Online volume encryption at rest

Volume Manager (VxVM) provides the online volume encryption at rest feature that lets you migrate unencrypted volumes to encrypted ones. Using this feature a volume can be migrated without application downtime, that is, while the file system is mounted and the I/Os are running. It also avoids complexities, like having to modify application configurations, and has a controlled impact on the application I/O performance.

The online migration process involves mirroring the existing storage configured under a volume, which requires an equal amount of additional storage that gets used in the background.

Online migration involves the Start phase, in which the process is initiated, and the Commit phase, in which the background changes made to the volume are finalized. The unencrypted volume is migrated to an encrypted one when both these phases are completed successfully.

After the Start phase is complete and before you can initiate the Commit phase, you can abort the migration or switch plexes. The switching of reads between the source (unencrypted) plex and the target (unencrypted) plex helps verify the data copied during the Start phase. Meanwhile, the writes continue to happen on both the plexes.

Limitations:

You can use either the VEA GUI or VxVM commands to migrate unencrypted volumes to encrypted ones. For details, refer to the Storage Foundation Administrator's Guide - Windows.

Alternatively, you can use the Management Server console of InfoScale Operations Manager. For details, refer to the InfoScale Operations Manager User's Guide.