Encrypting volume data with LVE | ONTAP

Enabling aggregate-level encryption with LVE license
Starting with ONTAP 9.7, newly created aggregates and volumes are encrypted by default when you have the LVE license and onboard or external key management. Starting with ONTAP 9.6, you can use aggregate-level encryption to assign keys to the containing aggregate for the volumes to be encrypted. Volumes you create in the aggregate are encrypted by default. You can override the default when you encrypt the volume.

Enabling encryption on a new volume
You can use the volume create command to enable encryption on a new volume.

Enabling encryption on an existing volume with the volume encryption conversion start command
You can use the volume encryption conversion start command to enable encryption of an existing volume "in place," without having to move the volume to a different location.

Enabling encryption on an existing volume with the volume move start command
You can use the volume move start command to enable encryption by moving an existing volume. You can use the same aggregate or a different aggregate.

Enabling node volume encryption
Beginning in ONTAP 9.8, you can use Lenovo Volume Encryption to protect the root volume of your node.