over NFS/CIFS share is designated as the primary host for the LDT GuardPoint Group. The primary role designation persists until the GuardPoint is disabled on the primary host or the primary host crashes. Designation of another CTE host for the primary role is the result of the old primary crashing, or disabling the GuardPoint. Another member of the LDT GuardPoint Group will be elected to assume the primary role for the LDT GuardPoint Group.
A secondary host is not a proper candidate for promotion to primary role if any of the following conditions exist for the GuardPoint on the secondary host:
-
The NAS share is mounted as read-only on the CTE host
-
The CTE host has not received the latest policy information from CipherTrust Manager
-
The latest key version available to the CTE host is not the most recent key version available to other members of the LDT GuardPoint Group
The read-only access to the GuardPoint directory restricts the designated host from performing LDT operations. LDT operations require read and write access to the NAS share.
The second and third conditions are most likely a transient communication failure between CipherTrust Manager and the designated CTE host. Once the communication issue between CipherTrust Manager and the CTE host is resolved, the CTE host will be updated with the most recent policy information, and it will accept subsequent designations for promotion to primary role.
In addition to the previous conditions, is usually the result of IO or networking issues between CTE host and the NAS share. If this occurs, disable the CTE host and remove it from the LDT GuardPoint Group. Removal of the CTE host triggers election of another CTE host for the primary role. If you are unable to disable the GuardPoint on the CTE host, you must reboot the host, and then remove the host from the LDT GuardPoint Group using the voradmin ldt group remove command.
The Designated Primary Set (DPS) contains a list of CTE hosts from which a primary role can be chosen by the LDT/LGS service. CipherTrust Manager administrators can create a DPS by choosing the hosts from the CTE client groups membership that can be promoted to the primary role. Thales recommends that CTE administrators inform the CipherTrust Manager administrator of their choice for DSP membership. The CipherTrust Manager administrator can update DPS as needed. The selected clients should be systems with sufficient resources that can sustain production workloads and the load from rekeying GuardPoints on the primary host. Note that the first CTE client enabling a GuardPoint assumes the primary role for that GuardPoint, regardless of the membership of the client to DPS. Election of another CTE host for promotion to primary role will be a member of the DPS, unless none of the members of the DPS has the GuardPoint enabled. In such a case, one of the members of the LDT GuardPoint Group on which the GuardPoint is enabled will be promoted to the primary role.
A Designated Primary Set (DPS) is created and assigned to a single LDT GuardPoint Group within a LDT GuardPoint Group. With the DPS assigned to a GuardPoint, the election of a new client for the primary role will be from the DPS.
In a Linux environment with a mix of clients from the client group and individual clients guarding the same NAS share, if you guard the NAS share on an individual client first, and later guard it through the client group, the individual client that guarded first is the primary client for the GuardPoint group.
Recommendations for selecting members for DPS
-
Only select server class systems capable of carrying out the rekey load without interruptions as the result of frequent reboots. Do not select transient hosts, such as a laptop.
-
Avoid disabling GuardPoints on primary host as much as possible. Disabling GuardPoints on the primary client triggers election of another member from DPS.
-
Minimize selecting the same preferred primary for multiple GuardPoints for better load distribution unless the primary host can carry out the LDT load.
Limitations
-
A Designated Primary Set is fully enforced when all members the client group are DPS-capable.
-
If a client group with DPS enabled has non-DPS capable members, the GuardPoints will not be pushed to the non-DPS capable clients.
-
Insufficient systems could cause slower rekey rates.
Configuration
When configuring a Designated Primary Set:
-
You can only choose clients from the client group membership as the designated primary client.
-
You must guard the NAS share on the client group first.
This Designated Primary Set feature is supported with CipherTrust Manager and CTE agents installed with:
| Software | Minimum Version |
|---|---|
| CipherTrust Transparent Encryption | 7.7 |
| CipherTrust Manager | 2.17 |
Prerequisites
Be sure to have completed the following configuration steps for guarding a share on your clients before creating a Designated Primary Set:
-
Configure a CIFS/SMB connection if your CTE clients are Windows clients.
-
Create an LDT Communication Group. See Managing LDT Communication Groups to create LDT Communication Groups.
-
Create an LDT Client Group. See Managing Client Groups to create Client Groups.
Note
-
Modifications made to a Designated Primary Set list are updated/pushed to the members of the client group associated with the DPS.
-
A Designated Primary Set (DPS) is fully enforced when all members of the client group are DPS-capable CTE agents. This means that the clients must be agents installed with CTE 7.7.0 or subsequent versions. If any member of the client group enabled with DPS is a non-DPS capable client, the GuardPoint will not be pushed to non-DPS capable clients.
Creating a Designated Primary Set
-
In CipherTrust Manager, click Transparent Encryption > Clients > Client Groups.
-
Click the desired client group name.
-
Select the Designated Primary Set tab.
It displays the list of Designated Primary Sets. Expand the desired Designated Primary Set to see its details.
-
Click Create Designated Primary Set.
-
In the General Info screen, provide a name for the Designated Primary Set and select an LDT Communication Group. Click Next.
-
In the Add Clients screen, select, or search for, the clients for the primary set.
Note
-
A Designated Primary Set must contain at least one client.
-
Add two or more clients to the Designated Primary Set to have available clients in DPS for election to the primary role in the case of LDT primary promotion.
-
During the promotion process, if a GuardPoint is not enabled on any members of the DPS, another client of LDT GuardPoint Group that is not a member of the DPS will be promoted to the primary role. As such, it is a best practice to select multiple clients for the Designated Primary Set for each GuardPoint.
-
Select/un-select designated primaries only when guarding NFS/CIFS shares in a client group.
-
-
In the Confirmation screen, review the details of Designated Primary Set.
-
Click Create. The screen displays a message indicating whether the Designated Primary Set was created successfully.
-
Click Close to close the screen. The Designated Primary Set displays in the Designated Primary Set tab.
-
After you have created a Designated Primary Set for a client group, you can create a corresponding LDT GuardPoint for it.
- See Creating LDT GuardPoints on SMB/NFS Paths for detailed instructions.
Adding New Clients to a Designated Primary Set
To add new clients to an existing Designated Primary Set:
-
Under Clients > Client Groups, click the desired client group name.
-
Select the Designated Primary Set tab.
-
Expand the desired Designated Primary Set.
-
Click Add Clients.
-
Select the checkboxes for the desired client names.
-
Click Add.
Changing the Designated Primary Set Associated with a GuardPoint
You must modify the Designated Primary Set associated with a GuardPoint, after the GuardPoint is created.
To change the Designated Primary Set associated with a GuardPoint:
-
Open the Transparent Encryption application.
-
Click the client group name in the Client Group Name column.
-
On the GuardPoints tab, click the ellipsis corresponding to the desired GuardPoint.
-
Click View/Edit. The Edit GuardPoint dialog box is displayed.
-
In the Designated Primary Set drop-down list, select a different .
-
Click Save.
The GuardPoint is updated successfully with the new Designated Primary Set.
Validating the Designated Primary Set
In CipherTrust Transparent Encryption, you can get the list of designated primary nodes for the guard path if you have configured a Designated Primary Set.
-
To get the list, type:
Example
Response
Note
If the DPS is not configured and you type the command to get the list, the response looks similar to the following:
LDT GuardPoint Primary: 192.168.34.54
LDT GuardPoint Designated Primaries: N/A
