Skip to main content

## Manage SKLM for z/OS Encryption

With the Manage SKLM for z/OS Encryption configuration page, you can configure the use of SKLM for z/OS servers with the library. Access the configuration page from the Actions menu with Manage SKLM for z/OS Encryption option. This requires that the Library Managed Encryption license has been activated on the Settings > Library > Licensed Features page.

For additional information on configuring SKLM for z/OS servers for use with the library, see the SKLM for z/OS server documentation.

On the Manage SKLM for z/OS Encryption page, it is possible to configure the following options which are valid for all logical libraries configured for SKLM for z/OS Encryption:

- Enable SSL
  Check this option to secure the communication between the library and the SKLM for z/OS server.
- Encryption Policy

- Encrypt All
  This setting applies to all drives in the logical library which is configured to use SKLM for z/OS encryption
- Internal Label - Selective Encryption
  Only encrypts cartridges with pool identifiers between 1500 and 9999 (inclusive), using keys specific to each pool. Labels for these keys are generated by the tape drive based on the pool identifier; for instance, key label IL_NBU_1505 would be generated for a cartridge in pool 1505.
- Internal Label - Encrypt All
  Encrypts all cartridges. Cartridges with pool identifiers between 2000 and 65535 (inclusive) are encrypted with keys specific to each pool. Labels for these keys are generated by the tape drive based on the pool identifier; for instance, key label IL_NBU_2505 would be generated for a cartridge in pool 2505.

"Internal Label" selections are only used for Symantec's Veritas NetBackup or the EMC Legato NetWorker.

- Primary key server
  At least the configuration of the IP address and port of the primary key server is necessary to get a working SKLM for z/OS configuration.
- Secondary key server
  Up to three servers can be configured under the secondary key server section. If connection to the primary key server fails, a failover to the configured secondary key server(s) will be done automatically.

Once the configuration has finished, the "SKLM for z/OS" encryption mode is selectable in the Logical Library Wizard (Expert Mode) on the Library > Logical Libraries page.