Data in Flight encryption provides protection against unauthorized access to data replicated between HPE StoreOnce appliances or data transferred between clients (Microsoft® Windows® and Linux®) and an HPE StoreOnce appliance. When enabled, the Data in Flight encryption security feature protects data that is in transit, from forensic attack using the IPsec protocol. The data can be moving between two HPE StoreOnce appliances over a WAN, or a StoreOnce appliance and a backup server over a LAN or WAN.
Data in Flight encryption is not supported for IPv6 subnets. Using Data in Flight encryption for direct backup operations to the StoreOnce appliance over a local network is not supported due to the performance impact of the encryption.
Data in Flight encryption
After successfully enrolling HPE StoreOnce as a client to ESKM, the key management mode on HPE StoreOnce changes from local to external. When a new encryption link is created on HPE StoreOnce for Data in Flight encryption, one KMIP key is generated on ESKM which protects the data in transit by encrypting the data packets moving through the network. Each time a new encryption link is created or deleted, the keystore on StoreOnce is updated to include all the latest clients added for Data in Flight encryption.
Data in Flight requires customers to use a Static IP, not DHCP, for the client IP address.
Network Configuration