Encrypt SAN Data At The Host? Emulex Says Yes: Page 2 of 2

Now that we're able to move virtual servers, and their storage, from data center to data center across a WAN, the storage traffic is more exposed and encrypting in flight makes more sense.

So if you're going to encrypt at least some of your LUNs Emulex's host based solution seems like a better solution to me than buying expensive encrypting blades for your Brocade DCX or Decru SAN appliances.  After all you need a pair of encryption devices at your primary site and at least one at your DR site which will add up to well into six figures even if you just want to encrypt a few LUNs. Emulex supports hardware encrypting HBAs or encryption in software, which might make sense at the DR site, and uses a KMIP standard key management server, which they OEM from IBM/Tivoli.  I'll be happier when they support other HBAs and iSCSI but the host may be the right place for encryption.

On the down side encrypting data will make it much harder, if not impossible, to get good data reduction via compression and/or data deduplication as it will hide similarities between data sets especially if they're encrypted with different keys.