Coming soon...New Support-Specific categorization of Knowledge Articles in the NetApp Knowledge Base site to improve navigation, searchability and your self-service journey.

Home
Advice and Troubleshooting
Data Storage Software
ONTAP OS
FAQ - NetApp Volume Encryption and NetApp Aggregate Encryption

FAQ - NetApp Volume Encryption and NetApp Aggregate Encryption

Last updated
Save as PDF
Share
1. Share
2. Tweet
3. Share

Views:: 38,309

Visibility:: Public

Votes:: 79

Category:: ontap-9

Specialty:: core

Last Updated:

Applies to

ONTAP 9
NetApp Volume Encryption (NVE)
NetApp Aggregate Encryption (NAE)

Answer

Overview	What are the software-based encryption capabilities in ONTAP? How does NetApp Volume Encryption (NVE) and NetApp Aggregate Encryption (NAE) encrypt data?
Requirements	Which hardware platforms support software-based encryption (NVE and NAE)? How do I determine if my cluster version supports NVE and NAE? Is NVE and NAE a licensed feature? How do I confirm ONTAP is running a version that prevents the use of encryption? Which key managers are available with NVE and NAE? Which external key managers are compatible with NVE and NAE? Can a system using NSE with an external key manager also use NVE and NAE? Which external key managers are supported with NVE and NAE starting in ONTAP 9.3? Do NVE and NAE require encryption on all volumes? Can I use NSE drives with NVE and NetApp Aggregate Encryption NAE? Can NVE be used in a mixed platform cluster with platforms that do not support NVE?
Architecture	What data is encrypted with NVE and NAE? Are ONTAP storage efficiencies maintained when software-based encryption (NVE or NAE) is in use? Does NVE and NAE work with aggregate deduplication? What type of algorithms do NVE and NAE use for encrypting data? Are Snapshot copies encrypted? Are FlexClone volumes encrypted? Can FlexClone volumes be encrypted with a different encryption key than the original volume? Are data volume encryption keys reused? Can I assign a specific encryption key to a data volume? If I use NetApp SnapMirror to mirror my encrypted volume to a different cluster, is the same encryption key used at the destination? Does NVE and NAE encrypt data in flight? Does NVE encrypt data during transfer when using SnapMiror? Are NetApp Volume Encryption keys replicated across clusters? Where are NVE and NAE encryption keys stored? What is the Trusted Platform Module (TPM)? Does NetApp Volume Encryption have to be enabled on both source and destination volumes of a SnapMirror relationship? Are NetApp Volume Encryption and NetApp Aggregate Encryption FIPS 140-2 Validated? Is there a special procedure or mechanism to protect against data spillage from prior to enabling NVE or NAE? Can deleted files be non-disruptively purged from NVE volumes? Does NVE support the use of external KMIP servers to store and secure encryption keys?
Configuration	How do I encrypt a new data volume? Can I encrypt existing data volumes? Can I encrypt an existing data volume in place (without a volume move)? Can I encrypt an existing volume in place with NAE in ONTAP 9.6? How do I realize aggregate deduplication space savings after moving NVE volumes to NAE volumes? How do I unencrypt an NVE volume? How do I unencrypt an NAE volume? How can I view the progress of the volume encryption conversion start command? Can I do a volume move while an active NVE volume encryption start is running? If a volume encryption is paused and resumed, will the conversion continue where it left off? Is it possible to tune the volume encryption conversion process? Is there a maximum number of simultaneous volume encryption conversion processes that can be run at one time? Can I instantaneously delete an NVE volume encryption key without deleting the volume? Can I instantaneously delete an NAE aggregate encryption key without deleting the NAE volumes? Are any additional steps needed after an encrypted volume is created to ensure that the data is encrypted? Can an existing encrypted volume have the encryption key changed or rekeyed? How can I know the last time a volume was rekeyed? Do I have to encrypt all of my data volumes when using NetApp Volume Encryption? How can I confirm if a volume is encrypted? How do I transition from the onboard key manager to an external key manager, or conversely? How can I require a prompt for the OKM passphrase at controller reboot? Why do I get error creating an NVE volume with -encrypt false when OKM initialized with -enable-cc-mode true? What are the circumstances where an external key manager is contacted by a node? How does ONTAP behave when the external key manager is not accessible? What happens with NVE and NAE volumes if the external key manager is not available during node giveback? Where can I download an NVE and NAE capable ONTAP image? What happens when I install an ONTAP non-NVE-capable release over an ONTAP release that is NVE-capable? How can I switch to an NVE or NAE-capable version of ONTAP from a non-NVE/NAE-capable version? How can I enable NVE by default for newly created volumes?
Performance	What is the performance impact of NVE and NAE? Do certain platforms perform better with NVE and NAE? Is there a performance difference between SSDs and HDDs while using NVE and NAE? Is there a performance impact on non-encrypted volumes when using NVE or NAE? How do I gauge the impact of enabling NVE or NAE on an existing system?
Interoperability	Can I use NVE and NAE with MetroCluster? Can I use NVE and NAE with ONTAP Select? Can I use NVE and NAE with NetApp FlexArray software? Can I use NVE and NAE with Cloud Volumes ONTAP? Is NVE and NAE supported for NetApp Flash Cache cards? Is data in NetApp Flash Pool intelligent caching encrypted by NVE and NAE? Are NetApp SnapLock software and NetApp ONTAP FlexGroup volumes compatible with NVE and NAE? What are the restrictions with FlexGroup volumes and NAE? Are external (KMIP) key managers compatible with NVE and NAE? Are clustered key managers supported with ONTAP for NVE and NAE? Is NVE and NAE supported with backup applications? Does NVE and NAE support drive partitioning features such as ADP?

Additional Information