VMware Cloud Foundation 4.5

5.2 5.1 5.0 4.5
Deutsch Français Italiano 日本語 English

Configure vSAN Data-At-Rest and Data-In-Transit Encryption from the vSphere Client

You activate vSAN Data-At-Rest encryption and Data-In-Transit encryption on the vSAN cluster. You can choose Native Key Provider to enable vSAN Encryption or you must set up an external Key Management Server (KMS) and establish a trusted connection between vCenter Server and the KMS.
  • Do not deploy external KMS server on the same vSAN datastore that you plan to encrypt.
  • You cannot encrypt a witness host. The witness host in a stretched cluster does not participate in vSAN encryption. Only metadata is stored on the witness host.
For more information, see vSAN Data-At-Rest Encryption and vSAN Data-In-Transit Enctyption in the vSAN product documentation.
  1. In a Web browser, log in to your vCenter Server by using the vSphere Client.​
    Setting
    Value
    URL
    https:/
    /management-domain-vcenter-server-fqdn
    /ui​​​
    User name​
    administrator@vsphere.local​
  2. VMW-vSAN-00183
     Activate data at rest encryption on the vSAN cluster.
    1. In the
      Hosts and Clusters
       inventory, select the vSphere cluster that uses vSAN as storage.
    2. Click the
      Configure
       tab and under
      vSAN
      , click
      Services
      .
    3. Click the Data Services
      Edit
       button.
    4. In the
      vSAN Services
       dialog box, activate the toggle switch of
      Data-At-Rest encryption
      , select a Native Key Provider or external KMS cluster, and click
      Apply
      .
    5. Repeat the procedure by selecting the vSphere cluster for the VI workload domain.
  3. VMW-vSAN-00184
     Activate data in transit encryption on the vSAN cluster.
    1. In the
      Hosts and Clusters
       inventory, select the vSphere cluster that uses vSAN as storage.
    2. Click the
      Configure
       tab and under
      vSAN
      , click
      Services
      .
    3. Click the Data Services
      Edit
       button.
    4. In the
      vSAN Services
       dialog box, activate the toggle switch of
      Data-In-Transit encryption
      , configure rekey interval and click
      Apply
      .
    5. Repeat the procedure by selecting the vSphere cluster for the VI workload domain.

Content feedback and comments