|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
This product bulletin is intended to
announce the availability of the fully configured Decru DataFort product line
via the NetApp Quote Tool. Decru DataFort
storage security appliances provide
wire-speed AES-256 encryption and protect data at rest with secure access
controls, authentication, secure logging, and optional client security
features. By locking down stored data with strong encryption and routing all
access through secure hardware, DataFort radically simplifies the security
model for networked storage. DataFort can be deployed transparently, with no
changes to applications, servers, desktops, storage, authentication, or user
workflow. DataFort is the only storage security platform that transparently secures
storage across the entire enterprise, including NAS, DAS, SAN/IP, SAN, and
tape environments. Decru DataFort appliances are available in the following
models:
All DataFort
appliances have the option of adding a Cluster License, which enables
active/active clustering between DataFort appliances, with secure key
sharing. See section 6 for information on ordering. Additional
options (available as NetApp bundles) on all DataFort appliances are: CryptoShred® Option: Option to ensure instant,
secure key deletion for data in harm's way (recommended for military
applications). Security Key:
Pick-resistant factory-installed Medeco lock. Note: The following option is only available on the 2U
E-Series DataFort appliance. IPsec Support: On-board, hardware-based IPsec
accelerator to encrypt data in transit (between the host and the DataFort
appliance). The IPsec option is currently supported for NFS/CIFS protocols,
but not for iSCSI. Decru DataFort appliances are complemented by the Decru®
Lifetime Key Management™ (LKM) System, a software utility that securely
automates the archiving and recovery of encryption keys across the
enterprise. The Lifetime Key Management System can be deployed in two
platforms: 1.
As an application running
on a standard server. In this case only the application license needs to be
purchased—see section 6.3 for sizing guidance. 2.
As a standalone appliance.
In this case, you need to order the appliance AND key management licenses to
be installed on every DataFort that connects to the LKM appliance. A centralized management feature called SecureView,
available as a license on all Decru appliances (including DataFort and LKM).
SecureView enables centralized management of appliance configurations,
admins, licenses, and patches and enables centralized control and monitoring
of all appliances. Note: SecureView is
an optional add on – it is not required in order to deploy DataForts or the
LKM Appliance. However, if it is ordered the use of SecureView requires at
least one LKM appliance in the environment. Refer to the below table for a more detailed comparison of
the LKM software and appliance solutions (including SecureView).
A software recovery tool called Decru Data Decryption
Software enables secure, software-based decryption to address
information-sharing requirements where DataFort hardware performance is not
required. Finally, Decru DataFort appliances require an
Administration Kit consisting of two system cards, three admin cards, and six
recovery cards to enable the various functions associated with a DataFort
appliance. One kit is recommended per security domain. 2. What's New? The February 2006 Quote Tool
update extends the Decru solution offerings with the following new
products/options: iSCSI protocol encryption option on
E-Series DataFort appliances. S110
DataFort appliance for parallel SCSI tape encryption. Stand-alone Decru Data Decryption
Software for optional software decryption. This has previously been bundled
with the Lifetime Key Management software. The March 2006
Quote Tool update adds the following: 2-hour parts replacement
service. Please refer to the ServiceMaps tool for availability information. ServiceMaps is a new tool provided by the Field
Operations team that enables users to research the highest available service
level in any city around the globe at http://servicemaps.netapp.com. If
ServiceMaps indicates Premium 2hr is available, then 2hr, 4hr, and NBD Decru
replacement service is available in the area. If Premium 4hr is available,
then 4hr and NBD Decru replacement service is available in the area. If
Premium NBD is available according to ServiceMaps, then NBD Decru replacement
service is available. The June
2006 Quote Tool update includes the following: All part
numbers have been updated to reflect their RoHS-compliant versions. An EOA
notice for the old part numbers (non-RoHS-compliant versions) can be found
at: http://www.netapp.com/mycommunities/PartnerCenter/solutions/products/product-bulletins/eoa-non-RoHS-Decru-0606.htm The August
2006 Quote Tool update includes the following: Launch additional support levels (including 4-hr
parts delivery) to meet the diverse support level
requirements of Decru’s customer base, which now range from next business day
delivery to 2-hour replacement. All support levels have been tiered to match
the tiered pricing structure of the DataFort product family, and to allow
support prices roughly proportional to product prices. The September
2006 Quote Tool update includes the following: Launch add-on Swiss and The December
2006 Quote Tool update includes the following: Launch configured The February
2007 Quote Tool update includes the following: Launch FC-Series and S-Series 2.2 operating system and
administration kits; introduce KM500 and DataFort SecureView and Key
Management software options. The August
2007 Quote Tool update includes the following: Configured
Decru DataFort’s will no longer include Cluster software marketing number.
The E3.1.1, FC2.2, and S2.2 operating systems no longer require a license key
to unlock cluster functionality.
FC1020 no longer supports the Cryptoshred option. A future Quote Tool release will introduce
FC1020 support via a new marketing number.
Cryptoshred is still available on the other E-Series and FC-Series
DataForts. The September
2007 Quote Tool update includes the following: Marketing
part number change for the Decru DataFort operating systems and administration
kits. The marketing number transition is part of an overall part number
consolidation and simplification initiative.
Introduce 5-day The 2-day
upgrade service offering is now available for customers requiring assistance
to upgrade across major versions of the DataFort OS (such as E-Series 2.0 to
E-Series 3.0). 3. Sales Tools (Sales Guides, Training Presentations, SE Presentations) 4. Customer-Ready Tools (Customer Presentations, Datasheets) Support matrices and some
examples of DataFort configurations can be found on the following links. Two currently unsupported configurations are: ·
DataFort encrypting
an NDMP data stream between NetApp FAS or NearStore® and tape library for
certain versions of Data ONTAP® (however, encrypting an NDMP stream from media
server to tape is supported). Specifically: § An FC-Series DataFort appliance (running OS version FC-Series 2.1) can be used to encrypt NDMP streams from Data ONTAP 7.0.2 or 7.1, using a port-mapped Cryptainer™ configuration. § However, the current versions of Data ONTAP 6.5.x do NOT support the use of an encrypting device such as a DataFort appliance between storage system and tape library. Therefore, this configuration is not currently supported. For more details, please refer to BURT 162438. ·
DataFort encrypting a
SnapMirror® or SnapVault® data stream. 1. You need to determine the storage
protocol and peak throughput required for the customer environment and pick
the appropriate DataFort appliance. Please select additional options (such as
CryptoShred or IPsec) as required. · NFS/CIFS/iSCSI—up
to 1Gb/s Ethernet—pick the 1U or 2U 2 Port E-Series DataFort appliance. Pick
any combination of the three available Ethernet protocols: NFS, CIFS, and
iSCSI. · FC—up
to 2Gb/s FC for SAN environment—pick 1U or 2U 2 Port FC-Series DataFort
appliance and select the Disk Option. · FC—up
to 2Gb/s FC for Tape environment—pick 1U or 2U 2 Port FC-Series DataFort
appliance and select the Tape Option. · FC—up
to 10Gb/s FC for Tape environment—pick the 2U 10 Port FC-Series DataFort
appliance. This DataFort appliance is only available with the Tape Option,
which must be selected. · LVD
SCSI—up to 70MB/s for Tape Environment— pick the 2U 2 Port (S110) DataFort
appliance and select the Tape Option. · If
the customer requirements dictate the need for the CryptoShred option
(description above), check this option. · If
the customer requirements dictate the need for IPsec acceleration, check the
IPsec option. Note that this option is only available on the 2U E-Series
DataFort appliance. · If the customer requirements dictate
the need for a factory-installed pick-resistant lock, pick the Security Key
option. 2. For high-availability environments,
some versions of DataFort require cluster licenses to enable multi-way
clustering. When ordering E-Series
DataFort appliances, you must pick one cluster license per DataFort appliance
(at no cost). When ordering FC-Series
or S-Series appliances, no cluster licenses are required as clustering
capabilities are enabled by default. 3. To simplify key management, as well
as provide a secure backup for encryption keys, it is highly recommended that
you add a key management system. This can be done in one of two platforms:
the LKM application (software only), or the LKM appliance. §
If choosing the Lifetime
Key Management application options, order one license per customer site (as
long as the site does not exceed 32 DataFort appliances). The price includes
software license only; no servers are included. §
If choosing the LKM
appliance, the best practice is to deploy at least two appliances in an
enterprise, in two different sites. Each LKM appliance can manage keys for up
to 100 DataFort appliances (including remote DataFort appliances). To order
this option, you must order the LKM Aappliance hardware, AND key management
licenses for each DataFort managed. Note that only 1one key management
license is required per DataFort, regardless of how many LKM Aappliances you
purchase and configure. 4. If the customer is looking to
centrally manage a large deployment, you should add SecureView licenses on
all Decru appliances (including DataFort and LKM appliances). SecureView
enables centralized management of appliance configurations, admins, licenses,
and patches and enables centralized control and monitoring of all appliances.
Note:
The use of SecureView requires at least one LKM appliance in the environment.
However, SecureView licenses are not required if the LKM appliance will be
used for key management purposes only. 5. If the customer desires an offline software decryption
option as a fallback, add one or more Decru Decryption Software licenses as
needed. 6. Choose appropriate service and support options for the hardware and software selected above, for the duration that the customer requires. For premium support levels (such as 4-hour or 2-hour parts replacement), please refer to the ServiceMaps tool for availability information prior to generating the quote. ServiceMaps is a new tool provided by the Field Operations team that enables users to research the highest available service level in any city around the globe at http://servicemaps.netapp.com. If ServiceMaps indicates Premium 2hr is available, then 2hr, 4hr, and NBD Decru replacement service is available in the area. If Premium 4hr is available, then 4hr and NBD Decru replacement service is available in the area. If Premium NBD is available according to ServiceMaps, then NBD Decru replacement service is available. 7. For a
first-time Decru customer, it is highly recommended that you add five days of
Professional Services time per customer site OR per every 10 DataFort
appliances sold, whichever is the larger number. For example, for two sites,
quote 10 days. For 30 DataFort appliances at one customer site, quote 15
days. This service includes DataFort architecture review and recommendations,
DataFort implementation, documentation of system configuration, site-specific
operations guide, and training. The implementation service is
available in multiples of one day or multiples of five days. To quote
multiple units of either PS service option, you may add the PS part to a
separate line item on the quote and choose the desired quantity. 8. For a new Decru customer, consider
offering the five-day 9. For
an existing customer planning to upgrade across major versions of the
DataFort OS (such as E-Series 2.0 to E-Series 3.0), it is
highly recommended that you engage a trained PSE via the two-day upgrade
Professional Services offering. This service will ensure a smooth upgrade and
includes all components required for the upgrade, such as new smart cards and
documentation. The following
is a list of all Decru part numbers available via the NetApp Quote Tool,
including hardware, software, support, and services.
Quoting Decru
DataFort is available for quoting with the current Quote Tool. Please refer
to the Quote Tool Bulletin for quoting: Product Availability Decru DataFort is available with the current Quote Tool release. Standard software warranty and
services apply. Contact Information: Please contact your Network Appliance sales
or channel partner representative with questions concerning this bulletin.
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
