Lenovo ThinkSystem DM3010H - Check LVE or LSE on Systems Running ONTAP 9.6 and Later; Verify LVE Configuration

2.
If AutoSupport is enabled, suppress automatic case creation by invoking an AutoSupport
message:
system node autosupport invoke -node * -type all -message
MAINT=number_of_hours_downh
The following AutoSupport message suppresses automatic case creation for two hours:
cluster1:*> system node autosupport invoke -node * -type all -message MAINT=2h
3.
Check the version of ONTAP the system is running on the impaired controller if up, or on the
partner controller if the impaired controller is down, using the
version -v command:
◦ If <lno-DARE> or <1Ono-DARE> is displayed in the command output, the system does not
support LVE, proceed to
Shut down the impaired controller - DM3010H.
◦ If <lno-DARE> or <1Ono-DARE> is not displayed in the command output, and the system is
running ONTAP 9.6 or later, continue to the next section,
Check LVE or LSE on systems
running ONTAP 9.6 and later.
4.
Disable automatic giveback from the healthy controller:
storage failover modify -node local
-auto-giveback false or storage failover modify -node local -auto-giveback-after-panic
false
Check LVE or LSE on systems running ONTAP 9.6 and later
Before shutting down the impaired controller, you need to verify whether the system has either
Lenovo Volume Encryption (LVE) or Lenovo Storage Encryption (LSE) enabled. If so, you need to
verify the configuration.
1.
Verify whether LVE is in use for any volumes in the cluster:
volume show -is-encrypted true
If any volumes are listed in the output, LVE is configured and you need to verify the LVE
configuration. If no volumes are listed, check whether LSE is configured and in use.
2.
Verify whether LSE is configured and in use:
storage encryption disk show
◦ If the command output lists the drive details with Mode & Key ID information, LSE is
configured and you need to verify the LSE configuration and in use.
◦ If no disks are shown, LSE is not configured.
◦ If LVE and LSE are not configured, no drives are protected with LSE keys, it’s safe to shut
down the impaired controller.
Verify LVE configuration
1.
Display the key IDs of the authentication keys that are stored on the key management servers:
security key-manager key query

After the ONTAP 9.6 release, you may have additional key manager types.
The types are KMIP, AKV, and GCP. The process for confirming these types is
the same as confirming
external or onboard key manager types.
◦ If the Key Manager type displays external and the Restored column displays yes, it’s safe to
31