IBM System i™
IBM i Tape Update
March 31, 2009
Nancy Roper
IBM Americas Advanced Technical Support
nroper@ca.ibm.com
i want stress free IT.
i want control.
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Agenda
 The Tape Product Line
– Products
– Roadmaps
– Adapter Cards & Support Matrix
 Tape Encryption and TKLM
 Virtual Tape Alternatives
 Remote Tape Alternatives
 Tape Virtualized via VIOS
 WORM Tape Update
 Optical update
 Recap
4
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Tape Product Line
for IBM i
5
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Current IBM Tape Product Line for IBM i
TS3500 HD
(High Density)
GA’d Fall 2008
LTO Family
Enterprise
Family
TS3500
TS3200
TS3310
TS3400
TS3100
TS2340
TS2900
TS2900 (SAS)
GA’d in Dec 2008
(POWER6 + i6.1)
TS2240
 Low cost
 High capacity
 Fast streaming operations
6
i want an i.
TS1130




TS1130 GA’d in
Sept 2008
(no perf increase)
High performance
High capacity
Industrial strength
Fast streaming and
start/stop operations
© 2009 IBM Corporation
IBM Power Systems
Although SAS drives have 2 ports, they
are only supported for single system attach
LTO Ultrium Tape Family
TS3310
NEW!
Requires POWER6
and IBM i 6.1
TS3200
TS2340
TS3100
TS2900
TS2240
TS3500
TS2240
TS2340
TS2900
TS3100
TS3200
TS3310
TS3500
Machine Name
3580-H4S
3580-L43/S43
3572
3573-L2U
3573-L4U
3576
3584
Max # Cartridges
1
1
9
23+1
45+3
396
>6200
Partition Capable
No
No
No
Yes (w HH)
Yes
Yes
Yes
LVD SCSI Drives
No
FH (1) (L43)
No
Yes (1)
Yes (2)
No (not for
LTO4)
No (not for
LTO3/4)
SAS Drives
HH (1)
FH (1) (S43)
HH (1)
HH (2)
FH (1)
HH (4)
FH (2)
FH (18)
No
Fibre Drives
No
No
No
4 Gbit (1)
4 Gbit (2)
4 Gbit (18)
4Gbit (192)
LME Encryption
No
No
Yes
w SAS/fibre
w SAS/fibre
w SAS/fibre
w fibre
(+ fc 5901)
(+ fc 5900)
(+ fc 5900)
(+ fc 5900)
(+ fc 1640)
HH = half high, FH = full high
(w Transparent LTO Encr Feat)
7
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Enterprise Tape Family
TS1130 Support
• V5R3 with IOP’d fibre cards
• V6R1 + POWER6 for
IOPless fibre cards
Drive based Encryption is supported for TS1120 / TS1130 drives
in the TS3400 and TS3500 (and 3494), but not standalone drives
TS1130 GA’d
in Sept 2008
TS3500
TS1130 Standalone Drive
TS1130 Standalone
TS3400
TS3500
3592-E06
3577-L5U
3584
Max # drives
1
2
192
Max # Cartridges
1
18
>6200
Partition Capable
No
Yes
Yes
LVD Drives
No
No
No (for TS1120/30)
Fibre Drives
4 Gbit
4 Gbit
4 Gbit (for TS1120/30)
No
Yes
Yes
Machine Name
Library Managed Encryption Capable
8
TS3400
i want an i.
© 2009 IBM Corporation
IBM Power Systems
LTO Tape Drive Roadmap (Full High Drives)
Gen 1
Gen 2
Gen 3
Gen 4
LTO1
LTO2
LTO3
LTO4
Media Capacity (native)
100 GB
200 GB
400 GB
Throughput (native)
Full High Drives (MB/sec)
15
35
Ultrium1
WORM (1)
Encryption
Cartridge Type
Gen 5
Gen 6
800 GB
1.6 TB
3.2 TB
80
120
Up to 180
Up to 270
Ultrium2
Ultrium3
Ultrium4
Ultrium5
Ultrium6
N/A
N/A
(Yes) (1)
(Yes) (1)
(Yes) (1)
Yes (1)
N/A
N/A
N/A
(fibre /SAS
drives only)
Yes
Yes
Fibre
Fibre
Fibre
SCSI
SCSI
SCSI
Sept
Feb
March
April
2000
2003
2005
2007
Yes
Server Attachment
Generally Available
Fibre
SCSI
SAS
On IBM i, Gen 5 LTO will likely
be IOPless attach only and will
likely not offer any performance
increase (capacity only)
tentatively
Spring
2010
This Roadmap is an estimate of the LTO Program’s current intent and is subject to change without notice.
Note 1: LTO WORM is supported on IOPless adapters only. See LTO WORM charts for details
9
i want an i.
© 2009 IBM Corporation
IBM Power Systems
LTO Media Reuse and Maximum Native Drive Speeds
LTO Cartridge
Generation
Native
Capacity
Gen 1
LTO Tape Drive Generation
Native
Datarate
Gen 1
Gen 2
Read
100GB
Gen 3
Half High
20 MB/s
15 MB/s
Gen 3
Gen 4
Half High
Gen 4
20 MB/s
20 MB/s
Write
Gen 2
Read
200GB
35 MB/s
35 MB/s
35 MB/s
35 MB/s
35 MB/s
60 MB/s
80 MB/s
80 MB/s
80 MB/s
Although HH / FH LTO4 have the same burst speed, and
the same usermix speed, the largefile sustained speed is
700 GB/hr on HH, 859 GB/hr FH
120 MB/s
120 MB/s
Write
Read
Gen 3
400GB
Write
Read
Gen 4
800GB
Write
Earlier generation
media performs at
slower speeds
Speeds shown are native rates. IBM i typically gets 3:1 compression on external tape drives, so the media will typically
hold 3* the amount shown and the drives may run at up to 3* the speed shown, unless they are bottlenecked by another
component in the path. Check the benchmarks in the Performance Capabilities Reference Manual for more information.
LTO WORM is supported on IBM i on IOPless adapters only (see LTO WORM charts for details)
10
i want an i.
© 2009 IBM Corporation
IBM Power Systems
On 3592, earlier media can be reformatted
to the new density and capacity
3592 Tape Drive Roadmap
Gen 1
Gen 2
Gen 3
3592
TS1120
TS1130
JJ / JR (WORM)
60 GBs
100 GBs
128 GB
JA / JW (WORM)
300 GBs
500 GBs
640 GB
700 GBs
1 TB
40
100
Cartridge Type
JJ/JA
WORM (1)
Native
Capacity
Gen 4
Gen 5
Gen 6
2 TBs
4 TBs
8 TBs
160
240
minimum
360
minimum
540
minimum
JJ/JA/JB
JJ/JA/JB
JA/JB/JC
JB/JC
JB/JC/JD
JR/JW
JR/JW/JX
JR/JW/JX
JW/JX/JY
JX/JY
JX/JY/JZ
N/A
Yes (2)
Yes
Yes
Yes
Yes
Fibre
Fibre
FICON
FICON
Fibre
Fibre
Fibre
Fibre
ESCON
ESCON
FICON
FICON
FICON
FICON
Sept
Oct
Sept
2003
2005
2008
JB / JX (WORM)
Native Throughput
(MBs/sec)
Encryption
Server Attachment
Generally Available
On IBM i, T1130 performs the same as TS1120,
but offers additional capacity
This Roadmap is an estimate of the 3592 Program’s current intent and is subject to change without notice.
Note 1: 3592 WORM is supported from V5R1 onwards, with better messaging from V5R4 onwards.
Note 2: TS1120 drives purchased prior to the availability of encryption on Sept 8/06 will need to purchase fc 5592 to get encryption
11
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Legend
High End Tape Performance Benchmarks
See Chapter 15 of the Performance Capabilities Reference manual (PCRM) for benchmark details.
This publication can be found at the following url: http://www-03.ibm.com/systems/i/advantages/perfmgmt/resource.html
Source File
IFS 1:m
User Mix
IFS m:m
Large File
Domino Offline
Linux NWS Offline
1800
LTO Family
1600
1400
GB per hour
1200
TS1130 is
expected to be
the same as
TS1120
Notice Updated LTO4 benchmarks on EXP24 & IOPless:
Usermix – 65 MB/sec (234 GB/hr)
Large file - 247 MB/sec (890 GB/hr)
Notice User mix speed
is not increasing
1000
890
GB/hr
LTO4 LVD SCSI tops
out at 140 MB/sec
(500 GB/hr)
(ie LTO3 speeds)
525
GB/hr
800
600
359x Family
350
GB/hr
142
GB/hr
400
365
GB/hr
1420
GB/hr
Disk
1700
GB/hr
890
GB/hr
Note: the 1st Savefile & Virtual
Tape Benchmarks used 924
arms in the Virtual Tape ASP.
Smaller environments should
review the arm-based
benchmarks in PCRM
200
0
LTO2 - fibre LTO3 - fibre LTO4 - fibre
(5704)
(IOPless)
12
i want an i.
3590H fibre
3592J fibre
TS1120 on Savefile on fc Integrated
4Gbit fibre
2757
Virtual Tape
© 2009 IBM Corporation
IBM Power Systems
Summary of Important Tape Tips
 TS2900 is a great entry SAS LTO4 drive that supports encryption
– Recall that it requires POWER6 and V6R1
 Be careful not to overstate the performance of a new drive:
– TS1120 and TS1130 perform the same on IBM i on both usermix and largefile … capacity
upgrade only
– LTO3 and LTO4 perform the same on a user mix workload
– Upgrade still makes sense for largefile workloads
– Upgrade still makes sense for encryption
– Upgrade still makes sense if capacity is required
– Half High drives have a lower sustained speed than full high drives
– Previous generation media restricts drive performance
 Avoid selling LVD SCSI if you can:
– LVD SCSI card tops out at 140 MB/sec, which can bottleneck the drive
– Not shareable
– Doesn’t support encryption
– Likely won’t go forward to the next generation of servers
 LTO5 is still a year out, and isn’t expected to give a performance gain, so feel very
comfortable selling LTO4 still
 The latest LTO firmware gives a performance boost for all generations and all attachments:
– For integrated drives, get the following PTFs: V5R4M5 = MF45813, V6R1M0 = MF45815
– For external drives, request the new firmware via the web
13
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Published Info that may contain errors re Tape
 SSIC Website is not ready yet
 Recall that fc 5746 (integrated HH SAS LTO4 drive) was not
announced via the regular channels, so does not appear in the
announcement letters or sales manual
 TS3100/TS3200 SAS Announcement Letters + Sales Manual have
multiple errors (eg it implies V6R1 is a pre-req for encryption vs a
pre-req for SAS)
 The IBM i Planning website has multiple errors in the Jan 2008
tape entry:
– http://www-947.ibm.com/systems/support/i/planning/upgrade/futurehdwr.html
– Refer to the Feb-Sept 2007 entry instead: the information is correct there
 References to LTO WORM tape support are inconsistent …
see WORM section later in this pitch
14
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Tape Adapter Cards
15
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Tape Adapter Cards (IOA’s)
LVD SCSI Cards
 fc 5702 / 5712
 fc 5736
 fc 5775 (IOPless)
Fibre Cards with IOPs
 fc 2765 – 100 MB/sec
 fc 5704 – 200 MB/sec
 fc 5761 – 400 MB/sec
140 MB/sec per port
(max 250 MB/sec per drive)
Bootable
Not Bootable. Use Alt-install
IOPless SAS Cards
IOPless Fibre Cards
 Fc 5912: PCI-X
320 MB/sec per port
(2 ports
on each)
 fc 5749: PCI-X – 400 MB/sec
 fc 5774: PCI-e – 400 MB/sec
 fc 5735: PCI-e – 800 MB/sec
(max 280 MB/sec per drive)
POWER6
V5R4M5 for TS2240,
V6R1 for the rest
POWER 6 / i 6.1 Phased Rollout Check support dates on next pages.
Bootable
16
i want an i.
Bootable
POWER6
+ i6.1 only
When reloading a system
using a drive attached to
a non-bootable IOP’d
fibre adapter card, you
need to do an “alt-install”
by booting to your
Licensed Internal Code
(LIC) CD, then reviewing
the list of attached drives
and selecting the one that
has the *SAVSYS tape in
it.
When reloading a system,
drives on the LVD SCSI
and IOPless fibre/SAS
cards can boot directly to
the *SAVSYS tape if the
card is in an alt-IPL slot.
Fibre drives need to be
direct-attached or zoned
so they are the only drive
visible to the card
© 2009 IBM Corporation
IBM Power Systems
IBM i Tape Support Matrix
Interim Solution for IBM i Tape Interop Info
For the current product line (TSxxxx), use the IBM i Tape Support Spreadsheet available on techdocs: (egs on next pgs)
http://www.ibm.com/support/techdocs/atsmastr.nsf/WebIndex/PRS3594
For older drives, watch for an updated set of charts to be posted in the same techdoc shortly
We believe that econfig has the correct rules now
Thank you for bearing with us throughout 2008!
Where we’re headed
IBM is working on a tool called System Storage Interoperability Center (SSIC) that will eventually be the official source for
this information.
http://www-03.ibm.com/systems/support/storage/config/ssic/displayesssearchwithoutjs.wss
Although the tool is posted on the web right now, the information in it is incomplete, so don’t rely on it.
We will alert the IBM i community via email once the SSIC tool is ready
17
i want an i.
© 2009 IBM Corporation
IBM Power Systems
IBM i Tape Support Matrix - TSxxxx
Plan to print the 3 charts shown and
keep them with you at all times!
Interim Resource until System Storage Interop Center (SSIC) tool is ready for TSxxxx drives/libraries
http://www.ibm.com/support/techdocs/atsmastr.nsf/WebIndex/PRS3594
18
i want an i.
Note that we do not
plan to maintain this
spreadsheet once
SSIC is ready
© 2009 IBM Corporation
IBM Power Systems
IBM i Tape Support Matrix – Server + IOA Definitions
Plan to print the 3 charts
shown and keep them
with you at all times!
Maps server models to column
titles in Interop Spreadsheet
Explains LVD SCSI
feature code #’s
including the fc 5736
collision with System P
19
i want an i.
© 2009 IBM Corporation
IBM Power Systems
IBM i Tape Support Matrix – Bonus LTO3/4 Guide
Plan to print the 3 charts shown and
keep them with you at all times!
20
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Virtual Tape
21
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Virtual Tape: What does the trade press say?
Virtual Tape is
very fast
Virtual tape will save
you money
Virtual tape solves
your Drive/Media/Staff
Failures
The Facts:
• Virtual Tape: 60-100 MB/sec, Physical Tape: 60-280 MB/sec
• A Feb 2008 study published by the Clipper group shows virtual
tape 23x more expensive than physical tape and 290x more if
you include the power costs (http://www.ultrium.com/News/paperform.php)
• Current technology tapes/media are very reliable. Operators can
make mistakes with virtual tape too
• Regular tape is economical to buy and has low power costs
• Well managed tape is automated and easy
22
i want an i.
Regular Tape is
expensive
Regular Tape is
complicated, manual,
and error prone
© 2009 IBM Corporation
IBM Power Systems
When a customer asks you about virtual tape …
 Ask him to describe the project he is working on
 What features of virtual tape caught his attention?
 What kind of tape is he using today?
 What challenges is he encountering today?
Then invite us to join you on an internal call and a customer call to discuss
23
i want an i.
© 2009 IBM Corporation
IBM Power Systems
What is Data Deduplication?
 Data de-duplication (often called "intelligent compression") is a method of reducing storage
needs by eliminating redundant data. Only one unique instance of the data is actually
retained on storage media. Redundant data is replaced with a reference or pointer to the
unique data copy.
C
B
A
C
C
A
B
A
C
B
A
i want an i.
2. Signature values are
compared to identify all
duplicates
B
A
C
A
B
B
A
1. Data elements are
analyzed to determine a
unique signature for each
24
A
C
A
B
A
B
A
A
B
3. Duplicate data elements
are eliminated and are
replaced with pointers to the
existing reference element
© 2009 IBM Corporation
IBM Power Systems
Virtual Tape Alternatives
IBM i Integrated
Virtual Tape
 V5R4 onwards
 Part of Operating System
 Good performance with
enough disk arms
 No turnkey remote replication
 Needs to move *SAVSYS to a
physical tape to boot
25
i want an i.
* All statements regarding IBM's
future direction and intent are
subject to change or withdrawal
without notice, and represent
goals and objectives only.
TS7530
 External Virtual Tape
 TS7510, TS7520, TS7530
Future Addition
TS7650
 External Virtual Tape with
Data De-Duplication
 Currently under test for
IBM i with tentative plan to
GA in June 2009
 Remote IP replication on
roadmap for fall 2009 and
2010
 Server-based dups
 80-100 MB/sec per stream
 Up to 1000 MB/sec per box
© 2009 IBM Corporation
IBM Power Systems
IBM TS7650 ProtecTIER® Deduplication Family
TS7650G Gateways
Highest Performance
largest Capacity
High Availability
TS7650 Appliance
Highest Performance
Largest Capacity
High Availability
High Performance
High Capacity
Flexible Storage
Highest Performance
Better Performance
Largest Capacity
Larger Capacity
Good Performance
Scalable
Highly Scalable
Low cost
Active-Active Cluster
Single Node
Up to 500 MB/sec
Active-Active Cluster
Up to 1000 MB/sec
1 PB TB useable
1 PB TB useable
Up to 500 MB/sec
Up to 500 MB/sec
36 TB useable
36 TB useable
Up to 250 MB/sec
Up to 100 MB/sec
18 TB useable
7 TB useable
26
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Remote Tape Alternatives
27
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Why Remote Backups?
•Minimize Tape Handling
•Minimize Risk of Tape Loss
•Avoid Trucking Costs
28
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Network Bandwidth Charges in North America
Mbits/sec
GB/hr 500 GB save
Cost
T1
1.54
0.7
30 days!
$250-$500 / month
T3
43
19
26 hours
$ 4 - 6K / month
OC3
155
70
7.1 hours
$20 - 45K / month
OC12
622
279
1.8 hours
$ tens or hundreds of
thousands / month
Sample Network Bandwidth Pricing is from InfoBahn at:
http://www.infobahn.com/research-information.htm
29
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Remote Tape Alternatives on i
SW Replication
• Data sent all day
• HA / DR fringe
benefit
Copy Services
• Data sent all day
• HA / DR fringe
benefit
• More disk req’d
Geo Mirroring
• Data sent all day
• 40-50 km limit
• HA exposure
during save
Integrated Virt Tape
• Bandwidth
• No remote BRMS
integration
TSM Client
• Slow
• Cumbersome
• User Data only
Remote Tape
• Bandwidth
• Up to 100 km
supported by IBM
via DWDM
Coming
in 2009
External Virt Tape
• Data sent over time
• De-dup reduces
bandwidth
30
i want an i.
OEM Vaulting SW
• Bandwidth
• Slow
• User Data Only
© 2009 IBM Corporation
IBM Power Systems
When a customer asks about remote tape …
 How did he get interested in remote tape?
 How big are his systems?
 What is the distance between his sites?
 What kind of network does he have between sites?
 Has he investigated network costs between sites?
 What kind of tape is he using today?
 Will he still need a physical tape to send offsite?
 Does he already have an HA Replication solution implemented?
Then invite us to join you on an internal call and a customer call to discuss
31
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Backup Encryption
32
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Comparison: Tape Drive vs BRMS SW Based Encryption
Tape Drive Hardware-based Encryption
Fibre or SAS LTO4
or TS1120 / TS1130
in a library
TKLM
V5R3 onwards
Considerations
• Needs fibre or SAS LTO4 or fibre
TS1120/TS1130 in a library
• Encrypts whole cartridges
Advantages
• No impact on CPU utilization
• Max 1% performance degradation
• No increase in media required
• All objects can be encrypted
33
i want an i.
BRMS Software-based Encryption
IBM i Encrypted Backup
Enablement Keys
BRMS Advanced
Feature
BRMS Control
Group
LibA encrypted
LibB unencrypted
Any tape drive
or library
V6R1 onwards
Advantages
• Any type of tape drive
• Mix/Match encryption on 1 cartridge
Considerations
• Significant increase in CPU utilization
• Significant Performance Degradation
• May take up to 3* as much media
• Certain system libraries can’t be
encrypted
i5/OS Encrypted Backup Enablement
- 5761-SS1 option 44 – is also req’d
© 2009 IBM Corporation
IBM Power Systems
System i Tape Encryption on IBM Tape Drives
How does it Work?
• IBM i sends the
backup to the tape
library
TKLM Server
• If the drive / library
has encryption
turned on, then the
library gets the keys
from the TKLM
IBM i
TKLM Server
LTO4 or TS1120 / TS1130 Drives
in a Tape Library
Components
• Encryption Capable Tape Drive(s) – fibre TS1120/TS1130 or
fibre/SAS LTO4
• A Tape Library – TS2900/3100/3200/3310, TS3400, TS3500, 3494
• Multiple Key Managers (TKLMs)
• Suitable Drive / Library / TKLM at DR Site to restore
34
i want an i.
• The drive/library
write the save
• BRMS is
recommended to
keep encrypted /
non-encrypted tapes
separate
© 2009 IBM Corporation
IBM Power Systems
The Encryption Key Manager (EKM) – IMPORTANT
Primary Site
TEST YOUR
RECOVERY
CAREFULLY!
Run Multiple TKLMs
Save / Synch
(so backups can still run
when one is down)
• Copy fresh keystore to all TKLMs
each time you add/change keys
• Keep offsite backup of TKLM
Comparable DR Site Gear
Don’t Encrypt TKLM
• Encryption Capable Drive / Library
• Access to TKLMs
• Run TKLM on a system/LPAR
where none of the saves will be
encrypted
Disaster Recovery Site
35
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Comparison of Tape Encryption Among Drives / Libraries
Vol 3
Vol 2
Tape GUI
Tape GUI
Drive 001 - ON
Drive 001 - ON
Drive 002 - OFF
Drive 002 - OFF
Vol 1
Vol 6
Vol 5
Vol 4
Small LTO4 Libraries
TS2900 / TS3100 / TS3200 /
TS3310 Libraries
• Turn Encryption on/off
via tape GUI interface
• All drives in a library
partition have the same
setting for encryption
36
i want an i.
Small TS1120/30
Library
TS3400 Library
• Turn Encryption on/off via
tape GUI interface
• All drives in a library
partition have the same
setting for encryption
Enterprise Libraries
TS3500 with LTO4 / TS1120/30
or 3494 with TS1120/TS1130
• Encryption can be
controlled by volume serial
number (“Barcode Encryption
Policy” = “BEP”)
• With ALMS, TS3500 can
have a mixture of encrypted
/ non-encrypted drives
© 2009 IBM Corporation
IBM Power Systems
Comparison of Solution Components for LTO4 vs TS1120/30
LTO4
Note: TS1120/30 use a
special media density for
encrypted tapes called
FMT3592A2E/A3E.
TS1120 / TS1130
LTO4 does not have a
special density.
Encryption Capable Drive
Fibre or SAS LTO4 drives only
(*NOT* LVD SCSI drives)
Fibre TS1120/30 (3592E) drives
with fc 5592 ($5K) or fc 9592 (nc)
Tape Library
TS2900, TS3100, TS3200, TS3310, TS3500
TS3400 or TS3500 or 3494
Transparent LTO
Encryption feature for
LME and SME
TS2900:
fc 5901 ($1,250 US)
TS3100/TS3200: fc 5900 ($2,500 US)
TS3310:
fc 5900 ($5,000 US)
TS3500:
fc 1604 ($12,000 US)
Not required
(function is included in drive
price)
Media
LTO4 media only
TS1120/30 Media
Key Manager
TKLM
TKLM
37
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Tivoli Key Lifecycle Manager (TKLM)
What is TKLM?
•Follow-on to Encryption Key Manager (EKM)
•Stores / Serves keys for Encyption:
•Tape: TS1120, TS1130, LTO4
•Disk: DS8000
•MUCH more user-friendly than EKM
What Platforms does it run on?
IBM i customers usually run their TKLM on Windows because:
• They typically have good skill on Windows
•Windows Server 2003 (32 bit)
•AIX 5.3 or later ( 64 bit), AIX 6.1 or later (64 bit)
•Red Hat AS 4.0 x86(32 bit )
•SuSE Linux 9.0 and 10 x86 (32 bit )
•Solaris 10 Sparc (64 bit)
• Avoids the temptation to run TKLM on a system with a
production application and accidentally encrypt the keys which
makes it impossible to recover (chicken / egg problem)
• Easy to load up a spare TKLM and store it offsite
• Easy to acquire hardware to re-build the TKLM after a big
disaster
• Faster to restore / rebuild the key store on Windows vs a larger
platform
Although we can’t RUN TKLM on IBM i, we can use TKLM
on another platform to encrypt our IBM i saves
38
i want an i.
© 2009 IBM Corporation
IBM Power Systems
TKLM: Advantages over EKM
Much Nicer Interface
•GUI Install Wizard
•Web GUI Interface
•Simple backup of TKLM data via GUI
New Functions
•Automated key rollover
•Notification of expired certificates
•Able to force a unique key for each LTO tape
Easier to Order/Use
•IBM Java RunTime Enviroment (IBM JRE) is
included with the product: no need to buy
TPC/BE
•Easy to include Support on the order
•Better documentation via Info Center
39
i want an i.
© 2009 IBM Corporation
IBM Power Systems
TKLM: Pricing and Licensing
TKLM A
TKLM C
A single TKLM server license with 8
tape drive RVUs (+ 2 base RVUS)
could be used as follows
(simultaneously):
• Load it onto TKLM A and have both tape
libraries point at it as their main Key Manager
with 10 drives in the drive table
TKLM B
TKLM D
6 drives
Primary Site
4 drives
Secondary Site
TKLM Server License includes:
•1 Production Copy of TKLM
•Multiple non-production copies of TKLM
•First 2 tape drive or disk resource activations
TKLM “Resource Value Units” (RVU’s):
•Authorization to add 1 more tape drive to drive table
•Or ability to encrypt 1 more TB of disk
40
i want an i.
• Load it onto TKLM B and have both libraries
point at it as their backup Key Manager.
TKLM B will be used automatically if TKLM A
is unavailable
• Load it onto TKLM C and TKLM D to use in
case of a disaster. The Libraries will have to
be switched to point at these key managers
when needed
• Load it onto 2 laptops to store offsite in case of
a serious disaster
• Use TKLM C and TKLM D 2-3 times a year for
2-3 days each time for disaster recovery
testing, even while TKLM A and TKLM B are
serving keys
• If the secondary site is a cold site (eg drives
are only used in a disaster), then 4 RVUs (+ 2
base) are enough
If the customer would like to run each tape
library from a local TKLM, then he will need 2
TKLM server licenses (2+2 base RVU’s) and 6
extra drive RVU’s
TKLM offers volume disounts. Check the
announcement letter for details
© 2009 IBM Corporation
IBM Power Systems
Notes - TKLM: Feature Codes
eConfig/AAS
• 5608-A91 Initial Server License with 2 tape/disk activations + 1 yr SW Maintenance
• 5608-A92 1-yr SW Maintenance Renewal without a lapse (20% of purchase price)
• 5608-A95 1-yr SW Maintenance Renewal following a lapse (60% of purchase price)
• 5608-A93 – initial license with 3-year maintenance
• 5608-A96 – subsequent 3-year maintenance without a lapse
• 5608-A94 – subsequent 3-year maintenance following a lapse
For each product above (except 5608-A92):
• Fc 0005 is the server license
• Fc 0003 is the tape or disk resource activation
For 5608-A92:
• Fc 0009 is the server license maintenance for the 1st yr
• Fc 0001 is the tape or disk Resource activation maintenance for the 1st yr
• Fc 0011 is the server license maintenance for subsequent years
• Fc 0003 is the tape or disk resource activation maintenance for subsequent yrs
From TKLM Announcement Letter - 209-020
dated January 13/09
The feature code #’s in the announcement
letter are truncated so it is difficult to
differentiate them, hence we have included
them here. Please see the announcement
letter for additional information.
Some customers may have bigger
discounts on AAS or Passport Advantage,
which will dictate how they order
Passport Advantage synchs up the
maintenance agreements in the 2nd year so
they are payable at the same time for all
products which may draw a customer to
this ordering method
Passport Advantage
• D0887LL - TKLM server license with 2 tape/disk activations + 1 yr SW maintenance
• E06JMLL - TKLM server license – 1 yr maintenance renewal
• D0888LL - TKLM server license – 1 yr maintenance renewal after a lapse
• D05EULL – Storage resource allocation including 1 yr SW maintenance
• E05EULL - Storage resource allocation - 1 yr SW maintenance renewal (no lapse)
• D05EVLL - Storage resource allocation - 1 yr SW maintenance renewal (no lapse)
• BJ0QUML – copy of code on CD for folks who don’t want to download it
41
i want an i.
© 2009 IBM Corporation
IBM Power Systems
TKLM Services – IBM Lab Services
Sample TKLM Engagement
•Preparatory Teleconferences
•3 days onsite
•install firmware + download TKLM code
•setup TKLM + copy to backup TKLM + test saves
•Skills transfer re operations + troubleshooting
•Review/record procedures
•Follow-up assistance if required
•40-50 hours total … depending on amount of assistance
customer would like
•Ballpark $12K in the USA including travel
•Can be discounted so BP’s can resell to their customers
•For information, contact IBM Lab Services
Mark Even
507-253-1313
even@us.ibm.com
42
i want an i.
Advantages of TKLM
Installation Services
•Gets the customer focussed
on the implementation
•Lab Services is aware of the
install gotchas and knows
how to bypass them
•Helps ensure the customer
understands how critical it is
that he has a current copy of
his keystore for recovery
•Makes the tape / encryption
deal go smoothly
Frank Kriss
507-253-1354
kriss@us.ibm.com
© 2009 IBM Corporation
IBM Power Systems
TKLM Resources
 TKLM Product Page (for publications etc):
– http://www-01.ibm.com/software/tivoli/products/key-lifecycle-mgr/
 TKLM Install Flash Demo - High Level
– http://ausgsa.ibm.com/home/s/m/smithn/web/public/testSite/TKLM/TKLM-012309a.html
 Jeff Ziehm’s TKLM Webinar and Install Demo – Nov 2008
– IBMers: http://w3-03.ibm.com/support/techdocs/atsmastr.nsf/WebIndex/PRS3428
– BP’s ... Sign on to Partnerworld, go to techdocs, and search on the following doc #: PRS3428
** note that the audio only captured Jeff’s voice, so there are gaps in the audio when someone is
asking a question
 Jeff Ziehm’s TKLM Webinar - Feb 2009
– IBMers: http://w3-03.ibm.com/support/techdocs/atsmastr.nsf/WebIndex/PRS3564
– BP’s: Sign on to Partnerworld, go to techdocs, and search on the following doc #: PRS3564
43
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Tape Drive Based Encryption Reminders
Things to Remember

Hardware Required
–
–
–
–
–
–

Software Required
–

Don’t encrypt your Key Manager
Have multiple Key Managers at your home site and DR site
Save your Key Manager and send a copy offsite anytime your keys change
Other Reminders
–
–
–
44
Tivoli Key Lifecycle Manager Software + hardware to run it on
Key Manager reminders
–
–
–

LTO4 or TS1120/TS1130 tape drives
Fibre or SAS (not SCSI)
Drives must reside in a tape library (although it’s OK to run in
sequential mode)
For LTO4, library must have the transparent LTO encryption feature
LTO4 media for LTO4, or any TS1120/TS1130 formatted media
Comparable gear at your recovery site
Choose TS3500 / 3494 over other libraries since it can turn encryption on/off based on volser
Include ALMS on a TS3500 order so encrypted/non-encrypted drives can share a TS3500
partition
Hire IBM Lab Services to help with install/setup (contact Mark Even in Rochester)
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Tape Virtualized via VIOS
45
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Tape Virtualized Via VIOS (great for blades!)
Today’s Interim Solution
VIOS
LPAR 1
LPAR 2
Prod
Data
Prod
Data
Virtualized Tape Stmt of Direction
VIOS
LPAR 1
LPAR 2
Prod
Data
Prod
Data
* All statements regarding IBM's
future direction and intent are
subject to change or withdrawal
without notice, and represent
goals and objectives only.
NPIV Stmt of Direction
VIOS
LPAR 1
LPAR 2
Prod
Data
Prod
Data
Virtual
Optical
SAS
SAS
TS2230-H3S
HH SAS LTO3
TS2240-H4S
HH SAS LTO4
 IBM i or BRMS save to virtual optical
 VIOS save to SAS tape
 Considerations:
–2-step process (time/complexity)
–Extra disk required (cost)
–BRMS only knows about virtual
optical save, not the VIOS tape
–Tape can only be restored to VIOS
Available today
46
i want an i.
SAS
SAS
Or for servers only,
HH SAS LTO4:
Fc 5746 internal
Fc 1404 in fc 7214 encl
Fc 5746 in fc 5720 encl
 VIOS-attached tape is virtualized directly
to the LPARs
 Use IVM GUI to assign the SAS card /
drive to the LPARs as needed (manual)
 BRMS knows about the VIOS tape
 Resulting tape can be restored on any
LTO4 drive
 Big improvement for blades, both for
backup + migration
 Rqmts: VIOS 2.1.1, eFW 3.4.2, IBM i 6.1 PTFs
Planned for 2Q09
Fibre
Drives TBD
 NPIV = N-Port ID Virtualization
 Virtualizes the tape fibre card to be shared
simultaneously by all attached LPARs
 First server IOA to support this is fc 5735 =
8 Gbit IOPless IOA
 Useful for servers with a lot of small LPARs
that don’t justify a dedicated fibre card
 Also good for blades
Planned for later in 2009
© 2009 IBM Corporation
IBM Power Systems
WORM Tape
47
i want an i.
© 2009 IBM Corporation
IBM Power Systems
WORM Tape Update
 LTO: (new)
– Supported for LTO3 and LTO4 on IOPless tape adapters
–
–
–
–
Includes full high and half high drives
Includes internal drives, bridge boxes, and libraries
Includes LVD, SAS, fibre, so long as they’re IOPless
IOPless LVD adapters need V5R4M5, SAS/fibre adapters need V6R1
New in
Dec 2008
– NOT supported on adapters that use IOPs
– Beware that documentation may be inconsistent re support
 3592
– Supported on all generations (3592-Jxx, TS1120, TS1130 onwards)
– Supported on adapters with or without IOPs
– V5R1 onwards
 PTFs required prior to V5R4:
– V5R1: MF33985, MF34271
– V5R2: MF33986, MF34272
– V5R3: MF33989, MF34273
– V5R4: included in base code
 Messages are much clearer from V5R4 onwards
– Prior to V5R4: “Cannot process this tape”
– V5R4 onwards: “Cannot process this tape because it’s WORM”
 Uses special WORM media
 **IMPORTANT** Confirm that your application supports WORM Tape
48
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Optical Update
49
i want an i.
© 2009 IBM Corporation
IBM Power Systems
3995 / 3996 Optical Update
 The Plasmon Story
• Plasmon manufactured our Optical Libraries
• Sadly, they went into receivership in December 2008
• Alliance Storage Technologies Inc has bought their assets
and appears to be back in business
• For details:
• www.plasmon.com
v www-03.ibm.com/systems/i/hardware/storage/optical/PlasmonReceivership.html
v For IBM Customers
v 3995 and 3996 are both already withdrawn from mktg
v IBM believes we have enough parts to service
existing boxes until end of life
v IBM is still selling additional drives, but new libraries
need to come from the used market
v IBM is still selling both UDO1 and UDO2 media
v Talk to us about other options for your customer’s optical needs
* All statements regarding IBM's future direction and intent are subject to
change or withdrawal without notice, and represent goals and objectives only.
50
i want an i.
IBM i website re 3995 / 3996:
www-03.ibm.com/systems/i/hardware/storage/optical/
© 2009 IBM Corporation
IBM Power Systems
3995 / 3996 Models
 3995-x4x – attached via HVD SCSI (really old – white optical boxes)
– Supported on any system/release with a supported HVD card
 3995-C2x attached via Ethernet LAN (really old –first black optical boxes)
– Supported on any system/release with a supported LAN card
 3995-C4x attached via HVD SCSI
– Supported on any system/release with a supported HVD card
Made by HP
Made by
Plasmon
 399F - Plasmon G-Series – customers bought directly from Plasmon
– Plasmon provided HW support, IBM Rochester provided SW support
– 6 enterprise models, 2 midrange models
– Normally attached via LVD SCSI with or without an IOP
– Option to attach via HVD SCSI
– Simple “swap 1 card” upgrade from HVD to LVD, if still available
 3996 attached via LVD SCSI
– IBM relogo’d the 2 midrange models of 399F (The most popular ones)
– Supported on any system/release with a supported LVD SCSI card,
with or without an IOP
HVD SCSI cards are fc 6501, 6534, 2729, 2749.
All require an IOP. Only fc 2749 is supported
on POWER6, and only for optical & 3590
51
i want an i.
All optical boxes are supported on POWER6
so long as you put them on a supported IOA
© 2009 IBM Corporation
IBM Power Systems
Recap
 The Tape Product Line
– Products
– Roadmaps
– Adapter Cards & Support Matrix
 Tape Encryption and TKLM
 Virtual Tape Alternatives
 Remote Tape Alternatives
 Tape Virtualized via VIOS
 WORM Tape Update
 Optical update
 Recap
52
i want an i.
© 2009 IBM Corporation
IBM Power Systems
Questions?
To Ask a Question ….
1)Type the question into the Chat Pod at the left of your screen *or*
2) Click the Raise-hand button to signal that you have a question.
When the moderator calls your name, unmute your phone with * 6,
and then ask your question
If we run out of time to answer your question, please call or email
Nancy directly at your leisure
53
i want an i.
© 2009 IBM Corporation