Buy LTO4 or IBM TS1120/TS1130 tape drives which do hardware encryption and have minimal impact on performance and use KMS (NetBackup) or EKM/TKLM (IBM) for key management.

The alternatives - ie encrypt on the host before sending to tape or using NetBackup MSEO (Media Server Encryption Option)  - can prove to be restrictively time consuming if you have a lot of data.

Media Server Encryption Option works fine, you can specify which copy, policy and pool is encrypted.
You have central server which stores policies and encryption keys and plugin for Media Server which install special tape drivers.
You can't manage MSEO from NB console, it's a product of Vormetric, but configuration in simple.. stored in text files.

Hi Almir

    Tape encryption has not supported in NBU,only it supports data encryption.This is i confirm from Symantec Support.

May be this document could help you.

ftp://exftpp.symantec.com/pub/support/products/NetBackup_Enterprise_Server/302438.pdf

Hi

Also you can encrypt your data using the fololowing cmd

 first   U Want  to run bpinst -ENCRYPTION <Client Name> From the master server

Then Run the bpkeyutil -clients <Client Name> from the client .

Thanks