desert crystal
Hello,
As provided in this doc: https://docs.netapp.com/us-en/ontap/encryption-at-rest/configure-netapp-volume-encryption-concept.html#support-details newly created aggregates and volumes are encrypted by default when you add a volume encryption (VE) license and have an onboard or external key manager configured.
Do you know how to disable this default behavior, and activate encryption only when needed for new volumes ?
gloomy belfry
If your aggregates have the “encrypt with aggregate key” option enabled, you have no choice. New volumes by default will have NAE. You can specify in the command line when making the volume to use NVE instead but it will still be encrypted. Any volume on an encryption enabled aggregate must be encrypted
If your aggregates do not have the encrypt with aggregate key enabled then the default will be to encrypt using NVE. You can override this on the command line with I think “-encrypt false”
desert crystal
Thank you for your response, one of my colleges has found an option to disable default encryption: https://kb.netapp.com/on-prem/ontap/DM/Encryption/Encryption-KBs/How_to_disable_default_encryption_in_ONTAP__9.7
