How to securely encrypt Hyper-V VMs in Failover Cluster

bitlockerfailoverclusterhyper-v

Having TPM 1.2 installed on 2x Dell x730, what options to encrypt user and network data in Failover Cluster?
I see Windows Server 2016 allows to passthrough the TPM to the VM. https://charbelnemnom.com/2017/03/how-to-enable-virtual-tpm-vtpm-in-windows-server-2016-hyper-v-vm-hyperv-ws2016/ This allows encrypting the data on VM level. Would encryption on the host level be more useful?
According to old Microsoft's article https://technet.microsoft.com/en-us/library/cc974516.aspx , I "should use BitLocker Drive Encryption on all volumes that store VM files. This includes the VMs, virtual hard disks, configuration files, snapshots, and any VM resource, such as ISOs and VFDs."
What if I use encryption at both VM-level and Failover Cluster? What is the performance to expect low or same ?

Best Answer

  1. The performance will fall anyway. No need to double encryption.
  2. I would not recommend using TrueCrypt fork-outs.
  3. Configuring BitLocker on Cluster Shared Volumes does the job.
Related Topic