standard on the DS8900F. However, Full disk encryption offerings must be activated before performing any logical configuration. 

GLYPH<SM590000> IBM Fibre Channel Endpoint Security (IFCES): Use this feature to encrypt data as it is transmitted between your IBM Z server and DS8900F. This encryption mechanism also uses external key servers. It can be enabled at any time. 

GLYPH<SM590000> Transparent Cloud Tiering (TCT): The DS8900F also provides support to encrypt data being transferred to the cloud, when using the TCT function. TCT encryption can be enabled at any time, and relies on external key managers. 

The current DS8900F encryption solution requires the use of an external key manager. The key manager is used in generating, protecting, storing, and maintaining encryption keys that are needed to encrypt information. 

For more information, including current considerations and preferred practices for DS8900F encryption, see 7.3.6, “Key manager servers for encryption” on page 199 and IBM DS8000 Encryption for data at rest and Transparent Cloud Tiering, and Endpoint Security , REDP-4500. 

For more information about encryption license considerations, see “Encryption activation review planning” on page 199. 

## 10.4 Network security 

The security of the network that is used to communicate to and manage the DS8900F (specifically the HMC) is important, depending on the client requirements. The DS8900F supports compliance to the National Institute of Standards and Technology (NIST) SP800-131a standards. 

Two components are required to provide full network protection: 

GLYPH<SM590000> The first component is Internet Protocol Security (IPSec), and for Gen-2 security, IPsec-v3 is required. IPSec protects the network communication at the Internet layer, or the packets that are sent over the network. This configuration ensures that a valid workstation or server communicates with the HMC and that the communication between them cannot be intercepted. 

GLYPH<SM590000> The second component is Transport Layer Security (TLS) 1.2, which provides protection at the application layer to ensure that valid software (external to the HMC or client) is communicating with the software (server) in the HMC. 

Note:  The details for implementing and managing security requirements are provided in IBM DS8870 and NIST SP 800-131a Compliance , REDP-5069. 

## 10.5 Configuration flow 

This section shows the list of tasks to perform when storage is configured in the DS8900F. 

Depending on the environment and requirements, not all tasks might be necessary. 

Logical configuration can be performed by using the DS GUI, DS CLI, or a combination of both. Depending on your preference and experience, one method might be more efficient than the other. The DS8900F GUI provides a powerful, yet simple process for logical configuration. If you use the DS GUI, not all of the steps that are listed in this book are 

