topic Re: Configuring OT for External KMS - weird requirements in ONTAP Discussions

Configuring OT for External KMS - weird requirements

JFM — Wed, 04 Jun 2025 10:05:56 GMT

Hi,

Reading the external key management configuration, in the encryption power guide:

"You can use one or more KMIP servers to secure the keys the cluster uses to access encrypted data. Beginning with ONTAP 9.6, you can use one or more KMIP servers to secure the keys a given SVM uses to access encrypted data.

(...)

You must configure the MetroCluster environment before the key manager is configured."

Do this mean: in case you are using an MC configuration, configure it before enabling KMIP" or does this mean an MC config is required to use KMIP servers.

Thanks for the clarification.

https://docs.netapp.com/us-en/ontap/encryption-at-rest/enable-external-key-management-96-later-nve-task.html

Re: Configuring OT for External KMS - weird requirements

SpindleNinja — Wed, 19 Jan 2022 19:17:37 GMT

i believe the former. You need both sides of an MCC up before you configure it.

For a non-MCC cluster you just set it up after the cluster is up.

Re: Configuring OT for External KMS - weird requirements

JFM — Wed, 19 Jan 2022 20:00:31 GMT

Thanks, makes sense... the wording should be adjusted IMHO in the doc.

Re: Configuring OT for External KMS - weird requirements

SpindleNinja — Wed, 19 Jan 2022 20:07:24 GMT

You can tell them, either by clicking "request doc changes" on the right side. or the email link at the bottom. "Have feedback for our website? Let us know " It'll create an email and populate the subject line.