With VE, both metadata and data (including Snapshot copies) are encrypted. Access to the data is given by a unique XTS-AES-256 key, one per volume. An external key management server or Onboard Key Manager (OKM) serves keys to nodes:

Aggregate and volume encryption is enabled by default if you have a volume encryption (VE) license and use an onboard or external key manager. The VE license is included with ONTAP One. Whenever an external or onboard key manager is configured there is a change in how the encryption of data at rest is configured for brand new aggregates and brand new volumes. Brand new aggregates will have Aggregate Encryption (AE) enabled by default. Brand new volumes that are not part of an AE aggregate will have Volume Encryption (VE) enabled by default. If a data storage virtual machine (SVM) is configured with its own key-manager using multi-tenant key management, then the volume created for that SVM is automatically configured with VE.

You can enable encryption on a new or existing volume. VE supports the full range of storage efficiency features, including deduplication and compression. Beginning with ONTAP 9.14.1, you can enable VE on existing SVM root volumes.

You can use VE on any type of aggregate (HDD, SSD, hybrid, array LUN), with any RAID type, and in any supported ONTAP implementation. You can also use VE with hardware-based encryption to “double encrypt” data on self-encrypting drives.

When VE is enabled, the core dump is also encrypted.

Ordinarily, every encrypted volume is assigned a unique key. When the volume is deleted, the key is deleted with it.

You can use Aggregate Encryption (AE) to assign keys to the containing aggregate for the volumes to be encrypted. When an encrypted volume is deleted, the keys for the aggregate are preserved. The keys are deleted if the entire aggregate is deleted.

You must use aggregate-level encryption if you plan to perform inline or background aggregate-level deduplication. Aggregate-level deduplication is otherwise not supported by VE.

Aggregate and volume encryption is enabled by default if you have a volume encryption (VE) license and use an onboard or external key manager.

VE and AE volumes can coexist on the same aggregate. Volumes encrypted under aggregate-level encryption are AE volumes by default. You can override the default when you encrypt the volume.

You can use the volume move command to convert an VE volume to an AE volume, and vice versa. You can replicate an AE volume to an VE volume.

You cannot use secure purge commands on an AE volume.

Although it is less expensive and typically more convenient to use the onboard key manager, you should set up KMIP servers if any of the following are true:

The scope of external key management determines whether key management servers secure all the SVMs in the cluster or selected SVMs only:

You can use both scopes in the same cluster. If key management servers have been configured for an SVM, ONTAP uses only those servers to secure keys. Otherwise, ONTAP secures keys with the key management servers configured for the cluster.

The following table shows VE support details: