topic Re: Encrypted Volume Creation in General Discussion

Encrypted Volume Creation

TdA — Wed, 04 Jun 2025 10:12:25 GMT

Hello friends,

I have a question, I need to create an encrypted volume and I do not know how to do it I have a FAS2552 cabin as I read a little I have to encrypt the aggregate but I already have volumes that are in production so I just wanted to know if it can be done to a new volume then I do not know if I need a license.

Thanks

Re: Encrypted Volume Creation

NetApp_SR — Fri, 01 Oct 2021 01:16:09 GMT

There are many options depending on hardware and ONTAP version. NetApp Volume Encryption (NVE) is included in ONTAP 9.x at no extra charge. There are geographic restrictions to encryption technology. The entire aggregate does not need to be encrypted. Volumes can be encrypted individually. All the volumes on an encrypted aggregate have to be encrypted with the aggregate key or with a volume key. Please review the below. If your questions are not addressed please let me know.

FAQ: NetApp Volume Encryption and NetApp Aggregate Encryption
https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/FAQ%3A_NetApp_Volume_Encryption_and_NetApp_Aggregate_Encryption

NetApp Encryption Power Guide
https://docs.netapp.com/ontap-9/topic/com.netapp.doc.pow-nve/Encryption%20of%20data%20at%20rest.pdf

NetApp Volume Encryption and NetApp Aggregate Encryption
https://www.netapp.com/pdf.html?item=/media/17070-ds-3899.pdf

NetApp Storage Encryption
https://www.netapp.com/pdf.html?item=/media/7563-ds-3213-en.pdf

Re: Encrypted Volume Creation

TdA — Wed, 13 Oct 2021 19:44:31 GMT

Hello,

I will check the documentation but some things are still not very clear to me.

Regards

Re: Encrypted Volume Creation

TdA — Thu, 21 Oct 2021 11:35:44 GMT

Hi @NetApp_SR

I have some doubts. I currently have a FAS2552 with ONTAP 9.8P4 as I read the requirements would not be compatible in addition to making NVE has to be licensed. Is this correct? According to my provider that was included.

What solution could be done if this is not possible?

Greetings

Re: Encrypted Volume Creation

NetApp_SR — Tue, 26 Oct 2021 01:45:52 GMT

The license is not a problem as it is included with ONTAP 9.x except for some geographic restrictions. I did some research and to enable NVE or NAE the controllers CPU needs the advanced encryption standard instruction set (AES-NI). A check of Hardware Universe shows the 2552 does not support AES-NI. The 2552 does support encrypted drives but they cannot be mixed with unencrypted drives on a cluster so all the drives would need to be replaced.

Re: Encrypted Volume Creation

SpindleNinja — Tue, 26 Oct 2021 15:34:09 GMT

What's still not clear?

There's two types of encryption-at-rest available . "physical" i.e. NSE/SED drives and "software" based inside ONTAP, that is NVE and NAE (volume encryption and aggr encryption).

The FAS2552 only supports the physical. i.e. NSE/SED drives. But that is a physical change of replacing non-NSE drives with NSE drives and a re-init of the cluster.

Re: Encrypted Volume Creation

TdA — Tue, 26 Oct 2021 15:41:27 GMT

Thank you, @SpindleNinja @NetApp_SR

It is now clear to me that the 2552 can only be physical.

Regards