Hi all, just looking for some information, I'm trying to setup volume encryption on 1 of the new volumes I created. I completed the steps from: https://docs.netapp.com/us-en/ontap/encryption-at-rest/configure-netapp-volume-encryption-concept.html#understanding-nve
when I run: volume show -is-encrypted true; it shows the volume has been encrypted. But how can I tell if the data in this volume is encrypted?
Is there a way to enable volume access for specific group of people using the encryption key? to avoid unauthorized access
#Enabling NVE
wary stratus
tacit yacht
Have a read through this KB, from how you’ve described what you want, this doesn’t work as you think it does. https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/FAQ%3A_NetApp_Volume_Encryption_and_NetApp_Aggregate_Encryption
The keys are used by ONTAP to protect the data at rest, there is a good diagram of the workflow at the second link in overview section
wary stratus
Have a read through this KB, from how you’ve described what you want, this doesn...
Thanks Jason, I have read through this and from what I understand, it encrypts the volume. I want to enable encryption on the volume where you can only view the data if you have the passphrase, which I understand is probably not possible
tacit yacht
Yeah that’s not possible with these technologies
wary stratus
Yeah that’s not possible with these technologies
Thanks Jason, I will have another think around 🙂
tacit yacht
It’s not something I’ve done before but perhaps someone else here has some suggestions
wary stratus
Happy for others to make any suggestions if anyone has any 😃
wary stratus
Additional question, does anyone know how to disable NVE for FlexGroup volumes?
I tried:
volume move start -vserver Data -volume EncryptDrive__0001 -destination-aggregate aggr_1 -encrypt-destination false
but get the error: Changing the encryption behavior is not allowed for FlexGroup constituents.
wary stratus
ahhh got it, thanks its working from diag mode
tacit yacht
No worries, constituents are only available in diag so you have to do it there