Skip to main content

Encrypt data at rest on ASA r2 storage systems

Contributors netapp-aherbin
PDFs

When you encrypt data at rest, it can’t be read if a storage medium is repurposed, returned, misplaced, or stolen. You can use ONTAP System Manager to encrypt your data at the hardware and software level for dual-layer protection.

NetApp Storage Encryption (NSE) supports hardware encryption using self-encrypting drives (SEDs). SEDs encrypt data as it is written. Each SED contains a unique encryption key. Encrypted data stored on the SED can’t be read without the SED's encryption key. Nodes attempting to read from an SED must be authenticated to access the SED's encryption key. Nodes are authenticated by obtaining an authentication key from a key manager, then presenting the authentication key to the SED. If the authentication key is valid, the SED will give the node its encryption key to access the data it contains.

Use the ASA r2 onboard key manager or an external key manager to serve authentication keys to your nodes.

In addition to NSE, you can also enable software encryption to add another layer of security to your data.

Steps

  1. In System manager, select Cluster > Settings.

  2. In the Security section, under Encryption, select Configure.

  3. Configure the key manager.

    Option Steps

    Configure the Onboard key Manager

    1. Select Onboard Key Manager to add the key servers.

    2. Enter a passphrase.

    Configure an external key manager

    1. Select External key manager to add the key servers.

    2. Select a blue plus sign followed by the word add to add the key servers.

    3. Add the KMIP server CA certificates.

    4. Add the KMIP client certificates.

  4. Select Dual-layer encryption to enable software encryption.

  5. Select Save.

What's next?

Now that you have encrypted your data at rest, if you are using the NVMe/TCP protocol, you can encrypt all the data sent over the network between your NVMe/TCP host and your ASA r2 system.

If you need to switch from the onboard key manager to an external key manager or vice versa, see Migrate ONTAP data encryption keys between key managers.