https://community.netapp.com/t5/ONTAP-Discussions/What-is-the-best-way-to-apply-encryption-in-NetApp-Cluster-Mode-IN-AFFA400/m-p/438679#M41256 <P>Depends on what you want as an end result.&nbsp;<BR /><BR /></P><P>NVE gives you encryption on each volume individually and the volume each have their own unique key. You have the option of either encrypting or not for each individual volume. &nbsp;If you plan to use an external KMIP server to take advantage of the secure-purge capability, then this is where you need to be. You just run through each volume and convert it “volume encryption conversion start…”<BR /><BR /></P><P>NAE (Netapp Aggregate Encryption) encrypts everything on the aggregate. Period. No choice. Additionally, you get to use the cross-volume efficiencies. Why? Using NAE, all volumes in the same aggregate share the same key. This allows for cross volume dedupe and compression to work. &nbsp;To get there is a multi step process. First ever SVM data volume must be encrypted as NVE. Then you pick an aggregate and make sure to svm-root volumes are there, if they are move it/them. Then you can modify that aggregate to be encryption-enabled. Then you start the process of converting each volume to aggregate-encryption. You would use the “volume move start” command. You can “move” it to the same aggregate but you include the option to encryption w with aggregate key.&nbsp;<BR /><BR /></P><P>you can always check your volumes:</P><P>&nbsp;volume show -fields encryption-type, encrypt</P><P>&nbsp;</P><P>&nbsp;which shows either volume or aggregate or none for the type and enabled or not.&nbsp;<BR /><BR /></P><P>this is all in the pdf above.&nbsp;</P> Tue, 27 Sep 2022 11:01:33 GMT TMACMD 2022-09-27T11:01:33Z https://community.netapp.com/t5/ONTAP-Discussions/What-is-the-best-way-to-apply-encryption-in-NetApp-Cluster-Mode-IN-AFFA400/m-p/438677#M41254 <P>Hello Experts,</P><P>&nbsp;</P><P>Currently, I have AFF A400 Box with 129 volumes and I want to apply encryption to it.</P><P>&nbsp;</P><P>What is the best option here to apply encryption to the existing filer?</P><P>&nbsp;</P><P>Regards</P><P>&nbsp;</P> Tue, 27 Sep 2022 07:49:51 GMT https://community.netapp.com/t5/ONTAP-Discussions/What-is-the-best-way-to-apply-encryption-in-NetApp-Cluster-Mode-IN-AFFA400/m-p/438677#M41254 satya1992_ 2022-09-27T07:49:51Z https://community.netapp.com/t5/ONTAP-Discussions/What-is-the-best-way-to-apply-encryption-in-NetApp-Cluster-Mode-IN-AFFA400/m-p/438678#M41255 <P>I believe the best option is to set up NVE and convert existing volumes to encrypted ones, see&nbsp;<A href="https://docs.netapp.com/us-en/ontap/pdfs/sidebar/Configure_NetApp_Volume_Encryption.pdf" target="_blank">https://docs.netapp.com/us-en/ontap/pdfs/sidebar/Configure_NetApp_Volume_Encryption.pdf</A></P> Tue, 27 Sep 2022 07:58:00 GMT https://community.netapp.com/t5/ONTAP-Discussions/What-is-the-best-way-to-apply-encryption-in-NetApp-Cluster-Mode-IN-AFFA400/m-p/438678#M41255 maffo 2022-09-27T07:58:00Z https://community.netapp.com/t5/ONTAP-Discussions/What-is-the-best-way-to-apply-encryption-in-NetApp-Cluster-Mode-IN-AFFA400/m-p/438679#M41256 <P>Depends on what you want as an end result.&nbsp;<BR /><BR /></P><P>NVE gives you encryption on each volume individually and the volume each have their own unique key. You have the option of either encrypting or not for each individual volume. &nbsp;If you plan to use an external KMIP server to take advantage of the secure-purge capability, then this is where you need to be. You just run through each volume and convert it “volume encryption conversion start…”<BR /><BR /></P><P>NAE (Netapp Aggregate Encryption) encrypts everything on the aggregate. Period. No choice. Additionally, you get to use the cross-volume efficiencies. Why? Using NAE, all volumes in the same aggregate share the same key. This allows for cross volume dedupe and compression to work. &nbsp;To get there is a multi step process. First ever SVM data volume must be encrypted as NVE. Then you pick an aggregate and make sure to svm-root volumes are there, if they are move it/them. Then you can modify that aggregate to be encryption-enabled. Then you start the process of converting each volume to aggregate-encryption. You would use the “volume move start” command. You can “move” it to the same aggregate but you include the option to encryption w with aggregate key.&nbsp;<BR /><BR /></P><P>you can always check your volumes:</P><P>&nbsp;volume show -fields encryption-type, encrypt</P><P>&nbsp;</P><P>&nbsp;which shows either volume or aggregate or none for the type and enabled or not.&nbsp;<BR /><BR /></P><P>this is all in the pdf above.&nbsp;</P> Tue, 27 Sep 2022 11:01:33 GMT https://community.netapp.com/t5/ONTAP-Discussions/What-is-the-best-way-to-apply-encryption-in-NetApp-Cluster-Mode-IN-AFFA400/m-p/438679#M41256 TMACMD 2022-09-27T11:01:33Z