Skip to main content

Delete existing external key management server connections before upgrading ONTAP

Contributors netapp-barbe netapp-aaron-holt netapp-dbagwell
PDFs

Before you upgrade ONTAP, if you are running ONTAP 9.2 or earlier with NetApp Storage Encryption (NSE) and upgrading to ONTAP 9.3 or later, you must use the command line interface (CLI) to delete any existing external key management (KMIP) server connections.

Steps

  1. Verify that the NSE drives are unlocked, open, and set to the default manufacture secure ID 0x0:

    storage encryption disk show -disk *

    Learn more about storage encryption disk show in the ONTAP command reference.

  2. Enter the advanced privilege mode:

    set -privilege advanced

    Learn more about set in the ONTAP command reference.

  3. Use the default manufacture secure ID 0x0 to assign the FIPS key to the self-encrypting disks (SEDs):

    storage encryption disk modify -fips-key-id 0x0 -disk *

    Learn more about storage encryption disk modify in the ONTAP command reference.

  4. Verify that assigning the FIPS key to all disks is complete:

    storage encryption disk show-status

    Learn more about storage encryption disk show-status in the ONTAP command reference.

  5. Verify that the mode for all disks is set to data

    storage encryption disk show

    Learn more about storage encryption disk show in the ONTAP command reference.

  6. View the configured KMIP servers:

    security key-manager keystore show

    Learn more about security key-manager keystore show in the ONTAP command reference.

  7. Delete the configured KMIP servers:

    security key-manager delete -address <kmip_ip_address>

    Learn more about security key-manager delete in the ONTAP command reference.

  8. Delete the external key manager configuration:

    security key-manager external disable

    Learn more about security key-manager external disable in the ONTAP command reference.

    Note This step does not remove the NSE certificates.
What's next

After the upgrade is complete, you must reconfigure the KMIP server connections.