ONTAP encryption deep dive

Encryption is easy to enable and impossible to rescue without its keys. Choose the layer deliberately, protect recovery material off-cluster, and test recovery.

NVE, NAE and NSE

Technology	Scope and keys	When to use
NVE	Software, per volume; each encrypted volume has a unique data key.	Volume-granular control and conversion of selected existing volumes.
NAE	Software, aggregate key; new volumes in an NAE aggregate are encrypted by default.	An encrypted-by-default boundary and aggregate-level keying.
NSE	Hardware encryption in supported self-encrypting drives.	Media-level protection on supported platforms; it can coexist with software encryption. Check your version/platform.

At-rest encryption does not replace in-flight protection. See security hardening and SnapLock.

Onboard and external key management

OKM keeps key hierarchy material in the cluster, protected by a cluster-wide passphrase. External management uses KMIP servers, a client certificate and trusted server CA certificates.

cluster::> security key-manager onboard enable
Enter the cluster-wide passphrase:
Re-enter the cluster-wide passphrase:
The Onboard Key Manager was enabled.

cluster::> security key-manager onboard show-backup
----------------BEGIN BACKUP----------------
...recovery material omitted...
-----------------END BACKUP-----------------
cluster::> security key-manager onboard sync
The onboard keys were synchronized.

Never paste real backup material into a ticket. Store it and its passphrase in independent, access-controlled recovery channels.

cluster::> security key-manager external enable -vserver cluster1 \
  -key-servers kmip1.example.com:5696,kmip2.example.com:5696 \
  -client-cert cluster1-kmip -server-ca-certs Corp-KMIP-CA
cluster::> security key-manager external show -vserver cluster1
Vserver   Client Certificate  Server CA Certificates
cluster1  cluster1-kmip       Corp-KMIP-CA

Key lifecycle

Enable one manager for the scope and verify every HA node can retrieve keys.
Create encrypted storage; ONTAP creates/registers keys.
Preserve OKM backup material or external configuration, certificates and KMIP-side backups.
Rotate with the supported rekey workflow and monitor it.
Exercise restore in a controlled test.

cluster::> security key-manager key query -restored false
Vserver   Key ID                                Key Type  Restored
cluster1  00000000000000000200000000000100...   NAE       false
cluster1  00000000000000000200000000000101...   NVE       false

cluster::> security key-manager external restore -vserver cluster1
Key manager restore operation completed successfully.

If every usable key copy and recovery path is lost, ciphertext is unrecoverable. Redundant encrypted data does not recreate a key.

Enable NVE and NAE; rotate keys

An existing volume uses a background conversion—not a boolean volume modify.

cluster::> volume encryption conversion start -vserver svm1 -volume finance
Do you want to continue? {y|n}: y
The conversion operation was started successfully.
cluster::> volume encryption conversion show -vserver svm1 -volume finance
Vserver  Volume   Status   Progress
svm1     finance  running  41%

NAE is selected when creating an aggregate. Confirm platform support and active help.

cluster::> storage aggregate create -aggregate aggr_secure -node node1 \
  -diskcount 12 -encrypt-with-aggr-key true
[Job 184] Job succeeded: DONE
cluster::> storage aggregate show -aggregate aggr_secure -fields encrypt-with-aggr-key
aggregate    encrypt-with-aggr-key
aggr_secure  true

cluster::> volume encryption rekey start -vserver svm1 -volume finance
The volume encryption rekey operation was started.
cluster::> volume encryption rekey show -vserver svm1 -volume finance
Vserver  Volume   Status   Progress
svm1     finance  running  67%

Performance, compliance and clones

cluster::> volume show -vserver svm1 -fields encryption-type
vserver  volume   encryption-type
svm1     finance  volume
svm1     archive  aggregate

Software encryption consumes CPU; AES acceleration, platform and workload determine impact. Benchmark the actual system. FIPS validation, licenses and export availability depend on version and jurisdiction—check current NetApp compliance documentation.

FlexClone inherits the encrypted parent and aggregate context. Clone split, move and destination choices can change keying; validate on your release and retain old keys while snapshots or clones depend on them.

Troubleshooting

Symptom	Check	Response
KMIP unreachable	DNS, route, TCP 5696, certificates, KMIP status, EMS.	Restore reachability; never delete old keys.
Keys missing after node add	`security key-manager key query`.	Run OKM sync.
Conversion/rekey stalled	Job, capacity, aggregate health, EMS.	Fix the condition before retrying.
Clone operation denied	Parent/destination encryption and manager scope.	Choose a supported destination; check your version.

cluster::> event log show -time >1h -severity ERROR -message-name *key*
Time                 Node   Severity  Event
8/27/2026 10:14:20   node1  ERROR     kmip.server.not.available: ...

Official ONTAP sources

Outputs are illustrative. Confirm commands and platform support on the target release.