How to Enable NetApp Encryption: A Step-by-Step Guide to OKM and EKM

In today's security landscape, protecting data at rest is not just a best practice—it's often a regulatory requirement. NetApp provides robust encryption capabilities within ONTAP to ensure that if physical disks are stolen or repurposed, your data remains unreadable.

In this guide, we will explore the two primary methods of managing encryption keys in NetApp ONTAP: the Onboard Key Manager (OKM) and the External Key Manager (EKM).

Understanding NetApp Encryption Types

Before diving into key management, it's important to distinguish between the two types of software-based encryption:

1. NetApp Volume Encryption (NVE): Encrypts data at the volume level. This allows for granular control and is the most common implementation.
2. NetApp Aggregate Encryption (NAE): Encrypts the entire aggregate. Newer ONTAP versions often have NAE enabled by default for new aggregates.

Method 1: Onboard Key Manager (OKM)

The Onboard Key Manager is the simplest way to get started. It stores the encryption keys directly on the ONTAP cluster, managed by the cluster administrator.

When to use OKM?

• Smaller environments.
• Scenarios where a separate key management server is not available or required.
• Quick deployments.

Licenses Needed

For most modern ONTAP systems, the base functionality of NVE is included, but ensure you have the NetApp Volume Encryption (VE) license if you are applying encryption to existing aggregates or specific legacy setups. In some cases a TPM licenses is needed depending on your hardware.

Step-by-Step Configuration

1. Enable the Onboard Key Manager Run the following command from the cluster management CLI:

security key-manager onboard enable

Note: You will be prompted to create a cluster passphrase. Store this securely; it is required for recovery.

2. Sync OKM (Required after adding new nodes) Whenever you add a new node to your cluster, you must synchronize the key manager:

security key-manager onboard sync

3. Verify the Status Check if the key manager is active:

security key-manager show

4. Enable Encryption on a Volume To encrypt a new volume, simply use the -encryption true parameter during creation:

volume create -vserver <vserver_name> -volume <vol_name> -aggregate <aggr_name> -encryption true

Method 2: External Key Manager (EKM)

For enterprise environments, the External Key Manager allows you to offload key management to a dedicated third-party server using the Key Management Interoperability Protocol (KMIP).

When to use EKM?

• High-compliance environments (PCI-DSS, HIPAA, GDPR).
• Organizations with a centralized security policy for all storage assets.
• Requirements for strict separation of duties between storage admins and security admins.

Licenses Needed

Like OKM, EKM utilizes the NetApp Volume Encryption (VE) license. Additionally, you will need a license for your chosen KMIP-compliant server (e.g., Thales, Entrust, Fortanix).

Step-by-Step Configuration

Configuring EKM is more complex as it requires coordination with your external key server.

1. Prepare the External KMIP Server Ensure your KMIP server is reachable from the ONTAP cluster management interfaces and that a client registration has been created for the cluster.

2. Enable External Key Management Run the enable command with the specific details of your KMIP server:

security key-manager external enable -server <kmip_server_ip> -port <port_number>

(Depending on the ONTAP version, you may need to provide additional parameters for certificates or authentication keys).

3. Verify Connection Ensure the cluster can communicate with the external manager:

security key-manager show

The status should indicate that the external manager is connected or online.

4. Enable Encryption on a Volume The volume creation command remains the same as with OKM:

volume create -vserver <vserver_name> -volume <vol_name> -aggregate <aggr_name> -encryption true

The cluster will now request the encryption key from the EKM server instead of using the internal database.

Comparison: OKM vs. EKM

Summary Checklist

• Identify if you need Volume (NVE) or Aggregate (NAE) encryption.
• Verify VE License is active.
• Choose OKM for simplicity or EKM for centralized security.
• Execute security key-manager commands.
• Test volume creation with -encryption true.

Official Resources

For more detailed information, refer to the official NetApp documentation:

• NetApp Encryption at Rest Concept Guide
• Configuring Onboard Key Management
• Configuring External Key Management