Skip to main content

Migrate ONTAP data encryption keys between key managers on ASA r2 systems

Contributors netapp-aherbin
PDFs

You can manage data encryption keys with the ONTAP onboard key manager on your ASA r2 system, an external key manager, or both in supported configurations. External key managers are supported only at the storage VM level. At the ONTAP cluster level, you can use either the onboard key manager or an external key manager.

If you enable your key manager at the…​ You can use…​

Cluster level only

Either the onboard key manager or an external key manager

Storage VM level only

An external key manager only

Both the cluster and storage VM level

One of the following key manager combinations:

  • Option 1

    Cluster level: Onboard key manager

    Storage VM level: External key manager

  • Option 2

    Cluster level: External key manager

    Storage VM level: External key manager

Migrate keys between key managers at the ONTAP cluster level

Beginning with ONTAP 9.16.1, you can use the ONTAP command line interface (CLI) to migrate keys between key managers at the cluster level.

From onboard key manager to external key manager
Steps

  1. Set the privilege level to advanced:

    set -privilege advanced

  2. Create an inactive external key manager configuration:

    security key-manager external create-config

  3. Switch to the external key manager:

    security key-manager keystore enable -vserver <storage_vm_name> -type KMIP

  4. Delete the onboard key manager configuration:

    security key-manager keystore delete-config -vserver <storage_vm_name> -type OKM

  5. Set the privilege level to admin:

    set -privilege admin
From external key manager to onboard key manager
Steps

  1. Set the privilege level to advanced:

    set -privilege advanced

  2. Create an inactive onboard key manager configuration:

    security key-manager onboard create-config

  3. Enable the onboard key manager configuration:

    security key-manager keystore enable -vserver <storage_vm_name> -type OKM

  4. Delete the external key manager configuration

    security key-manager keystore delete-config -vserver <storage_vm_name> -type KMIP

  5. Set the privilege level to admin:

    set -privilege admin

Migrate keys between key managers across ONTAP cluster and storage VM levels

You can use the ONTAP command line interface (CLI) to migrate keys between key managers at the cluster and storage VM levels.

Steps

  1. Set the privilege level to advanced:

    set -privilege advanced

  2. Migrate the keys:

    security key-manager key migrate -from-vserver <storage_vm_name> -to-vserver <storage_vm_name>

  3. Set the privilege level to admin:

    set -privilege admin