NEED DISK REKEY Warning in Upgrade Plan

[NEO-BAHAMUT]

Hi All, i've been preparing for an ONTAP upgrade recently from 9.11.1P10 up to 9.15.1P12. I've got a report from ActiveIQ and as a warning it states that "Encryption Keys are not in sync for all nodes". It also links me to the following article - ONTAP Upgrade Advisor Plan: Validate encryption keys are in sync for all nodes - NetApp Knowledge Base

Now i believe that from a disk level we don't have encryption enabled but we do at volume level. When looking in the cluster settings I can see this

just wondered if anyone could give us any info on this warning we are getting and will it stop the upgrade? When running the commands in the article its coming back as though there is no problem.

[TMACMD · Accepted solution]

You don’t need to let the disks. It’s easy though

 just click the button in the GUI

 i find it should be a best practice to sync keys before upgrading 

security key-manager onboard sync

 You’ll need the output from the 

“security key-manager onboard show-backup” and your passphrase to “security key-manager onboard verify-backup” 

[NEO-BAHAMUT]

Hi TMAC!

we recently decommissioned four FAS controllers with SAS disks. The volumes on these controllers weren’t encrypted. Before decom I migrated everything to our two new controllers which we encrypted volumes. That’s not something onconfigured and weren’t sure if volume encryption was something new in the new controllers?

Is there any issue in us encrypting the disks? It will obviously increase the security on the data.

Is there any issue or will it disrupt client connectivity to the disks etc? I don’t really know much about this side of ONTAP.

[TMACMD]

Enabling Encryption on flash is instant. No disruption. 
you must have the onboard key manager setup and synced to all current nodes. 

if you have flash, I hope you are using aggregate encryption so as to take advantage of cross volume efficiencies. If you are only doing NetApp volume encryption then your still get efficiencies except you can’t get any cross-volume

 you can check with

 volume show -fields encryption-type 

volume = nve

aggregate = nae

none = no encryption

[NEO-BAHAMUT]

Hi TMAC, just to confirm - yes we are using Aggregate encryption.

So going forward, would you suggest we make sure keys are all in sync (i think they are), and also Rekey them to remove the warning?