Why Veeam uses software encryption with my HPE LTO-7 drive?

[fsr]

The drive has hardware encryption. I enabled encryption on the media pool. Made a new backup of files to tape job to test it, but the log says: "31/7/2019 10:22:46 :: New tape backup session started, encryption: software".

Why is it using software encryption?

I used HPE Library and Tape tools, and ran an "LTO encryption test", and the test result is that it's working correctly.

Test 'LTO Encryption Test' started on device 'HP Ultrium 7-SCSI' at address '1/0.4.0'
Passed
Operations Log
LTO Encryption Test Options
Allow Overwrite (all data on your tape will be overwritten) : True
executing LTO Encryption test...
checking tape load ...
rewinding ...
confirming mode page settings ...
writing data ...
spacing ...
reading encrypted data, correct key...
writing data ...
spacing ...
encrypted data, mixed mode decryption...
non-encrypted data, mixed mode decryption...
spacing ...
non-encrypted data, decryption disabled...
spacing ...
encrypted data, decryption disabled...
encrypted data, incorrect key...
encrypted data, no AKAD...
non-encrypted data, no AKAD...
rewinding ...
erasing ...
rewinding ...
restoring mode page settings ...
Test Passed.
LTO Encryption test version: V12.02.2015
Test run: Wed Jul 31 10:57:24 2019

HPE Library and Tape tools does turn on the blue "encryption" led on the tape unit, but the Veeam job does not.

The tape unit is external. Windows version is Server 2019.

Regards

[Dima P.]

Hello Fernando,

Any chanсe you are using Update 4b? If that's true please apply this patch (there is a known issue where software encryption is being used instead of hardware encryption when both are available). Thanks!

[fsr]

Thanks, i had update 4b installed, so i applied the patch, and now it reports "encryption: hardware", and the speed is around 200 MB/s, as it was when no encryption was used. Oddly, the blue "encryption" led on the tape unit remains unlit, so to see if it is really encrypting the data, i changed the encryption key, and then restored a file from tape, and it did restore without any errors, so i suppose that the backup to tape wasn't really encrypted at all, right?

[skrause]

Hello Fernando,

Any chanсe you are using Update 4b? If that's true please apply this patch (there is a known issue where software encryption is being used instead of hardware encryption when both are available). Thanks!

Quick question on the hotfix. The files only need to be loaded on the tape server, not on the B&R server orchestrating the jobs, correct?

The steps didn't mention it, but the first steps talked about stopping jobs and services on the B&R server so I wanted to make sure before I make the change

[Dima P.]

it reports "encryption: hardware", and the speed is around 200 MB/s

The main benefit of the hardware encryption is that it has very minor impact on the performance.

then restored a file from tape, and it did restore without any errors, so i suppose that the backup to tape wasn't really encrypted at all, right?

To check that you need to remove the tape from tape catalog (otherwise Veeam B&R has the knowledge of the tape media and it's key and wont ask you for the password).

The files only need to be loaded on the tape server, not on the B&R server orchestrating the jobs, correct?

Yes, the fix should applied to the tape server component.

[skrause]

Interestingly enough, this hotfix actually fixed an issue we had this morning before I installed it doing our monthly "can we restore from our 6 month old tapes?" test where it errored out with a weird message.

Thanks for letting us avoid a support ticket by linking the hotfix