topic Re: NEED DISK REKEY Warning in Upgrade Plan in ONTAP Discussions

NEED DISK REKEY Warning in Upgrade Plan

NEO-BAHAMUT — Sat, 19 Jul 2025 06:47:26 GMT

Hi All, i've been preparing for an ONTAP upgrade recently from 9.11.1P10 up to 9.15.1P12. I've got a report from ActiveIQ and as a warning it states that "Encryption Keys are not in sync for all nodes". It also links me to the following article - ONTAP Upgrade Advisor Plan: Validate encryption keys are in sync for all nodes - NetApp Knowledge Base

Now i believe that from a disk level we don't have encryption enabled but we do at volume level. When looking in the cluster settings I can see this

just wondered if anyone could give us any info on this warning we are getting and will it stop the upgrade? When running the commands in the article its coming back as though there is no problem.

Re: NEED DISK REKEY Warning in Upgrade Plan

TMACMD — Sat, 19 Jul 2025 11:17:14 GMT

You don’t need to let the disks. It’s easy though

just click the button in the GUI

i find it should be a best practice to sync keys before upgrading

security key-manager onboard sync

You’ll need the output from the

“security key-manager onboard show-backup” and your passphrase to “security key-manager onboard verify-backup”

Re: NEED DISK REKEY Warning in Upgrade Plan

NEO-BAHAMUT — Sat, 19 Jul 2025 11:37:10 GMT

Hi TMAC!

we recently decommissioned four FAS controllers with SAS disks. The volumes on these controllers weren’t encrypted. Before decom I migrated everything to our two new controllers which we encrypted volumes. That’s not something onconfigured and weren’t sure if volume encryption was something new in the new controllers?

Is there any issue in us encrypting the disks? It will obviously increase the security on the data.

Is there any issue or will it disrupt client connectivity to the disks etc? I don’t really know much about this side of ONTAP.

Re: NEED DISK REKEY Warning in Upgrade Plan

TMACMD — Sat, 19 Jul 2025 11:43:07 GMT

Enabling Encryption on flash is instant. No disruption.
you must have the onboard key manager setup and synced to all current nodes.

if you have flash, I hope you are using aggregate encryption so as to take advantage of cross volume efficiencies. If you are only doing NetApp volume encryption then your still get efficiencies except you can’t get any cross-volume

you can check with

volume show -fields encryption-type

volume = nve

aggregate = nae

none = no encryption

Re: NEED DISK REKEY Warning in Upgrade Plan

NEO-BAHAMUT — Sun, 20 Jul 2025 08:34:28 GMT

Hi TMAC, just to confirm - yes we are using Aggregate encryption.

So going forward, would you suggest we make sure keys are all in sync (i think they are), and also Rekey them to remove the warning?