Enabling SMB encryption of data in transit

By default, when you create an SVM, SMB encryption is turned off. You can either enable SMB encryption required on individual shares, or on an SVM, which turns it on for all shares on that SVM.

Note

When SMB encryption required is enabled on an SVM or share, SMB clients that do not support encryption cannot connect to that SVM or share.

To require SMB encryption for incoming SMB traffic on an SVM

Use the following procedure to require SMB encryption on a SVM using the NetApp ONTAP CLI.

1. To connect to the SVM management endpoint with SSH, use user name vsadmin and the vsadmin password that you set when you created the SVM. If you did not set a vsadmin password, use user name fsxadmin and the fsxadmin password. You can SSH into the SVM from a client that is in the same VPC as the file system, using the management endpoint IP address or DNS name.

   ssh vsadmin@svm-management-endpoint-ip-address

   The command with sample values:

   ssh vsadmin@198.51.100.10

   The SSH command using the management endpoint DNS name:

   ssh vsadmin@svm-management-endpoint-dns-name

   The SSH command using a sample DNS name:

   ssh [e-mail]

   Password: vsadmin-password
   
   This is your first recorded login.
   FsxIdabcdef01234567892::>
   

2. Use the vserver cifs security modify NetApp ONTAP CLI command to require SMB encryption for incoming SMB traffic to the SVM.

   vserver cifs security modify -vserver vserver_name -is-smb-encryption-required true

3. To stop requiring SMB encryption for incoming SMB traffic, use the following command.

   vserver cifs security modify -vserver vserver_name -is-smb-encryption-required false

4. To see the current is-smb-encryption-required setting on an SVM, use the vserver cifs security show NetApp ONTAP CLI command:

   vserver cifs security show -vserver vs1 -fields is-smb-encryption-required
            
   vserver  is-smb-encryption-required
   -------- -------------------------
   vs1      true

For more information about managing SMB encryption on an SVM, see Configuring required SMB encryption on SMB servers for data transfers over SMB in the NetApp ONTAP Documentation Center.

To enable SMB encryption on a volume

Use the following procedure to enable SMB encryption on a share using the NetApp ONTAP CLI.

1. Establish a secure shell (SSH) connection to the SVM's management endpoint as described in Managing SVMs with the ONTAP CLI.

2. Use the following NetApp ONTAP CLI command to create a new SMB share and require SMB encryption when accessing this share.

   vserver cifs share create -vserver vserver_name -share-name share_name -path share_path -share-properties encrypt-data

   For more information, see vserver cifs share create in the NetApp ONTAP CLI Command man pages.

3. To require SMB encryption on an existing SMB share, use the following command.

   vserver cifs share properties add -vserver vserver_name -share-name share_name -share-properties encrypt-data

   For more information, see vserver cifs share create in the NetApp ONTAP CLI Command man pages.

4. To turn off SMB encryption on an existing SMB share, use the following command.

   vserver cifs share properties remove -vserver vserver_name -share-name share_name -share-properties encrypt-data

   For more information, see vserver cifs share properties remove in the NetApp ONTAP CLI Command man pages.

5. To see the current is-smb-encryption-required setting on an SMB share, use the following NetApp ONTAP CLI command:

   vserver cifs share properties show -vserver vserver_name -share-name share_name -fields share-properties

   If one of the properties returned by the command is the encrypt-data property, then that property specifies that SMB encryption must be used when accessing this share.

   For more information, see vserver cifs share properties show in the NetApp ONTAP CLI Command man pages.