toasters November 2014

toasters@lists.teaparty.net

33 participants
18 discussions

cDOT security best practise reference?
by Martin 01 Apr '15

01 Apr '15

Hi, I've recently written a Netapp security policy for 7-mode Ontap. I used the TRs for reference: Data ONTAP Security Guidance - TR-3950 (November 2011) PCI-DSS Version 2.0 and Data ONTAP 8.1 TR-3996 (August 2012) Both of these are fairly old and not specific to cDOT. I've seen TR-4191 but that is specific to Windows File services: TR-4191 - Best Practices Guide for Clustered Data ONTAP 8.2.x Windows File Services Does anyone know of any best practise documents for cDOT whether Netapp or otherwise? Thanks Martin -- View this message in context: http://network-appliance-toasters.10978.n7.nabble.com/cDOT-security-best-pr… Sent from the Network Appliance - Toasters mailing list archive at Nabble.com.

9 13

FCP Ports operational down
by Alexander Griesser 28 Nov '14

28 Nov '14

Hi there, I'm having a hard time currently connecting my new FAS8020 to our existing fabric - the FCP ports just won't get online and I'm not sure where exactly the problem is and how to debug that since I'm more the NAS guy not having much practical experience with FCP configurations, so here's the deal for all of you who are wanting to help. FAS8020 Clustered Data Ontap 8.2.1 Brocade DS4900B Brocade Switchport: > portcfgshow 0 Area Number: 0 Speed Level: AUTO(HW) Fill Word: 0(Idle-Idle) AL_PA Offset 13: OFF Trunk Port ON Long Distance OFF VC Link Init OFF Locked L_Port OFF Locked G_Port OFF Disabled E_Port OFF Locked E_Port OFF ISL R_RDY Mode OFF RSCN Suppressed OFF Persistent Disable OFF LOS TOV enable OFF NPIV capability ON QOS E_Port OFF Port Auto Disable: OFF Mirror Port OFF F_Port Buffers OFF Fault Delay: 0(R_A_TOV) NPIV PP Limit: 126 > portshow 0 portIndex: 0 portName: portHealth: OFFLINE Authentication: None portDisableReason: None portCFlags: 0x1 portFlags: 0x1 PRESENT U_PORT LocalSwcFlags: 0x0 portType: 10.0 POD Port: Port is licensed portState: 2 Offline Protocol: FC portPhys: 4 No_Light portScn: 0 port generation number: 0 state transition count: 0 portId: 010000 portIfId: 4302100d portWwn: 20:00:00:05:1e:5b:f9:a3 portWwn of device(s) connected: Distance: normal portSpeed: N4Gbps LE domain: 0 FC Fastwrite: OFF Interrupts: 2 Link_failure: 0 Frjt: 0 Unknown: 0 Loss_of_sync: 0 Fbsy: 0 Lli: 2 Loss_of_sig: 2 Proc_rqrd: 5 Protocol_err: 0 Timed_out: 0 Invalid_word: 0 Rx_flushed: 0 Invalid_crc: 0 Tx_unavail: 0 Delim_err: 0 Free_buffer: 0 Address_err: 0 Overrun: 0 Lr_in: 0 Suspended: 0 Lr_out: 0 Parity_err: 0 Ols_in: 0 2_parity_err: 0 Ols_out: 0 CMI_bus_err: 0 Port part of other ADs: No FCP Adater on NetApp: Node: jetfire Adapter: 1b Description: Fibre Channel Target Adapter 1b (QLogic 8324 (8362), rev. 2, 16G) Physical Protocol: fibre-channel Maximum Speed: 16 Status: link not connected Substatus: ADAPTER UP Host Port Address: 0 Firmware Revision: 6.10.0 Data Link Rate (Gbit): 0 Fabric Established: false Connection Established: loop Mediatype: ptp Configured Speed: 4 Configured State: up Switch Port: : AFAIK, the 16Gbit/s adapter should be backwards compatible to 4Gbit/s, our switch only has 4Gbit/s but it supports NPIV which seems to be a requirement for running Clustered Data Ontap via FC. So, I have no idea what information I should provide upfront for someone who's wanting to help me through get through that, but I'm more than happy to send more info when requested. Thanks, Alexander Griesser System-Administrator ANEXIA Internetdienstleistungs GmbH Telefon: +43-5-0556-320 Telefax: +43-5-0556-500 E-Mail: ag(a)anexia.at<mailto:ag@anexia.at> Web: http://www.anexia.at<http://www.anexia.at/> Anschrift Hauptsitz Klagenfurt: Feldkirchnerstraße 140, 9020 Klagenfurt Geschäftsführer: Alexander Windbichler Firmenbuch: FN 289918a | Gerichtsstand: Klagenfurt | UID-Nummer: AT U63216601

9 30

NDMPcopy on 7.3.4p4
by Basil 28 Nov '14

28 Nov '14

Hey folks, I have an old filer that I can't do a firmware upgrade on (it's being replaced in the next 6 months) where I need to move data from a qtree to its own volume. I would like to investigate the ndmpcopy command for this, however when I do this, the one CLI interactive session that the filer has is taken up. We can't do any more interactive commands on the filer, and if we press ctrl-c, the ndmpcopy is killed. I don't want to test this on my prod box and my nonprod boxes are all running newer firmware, but does anyone know whether we can kick off an ndmpcopy using a non-interactive command? Would we be able to cancel it after starting it? Thanks, Basil

2 2

How widely is the MetroCluster construct used outside the DACH region?
by Strauss Wolfram 26 Nov '14

26 Nov '14

NetApp MetroCluster, and the SyncMirror component in particular, is a construct mainly demanded by companies in the DACH region, as I was told by NetApp. We are a Swiss company and our management often demands synchronous data replication between two datacenters on the storage level, hence we have quite a couple of MetroClusters running. How many of you outside the DACH region are using MetroClusters? And for those who don't, how do you deal with synchronous replication of data? Do you solve the problem on higher layers (OS, application, etc.) or are your requirements simply less strict, so that e.g. snapmirror asnyc is sufficient? Wolfram

5 5

CDOT alternative to 7-mode netbios alias
by Kevin Richards 26 Nov '14

26 Nov '14

Hi, Looks like NetBIOS aliases are no longer supported with CDOT. What recommendations do people have to consolidate many different Windows file servers to a new CDOT cluster? Thank you. Kevin

5 4

Need Working Nexus 7000 Config for cDOT - 2 scenarios
by Bob McKim 25 Nov '14

25 Nov '14

Hi toasters, I'm looking for a working Nexus 7000 config for the following 2 scenarios - Single mode 10g ifgrp (2 interfaces) with 2 vlans 2 switch vPC for a two interface 10g ifgrp with 2 vlans If we bring the single mode ifgrp (e0b and e0d) up with no vlan tagging, it works fine for each sub-net. As soon as we add vlan tagging on cluster nodes, we can't ping the gateways. Require the vlan tagging to support our failover groups. This is what we tried on the Cisco for the single mode with 2 vlans - no dice. config t interface Ethernet1/14 description <<xxx>> switchport mode trunk switchport trunk native vlan 26 switchport trunk allowed vlan 26, 28 no shutdown Thanks in advance, Bob McKim Senior IT Specialist IBM Global Technology Services NetApp Certified Professional Although no hardware was injured in the creation of this note, a few billion electrons and photons were utilized against their will.

5 5

NetApp 3170 and drive array ds14_NOT_mk2??
by CH 22 Nov '14

22 Nov '14

So I seem to be the place old NetApps go to die locally. This one is a v3170 which powers up fine but this drive array (DS14 version 1?) is a bit puzzling because documentation is hard to find. The person that brought it to me just provided the black (termination?) cables but wasn’t sure if they are hooked up right. Also it looks like i have two different types of fiber between the drive shelves and 3170,(SC and LC?) so not completely sure these really went together in their previous lives in production. (would this cable connect them? http://www.ebay.com/itm/271651441657?_trksid=p2060778.m1438.l2649&ssPageNam…) Any ideas? https://plus.google.com/photos/107454380334199416485/albums/608198030151578…

6 10

Domain trust
by Camillo Gornati 12 Nov '14

12 Nov '14

Hello all! Is it possible to map users on a different domain on a netapp CIFS? Maybe using domain trusts? We are starting migrating data from domain A to domain B, but after data migration, users will also be moved to a difference domain... Sent using morse code!

2 1

Subsecond Timestamps?
by Steven Kreuzer 12 Nov '14

12 Nov '14

Did NetApp add sub second timestamps? I had a conversation with a NetApp engineer in 2011 saying that it won't be possible to add support for subsecond timestamps in nfsv3. However, if I stat a file via nfs on a filer running 8.1.2 I appear to be getting something back steven@warthog1:~ $ python -c "import os; print '%.6f' % os.stat('foo').st_mtime" 1415818448.392293

1 0

cdot NFS exports
by Iluhes 12 Nov '14

12 Nov '14

Hi toasters, NFS export in CDOT (ouch) I understand I have to have a default policy and a rule.. 1. Must it have 0.0.0.0/0 read only? What if I dont want to give read-only to entire name space to all clients? 2. Qtrree exports: can I restrict qtree A to host A, and qtree B to host B, but then what about volume and it is policy? Can qtree be more restrictive than volume (and why dont qtree show up in GUI?) 3. Does showmount -e LIF of NFS filer still produce good information. It does not look like, so how do I check what my exports are? 4. What does it buy me with qtree exports, what? If I have to give access to server A and B to volume that has qtree A and B

3 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters November 2014