Skip to main content

Set up TLS secure channel for NVMe/TCP

Contributors netapp-mwallis netapp-aaron-holt netapp-bhouser
PDFs

Beginning with ONTAP 9.16.1, you can configure TLS secure channel for NVMe/TCP connections. You can use System Manager or the ONTAP CLI to either add a new NVMe subsystem with TLS enabled, or enable TLS for an existing NVMe subsystem. ONTAP does not support TLS hardware offload.

System Manager

Beginning with ONTAP 9.16.1, you can use System Manager to configure TLS for NVMe/TCP connections while creating or updating an NVMe subsystem, creating or cloning NVMe namespaces, or adding consistency groups with new NVMe namespaces.

Steps

  1. In System Manager, click Hosts > NVMe Subsystem and then click Add.

  2. Add the NVMe subsystem name, and select the storage VM and host operating system.

  3. Enter the Host NQN.

  4. Select Require Transport Layer Security (TLS) next to the Host NQN.

  5. Provide the pre-shared key (PSK).

  6. Click Save.

  7. To verify that TLS secure channel is enabled, select System Manager > Hosts > NVMe Subsystem > Grid > Peek view.

CLI
Steps

  1. Add an NVMe subsystem host that supports TLS secure channel. You can provide a pre-shared key (PSK) using the tls-configured-psk argument:

    vserver nvme subsystem host add -vserver <svm_name> -subsystem <subsystem> -host-nqn <host_nqn> -tls-configured-psk <key_text>

  2. Verify that the NVMe subsystem host is configured for TLS secure channel. You can optionally use the tls-key-type argument to only display hosts that are using that key type:

    vserver nvme subsystem host show -vserver <svm_name> -subsystem <subsystem> -host-nqn <host_nqn> -tls-key-type {none|configured}

  3. Verify that the NVMe subsystem host controller is configured for TLS secure channel. You can optionally use any of the tls-key-type, tls-identity, or tls-cipher arguments to only display the controllers that have those TLS attributes:

    vserver nvme subsystem controller show -vserver <svm_name> -subsystem <subsystem> -host-nqn <host_nqn> -tls-key-type {none|configured} -tls-identity <text> -tls-cipher {none|TLS_AES_128_GCM_SHA256|TLS_AES_256_GCM_SHA384}
Related information