Skip to main content
NetApp Knowledge Base

Onboard key manager keys don't match between clusters in a MetroCluster

  1. Last updated
    Jun 24, 2024
  2. Save as PDF
Views:
934
Visibility:
Public
Votes:
0
Category:
metrocluster
Specialty:
metrocluster
Last Updated:
6/24/2024, 2:47:51 PM

Applies to

  • ONTAP 9
  • MetroCluster 
  • Onboard Key Manager (OKM)
  • NetApp Volume Encryption (NVE)

Issue

  • After ONTAP upgrade on a MetroCluster system, MetroCluster health reports as degraded:

::> system health subsystem  show
Subsystem         Health
----------------- ------------------
SAS-connect       ok
Environment       ok
Memory            ok
Service-Processor ok
Switch-Health     ok
CIFS-NDO          ok
Motherboard       ok
IO                ok
MetroCluster      degraded
MetroCluster_Node ok
FHM-Switch        ok
FHM-Bridge        ok
SAS-connect_Cluster ok
13 entries were displayed.

  • The following error is reported in metrocluster check or during switchover simulation:

::> metrocluster operation show
Operation: switchover-simulate
State: failed
Errors: Failed to validate the node and cluster components before the switchover operation.
node1 (overridable veto): Internal Error. The "clus_salt" value in the Onboard Key Manager database was not properly updated

 Type of Check: onboard-key-management
                         Cluster Name: Cluster1
                  Result of the Check: warning
Additional Information/Recovery Steps: Internal Error. The "clus_salt" value in the Onboard Key Manager database was not properly updated.

  • From the output of the below command, it is observed that the SVM-KEK and NSE-AK keys match between the clusters:

::> security key-manager key show -used-by SVM-KEK,NSE-AK

 

 

Sign in to view the entire content of this KB article.

New to NetApp?

Learn more about our award-winning Support

NetApp provides no representations or warranties regarding the accuracy or reliability or serviceability of any information or recommendations provided in this publication or with respect to any results that may be obtained by the use of the information or observance of any recommendations provided herein. The information in this document is distributed AS IS and the use of this information or the implementation of any recommendations or techniques herein is a customer's responsibility and depends on the customer's ability to evaluate and integrate them into the customer's operational environment. This document and the information contained herein may be used solely in connection with the NetApp products discussed in this document.