First, enable a key manager

Then convert all data volumes to NVE

volume encrypt start …. 

After that, be sure any svm root volumes have been moved to the same aggregate. 

Then convert the aggregates without the svm to NAE -> aggregate modify -aggregate xx -encrypt

Move the svm root

Vol move start -volume svmroot -dest aggr-nae -encrypt-with-aggr-key true 

Encrypt the last aggregate

Now convert all the volumes to nae:

Vol move start -Vol xx -dest same-as-source -encrypt-with-aggr-key true

If you do not do the last step, you will not have full NAE. There is a kb about this as well