What is the default rekey interval for vSAN data-in-transit encryption on the VxRail Cluster?

VxRail leverages VMware vSAN for its software-defined storage. The vSAN data-in-transit encryption feature secures data traffic between hosts within the cluster. To maintain security, vSAN periodically generates new encryption keys for this traffic. The default interval for this rekeying operation is set to 24 hours, which is equivalent to 1 day. While this interval is configurable, the out-of-the-box default is 24 hours.

B. 6 hours: This is a valid configurable interval but is not the default setting for vSAN data-in-transit encryption.

C. 7 days: This is an incorrect value; the default interval is much shorter to ensure a higher security posture.

D. 12 hours: This is another possible configurable value but does not represent the default rekeying period.

1. VMware vSAN 8.0 Security Guide

Chapter 3

"Data-in-Transit Encryption". The document states

"vSAN generates new keys and rekeys the hosts periodically. The default rekey interval is 24 hours. You can configure the rekeying interval."

2. Dell VxRail™ 7.0.x Security Configuration Guide

Page 28

Section "Data-in-transit encryption". The guide specifies

"The rekey interval is configurable

with a default of 24 hours."

3. VMware vSphere 7.0 Documentation

"Administering VMware vSAN"

Section "Enable Data-in-Transit Encryption". This section confirms

"The default rekey interval is 24 hours."