Encryption of data in transit - FSx for ONTAP

Encryption of data in transit

Encryption of data in transit is supported on file shares that are mapped on a compute instance that supports SMB protocol 3.0 or newer. This includes all Microsoft Windows versions starting from Windows Server 2012 and Windows 8. When enabled, FSx for ONTAP automatically encrypts data in transit using SMB encryption as you access your file system without the need for you to modify your applications.

SMB encryption uses AES-128-GCM or AES-128-CCM (with the GCM variant being chosen if the client supports SMB 3.1.1) as its encryption algorithm, and also provides data integrity with signing using SMB Kerberos session keys. The use of AES-128-GCM leads to better performance, for example, up to a 2x performance improvement when copying large files over encrypted SMB connections.

You use the NetApp ONTAP CLI to manage the encryption in transit settings on FSx for ONTAP SVMs and volumes. To access the NetApp ONTAP CLI, establish an SSH session on the SVM on which you are making encryption in transit settings, as described in Managing SVMs using the NetApp ONTAP CLI.

Enable SMB encryption of data in transit

By default, when you create an SVM, SMB encryption is turned off. You can either enable SMB encryption required on individual shares, or on an SVM, which turns it on for all shares on that SVM.

Note

When SMB encryption required is enabled on an SVM or share, SMB clients that do not support encryption cannot connect to that SVM or share.

To require SMB encryption for incoming SMB traffic on an SVM

Use the following procedure to require SMB encryption on a SVM using the NetApp ONTAP CLI.

  1. Establish a secure shell (SSH) connection to the SVM's management endpoint as described in Managing SVMs using the NetApp ONTAP CLI.

  2. Use the following NetApp ONTAP CLI command to require SMB encryption for incoming SMB traffic to the SVM.

    vserver cifs security modify -vserver vserver_name -is-smb-encryption-required true
  3. To stop requiring SMB encryption for incoming SMB traffic, use the following command.

    vserver cifs security modify -vserver vserver_name -is-smb-encryption-required false
  4. To see the current is-smb-encryption-required setting on an SVM, use the following NetApp ONTAP CLI command:

    vserver cifs security show -vserver vs1 -fields is-smb-encryption-required vserver is-smb-encryption-required -------- ------------------------- vs1 true

For more information about managing SMB encryption on an SVM, see Configuring required SMB encryption on SMB servers for data transfers over SMB in the NetApp ONTAP Documentation Center.

To enable SMB encryption on a volume

Use the following procedure to enable SMB encryption on a share using the NetApp ONTAP CLI.

  1. Establish a secure shell (SSH) connection to the SVM's management endpoint as described in Managing SVMs using the NetApp ONTAP CLI.

  2. Use the following NetApp ONTAP CLI command to create a new SMB share and require SMB encryption when accessing this share.

    vserver cifs share create -vserver vserver_name -share-name share_name -path share_path -share-properties encrypt-data

    For more information, see vserver cifs share create in the NetApp ONTAP CLI Command man pages.

  3. To require SMB encryption on an existing SMB share, use the following command.

    vserver cifs share properties add vserver_name -share-name share_name -share-properties encrypt-data

    For more information, see vserver cifs share create in the NetApp ONTAP CLI Command man pages.

  4. To turn off SMB encryption on an existing SMB share, use the following command.

    vserver cifs share properties remove -vserver vserver_name -share-name share_name encrypt-data

    For more information, see vserver cifs share properties remove in the NetApp ONTAP CLI Command man pages.

  5. To see the current is-smb-encryption-required setting on an SMB share, use the following NetApp ONTAP CLI command:

    vserver cifs share properties show -vserver vserver_name -share-name -fields encrypt-data

    For more information, see vserver cifs share properties show in the NetApp ONTAP CLI Command man pages.