topic Re: NFS/CIFS Encryption in ONTAP Discussions

NFS/CIFS Encryption

heightsnj — Wed, 04 Jun 2025 12:37:15 GMT

In terms of end to end encryption over NFS/CIFS, I know there can have NetApp Volume Encryption which will happen on volumes. What about encryptions from VM clients and to the NetApp storage?

In NFS Datastore cases, we are using v3, and not using Kerboros( I know Kerbors can support AES). We also use NFS/CIFS share. So, what kind of encryptions suppored here if any, and how can they work out?

Thanks!

Re: NFS/CIFS Encryption

paul_stejskal — Thu, 18 Apr 2019 14:45:51 GMT

SMB3 and NFS+krb5p are supported. I would recommend going to over 9.2 to get support otherwise AES-NI Intel CPU instruction sets won't be active in ONTAP and you won't see good performance at all.

Re: NFS/CIFS Encryption

heightsnj — Thu, 18 Apr 2019 15:49:25 GMT

My question is what if we didn't implement KRB at all? Any encryption can be used, and how?

in SMB3 case, what requirements on NetApp storage and Window clients?

Re: NFS/CIFS Encryption

paul_stejskal — Thu, 18 Apr 2019 16:42:20 GMT

I don't believe it's possible to encrypt NFS streams outside of KRB5P.

For SMB3, there is SMB encryption built into the protocol and we support it. I'd check with Microsoft for details or search around enabling, but it is well documented.

https://docs.netapp.com/ontap-9/topic/com.netapp.doc.cdot-famg-cifs/GUID-6F694E53-022A-453A-8AC9-6F2941794DA6.html

https://docs.netapp.com/ontap-9/topic/com.netapp.doc.cdot-famg-cifs/GUID-EF158266-85EE-4648-8D0F-6F80F0E13DCA.html

https://whyistheinternetbroken.wordpress.com/2017/07/24/ontap92-krb5p/

https://www.netapp.com/us/media/tr-4616.pdf <--talks about KRB5P NFS with Active Directory

Securing your NetApp infrastructure: https://www.netapp.com/us/media/tr-4569.pdf