toasters November 2014

toasters@lists.teaparty.net

33 participants
18 discussions

cDOT security best practise reference?
by Martin 01 Apr '15

01 Apr '15

Hi, I've recently written a Netapp security policy for 7-mode Ontap. I used the TRs for reference: Data ONTAP Security Guidance - TR-3950 (November 2011) PCI-DSS Version 2.0 and Data ONTAP 8.1 TR-3996 (August 2012) Both of these are fairly old and not specific to cDOT. I've seen TR-4191 but that is specific to Windows File services: TR-4191 - Best Practices Guide for Clustered Data ONTAP 8.2.x Windows File Services Does anyone know of any best practise documents for cDOT whether Netapp or otherwise? Thanks Martin -- View this message in context: http://network-appliance-toasters.10978.n7.nabble.com/cDOT-security-best-pr… Sent from the Network Appliance - Toasters mailing list archive at Nabble.com.

9 13

FCP Ports operational down
by Alexander Griesser 28 Nov '14

28 Nov '14

Hi there, I'm having a hard time currently connecting my new FAS8020 to our existing fabric - the FCP ports just won't get online and I'm not sure where exactly the problem is and how to debug that since I'm more the NAS guy not having much practical experience with FCP configurations, so here's the deal for all of you who are wanting to help. FAS8020 Clustered Data Ontap 8.2.1 Brocade DS4900B Brocade Switchport: > portcfgshow 0 Area Number: 0 Speed Level: AUTO(HW) Fill Word: 0(Idle-Idle) AL_PA Offset 13: OFF Trunk Port ON Long Distance OFF VC Link Init OFF Locked L_Port OFF Locked G_Port OFF Disabled E_Port OFF Locked E_Port OFF ISL R_RDY Mode OFF RSCN Suppressed OFF Persistent Disable OFF LOS TOV enable OFF NPIV capability ON QOS E_Port OFF Port Auto Disable: OFF Mirror Port OFF F_Port Buffers OFF Fault Delay: 0(R_A_TOV) NPIV PP Limit: 126 > portshow 0 portIndex: 0 portName: portHealth: OFFLINE Authentication: None portDisableReason: None portCFlags: 0x1 portFlags: 0x1 PRESENT U_PORT LocalSwcFlags: 0x0 portType: 10.0 POD Port: Port is licensed portState: 2 Offline Protocol: FC portPhys: 4 No_Light portScn: 0 port generation number: 0 state transition count: 0 portId: 010000 portIfId: 4302100d portWwn: 20:00:00:05:1e:5b:f9:a3 portWwn of device(s) connected: Distance: normal portSpeed: N4Gbps LE domain: 0 FC Fastwrite: OFF Interrupts: 2 Link_failure: 0 Frjt: 0 Unknown: 0 Loss_of_sync: 0 Fbsy: 0 Lli: 2 Loss_of_sig: 2 Proc_rqrd: 5 Protocol_err: 0 Timed_out: 0 Invalid_word: 0 Rx_flushed: 0 Invalid_crc: 0 Tx_unavail: 0 Delim_err: 0 Free_buffer: 0 Address_err: 0 Overrun: 0 Lr_in: 0 Suspended: 0 Lr_out: 0 Parity_err: 0 Ols_in: 0 2_parity_err: 0 Ols_out: 0 CMI_bus_err: 0 Port part of other ADs: No FCP Adater on NetApp: Node: jetfire Adapter: 1b Description: Fibre Channel Target Adapter 1b (QLogic 8324 (8362), rev. 2, 16G) Physical Protocol: fibre-channel Maximum Speed: 16 Status: link not connected Substatus: ADAPTER UP Host Port Address: 0 Firmware Revision: 6.10.0 Data Link Rate (Gbit): 0 Fabric Established: false Connection Established: loop Mediatype: ptp Configured Speed: 4 Configured State: up Switch Port: : AFAIK, the 16Gbit/s adapter should be backwards compatible to 4Gbit/s, our switch only has 4Gbit/s but it supports NPIV which seems to be a requirement for running Clustered Data Ontap via FC. So, I have no idea what information I should provide upfront for someone who's wanting to help me through get through that, but I'm more than happy to send more info when requested. Thanks, Alexander Griesser System-Administrator ANEXIA Internetdienstleistungs GmbH Telefon: +43-5-0556-320 Telefax: +43-5-0556-500 E-Mail: ag(a)anexia.at<mailto:ag@anexia.at> Web: http://www.anexia.at<http://www.anexia.at/> Anschrift Hauptsitz Klagenfurt: Feldkirchnerstraße 140, 9020 Klagenfurt Geschäftsführer: Alexander Windbichler Firmenbuch: FN 289918a | Gerichtsstand: Klagenfurt | UID-Nummer: AT U63216601

9 30

NDMPcopy on 7.3.4p4
by Basil 28 Nov '14

28 Nov '14

Hey folks, I have an old filer that I can't do a firmware upgrade on (it's being replaced in the next 6 months) where I need to move data from a qtree to its own volume. I would like to investigate the ndmpcopy command for this, however when I do this, the one CLI interactive session that the filer has is taken up. We can't do any more interactive commands on the filer, and if we press ctrl-c, the ndmpcopy is killed. I don't want to test this on my prod box and my nonprod boxes are all running newer firmware, but does anyone know whether we can kick off an ndmpcopy using a non-interactive command? Would we be able to cancel it after starting it? Thanks, Basil

2 2

How widely is the MetroCluster construct used outside the DACH region?
by Strauss Wolfram 26 Nov '14

26 Nov '14

NetApp MetroCluster, and the SyncMirror component in particular, is a construct mainly demanded by companies in the DACH region, as I was told by NetApp. We are a Swiss company and our management often demands synchronous data replication between two datacenters on the storage level, hence we have quite a couple of MetroClusters running. How many of you outside the DACH region are using MetroClusters? And for those who don't, how do you deal with synchronous replication of data? Do you solve the problem on higher layers (OS, application, etc.) or are your requirements simply less strict, so that e.g. snapmirror asnyc is sufficient? Wolfram

5 5

CDOT alternative to 7-mode netbios alias
by Kevin Richards 26 Nov '14

26 Nov '14

Hi, Looks like NetBIOS aliases are no longer supported with CDOT. What recommendations do people have to consolidate many different Windows file servers to a new CDOT cluster? Thank you. Kevin

5 4

Need Working Nexus 7000 Config for cDOT - 2 scenarios
by Bob McKim 25 Nov '14

25 Nov '14

Hi toasters, I'm looking for a working Nexus 7000 config for the following 2 scenarios - Single mode 10g ifgrp (2 interfaces) with 2 vlans 2 switch vPC for a two interface 10g ifgrp with 2 vlans If we bring the single mode ifgrp (e0b and e0d) up with no vlan tagging, it works fine for each sub-net. As soon as we add vlan tagging on cluster nodes, we can't ping the gateways. Require the vlan tagging to support our failover groups. This is what we tried on the Cisco for the single mode with 2 vlans - no dice. config t interface Ethernet1/14 description <<xxx>> switchport mode trunk switchport trunk native vlan 26 switchport trunk allowed vlan 26, 28 no shutdown Thanks in advance, Bob McKim Senior IT Specialist IBM Global Technology Services NetApp Certified Professional Although no hardware was injured in the creation of this note, a few billion electrons and photons were utilized against their will.

5 5

NetApp 3170 and drive array ds14_NOT_mk2??
by CH 22 Nov '14

22 Nov '14

So I seem to be the place old NetApps go to die locally. This one is a v3170 which powers up fine but this drive array (DS14 version 1?) is a bit puzzling because documentation is hard to find. The person that brought it to me just provided the black (termination?) cables but wasn’t sure if they are hooked up right. Also it looks like i have two different types of fiber between the drive shelves and 3170,(SC and LC?) so not completely sure these really went together in their previous lives in production. (would this cable connect them? http://www.ebay.com/itm/271651441657?_trksid=p2060778.m1438.l2649&ssPageNam…) Any ideas? https://plus.google.com/photos/107454380334199416485/albums/608198030151578…

6 10

Domain trust
by Camillo Gornati 12 Nov '14

12 Nov '14

Hello all! Is it possible to map users on a different domain on a netapp CIFS? Maybe using domain trusts? We are starting migrating data from domain A to domain B, but after data migration, users will also be moved to a difference domain... Sent using morse code!

2 1

Subsecond Timestamps?
by Steven Kreuzer 12 Nov '14

12 Nov '14

Did NetApp add sub second timestamps? I had a conversation with a NetApp engineer in 2011 saying that it won't be possible to add support for subsecond timestamps in nfsv3. However, if I stat a file via nfs on a filer running 8.1.2 I appear to be getting something back steven@warthog1:~ $ python -c "import os; print '%.6f' % os.stat('foo').st_mtime" 1415818448.392293

1 0

cdot NFS exports
by Iluhes 12 Nov '14

12 Nov '14

Hi toasters, NFS export in CDOT (ouch) I understand I have to have a default policy and a rule.. 1. Must it have 0.0.0.0/0 read only? What if I dont want to give read-only to entire name space to all clients? 2. Qtrree exports: can I restrict qtree A to host A, and qtree B to host B, but then what about volume and it is policy? Can qtree be more restrictive than volume (and why dont qtree show up in GUI?) 3. Does showmount -e LIF of NFS filer still produce good information. It does not look like, so how do I check what my exports are? 4. What does it buy me with qtree exports, what? If I have to give access to server A and B to volume that has qtree A and B

3 5

Flash Pool on a 2240-2 Running 8.1.3 7-Mode
by Philbert Rupkins 11 Nov '14

11 Nov '14

Hello, We are considering the addition of a Flash Pool to our 2240 arrays. We currently run ONTAP 8.1.3 7-mode with no plans of upgrading to 8.2.x. Per the docs, 8.1.3 allows us a total Flash Pool SSD cache capacity of 400G for the entire 2240 array. We're told we can't get 100G drives so our next best option is 200G drives. The problem with using 200G drives for the Flash Pool aggregate's SSD cache is that we'll be limited to a single 200G SSD drive to be used for cache behind each 2240 controller. Why is the is a problem? Well, the Flash Pool TR and FAQ touches on the possibility of the SSD cache becoming a bottleneck. I'd imagine this is more likely with just a single 200G data disk in the RAID-DP SSD cache. What makes it more of a concern is NetApp stating that a single SSD drive is capable of roughly 5,000 IOPS (I assume at a 4K 70r/30w workload) while the 2240 is capable of 15,000+ IOPS while processing the same workload. Note: We'd like to flash pool enable both controllers in the array and the SSD cache is required to be RAID-DP as the aggregate is RAID-DP and we are running 8.1.3. My questions: Are my concerns warranted? Has anybody had good or bad experiences with Flash Pool and the 2240 arrays? Anybody running a similar configuration to what is outlined above? I'd love to hear about your experiences. Thanks, Phil

2 1

Setting Flow Control to None on Production Filers
by Philbert Rupkins 11 Nov '14

11 Nov '14

Hello, Anybody have experience setting Flow Control to none on an array (controllers) that are already being used in production? We have a number of filers that were deployed with Flow Control set to Full on the 10GE interfaces. NetApp best practices recommend setting Flow Control to none. Is it preferable to: a) Update the RC file with the Flow Control settings and do a takeover/giveback to apply the new flow control settings? b) Modify the interface Flow Control settings directly with the system up and running? Then update the RC file so those settings will persist across future takeover/givebacks? I know the interface would 'reset' and I'm not sure how long of an outage we can expect. c) Something else? Our busiest ethernet based clients are VMWare ESXi hosts with pretty busy NFS datastores. Thank you all in advance! Phil

5 5

"Sensitive data" storage needs
by Michael Garrison 10 Nov '14

10 Nov '14

We currently offer a NFS v3 service that people can purchase. It's relatively inexpensive and basic, but thats what folks like. They can access it from their desktop and then access the data on a cluster to do compute jobs. However, it doesn't meet the requirements of being able to store sensitive data - like ePHI. I've been exploring the route of NFS v4 with Kerberos, but the Linux client leaves a lot to be desired. Additionally, folks are so used to how NFS v3 works that introducing Kerberos into the mix is challenging. How are other groups (business, academic, whatever), addressing security, yet doing it in an inexpensive manner and allowing cross-platform access? Is anyone doing NFS v4 (or v3) with Kerberos today? Thanks, Mike Garrison

6 10

Converting to ipspace config
by Fletcher Cocquyt 10 Nov '14

10 Nov '14

We have a mgmt directive to migrate our vfilers to use distinct ipspaces. The procedure as described by Netapp support involves major downtime (destroying vfiler containers and rebuilding with the volumes served within the new ipspace) I'm looking for advice for anyone who has been through this procedure - any way to minimize downtime (already looking at using VMware storage vmotion to migrate VMs to pre-ipspaced vfiler datastores) Thanks for any info, tips Fletcher

2 1

Cluster OS snapmirror how to's
by Iluhes 04 Nov '14

04 Nov '14

Hi Folks, Need your help I am used to do snapmirrors from within vFilers. i would add a second nick into vFiler in 7-mode, for network that is used for replication and than setup snapmirror inside the vFiler. How does it work in CDOT? Can I setup snapmirror on vserver level? If yes, than can I add replication network as second LIF inside vserver (if yes, what is the protocal type?) If not, how is it done? Snapmirror on cluter level? Can I use intercluster LIFS for that? I dont want the peering relationship, I just want qtree/volume level snapmirror between vserver volumes, but yet over specific replication network

3 4

StoreVault Chassis Swap
by Stephen Stocke 03 Nov '14

03 Nov '14

Hi We have a need to recover some data which was stored on a StoreVault S550. We have all the disks from the original system and a spare S550 chassis. Unfortunately, we don't have the CF card from the original system but the spare chassis still has its original CF card and we have licenses for the protocols required on the spare. Does anyone have any insights as to how we can accomplish this? I'm hoping it will be as easy as booting the spare chassis to maintenance mode and changing ownership of the disks and then booting from vol0 on the newly found aggregate. We're a little nervous to just try it without some guidance in case there's any chance that the new controller might do something drastic to the "foreign" disks. We're obviously out of other options if we're considering this path... Finally, Netapp have taken down the old KB which provided the procedure for a chassis swap (KB42667) and unfortunately I don't have a copy anywhere. I don't think it quite covered our scenario but if anyone has a copy and can forward it, I would be grateful! Kind regards Steve -------------------------------------------------------------------------------- This e-mail message has been scanned for Viruses and Content and cleared by MailMarshal -------------------------------------------------------------------------------- disclaimer This email communication does not create or vary any contractual relationship between LogicalisCI and you. Internet communications are not secure and accordingly LogicalisCI does not accept any legal liability for the contents of this message. The contents of this email are confidential to the intended recipient at the email address to which it has been addressed. It may not be disclosed to or used by anyone other than this addressee, nor may it be copied in any way. If received in error, please contact LogicalisCI on the above number (listed as Main) quoting the name of the sender and the addressee and then delete it from your system. Please note that neither LogicalisCI nor the sender accepts any responsibility for viruses and it is your responsibility to scan the email and attachments (if any). Please be aware that LogicalisCI may monitor email traffic data and also email content for security purposes. The following companies are collectively referred to in the above statements as LogicalisCI: Logicalis Channel Islands Limited, Registered in Jersey No: 67161, Registered Office: Rue A La Dame, Five Oaks, St. Saviour, Jersey, JE2 7NH Logicalis Jersey Limited, Registered in Jersey No: 10124, Registered Office: Rue A La Dame, Five Oaks, St. Saviour, Jersey, JE2 7NH Logicalis Guernsey Limited, Registered in Guernsey No: 10896, Registered Office: Pitronnerie Road, St. Peter Port, Guernsey, GY1 2RF

2 2

AW: Cannot login to service processor on FAS2240-4
by Alexander Griesser 01 Nov '14

01 Nov '14

Issue resolved, I fell for it again and forgot that I had this problem already years ago. When the root password of the filer is > 16 characters, you may only use the first 16 characters of this password for the service processor, so while it seems to automatically shrink the password string when setting it onto the service processor, it does not just ignore the excess characters at the end, you need to shorten the password to 16 characters to be able to login on the SP then. Best, Alexander Griesser System-Administrator ANEXIA Internetdienstleistungs GmbH E-Mail: ag(a)anexia.at<mailto:ag@anexia.at> Web: http://www.anexia.at<http://www.anexia.at/> Anschrift Hauptsitz Klagenfurt: Feldkirchnerstraße 140, 9020 Klagenfurt Geschäftsführer: Alexander Windbichler Firmenbuch: FN 289918a | Gerichtsstand: Klagenfurt | UID-Nummer: AT U63216601 Von: Alexander Griesser Gesendet: Samstag, 01. November 2014 21:01 An: toasters(a)teaparty.net Betreff: Cannot login to service processor on FAS2240-4 Hi, I'm currently experiencing a strange issue with one of our FAS2240-4 systems - I am unable to login to the service processor using the username "naroot" and the password for the normal root account. I've rebooted the service processor several times and have also reset the password of the root account on the system itself, but it does not change the behaviour. I've also just updated the filer to 8.2.2P1, SP is 2.2.2P2 (latest available version) - any ideas what else could cause this issue of not being able to log in to the service processor? Best, Alexander Griesser System-Administrator ANEXIA Internetdienstleistungs GmbH E-Mail: ag(a)anexia.at<mailto:ag@anexia.at> Web: http://www.anexia.at<http://www.anexia.at/> Anschrift Hauptsitz Klagenfurt: Feldkirchnerstraße 140, 9020 Klagenfurt Geschäftsführer: Alexander Windbichler Firmenbuch: FN 289918a | Gerichtsstand: Klagenfurt | UID-Nummer: AT U63216601

1 0

Cannot login to service processor on FAS2240-4
by Alexander Griesser 01 Nov '14

01 Nov '14

Hi, I'm currently experiencing a strange issue with one of our FAS2240-4 systems - I am unable to login to the service processor using the username "naroot" and the password for the normal root account. I've rebooted the service processor several times and have also reset the password of the root account on the system itself, but it does not change the behaviour. I've also just updated the filer to 8.2.2P1, SP is 2.2.2P2 (latest available version) - any ideas what else could cause this issue of not being able to log in to the service processor? Best, Alexander Griesser System-Administrator ANEXIA Internetdienstleistungs GmbH E-Mail: ag(a)anexia.at<mailto:ag@anexia.at> Web: http://www.anexia.at<http://www.anexia.at/> Anschrift Hauptsitz Klagenfurt: Feldkirchnerstraße 140, 9020 Klagenfurt Geschäftsführer: Alexander Windbichler Firmenbuch: FN 289918a | Gerichtsstand: Klagenfurt | UID-Nummer: AT U63216601

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters November 2014