EMC® VNX® Series Security Configuration Guide for VNX

Network encryption

The storage management server provides 256-bit (128-bit is also supported) symmetric encryption of all data passed between it and the client components that communicate with it, as listed in Ports used by Unisphere components on VNX for block (Web browser, Secure CLI), as well as all data passed between storage management servers. The encryption is provided using SSL/TLS and uses the RSA encryption algorithm, which provides the same level of cryptographic strength as is employed in e-commerce. Encryption protects the transferred data from prying eyes-whether on the local LANs behind the corporate firewalls, or if the storage systems are being remotely managed over the Internet.

The storage management server supports SSL/TLS over the industry-standard port 443 to ease integration with firewall rule sets. For those customers who would like to use another port, instead of the industry standard, the storage management server also supports SSL/TLS over port 2163 (VNX for block only). Port selection is performed when the storage-system network settings are configured. EMC recommends that all storage management server installations in the same domain use the same port for SSL/TLS communications.

VNX for file supports Secure Socket Layer (SSL) for Data Mover Hypertext Transfer Protocol (HTTP) and Lightweight Directory Access Protocol (LDAP) connections.

Instances of the storage management server installed on Windows hosts use the same communication security mechanisms as those that run on the SP; however, since the application is running on a host, additional security measures are taken to protect Unisphere domain configuration and security information. First, ACLs are set so that only administrator-level accounts can access the install directory. Second, the files are encrypted.