EMC® VNX® Series Security Configuration Guide for VNX

Adding a disk drive to a VNX with encryption activated

Inserting one or more new disks into the system does not trigger generation of a new DEK for each disk. This operation will not occur for a new disk until the disk is added to a RAID Group or storagepool. A keystore modified status will be set by the Key Manager at this point and will trigger an alert to back up the keystore because DEK modifications were made to the keystore.

When you add a new disk drive to a VNX, the drive is considered unbound. Disk drives that are not bound are overwritten with default data to remove pre-existing data. Only the addressable space of the drive is overwritten. Any residual plaintext data that may be hidden in obscured locations within the drive will not be overwritten.

When you add or replace a SAS UltraFlex I/O module to a VNX with encryption activated, you must perform an additional manual reboot of the affected Storage Processor once the replacement process is completed. Use either Unisphere or the VNX OE for Block CLI command: naviseccli -h <IP_address_of SP> -user <name> -password <password> -scope <scope> rebootSP. This command reboots the SP to which the IP_address refers.