Release notes
Migrate ONTAP data encryption keys between key managers on your ASA r2 system
Suggest changes
PDFs
You can manage your data encryption keys using either the ONTAP onboard key manager on your ASA r2 system or an external key manager (or both). External key managers can only be enabled at the storage VM level. At the ONTAP cluster level, you can enable either the onboard key manager or an external key manager.
| If you enable your key manager at the… | You can use… |
|---|---|
Cluster level only |
Either the onboard key manager or an external key manager |
SVM level only |
An external key manager only |
Both the cluster and SVM level |
One of the following key manager combinations:
|
Migrate keys between key managers at the ONTAP cluster level
Beginning with ONTAP 9.16.1 you can use the ONTAP command line interface (CLI) to migrate keys between key managers at the cluster level.
-
Set the privilege level to advanced:
-
Create an inactive external key manager configuration:
-
Switch to the external key manager:
-
Delete the onboard key manager configuration:
-
Set the privilege level to admin:
Migrate keys between key managers across ONTAP cluster and storage VM levels
You can use the ONTAP command line interface (CLI) to migrate keys between the key manager at the cluster level and a key manager at the storage VM level.
-
Set the privilege level to advanced:
-
Migrate the keys:
-
Set the privilege level to admin:
