advanced concepts for netapp ontap 9 · advanced concepts for netapp ontap 9 2 ... describe...

Advanced Concepts for NetAppONTAP 9

September 2016 | SL10282 Version 1.2

Advanced Concepts for NetApp ONTAP 92 © 2016 NetApp, Inc. All rights reserved. NetApp Proprietary

TABLE OF CONTENTS

1 Introduction...................................................................................................................................... 4

2 Lab Environment............................................................................................................................. 5

3 Lab Activities................................................................................................................................... 7

3.1 Lab Preparation......................................................................................................................... 7

3.1.1 Accessing the Command Line..............................................................................................................................7

3.1.2 Accessing System Manager................................................................................................................................. 9

3.2 ONTAP CLI................................................................................................................................11

3.2.1 Explore the Command Hierarchy....................................................................................................................... 11

3.2.2 Setting the SVM Context....................................................................................................................................15

3.2.3 Node Management CLI...................................................................................................................................... 16

3.2.4 Node-Scoped CLI............................................................................................................................................... 17

3.3 IPspaces, Broadcast Domains, and Subnets....................................................................... 18

3.3.1 ONTAP 9 Networking Overview......................................................................................................................... 18

3.3.2 Exercise.............................................................................................................................................................. 19

3.4 Quality of Service (QoS).........................................................................................................26

3.4.1 Exercise.............................................................................................................................................................. 26

3.5 SnapMirror................................................................................................................................32

3.5.1 Exercise.............................................................................................................................................................. 33

3.6 SnapLock..................................................................................................................................56

3.6.1 Exercise.............................................................................................................................................................. 57

3.7 Application Provisioning with ONTAP 9 System Manager..................................................84

3.7.1 Exercise.............................................................................................................................................................. 84

3.8 Appendix: Additional Administrative Users and Roles....................................................... 93

3.8.1 Cluster-Scoped Users and Roles....................................................................................................................... 93

3.8.2 SVM Users and Roles........................................................................................................................................98


3.9 Appendix: Active Directory Authentication Tunneling...................................................... 104

3.10 Automated Nondisruptive Upgrades................................................................................. 105

4 Version History............................................................................................................................ 107


1 IntroductionThis Lab Guide provides the steps to complete the Insight 2016 “Hands-on Lab for Advanced Concepts forONTAP 9”.

1 Lab ObjectivesThis lab provides an introduction into a number of more advanced features found in ONTAP 9, including theCommand Line Interface (CLI), IPspaces, using quality of service (QoS) to identify and control rogue workloads,cluster peering, reporting storage savings with improved interface, using NetApp SnapLock® for regulatorycompliant write-once-read-many (WORM) storage, administrative users and roles, and Active DirectoryAuthentication Tunneling.

1 PrerequisitesThis lab builds on the concepts covered in the “Basic Concepts for NetApp ONTAP 9 ” lab, and requiresknowledge of the topics covered in that lab. You should already understand the concepts and know how touse OnCommand System Manager, how to configure a Storage Virtual machine (SVM), and how to createaggregates, volumes, and LIFs. You should also have a basic knowledge of Windows administration. Knowledgeof UNIX is not required, but a Linux virtual machine (VM) is provided.

Your starting point for this lab is a cluster named “cluster1”, with two nodes named “cluster1-01” and “cluster1-02”.There are three SVMs, “svm1”, “svm2”, and “svm3”, each hosting a variety of volumes.

Before you start the lab, launch System Manager and get familiar with the cluster configuration, including location,naming, and status of the aggregates, volumes, LIFs, and SVMs.

The terms “Storage Virtual Machine (SVM)” and “Vserver” are used interchangeably in this lab. “SVM” is used todescribe virtualized storage systems as a concept. “Vserver” is the term used to refer to SVMs in the clusteredData ONTAP command line and in the System Manager user interface. SVMs configured in this lab follow thenaming convention “svmN”, where “N” is a number, and “svm” is shorthand for “Storage Virtual Machine”.


2 Lab EnvironmentThe following figure illustrates the network configuration.

Figure 2-1:

Table 1 shows the host information used in this lab.

Table 1: Host Information

Host Name Operating System Role/Function IP Address

cluster1 ONTAP 9 cluster 192.168.0.101

cluster1-01 ONTAP 9 cluster 1, node 1 192.168.0.111


cluster2 ONTAP 9 cluster 192.168.0.102


JUMPHOST Windows 2012 R2 primary desktop for lab 192.168.0.5

rhel1 Red Hat Linux 6.7 Linux server 192.168.0.61

DC1 Windows 2008R2 Active Directory/DNS 192.168.0.253

Table 2 lists the user IDs and passwords used in this lab.


Table 2: User IDs and Passwords

Host Name User ID Password Comments

JUMPHOST DEMO\Administrator Netapp1!

cluster1 admin Netapp1! Same for individual cluster nodes

cluster2 admin Netapp1! Same for individual cluster nodes

rhel1 root Netapp1!

DC1 DEMO\Administrator Netapp1!


3 Lab ActivitiesIn this lab, you will perform the following tasks:

• Explore the CLI in more detail, and set it to work in an SVM context.• Navigate the node-scoped CLI.• Check the cluster and SVM administrative roles, users, and groups.• Learn about IPspace, Broadcast Domains, and Subnets.• Use QoS to manage tenants and workloads.• Create intercluster LIFs and create a cluster peering relationship for SnapMirror.• Learn how to protect your data using NetApp SnapMirror and SnapLock.• Explore Application Provisioning with ONTAP 9 System Manager.• Configure authentication tunneling for cluster administrators (refer to the appendix).• Learn about new automated nondisruptive upgrade features in ONTAP 9.

This is a self-guided lab. You can complete or skip any exercise.

The expected time for you to complete the entire lab is approximately 1 hour.

Note: Before you begin the lab activities, you should understand how to log into and out of an ONTAPsystem by using the CLI and System Manager.

3.1 Lab Preparation

3.1.1 Accessing the Command Line

PuTTY is the terminal emulation program used in the lab to log into Linux hosts and storage controllers in order torun command line commands.

1. The launch icon for the PuTTY application is pinned to the taskbar on the Windows host Jumphost asshown in the following screenshot; just double-click on the icon to launch it.

1

Figure 3-1:

If you already have another PuTTY session open then this step will only bring that session into focuson the display. If your intention is to open another PuTTY session, then right-click on the PuTTY toolbaricon, and select PuTTY from the context menu.

Once PuTTY launches, you can connect to one of the hosts in the lab by following the next steps. Thisexample shows a user connecting to the Data ONTAP cluster named cluster1.

2. By default PuTTY should launch into the “Basic options for your PuTTY session” display as shown in thescreenshot. If you accidentally navigate away from this view just click on the Session category item toreturn to this view.


3. Use the scrollbar in the “Saved Sessions” box to navigate down to the desired host, and double-click itto open the connection. A terminal window will open and you will be prompted to log into the host. Youcan find the correct username and password for the host in the Lab Host Credentials table in the “LabEnvironment” section at the beginning of this guide.

2

3

Figure 3-2:

If you are new to the ONTAP CLI, the length of the commands can seem a little initimidating. However,the commands are actually quite easy to use if you remember the following three tips:

• Make liberal use of the Tab key while entering commands, as the clustered Data ONTAPcommand shell supports tab completion. If you hit the Tab key while entering a portion of acommand word, the command shell will examine the context and try to complete the rest ofthe word for you. If there is insufficient context to make a single match, it will display a list of allthe potential matches. Tab completion also usually works with command argument values, butthere are some cases where there is simply not enough context for it to know what you want,in which case you will just need to type in the argument value.

• You can recall your previously entered commands by repeatedly pressing the up-arrow key,and you can then navigate up and down the list using the up and down arrow keys.When youfind a command you want to modify, you can use the left arrow, right arrow, and Delete keysto navigate around in a selected command to edit it.

• Entering a question mark character “?” causes the CLI to print contextual help information.You can use this character by itself, or while entering a command.

The Cluster CLI section of this lab guide covers the operation of the clustered Data ONTAP CLI in muchgreater detail.


Caution: The commands shown in this guide are often so long that they span multiple lines.When you see this, in every case you should include a space character between the text fromadjoining lines.

If you intend to use copy/paste of commands from the guide to the lab, when dealing with multi-line commands you can only copy one line at a time. If you try to copy multiple lines at once thenthe commands will fail in the lab.

3.1.2 Accessing System Manager

If you prefer to use a graphic interface instead of the command-line interface for accessing and managing thecluster, you can do so by using OnCommand System Manager, which is included with Data ONTAP as a webservice, enabled by default, and accessible by using a browser. On the Jumphost, the Windows 2012R2 Serverdesktop you see when you first connect to the lab, open the web browser of your choice. This lab guide usesChrome, but you can use Firefox or Internet Explorer if you prefer one of those. All three browsers already haveSystem Manager set as the browser home page.

1. Launch Chrome to open System Manager.

1

Figure 3-3:

The “OnCommand System Manager Login” window opens.2. Note the tabs at the top of the browser window. This lab contains multiple clusters, and each tab opens

System Manager for a different cluster.3. Enter the User Name admin, and the Password Netapp1!.4. Click the Sign In button.


2

3

4

Figure 3-4:

System Manager is now logged in to cluster1, and displays a summary page for the cluster. If you areunfamiliar with System Manager, here is a quick introduction to its layout. Please take a few moments toexpand and browse these tabs to familiarize yourself with their contents.

5. Use the tabs in the top pane of the window to manage various aspects of the cluster. The Dashboardtab in System Manager enables you to monitor the health and performance of a cluster. You can alsoidentify hardware problems and storage configuration issues by using the dashboard.

6. You can access all the LUNs in the cluster by using the LUNs tab, or you can access the LUNs specificto the SVM by using SVMs > LUNs.

7. The SVMs tab allows you to manage individual Storage Virtual Machines (SVMs, also known asVservers).

8. You can use the Network tab to view the list of network components, such as subnets, networkinterfaces, Ethernet ports, broadcast domains, FC/FcoE adapters, and IPspaces, and to create, edit, ordelete these components in your storage system.

9. The Hardware and Diagnostics tab allows you to set up the physical storage, including assigning disksto nodes, zeroing the spare disks, and creating aggregates.

10. You can use the Protection tab to create and manage mirror, vault, and mirror vault relationships, andto display details about these relationships.

11. You can use the Configurations tab (you might need to expand your browser window to see this tab)to gather the configuration information, creating cluster-management and node-management interfaces,adding licenses, setting up the cluster time, and monitoring HA pairs.


5 6 7 8 9 10 11

Figure 3-5:

Tip: As you use System Manager in this lab, you may encounter situations where buttons at the bottom ofa System Manager pane are beyond the viewing size of the window, and no scroll bar exists to allow youto scroll down to see them. If this happens, you have two options; either increase the size of the browserwindow (you might need to increase the resolution of your Jumphost desktop to accommodate the largerbrowser window), or in the System Manager window, use the tab key to cycle through all the various fieldsand buttons, which eventually forces the window to scroll down to the non-visible items.

3.2 ONTAP CLIThis section provides an introduction to the ONTAP Command Line Interface, or CLI. Here you will learn aboutthe command hierarchy and the various CLI interfaces (clustershell, nodeshell), and also about a number of theshell's usability features.

When you open an SSH session to a cluster, you are usually doing so to the cluster management LIF. The clustermanagement LIF is set up when you first configure the cluster, and automatically migrates across the cluster if thehome port or home node on which it is located goes down. When you log into the cluster management LIF youare accessing the clustershell.

If you have not already opened a PuTTY session to cluster1, please do so now.

3.2.1 Explore the Command Hierarchy

After logging in, you are placed at the top of the command line hierarchy. The commands are built in a commandhierarchy, with associated commands grouped together in branches. These branches are made up of commanddirectories and commands; this organization is similar to the organization of directories and files within a filesystem.

Type ? to list the base commands available at the top level of the hierarchy.

cluster1::> ? up Go up one directory cluster> Manage clusters dashboard> (DEPRECATED)-Display dashboards event> Manage system events exit Quit the CLI session export-policy Manage export policies and rules history Show the history of commands for this CLI session job> Manage jobs and job schedules


lun> Manage LUNs man Display the on-line manual pages metrocluster> Manage MetroCluster network> Manage physical and virtual network connections qos> QoS settings redo Execute a previous command rows Show/Set the rows for this CLI session run Run interactive or non-interactive commands in the nodeshell security> The security directory set Display/Set CLI session settings snapmirror> Manage SnapMirror statistics> Display operational statistics storage> Manage physical storage, including disks, aggregates, and failover system> The system directory top Go to the top-level directory volume> Manage virtual storage, including volumes, snapshots, and mirrors vserver> Manage Vserverscluster1::>

Type any base command to move into that branch of the command hierarchy. For example, the “volume” branchcontains all commands related to volumes. The prompt changes to show you the part of the command tree youare working in.

Type ? again. This time the hierarchy shows you the specific subcommands available for that part of thecommand tree.

cluster1::> volumecluster1::volume> ? aggregate> Manage Infinite Volume aggregate operations autosize Set/Display the autosize settings of the flexible volume. clone> Manage FlexClones create Create a new volume delete Delete an existing volume efficiency> Manage volume efficiency file> File related commands modify Modify volume attributes mount Mount a volume on another volume with a junction-path move> Manage volume move operations offline Take an existing volume offline online Bring an existing volume online qtree> Manage qtrees quota> Manage Quotas, Policies, Rules and Reports rename Rename an existing volume restrict Restrict an existing volume show Display a list of volumes show-footprint Display a list of volumes and their data and metadata footprints in their associated aggregate. show-space Display space usage for volume(s) size Set/Display the size of the volume. snapshot> Manage snapshots unmount Unmount a volumecluster1::volume>

To show the syntax for a particular command, enter the command and follow it with ?.

cluster1::volume> size ? -vserver <vserver name> Vserver Name [-volume] <volume name> Volume Name [[-new-size] <text>] [+|-]<New Size>cluster1::volume>

Tab completion works by completing what you are typing, and prompting you for what is recommended next whileyou are still typing part of a command directory, or command. It can even provide options for the values requiredto complete the command.

Try tab completion by backspacing to clear the size command, typing the modify command, and pressing the Tabkey. The next option is automatically filled in. Press Tab again to get a list of options, and then type 1 to completethe text svm1. Press Tab again to get the -volume option, and type in the volume name svm1_vol02. Continue


using tab completion until you get to -security-style unix. Before you press Enter, backspace to delete the word“unix”, and type ?.

The output should look like this example:

cluster1::volume> modify -vserver svm1 -volume svm1_vol02 -size 1GB -state online -policy default -user 0 -group 0 -security-style ? mixed ntfs unix

Backspace to delete the modify command, and type .. to move up one level in the command hierarchy, or typetop to return to the root of the command tree.

cluster1::volume> topcluster1::>

Type history to show the commands that you executed in the current session, or use the up arrow to repeatrecently executed commands. Use the right and left arrows, and the backspace key to edit and rerun thecommands. Alternatively, you can use the! (number) syntax to run a previous command in the list.

cluster1::> history 1 rows 0 2 volume 3 topcluster1::>

You may notice the rows 0 command in the history list output shown in this guide (and not shown in your lab).rows 0 disables output paging on the command console. After you run rows 0, the console stops prompting you to“Press <space> to page down, <return> for next line, or ‘q’ to quit”. We suggest you leave the existing paginationsetting in place while you proceed through this lab.

Certain commands require different privilege levels. By default, you are logged in with admin privilege. To enter“advanced” or “diag” privilege, issue the set -privilege <level> command, or use set <level> as the shorterversion of the command. An * is appended to the prompt to show that you are not in the default privileged level.

Note: There is no access to advanced or diag privilege commands in System Manager.

The best practice is to initiate non-admin privilege only as needed, then return to admin privilege with the set -priv admin or set admin commands.

cluster1::> set advancedWarning: These advanced commands are potentially dangerous; use them only when directed to do so by NetApp personnel.Do you want to continue? {y|n}: ycluster1::*>cluster1::*> set admincluster1::>

You can type abbreviations to issue a command. For example, vol show is recognized as volume show. Be awarethat command abbreviations are limited. For instance, there are also volume show-footprint or volume show-spacecommands, so the abbreviation vol sho is not unique to a single command, and therefore not recognized.

You can use pattern matching with wildcards when running commands. For example:

cluster1::> vol show svm2*Vserver Volume Aggregate State Type Size Available Used%--------- ------------ ------------ ---------- ---- ---------- ---------- -----svm2 svm2_root aggr1_cluster1_02 online RW 20MB 18.88MB 5%svm2 svm2_vol01 aggr1_cluster1_01 online RW 1GB 1023MB 0%2 entries were displayed.cluster1::>

When running commands, you see only certain fields by default. To display all fields, run the -instance command.

cluster1::> network interface show -lif cluster_mgmt -instance Vserver Name: cluster1 Logical Interface Name: cluster_mgmt


Role: cluster-mgmt Data Protocol: none Home Node: cluster1-01 Home Port: e0c Current Node: cluster1-01 Current Port: e0c Operational Status: up Extended Status: - Is Home: true Network Address: 192.168.0.101 Netmask: 255.255.255.0 Bits in the Netmask: 24 IPv4 Link Local: - Subnet Name: - Administrative Status: up Failover Policy: broadcast-domain-wide Firewall Policy: mgmt Auto Revert: false Fully Qualified DNS Zone Name: none DNS Query Listen Enable: false Failover Group Name: Default FCP WWPN: - Address family: ipv4 Comment: - IPspace of LIF: Defaultcluster1::>

You will often see a very large number of fields for a particular object. To show a few specific fields, limit thenumber of displayed fields by using the -fields qualifier.

Remember, you can use ? to show all possible values. Try using wildcards to show only items with “svm1” in thename.

cluster1::> network interface show ? [ -by-ipspace | -failover | -instance | -fields <fieldname>, ... ] [ -vserver <vserver> ] Vserver Name [[-lif] <lif-name>] Logical Interface Name [ -role {cluster|data|node-mgmt|intercluster|cluster-mgmt} ] Role [ -data-protocol {nfs|cifs|iscsi|fcp|fcache|none}, ... ] Data Protocol [ -home-node <nodename> ] Home Node [ -home-port {<netport>|<ifgrp>} ] Home Port [ -curr-node <nodename> ] Current Node [ -curr-port {<netport>|<ifgrp>} ] Current Port [ -status-oper {up|down} ] Operational Status [ -status-extended <text> ] Extended Status [ -is-home {true|false} ] Is Home [ -address <IP Address> ] Network Address [ -netmask <IP Address> ] Netmask [ -netmask-length <integer> ] Bits in the Netmask [ -auto {true|false} ] IPv4 Link Local [ -subnet-name <subnet name> ] Subnet Name [ -status-admin {up|down} ] Administrative Status [ -failover-policy {system-defined|local-only|sfo-partner-only|ipspace-wide|disabled|broadcast-domain-wide} ] Failover Policy [ -firewall-policy <policy> ] Firewall Policy [ -auto-revert {true|false} ] Auto Revert [ -dns-zone {zone-name|none} ] Fully Qualified DNS Zone Name [ -listen-for-dns-query {true|false} ] DNS Query Listen Enable [ -failover-group <failover-group> ] Failover Group Name [ -wwpn <text> ] FCP WWPN [ -address-family {ipv4|ipv6|ipv6z} ] Address family [ -comment <text> ] Comment [ -ipspace <IPspace> ] IPspace of LIFcluster1::> network interface show svm1* -field home-nodevserver lif home-node------- --------------- -----------svm1 svm1_admin_lif1 cluster1-01svm1 svm1_cifs_nfs_lif1 cluster1-012 entries were displayed.cluster1::>


You can set other options to customize the behavior of the CLI. A useful option is to set the default timeout valuefor CLI sessions. Check the settings on your system and, if they are not set, modify the timeout to be 0. Thissetting disables the timeout for your CLI session.

cluster1::> system timeout modify 30cluster1::> system timeout modify 0cluster1::> system timeout showCLI session timeout: 0 minutescluster1::>

The set command, which you already used to specify the privilege level, has other options shown in the nextexample. See what happens when you set different options. Remember to set the options back before youcontinue.

cluster1::> set ? [[-privilege] {admin|advanced|diagnostic}] Privilege Level [ -confirmations {on|off} ] Confirmation Messages [ -showallfields {true|false} ] Show All Fields [ -showseparator <text (size 1..3)> ] Show Separator [ -active-help {true|false} ] Active Help [ -units {auto|raw|B|KB|MB|GB|TB|PB} ] Data Units [ -rows <integer> ] Pagination Rows ('0' disables) [ -vserver <text> ] Default Vserver [ -node <text> ] Default Node [ -stop-on-error {true|false} ] Stop On Errorcluster1::>

3.2.2 Setting the SVM Context

For many commands, you must specify the SVM by using the -vserver <SVM name> qualifier. This is becauseobjects, such as volume names, only need to be unique within the SVM, but could be repeated across multipleSVMs.

Suppose that you are running a number of commands within the same SVM. In this scenario, you can set acontext to a specific SVM so that you do not need to qualify the commands each time.

Without the SVM context, try the volume show command. You should see the root volume for each node (vol0), aswell as the volumes in all of the SVMs.

cluster1::> volume showVserver Volume Aggregate State Type Size Available Used%--------- ------------ ------------ ---------- ---- ---------- ---------- -----cluster1-01 vol0 aggr0_cluster1_01 online RW 2.85GB 1.16GB 59%cluster1-02 vol0 aggr0_cluster1_02 online RW 2.85GB 1.04GB 63%svm1 svm1_root aggr1_cluster1_01 online RW 20MB 18.88MB 5%svm1 svm1_vol01 aggr1_cluster1_01 online RW 1GB 972.5MB 5%svm1 svm1_vol02 aggr1_cluster1_02 online RW 1GB 972.5MB 5%svm1 svm1_vol03 aggr2_cluster1_01 online RW 1GB 972.5MB 5%svm1 svm1_vol04 aggr2_cluster1_02 online RW 1GB 972.5MB 5%svm2 svm2_root aggr1_cluster1_02 online RW 20MB 18.88MB 5%svm2 svm2_vol01 aggr1_cluster1_01 online RW 1GB 1023MB 0%9 entries were displayed.cluster1::>

To display only the volumes in the SVM named svm1, issue volume show -vserver svm1. Alternatively, you can seta temporary context for just svm1. Try this command:

cluster1::> vserver context -vserver svm1Info: Use 'exit' command to return.svm1::> vol showVserver Volume Aggregate State Type Size Available Used%--------- ------------ ------------ ---------- ---- ---------- ---------- -----svm1 svm1_root aggr1_cluster1_01 online RW 20MB 18.88MB 5%svm1 svm1_vol01 aggr1_cluster1_01 online RW 1GB 972.5MB 5%svm1 svm1_vol02 aggr1_cluster1_02 online RW 1GB 972.5MB 5%svm1 svm1_vol03 aggr2_cluster1_01 online RW 1GB 972.5MB 5%svm1 svm1_vol04 aggr2_cluster1_02 online RW 1GB 972.5MB 5%5 entries were displayed.svm1::>


The prompt changes to the SVM that you selected (svm1), and you see only the volumes that belong to svm1. Aslong as you are in the SVM context, you will not have to use the -vserver <SVM name> qualifier.

List the available commands. You will see a different (restricted) command list. For example, there is no storagecommand. This is because the SVM shell is running with sufficient privileges to execute only the specificcommands that are relevant to an SVM. Once you type exit and return to the cluster prompt, you have fullcommand access over all entities in the cluster.

svm1::> ? up Go up one directory dashboard> (DEPRECATED)-Display dashboards exit Quit the CLI session export-policy Manage export policies and rules history Show the history of commands for this CLI session job> Manage jobs and job schedules lun> Manage LUNs man Display the on-line manual pages network> Manage physical and virtual network connections redo Execute a previous command rows Show/Set the rows for this CLI session security> The security directory set Display/Set CLI session settings snapmirror> Manage SnapMirror statistics> Display operational statistics system> The system directory top Go to the top-level directory volume> Manage virtual storage, including volumes, snapshots, and mirrors vserver> Manage Vserverssvm1::> exitcluster1::>

3.2.3 Node Management CLI

Each node in the cluster has its own management LIF. Node management LIFs exist so that you can manageindividual nodes if they lose contact with the rest of the cluster.

Use the following command to display information about the node management LIFs. Each node has an SVM thatowns the management LIF for the node.

cluster1::> network interface show -role node-mgmt Logical Status Network Current Current IsVserver Interface Admin/Oper Address/Mask Node Port Home----------- ---------- ---------- ------------------ ------------- ------- ----cluster1 cluster1-01_mgmt1 up/up 192.168.0.111/24 cluster1-01 e0c true cluster1-02_mgmt1 up/up 192.168.0.112/24 cluster1-02 e0c true2 entries were displayed.cluster1::>

You can establish an SSH session to any of these node management LIFs. Use your admin/Netapp1!credentials. The prompt is the same as the prompt for the cluster management CLI.

In addition to its own LIF, each node also has its own root volume. The node root volume is bound to the clusternode. It contains configuration files, logs, and other files associated with a node’s normal operation. A node rootvolume is part of the physical cluster infrastructure. It is not associated with an SVM, does not hold user data, anddoes not contain junctions to other volumes.

The CLI you have access to in this lab is exactly the same as if you created an SSH session to the clustermanagement LIF. The difference is that the node management LIF always resides on its own node because itis an IP address used specifically for managing a particular node. The node management LIF does not fail overto another node if the home node is shut down. For this reason, you should use the cluster management LIF tomanage the cluster, because this LIF can, and will, fail over to another node. As long as the cluster is active, youalways have a reachable cluster management LIF.

However, suppose that a node is no longer in the cluster. If the node is still up, you can create an SSH session toits node management LIF to run node-specific diagnostics, because these will not be accessible from the clustermanagement CLI.


3.2.4 Node-Scoped CLI

The node-scoped CLI is also known as the node shell. It provides access to node-specific commands that mightbe required to perform administrative tasks not available in the cluster management CLI.

Administrative tasks that require the use of the node-scoped CLI are rare. The node-scoped CLI is not typicallyused to administer an ONTAP system. The node-scoped CLI should be used infrequently, and with care.

You enter the node CLI from the cluster management CLI. Go to the cluster1 PuTTY session for this section,using the procedure described in the “Accessing the Command Line” section of this lab guide.

You can access the node shell through two methods. The method to use depends on whether you want to runone specific command, or a series of commands.

3.2.4.1 Single CommandCheck the names of your nodes by typing node show.

cluster1::> node showNode Health Eligibility Uptime Model Owner Location--------- ------ ----------- ------------- ----------- -------- ---------------cluster1-01 true true 02:19:21 SIMBOXcluster1-02 true true 02:19:05 SIMBOX2 entries were displayed.cluster1::>

Note: See the Model column? Have you noticed any other indication that you are running an ONTAPsimulator rather than physical hardware?

To run a single specific command for one node, specify that node by using the node run -node <node-name><command> command.

cluster1::> node run -node cluster1-02 aggr status Aggr State Status Optionsaggr1_cluster1_02 online raid_dp, aggr nosnap=on 64-bitaggr0_cluster1_02 online raid_dp, aggr root, nosnap=on 64-bitaggr2_cluster1_02 online raid_dp, aggr nosnap=on 64-bitcluster1::>

When the command executes, it displays the aggregates defined on that node and returns you to the clusterprompt.

In this case, node scope syntax is used instead of ONTAP syntax, and the output is also formatted differently. Thenode-scoped CLI does not support tab completion.

The equivalent ONTAP CLI command is storage aggregate show.

cluster1::> storage aggregate show -node cluster1-02Aggregate Size Available Used% State #Vols Nodes RAID Status--------- -------- --------- ----- ------- ------ ---------------- ------------aggr0_cluster1_02 3.02GB 141.3MB 95% online 1 cluster1-02 raid_dp, normalaggr1_cluster1_02 102.3GB 101.3GB 1% online 2 cluster1-02 raid_dp, normalaggr2_cluster1_02 102.3GB 101.3GB 1% online 1 cluster1-02 raid_dp, normal3 entries were displayed.cluster1::>

3.2.4.2 Node ShellIf you want to run a number of node-specific commands, start a shell by omitting the command parameter.

cluster1::> node run -node cluster1-02Type 'exit' or 'Ctrl-D' to return to the CLI


cluster1-02>

The prompt changes to the node of the shell you are in. To return to the cluster management CLI, enter exit, orpress Ctrl-D. For now, stay in the node shell.

List the available commands.

cluster1-02> ?? fsecurity ping sourceacpadmin halt ping6 statsaggr help pktt storagebackup hostname priority sysconfigcdpd ic priv sysstatcf ifconfig qtree timezoneclone ifgrp quota traceroutecna_flash ifstat rdfile traceroute6coredump ipspace reallocate upsdate key_manager restore_backup uptimedcb keymgr revert_to versiondf license route vfilerdisk logger rshstat vlandisk_fw_update man sasadmin vmservicesdownload maxfiles sasstat volecho mt savecore wafltopems ndmpcopy shelfchk wccenvironment ndp sis wrfilefcadmin netstat smnadmin ypcatfcp options snap ypgroupfcstat partner snapmirror ypmatchfile passwd software ypwhichflexcachecluster1-02>

The following list identifies situations in which you should use the node shell:

• When you modify the size of the node root volume. Using the node shell is necessary because thenode root volume is considered a 7-Mode volume, and can be modified only in the node scope.

• When running the snapshot delta command. The cluster management CLI does not currently includethis command. The command is available as in System Manager, through a ZAPI, or it can be run fromthe node shell.

Note: In general, do not perform network configuration or storage provisioning from the node shell. Youshould only use it for those functions that you cannot perform from the cluster management CLI, or fromSystem Manager.

Exit the node shell.

cluster1-02> exitlogoutcluster1::>

3.3 IPspaces, Broadcast Domains, and Subnets

3.3.1 ONTAP 9 Networking Overview

ONTAP 9 introduces new networking constructs designed to simplify deployment and configuration: IPspaces,broadcast domains, and subnets.

3.3.1.1 IPspacesAn IPspace is a logical construct that represents a space containing unique IP addresses. Beginning with NetAppclustered Data ONTAP 8.3, multiple SVMs can have overlapping IP addresses provided that each of those SVMsresides in a different IPspace.


3.3.1.2 Broadcast DomainsBroadcast domains enable you to group network ports that belong to the same layer 2 network. The ports in thegroup can then be used by an SVM for data or management traffic.

Broadcast domains simplify the configuration of ONTAP by making it easier to ensure that all ports in a failovergroup reside in the same layer 2 network, and all ports in the same layer 2 network have the same maximumtransmission unit (MTU) values.

A broadcast domain resides in an IPspace. During cluster initialization, the system creates two default broadcastdomains:

• The “Default” broadcast domain contains ports that are in the “Default” IPspace. These ports are usedprimarily to serve data. Cluster management and node management ports are also in this broadcastdomain.

• The “Cluster” broadcast domain contains ports that are in the “Cluster” IPspace. These ports are usedfor cluster communication, and include all cluster ports from all nodes in the cluster.

If you create unique IPspaces to separate client traffic, then you must create a broadcast domain in each of thoseIPspaces. If your cluster does not require separate IPspaces, then all broadcast domains (and all ports) reside inthe system-created “Default” IPspace.

When you create a broadcast domain, you need to specify the name of the broadcast domain, an IPspace, anMTU value, and a list of ports.

3.3.1.3 SubnetsSubnets in ONTAP provide a way to provision blocks of IP addresses at a time. They simplify networkconfiguration by allowing the administrator to specify a subnet during LIF creation, rather than an IP address andnetmask. A subnet object in ONTAP does not need to encompass an entire IP subnet, or even a maskable rangewithin a subnet.

A subnet is created within a broadcast domain, and it contains a pool of IP addresses. You can allocate IPaddresses in a subnet to ports in the broadcast domain when LIFs are created. When you remove the LIFs, the IPaddresses are returned to the subnet pool, and are available for future LIFs.

If you specify a gateway when defining a subnet, a default route to that gateway is automatically added to theSVM when you create a LIF using that subnet.

3.3.2 Exercise

In this exercise, you will use the networking constructs available with ONTAP 9: IPspaces, Broadcast Domains,and Subnets.

1. If you do not already have an instance of System Manager running, then from the taskbar of jumphost,launch Chrome.

1

Figure 3-6:


The Chrome browser opens and displays two tabs for NetApp OnCommand System Manager.2. Click the tab for cluster2.3. Enter your credentials as the user admin with the password Netapp1!.4. Click Sign In.

2

3

4

Figure 3-7:

System Manager displays the Dashboard for cluster2.

Start by creating a new namespace. You will use this IPspace in the later steps to create a broadcastdomain and a subnet.

5. On the command bar, click the Network tab.6. Click the IPspaces sub-tab.7. In the IPspaces tab, click Create.


5

6

7

Figure 3-8:

The “Create IPspace” window opens.

8. Set the “IPspace Name” field to new-ipspace.9. Click Create.

8 9Figure 3-9:

The “Create IPspace” window closes, and focus returns to the Network view in System Manager, wherethe newly created new-ipspace is now displayed in the list of available IPspaces.

Next create a new broadcast domain. You will need to specify a name, an IPspace in which it can reside,a set of physical network ports, and an MTU value.

10. Click the Broadcast Domains sub-tab.11. Click Create.


1011

Figure 3-10:

The “Create Broadcast Domain” window opens.

12. Specify the fields in the “Create Broadcast Domain” dialog box, as follows:

• Name: new-broadcast-domain• MTU: 1500• Ipspace: new-ipspace• Port name: check e0gand e0h

13. Click Create.


12

13

Figure 3-11:

The “Create Broadcast Domain” window closes and focus returns to the Network view in SystemManager, where the newly created new-broadcast-domain is now displayed in the list of availableBroadcast Domains.

Now create a new subnet using your newly created IPspace and broadcast domain. The subnet objectrequires a name, a broadcast domain, an IPspace, a subnet mask, and a range of IP addresses.

14. Click the Subnets sub-tab.15. Click Create.


14

15

Figure 3-12:

The “Create Subnet” window opens.

16. Specify the field in the “Create Subnet” dialog box as follows:

• Name: new-subnet• Subnet IP/Subnet mask: 192.168.0.0/24• IP addresses: 192.168.0.170-192.168.0.179• Gateway: 192.168.0.1• Broadcast domain: new-broadcast-domain

17. In the Broadcast Domain area of the dialog box, expand Show ports on this domain and view the listof network ports that will be associated with this subnet.

18. Click Create.


17

18

16

Figure 3-13:

The “Create Subnet” window closes and focus returns to the Network view in System Manager, wherethe newly created new-subnet is now displayed in the list of available Subnets.

Attention: As you may have noticed, the subnet ranges for new-subnet and dr-subnet are thesame. However, these are in fact two distinct networks as they each utilize a different broadcastdomain. If you look at the network ports assigned to each of those broadcast domains (anexercise left to the reader) you'll observe that they use different network ports, which in this labare assigned to two separate logical networks (i.e. separate VLANs). This capability presentssignificant advantages for customers who are interested in deploying ONTAP storage clusters inmulti-tenant environments.

Finally, determine the port health status. You can view and edit the Ethernet port settings, such as theduplex mode, speed settings and health status using System Manager.

19. Click the Ethernet Ports sub-tab.20. In the port list, select the entry for port e0g.21. Verify that e0g's assigned Broadcast Domain is “new-broadcast-domain” and that it's assigned IPspace

is “new-ipspace”.22. The “Ethernet Port Properties” pane shows that this port is in a “Healthy” state.


19

20

21

22

Figure 3-14:

3.4 Quality of Service (QoS)Quality of service (QoS) in NetApp ONTAP allows the cluster administrator to limit the IOPs, or raw throughput,available to an SVM, LUN, volume, or file (such as a VMDK file). QoS can be used to control workloads thatexcessively consume resources, and to manage tenant service levels natively inside the storage system.

ONTAP 8.3 supports 3500 QoS Policy Groups per cluster. ONTAP 9.0 raise this limit to 12,000 QoS PolicyGroups per cluster cluster. Each QoS Policy group supports one or more individual objects (Vol, LUN, file),meaning you can manage much more than 12000 objects in total by placing multiple objects per policy group.

ONTAP 9.0 also supports the ability to configure IOPS and Throughput (BPS) together to define the QoS maxlimit. In earlier versions of ONTAP, you could only specify either IOPS, or BPS, and not both. This allowedadministrators to set the max IOPS for a tenant, but the tenant could circumvent the expected throughput limit byusing a higher block size. This allowed tenants to consume higher throughput than they paid for, and decreasedthe overall utilization of the cluster. In ONTAP 9.0, service providers can now limit both IOPS and BPS, preventingover-utilization, and allowing better enforcement of Service Level Agreements.

3.4.1 Exercise

In this activity, you will create and examine the QoS configuration on cluster1 using the ONTAP CLI. This exerciseuses a workload generator to drive I/O to an SVM on cluster1. After the workload generator starts, you willconfigure QoS and see the reduction of I/O operations serviced to the workload generator.


The workload generator runs directly on the Windows Jumphost, and targets I/O to the drive letter “Z:”. TheJumphost has the drive letter “Z:” mapped to a CIFS share on svm1 that provides access to the volume“svm1_vol01”.

Note: For brevity, the following steps to launch PuTTY do not include screenshots. If you are unfamiliarwith PuTTY and need further instruction, please see the Accessing the Command Line section at thebeginning of this lab guide.

1. From the taskbar of Jumphost, launch PuTTY.2. In the PuTTY Saved Sessions list, select cluster1.3. Click Open.4. Log in as the user admin, with the password Netapp1!.5. List the policy groups on the cluster.

cluster1::> qos policy-group showThis table is currently empty.

cluster1::>

There currently are no policy groups defined.6. Create a new policy-group for svm1 on cluster1 by specifying both BPS and IOPS together as max-

throughput.

cluster1::> qos policy-group create -vserver svm1 -policy-group 100KBPS-100IOPS -max-throughput 100IOPS,100KB/sec

cluster1::>

7. Verify that your new policy-group is created successfully.

cluster1::> qos policy-group showName Vserver Class Wklds Throughput ---------------- ----------- ------------ ----- ------------100KBPS-100IOPS svm1 user-defined 0 0-100IOPS,100KB/s

cluster1::>

8. Since there are no policy groups, it stands to reason that there are no defined workloads beingmonitored either.

cluster1::> qos workload showThis table is currently empty.

cluster1::>

9. Generate performance statistics for all the workloads on the cluster. Since there are no definedworkloads, this command will generate some statistics for the cluster as a whole. Observe severaliterations of output, noting that the overall load is generally low for both IOPs and Throughput. Leave thecommand running.

cluster1::> qos statistics workload performance showWorkload ID IOPS Throughput Latency --------------- ------ -------- ---------------- ---------- -total- - 116 4.45KB/s 229.00us _USERSPACE_APPS 14 115 4.45KB/s 230.00us User-Default 2 1 0KB/s 0ms User-Default 2 1 0KB/s 0ms -total- - 98 12.08KB/s 271.00us _USERSPACE_APPS 14 97 12.08KB/s 273.00us User-Default 2 1 0KB/s 0ms -total- - 8 4.74KB/s 0ms _USERSPACE_APPS 14 8 4.74KB/s 0ms -total- - 101 12.36KB/s 231.00us _USERSPACE_APPS 14 100 12.36KB/s 232.00us User-Default 2 1 0KB/s 0ms -total- - 213 3.88KB/s 93.00us _USERSPACE_APPS 14 213 3.88KB/s 93.00us


10. On the desktop of Jumphost, double-click the workload-512.bat file to start the workload generator.

10

Figure 3-15:

11. A command prompt window opens and starts outputting workload statistics. The first line of the outputshows the workload parameters, which in this case is an I/O load with block size 512 bytes that it isgenerating reads against the share mounted on Jumphost's Z: drive.

Figure 3-16:


12. Switch back to the cluster1 PuTTY window and examine the statistics for the still running qosstatistics workload performance show command. Notice the large jump in IOPs and Throughput thatcoincides with the time when you launched the workload script. Press Ctrl-C to terminate the workloadstatistics output.

-total- - 213 3.88KB/s 93.00us _USERSPACE_APPS 14 213 3.88KB/s 93.00us User-Default 2 1 0KB/s 0ms -total- - 8 11.63KB/s 0ms _USERSPACE_APPS 14 7 11.63KB/s 0ms User-Default 2 1 0KB/s 0ms Workload ID IOPS Throughput Latency --------------- ------ -------- ---------------- ---------- -total- - 3328 1.59MB/s 159.00us User-Default 2 3228 1.58MB/s 155.00us _USERSPACE_APPS 14 101 12.65KB/s 264.00us -total- - 3638 1.78MB/s 151.00us User-Default 2 3624 1.77MB/s 151.00us _USERSPACE_APPS 14 13 9.23KB/s 0ms -total- - 3583 1.74MB/s 147.00us User-Default 2 3575 1.74MB/s 148.00us<Ctrl-C>cluster1::>

13. Assign the “volume svm1_vol01” to the policy-group “100KBPS-100IOPS” you created earlier.

cluster1::> volume modify -vserver svm1 -volume svm1_vol01 -qos-policy-group 100KBPS-100IOPS Volume modify successful on volume svm1_vol01 of Vserver svm1.

cluster1::>

14. Query the workload statistcs again, and then after a few iteraions enter Ctrl-C to stop the output.

cluster1::> qos statistics workload performance showWorkload ID IOPS Throughput Latency --------------- ------ -------- ---------------- ---------- -total- - 227 66.27KB/s 4.78ms _USERSPACE_APPS 14 120 13.10KB/s 221.00us svm1_vol01-wi.. 950 106 53.17KB/s 9.96ms User-Default 2 1 0KB/s 0ms -total- - 259 61.36KB/s 4.24ms _USERSPACE_APPS 14 154 8.53KB/s 260.00us svm1_vol01-wi.. 950 106 52.83KB/s 10.02ms -total- - 337 66.09KB/s 3.31ms _USERSPACE_APPS 14 229 12.75KB/s 217.00us svm1_vol01-wi.. 950 107 53.33KB/s 9.96ms User-Default 2 1 0KB/s 0ms -total- - 392 175.20KB/s 2.73ms _USERSPACE_APPS 14 285 121.87KB/s 23.00us svm1_vol01-wi.. 950 107 53.33KB/s 9.96msCtrl-Ccluster1::>

As you can see, the statistics are significantly lower, but the output is a little busy given the variousworkload categories being reported. Narrow down the scope of the statistics so they will be easier tointerpret.

15. The act of assigning a QoS policy to the volume actually assigns it a workload name. Print thatworkload name so you can use it to refine the performance statistics output.

cluster1::> qos workload showWorkload Wid Policy Group Vserver Volume LUN Qtree File Path-------------- ----- ------------ -------- -------- ------ ------ -------------svm1_vol01-wid950 950 100KBPS-100IOPS svm1 svm1_vol01 - - -

cluster1::>

Caution: The workload name in your lab may be different than what is shown here. Othercommands in this exercise use this value as an input, and this lab guide uses “svm1_vol01-wid950” as the workload name. If the workload name in your lab instance is different, you will


need to substitute your workload name in place of “svm1_vol01-wid950” for later commands inthis exercise.

16. View the workload performance again, this time using this workload name to filter down the scope ofthe statistics report.

cluster1::> qos statistics workload performance show -workload svm1_vol01-wid950Workload ID IOPS Throughput Latency --------------- ------ -------- ---------------- ---------- -total- - 113 53.36KB/s 9.38ms svm1_vol01-wi.. 950 106 53.00KB/s 10.00ms -total- - 136 58.58KB/s 7.82ms svm1_vol01-wi.. 950 106 53.17KB/s 10.00ms -total- - 210 58.13KB/s 5.16ms svm1_vol01-wi.. 950 107 53.33KB/s 10.00ms -total- - 112 53.77KB/s 9.58ms svm1_vol01-wi.. 950 107 53.50KB/s 10.00msclsuet1::>

Observe the output reported in the IOPS and Throughput columns for svm_vol01. Notice thatthe limiting factor is IOPS. Values for IOPS have dropped from the 1500 range down to 100, andthroughput is in the range of 50s. Press Ctrl-C when you are finished examining the output.

17. Bring the workload generator script window back into focus and press Ctrl-C. When asked if you wantto terminate the batch job, answer y, after which the window closes.

17

Figure 3-17:

18. On the desktop of Jumphost, double-click the workload-2048.bat file on the left side of the desktop tostart a new workload generator.


18

Figure 3-18:

19. A command prompt window opens and starts outputting workload statistics. The first line of outputshows that this I/O workload is doing reads with a block size of 2048 bytes against the share mountedon the Z: drive.

Figure 3-19:


20. In the PuTTY session window for cluster1, display the workload performance statistics for the workload.

cluster1::> qos statistics workload performance show -workload svm1_vol01-wid950Workload ID IOPS Throughput Latency --------------- ------ -------- ---------------- ---------- -total- - 622 123.06KB/s 1.75ms svm1_vol01-wi.. 950 53 106.67KB/s 19.93ms -total- - 59 107.68KB/s 18.18ms svm1_vol01-wi.. 950 53 106.67KB/s 19.99ms -total- - 57 106.18KB/s 18.76ms svm1_vol01-wi.. 950 53 106.00KB/s 20.06ms -total- - 152 111.60KB/s 7.36ms svm1_vol01-wi.. 950 53 106.00KB/s 20.06ms<Ctrl-C>cluster1::>

Observe the output reported in the IOPS and Throughput columns for svm_vol01. Notice that in thiscase, the limiting factor is Throughput. IOPS is in the range of 50s, and the Throughput values havechanged to the range of 100KBps. Press Ctrl-C when you are finished to terminates the workloadstatistics.

21. Bring the workload generator window into focus, and press Ctrl-C. When asked if you want toterminate the batch job, answer y, after which the window closes.

21

Figure 3-20:

22. Remove the QoS policy from vol01 so it will not hinder later exercises in this lab.

cluster1::> volume modify -vserver svm1 -volume svm1_vol01 -qos-policy-group noneVolume modify successful on volume svm1_vol01 of Vserver svm1.

cluster1::>

This completes the exercise.

3.5 SnapMirrorSnapMirror is the asynchronous replication technology used in ONTAP. Asynchronous replication refers to datathat is replicated (backed up to the same site or an alternate site) on a periodic interval rather than as soon as thedata is written.


MetroCluster, introduced with ONTAP 8.3, provides synchronous replication. Synchronous replication refersto data that is replicated (backed up to the same site, or an alternate site) as soon as the data is written.MetroCluster configuration is outside the scope of this lab.

ONTAP 8.3 provided a number of SnapMirror enhancements, including a version-flexible SnapMirror functionality,that allows the source of a SnapMirror relationship to be upgraded first (assuming that the source and destinationboth run a version of ONTAP 8.3, or later).

3.5.1 Exercise

In this lab activity, you create a version-flexible SnapMirror relationship between two volumes in cluster1 andcluster2. To do this, you first set up cluster peering between cluster1 and cluster2 by adding LIFs dedicated tointercluster peering, then establish an authenticated relationship between the clusters. After the cluster peeringrelationship is created, you will create a SnapMirror relationship between a volume on cluster1 (that serves as thesource of the SnapMirror relationship), and another volume on cluster2 (that serves as the disaster recover (DR)copy).

3.5.1.1 Create Intercluster LIFs.Before you set up the authenticated relationship between cluster1 and cluster2, the clusters must be able tocommunicate with each other. Intercluster LIFs serve this purpose.

Perform the following tasks to create intercluster LIFs.

Attention: In this exercise, you use System Manager both on cluster1 and on cluster2, so pay specialattention to which cluster you are connected to during each step.

1. In your Chrome browser, click the browser tab for System Manager on cluster1.2. If System Manager is not already logged in, enter the credentials for the user admin, with the password

Netapp1!.3. Click Sign In.

1

2

3

Figure 3-21:


4. On the command bar at the top of the window, click Network.5. In the “Network” pane, click the Network Interfaces tab.6. In the “Network” pane, click the Create button.

4

5

6

Figure 3-22:

The “Create Network Interface” dialog box opens.

7. Set the fields in this window as follows:

• “Name:” intercluster_lif1• “Interface Role:” Intercluster Connectivity• “IPspace:” Default• “Assign IP address:” Using a subnet

When you set this field, the “Add Details” window opens.

• The defaults in the Add Details window are all fine, so click OK.

The “Add Details” window closes.• “Ports:” Select the entry for cluster1-01 > e0c

8. Click Create.


8

Figure 3-23:

The “Create Network Interface” window closes, and focus returns to the “Network” pane in SystemManager.

Your newly created LIF intercluster_lif1 should be listed under the “Network Interfaces” list in theNetworks pane, although you may need to scroll down to see it.

Every node in cluster1 requires a cluster interconnect LIF, and since cluster1 is a two-node cluster, youalso need to create a cluster interconnect LIF for cluster1-02.

9. Click the Create button again.


9

Figure 3-24:

The “Create Network Interface” dialog window opens.10. Set the fields in this window as follows:

• “Name:” intercluster_lif2• “Interface Role:” Intercluster Connectivity• “IPspace:” Default• “Assign IP address:” Using a subnet

The “Add Details” window opens.



11. Click Create.


11

Figure 3-25:

The “Create Network Interface” window closes, and focus returns to the “Network” pane in SystemManager.

12. System Manager should still show the Network Interface list in the Network pane. Scroll down to thebottom of the list to see the entries for the new intercluster LIFs that you created. The assigned IPaddresses for those LIFs are included in the list entries.

13. If you click a specific LIF, you can see more detail displayed on the bottom of the pane.

In this example, the IP addresses for the intercluster LIFs are 192.168.0.158 and 192.168.0.159.However, because ONTAP assigns the LIF addresses automatically, it is possible that the values inyour lab are different from the values in the example.


Attention: Record the actual addresses assigned to the intercluster LIFs in your lab becauseyou will need them for a later step of the lab.

12

13

Figure 3-26:

You just created the intercluster LIFs for cluster1, so now create the intercluster LIFs for cluster2. Sincecluster2 contains a single node, you will only create one intercluster LIF for this cluster.

14. In your Chrome browser, click the browser tab for cluster2.15. If System Manager is not already logged in, log in as the user admin, with the password Netapp1!.16. On the command bar at the top of the window, click Network.17. In the “Network” pane, click the Network Interfaces tab.18. In the “Network” pane, click the Create button.


16

17

18

14

Figure 3-27:

The “Create Network Interface” dialog box opens.

19. Set the fields in this window as follows:

• “Name:” intercluster_lif1

Note: You can use the same name here that you used on cluster1 because LIFnames are scoped to the containing cluster.

• “Interface Role:” Intercluster Connectivity• “IPspace:” Default• “Assign IP address:” Using a subnet

The “Add Details” window opens.



20. Click Create.


20

Figure 3-28:

The “Create Network Interface” window closes, and focus returns to the Network pane in SystemManager.

21. Record the IP address that Data ONTAP automatically assigned to your LIF. In this example, theaddress is 102.168.0.165, but the value may be different in your lab.


21

Figure 3-29:

Now that all your nodes have intercluster LIFs, it's time to establish the cluster peering relationship.22. In your Chrome browser, click the browser tab for cluster1.23. On the command bar at the top of the window, click Configurations.

Note: You may need to expand your browser if you don't see this entry in the command bar inyour lab.

24. In the left pane under the “Cluster Settings” section, click Cluster Peers.25. In the “Peers” pane, click Create.


24

25

2322

Figure 3-30:

The “Create Cluster Peer” dialog box opens.

26. In the “Passphrase” box enter Netapp1!.27. In the “Intercluster IP Addresses” box, add the IP address that you noted earlier for the LIF

intercluster_lif1 from the node cluster2-01.

Caution: In the example shown in this lab, the address was 192.168.0.165, but the addressthat ONTAP assigned to the LIF in your lab might be different.

28. Click Create.


26

27

28

Figure 3-31:

The “Confirm Create Cluster Peer” dialog box opens.

29. Click OK.

29Figure 3-32:

The dialog box closes, and you return to the System Manager window.30. An entry for cluster2 now appears in the Peers list, but it is shown as “unavailable” because the

authentication status is still pending. You have initiated a cluster peering operation from cluster1, but tocomplete it, cluster2 must also accept the peering request.


30

Figure 3-33:

Switch over to cluster2 so that you can accept the cluster peering operation.31. In your Chrome browser, click the browser tab for cluster2.32. On the command bar at the top of the window, click Configurations.33. In the left pane under the “Cluster Settings” section, click Cluster Peers.34. In the Peers pane, click Create.


31 32

3334

Figure 3-34:

The “Create Cluster Peer” dialog box opens.

35. In the “Passphrase” box enter Netapp1!.36. In the “Intercluster IP Addresses” box, add the IP addresses that you noted earlier for the intercluster

LIFs on cluster1 (intercluster_lif1 and intercluster_lif2).

Caution: In the example shown in this lab, the addresses were 192.168.0.158 and192.168.0.159, but the addresses assigned to the LIFs in your lab might be different.

37. Click Create.


35

36

37

Figure 3-35:

The “Confirm Create Cluster Peer” dialog box opens.38. Click OK.

38Figure 3-36:

The dialog box closes, and you return to the System Manager window.

39. System Manager takes a few moments to create the peer relationship between cluster1 and cluster2.The authentication status for that relationship should change to “ok” immediately, but the Availabilitycolumn will be at “pending”.

40. Wait a few seconds, then click Refresh every 1–2 seconds until the Availability column changes from“pending” to “Available”.


39

40

Figure 3-37:

41. Click on the Chrome browser tab for cluster1, which should still be displaying the cluster peering pagein System Manager.

42. Click the Refresh button to update the status information on the peering relationship.43. The value in the Availability column should change from “Unavailable” to “Available”.


41

42

43

Figure 3-38:

At this point, the two clusters have an established peering relationship. Next, you can create aSnapMirror relationship.

3.5.1.2 Create a SnapMirror RelationshipBecause you created a peering relationship between the two clusters, they are now capable of entering into aSnapMirror relationship between each other. In this exercise, you establish a SnapMirror relationship between anSVM volume on each cluster.

1. In your Chrome browser, click the browser tab for cluster2.2. On the command bar at the top of the window, navigate to Protection > Relationships.3. ClickCreate.


12

3

Figure 3-39:

The “Browse SVM” window opens.

4. Select svm1-dr to be the SVM for the destination volume.5. Click Select.


4

5

Figure 3-40:

The “Browse SVM” window closes, and the “Create Protection Relationship” window opens.

6. In the “Relationship Type” section, leave the “Relationship Type:” field set to to the default value ofMirror to indicate that this is a SnapMirror relationship.

7. Check the Create version-flexible mirror relationship checkbox.8. In the “Source Volume” section, click the Browse... button next to the “Storage Virtual Machine:” field.


6

7

8

Figure 3-41:

The “Select Source Storage Virtual Machine” window opens.

9. Note there are no SVMs listed in this window because no VMs have been peered to this SVM (svm1-dr)yet.

10. Click the Athenticate link.


9

10

Figure 3-42:

The “Authentication” window opens.

11. The credentials fields are pre-populated with incorrect values, so replace the Username with admin,and the password with Netapp1!.

12. Click OK.

11

12

Figure 3-43:

The “Authentication” window closes, and the “Remote cluster certificate not trusted” window opens.


13. The clusters in this lab are using self-signed certificates, so it is ok to trust the connection. Click Yes tocontinue with the connection.

13

Figure 3-44:

The “Remote cluster certificate not trusted” window closes, and the “Select Source Storage VirtualMachine” window opens.

14. Select the entry for svm1.15. Click Peer and Continue.

14

15Figure 3-45:

The “Select Source Storage Virtual Machine” window closes and focus returns to the “Create ProtectionRelationship” window.


Now that the SVMs are peered, continue populating the fields in this window.16. Use the Browse... button next to the “Volume:” field to set that field to svm1_vol01.17. In the “Destination Volume” section, use the Browse... button next to the “Aggregate” field to set the

value of that field to aggr1_cluster2_01. Leave all other fields in this section at their default values.18. In the “Configuration Details” section, use the Browse... button next to the “Schedule:” field to set the

value of that field to daily.19. Scroll down to the bottom of this window and make sure the Initialize Relationship checkbox is

checked. It should be checked by default.20. When finished, click Create.

16

17

1819

20

Figure 3-46:

The “Create Protection Relationship” begins the process of establishing and initializing the SnapMirrorrelationship between the volumes.

21. When the status of all the initialization operations indicate success, click OK.


21

Figure 3-47:

The “Create Protection Relationship” window closes, and focus returns to the “Relationships pane inSystem Manager.

You can now view information regarding the SnapMirror relationship you just created.22. Still in the “Relationships” window, click on the svm1_vol01 entry (this is the only entry in the

relationships list). The Relationship State displays as “Uninitialized”, and the Transfer Status displaysas “Transferring”.

23. In the main pane, click the Refresh button periodically until the “Transfer Status” value changes to“Idle”, indicating that the baseline transfer has completed.


22

23

Figure 3-48:

Note: In this lab the baseline transfer will complete in just a minute or two because the volumesvm1_vol01 contains very little data. In a production environment with larger data sets thebaseline transfer will take much longer to complete.


3.6 SnapLock

SnapLock is the NetApp high-performance compliance solution that provides the capability of data retentionand Write Once, Read Many (WORM) protection for retained data. With SnapLock, customers can create non-modifiable, non-erasable volumes to prevent files from being altered or deleted until a specified retention date.SnapLock allows this retention to be performed at the file level through standard open file protocols such as CIFSand NFS.

SnapLock is a license-based feature of ONTAP that works with application software to administer non-rewritablestorage of data. There are two types of SnapLock: SnapLock Compliance (SLC) and SnapLock Enterprise (SLE).Both types can be activated through a single add-on license in ONTAP. Both the types run on NetApp systemswith lower cost SATA-based drives, or higher performance SAS or fiber-attached disk drives. This flexibility allowscustomers to buy the amount and type of storage that fit their business needs for SnapLock WORM storage.

3.6 What Are SnapLock Compliance and SnapLock Enterprise?Both SnapLock types provide the capabilities of non-erasable, non-rewritable WORM data permanencefunctionality using high-throughput magnetic disk drives in a cost-efficient, highly available RAID configuration.From a data protection perspective, the process of committing data to an immutable WORM state on eitherSnapLock type can be thought of in the same manner as storing data on an optical platter. Similar to an opticalplatter burned with data, both SnapLock types protect data committed to WORM state from any possiblealteration or deletion until their retention periods have been expired.


SnapLock Compliance (SLC) is designed to assist organizations in implementing a comprehensive archivalsolution for meeting strict regulatory requirements for data retention, such as SEC 17a-4. SnapLock Complianceprovides an “untrusted storage administrator” model of operation, in which the records and files committed toWORM storage on a SnapLock Compliance volume can never be altered or modified, and can be deleted onlyafter their retention periods expire. Moreover, a SnapLock Compliance volume cannot be deleted until all therecords and files stored on it have passed their retention periods. In case of SLC, any operation by the storageadministrator that could compromise WORM data is not permitted, and there is protection not only at the file levelbut also at volume, aggregate, and disk levels.

SnapLock Enterprise (SLE), in contrast, operates under a “trusted storage administrator” model, and is designedto help organizations meet self-regulated and best practice guidelines for protecting digital assets with WORMdata storage. Data stored on a SnapLock Enterprise volume is protected from alteration or modification.SnapLock Enterprise has one main difference from SnapLock Compliance. Because the stored data is not forstrict regulatory compliance, SnapLock Enterprise volumes, and the data they contain, can be destroyed by anadministrator with root privileges on the storage system that contains the SnapLock Enterprise volumes beforethe end of their retention periods.

Attention: Even those with administrative access to the storage system are not permitted to modifyindividual files under WORM protection on a SnapLock Enterprise volume.

For the purpose of this lab, you will use SnapLock Enterprise (SLE) aggregates.

3.6.1 Exercise

3.6.1 Create A SnapLock Aggregate On Each ClusterSnapLock is the aggregate-level property. You must create a SnapLock aggregate before creating a SnapLockvolume. The SnapLock mode for the aggregate, Compliance or Enterprise, is inherited by the volumes in theaggregate. You can destroy or rename an Enterprise aggregate at any time. You cannot destroy or rename aCompliance aggregate until the retention period has elapsed.

The SnapLock aggregate can be created through either the System Manager GUI, or the ONTAP NetAppManageability SDKs, or using the command line. In this lab activity, you will create a SnapLock Enterpriseaggregate on node 1 in both cluster1 and cluster2 using System Manager GUI. You can create aggregates fromthe System Manager Dashboard.

1. In your Chrome browser, click the browser tab for cluster1.2. In the command bar at the top of the window, navigate to Hardware and Diagnostics > Aggregates.3. Click on the Create button to launch the Create Aggregate Wizard.


1

2

3

Figure 3-49:

The “Create Aggregate” window opens.4. Specify the “Name” of the aggregate as aggr_sle_cluster1_01.5. For “Disk Type”, click Browse.

45

Figure 3-50:

The “Select Disk Type” window opens.6. Select the Disk Type entry for the node cluster1-01.7. Click OK.


67

Figure 3-51:

The “Select Disk Type” window closes, and focus returns to the “Create Aggregate” window.8. The “Disk Type” should now show as VMDISK.9. Set the “Number of Disks” to 5.10. Select the “SnapLock Type” as SnapLock Enterprise.11. Check the Initialize ComplianceClock checkbox. In a production environment, a storage administrator

should take note of the current system time and make sure that the storage system’s time is asaccurate as possible.

Note: When you create a SnapLock aggregate for the first time on a node, you will see amessage in the wizard asking you to initialize the ComplianceClock. In a data complianceenvironment you cannot rely on a system clock because it can be arbitrarily modified by theadministrator, thereby compromising the retention period of WORM files and Snapshot®copies. Therefore, SnapLock relies on the ComplianceClock service in ONTAP, which is asoftware-based tamper-resistant clock. The ComplianceClock can be initialized only once by theadministrator on every node.

12. Click Create.


8

9

10

11

12

Figure 3-52:

The “Create Aggregate” window closes, and focus returns to the Aggregates view in System Manager.13. Select the entry for the newly created aggregate “aggr_sle_cluster1_01” if it is not already selected.

Specifically, note that this aggregate has the “SnapLock Type” as SnapLock Enterprise.


13

Figure 3-53:

Now repeat the process to create a new aggregate on the node “cluster2-01”.14. In Chrome, select the browser tab for cluster2.15. In the command bar at the top of the window, navigate to Hardware and Diagnostics > Aggregates.16. Click on the Create button to launch the Create Aggregate Wizard.

1415

16

Figure 3-54:

The “Create Aggregate” window opens.17. Specify the “Name” of the aggregate as aggr_sle_cluster2_01.18. Since there is only one node in this cluster (and therefore only one place to select drives from), the

“Disk Type” field is pre-populated with VMDISK.19. Set the “Number of Disks” to 5.20. Select the “SnapLock Type” as SnapLock Enterprise.21. Check the Initialize ComplianceClock checkbox.


22. Click Create to create the new aggregate and to close the wizard.

1718

19

20

21

22

Figure 3-55:

The “Create Aggregate” window closes, and focus returns to the Aggregates view in System Manager.23. Select the entry for the newly created aggregate “aggr_sle_cluster2_01” if it is not already selected. In

the last column, you will see the “SnapLock Type” is SnapLock Enterprise.


23

Figure 3-56:

3.6.1 Create A Volume Within The SnapLock AggregateNow that you have created the SnapLock aggregate “aggr_sle_cluster1_01” on the node “cluster1-01”, you willuse that aggregate to host a thinly provisioned volume named worm” for the SVM named “svm3”.

1. In your Chrome browser, click the browser tab for cluster1.2. In the command bar at the top of the window, click SVMs.3. In the SVM's list click svm3


1

2

3

Figure 3-57:

4. Click the Volumes sub-tab.5. Click Create to launch the Create Volume Wizard.

4

5

Figure 3-58:

The Create Volume wizard window opens.6. Specify the “Name” of the volume as worm.7. Use the Choose button to set the Aggregate to aggr_sle_cluster1_01.


8. Set the “Total Size” to 10 GB.9. Set “Space Reserve” to Thin Provisioned.

Figure 3-59:

6

7

8

9

10. Select the SnapLock tab.

Here you can configure autocommit-period, minimum-retention-period, maximum-retention-period anddefault-retention-period for the SnapLock volume. In the production environment, retention periods aretypically configured in years. But, for the demonstration purposes in this lab, you will configure retentionperiods in minutes, which can only be done using CLI. Leave all the values at their default for now.

11. Click Create.


10

11

Figure 3-60:

##The “Create Volume” window closes, and focus returns to the “Volumes” pane in System Manager.12. The newly created “worm” enterprise volume now appears in the Volumes list. You can see the

SnapLock details in the “SnapLock Details” section of the lower pane. (You may need to scroll thewindow to the right to see this information.)


12

Figure 3-61:

System Manager has also automatically mapped the engineering volume into the SVM’s NASnamespace.

13. In the command bar at the top of the window, click Namespace.14. Notice that the “worm” volume is now junctioned under the root of the svm3's namespace, and has also

inherited the default NFS Export Policy.

13

14

Figure 3-62:


Since you have already configured the access rules for the default policy, the volume is instantlyaccessible to CIFS or NFS clients. The worm volume was junctioned as “/worm”, meaning that anyclient that had mapped a share to \\svm3\corp or NFS mounted svm3:/ would now instantly see theworm directory in the share, and in the NFS mount.

3.6.1 Modify The Retention Time For The SnapLock Volume Using The CLIYou can set the retention time for a file explicitly, or you can use the default retention period for the volume toderive the retention time. Unless you set the retention time explicitly, SnapLock uses the configured volume-leveldefault retention period to calculate the retention time. For the demonstration purpose, you will set the retentionperiod for the worm volume in minutes.

1. On Jumphost, open a PuTTY session to cluster1, and log in as admin with the password Netapp1!.2. View the snaplock details for the worm volume.

cluster1::> volume snaplock show -vserver svm3 -volume worm

Vserver: svm3 Volume: worm SnapLock Type: enterpriseMinimum Retention Period: 0 yearsDefault Retention Period: minMaximum Retention Period: 30 years Autocommit Period: none Privileged Delete: - Expiry Time: none ComplianceClock Time: Thu Sep 15 23:05:56 UTC 2016 +00:00

cluster1::>

3. Set the default retention period for the worm volume to 5 minutes.

cluster1::> volume snaplock modify -vserver svm3 -volume worm -default-retention-period 5 minutes

cluster1::>

4. Verify that the default retention period for the worm volume is set to 5 minutes.

cluster1::> volume snaplock show -vserver svm3 -volume worm

Vserver: svm3 Volume: worm SnapLock Type: enterpriseMinimum Retention Period: 0 yearsDefault Retention Period: 5 minutesMaximum Retention Period: 30 years Autocommit Period: none Privileged Delete: - Expiry Time: none ComplianceClock Time: Thu Sep 15 23:06:37 UTC 2016 +00:00

cluster1::>

5. Close the PuTTY session to cluster1.

cluster1::> exit

3.6.1 Connect To The SnapLock Volume From A Windows ClientThis part for the lab demonstrates connecting the Windows client Jumphost to the CIFS share “\\svm3\worm”using the Windows GUI.

1. On the taskbar of Jumphost, launch Windows Explorer.


1

Figure 3-63:

Windows Explorer opens.2. In Windows Explorer, select the P: drive, which is mapped to the “\\svm3\corp” share.3. The worm volume you earlier junctioned into the svm3’s namespace is visible at the top of the corp

share, which points to the root of the namespace. Double-click on the worm folder to open it so thatWindows Explorer now displays the contents of the worm folder (which is empty).

2

3

Figure 3-64:

Now create a file in this folder to commit it to WORM.4. Right-click in the empty space in the right pane of File Explorer.5. In the context menu, select New > Text Document.

Figure 3-65:


4

5

6. Name the resulting file compliance.txt.7. Double-click the compliance.txt file you just created to open it with Notepad.

6

7

Figure 3-66:

Notepad opens.8. In Notepad, enter some text, and use the File > Save menu to save the file’s updated contents to the

share.9. Close Notepad.


8

9

Figure 3-67:

Notepad closes.10. In Windows Explorer, right click on compliance.txt, and select Properties from the context menu.

10

Figure 3-68:

The “compliance.txt Properties” window opens.11. Check the Read-only checkbox.

You commit a file to WORM manually by making the file read-only. You can use any suitable commandor program over NFS or CIFS to change the read-write attribute of a file to read-only.

12. Click OK.


11

12

Figure 3-69:

The “compliance.txt Properties” window closes.

Now the file compliance.txt has been committed to WORM with a 5 minute retention duration as youconfigured earlier.

13. Quickly reopen the compliance.txt (by double-clicking the file).14. Change the file's contents, and try to save it again.


13 14

Figure 3-70:

15. You are presented with a “Save As” window, because Windows Explorer is unable to write to the filesince you are not allowed to change the contents of the file committed to WORM.

16. Click Cancel.


15

16

Figure 3-71:

17. Close Notepad, discarding the changes you tried to make.18. In Windows Explorer, try to permanently delete the file by selecting it and using Shift+Delete on your

keyboard.19. When the “Delete a File” window opens, click Yes.

19

Figure 3-72:


The “Delete a File” window closes and the “File Access Denied” window opens.20. Click Cancel.

20

Figure 3-73:

The “File Access Denied” window closes.

You are not allowed to delete the file committed to WORM until the retention period of 5 minutes hasexpired. After that time has passed you will be able to delete this file. However, even then you willstill not be able to change the contents of the file, even if you change the file's properties to makeit writeable again. You will not get an operating system error when you try to write to the file in thisscenario, but the file's contents will not change. You can verify this if you try to read the file's contentsagain, and you are free to do so.

21. When you are finished, close Windows Explorer.

3.6.1 Create A Backup Copy Of The SnapLock VolumeTo comply with data retention rules, regulatory agencies might require that a second copy of archived data bekept at a remote site. The most straightforward and natural way to comply with this requirement is to replicatedata from a primary NetApp system to a secondary NetApp system in a separate location. You can useSnapMirror to replicate WORM files to another geographic location for disaster recovery and other purposes.

This part for the lab demonstrates mirroring a SnapLock volume from cluster1 to cluster2. The source anddestination volumes must be created in peered clusters with peered SVMs. You have already peered the clustersin the previous section. If not, you need to complete that section in order to proceed further.

1. In Chrome, click the browser tab for cluster1.2. In the command bar at the top of the window, click SVMs.3. In the SVMs list, click svm3.


12

3

Figure 3-74:

4. Select the Volumes sub-tab.5. In the “Volumes” pane, select the entry for the worm volume.6. Click the Protect button to open the Create Protection Relationship wizard.

45

6

Figure 3-75:

The “Create Protection Relationship” window opens.


7. Leave the “Relationship Type” as Mirror.8. In the “Destination Volume” section, select the “cluster” as cluster2.9. Click Browse that is located next to the “Storage Virtual Machine” field.

7

8

9

Figure 3-76:

The “Select Destination Storage Virtual Machine” window opens.10. Click on Authenticate to view the list of SVMs that are not peered.


10

Figure 3-77:

The “Authentication” dialog box opens.11. Specify the “Username” as admin, and “Password” as Netapp1!.12. Click OK.

11

12

Figure 3-78:

The “Authentication”dialog closes, and the “Remote cluster certificate not trusted” window opens.13. Click Yes to trust the connection.


13

Figure 3-79:

The “Remote cluster certificate not trusted” window closes, and the “Select Destination Storage VirtualMachine” window opens.

14. Select svm3-dr from the list.15. Click Peer and continue.

14

15Figure 3-80:

The “Select Destination Storage Virtual Machine” window closes, and focus returns to the “CreateProtection Relationship” window.

16. Use the Browse button next to the “Aggregate” field to set that field to aggr_cle_cluster2_01.


17. In the “Configuration Details” section, use the Browse button that is next to the “Schedule” field to setthat field to weekly.

18. Leave the other field values at their defaults.19. Click Create.

16

17

19

Figure 3-81:

The “Create Mirror Relationship” changes to displays the process of establishing and initializing theSnapMirror relationship between the volumes. When it finishes all the lines in the Status section havegreen checkmarks.

20. Click OK.


20

Figure 3-82:

The “Create Protection Relationship” window closes, and focus returns to the “Volumes” view SystemManager.

21. In the “Volumes” list, select the entry for the worm volume if it is not already selected.22. At the bottom of the window, select the Data Protection tab.23. The lower pane shows that the worm volume has a healthy SnapMirror relationship to the

svm3_worm_mirror volume.


21

22

23

Figure 3-83:

You have now successfully established a SnapMirror relationship. To verify the status of thatdestination's SnapLock status you'll need to look at the destination cluster.

24. In Chrome, select the browser tab for cluster2.25. In the command bar at the top of the window, click on SVMs.26. In the SVM's list, click on the svm3-dr.


24

25

26

Figure 3-84:

27. Click the Volumes sub-tab.28. In the “Volumes” list, select the entry for svm3_worm_mirror.29. You can see the SnapLock details in the lower pane titled “SnapLock Details”. Notice that the values for

“ComplianceClock Time”, “Maximum Retention Period”, “Minimum Retention Period”, “Default RetentionPeriod”, and “Autocommit Period” have been replicated successfully from source to destination.


2728

29

Figure 3-85:


3.7 Application Provisioning with ONTAP 9 System ManagerApplication Provisioning is a new feature in ONTAP 9 System Manager on All Flash FAS (AFF) systems thatoffers simplified out-of-box ability to quickly provision storage for a number of popular applications based ontemplates. The templates prompt users to supply all the necessary information to provision volumes, shares orLUNs, and initiator groups, while adhering to best practices.

3.7.1 Exercise

In this activity you will use three templates to easily and rapidly create volumes and configure them for use whileconforming to best practices. The first exercise will be for a SQL application over SMB, followed by similar stepsfor SAN. The third exercise cover datastore provisioning for VMware.

Caution: This lab has a known issue with the Oracle templates. Avoid using the Oracle options, as theywill likely return errors.

3.7.1 Application Provisioning Demonstration for SQL Server on SMB or SANThis activity uses the Application Provisioning Template to deploy volumes, and configure shares and LUNsspecifically for quick setup of a Microsoft SQL Server.



Netapp1!.3. Click SVMs4. Click svm2.

1

3

4

Figure 3-86:

5. Click Application Provisioning.6. Click the template for SMB SQL Server.

5

6

Figure 3-87:


In the lower pane of the System Manager window, complete the fields as follows:7. “Database Name:” DB1onCIFS8. “Database Size:” 109. “Log Size:” 1010. “Tempdb Size:” 1011. “Number of Server Cores:” 4 (this is the default value)12. “Span HA Controller Nodes:” No (this is the default value)13. “SQL Server Installation Account:” DEMO\Administrator14. “SQL Server Service Account:” DEMO\Administrator15. “SQL Server Agent Service Account:” DEMO\Administrator

Attention: In a production environment it is highly unlikely that you would want to use a domainadministrator account for these three SQL Server account names, but since SQL Server isnot actually installed in this lab, for the purpose of demonstrating application provisoning, anyaccount name will do.

16. Click Provision Storage.

7

89

101112

13

14

1516

Figure 3-88:

17. Provisioning begins, and as it runs you will see Progress Messages display in the lower pane.18. Click Done.


17

18

Figure 3-89:

Now you will provision application storage using the SAN SQL Server template.

1. Click the template SAN SQL Server.


1

Figure 3-90:

Observe that the layout for this template is similar to what you just saw for the SMB SQL Server, butinstead of accounts you have Initiator settings required for a SAN LUN. Complete the fields as follows:

2. “Database Name:” DB2onSAN3. “Database Size:” 104. “Log Size:” 105. “Tempdb Size:” 10 (this is the default value)6. “Number of Server Cores:” 4 (this is the default value)7. “Span HA Controller Nodes:” No8. “Initiator Group:” Create New9. “Initiator Group Name:” IG110. “Initiator OS Type:” Windows11. “Initiator OS Type:” iqn.1991-05.com.microsoft:jumphost.demo.netapp.com12. Click Provision Storage.


23

4

5

6

7

8

9

10

11

12

Figure 3-91:

13. Examine the Progress Messages once provisioning completes.14. Click Done.


13

14

Figure 3-92:

This exercise is completed.

3.7.1 Application Provisioning Demonstration for NAS Virtual ServerInfrastructureIn this exercise you will use the Application Provisioning Template to deploy multiple volumes, and configureexports that can be use for VMware Datastores.


Netapp1!.3. Click SVMs4. Click svm2.


1

3

4

Figure 3-93:

5. Click Application Provisioning.6. Click the template NAS Virtual Server Infrastructure.

5

6

Figure 3-94:

In the lower pane of the System Manager window, complete the fields as follows:7. “Select Hypervisor:” VMware.


Note: Hyper-V and XenServer/KVM are also supported.8. “Datastore Prefix:” Datastore.9. “Number of Datastores:” 8 (this is the default value).10. “Datastore Size:” 1 GB.

Note: In a production environment you would normally provision storage in TB, but for thepurposes of this demo 1 GB is sufficient.

11. “Volume Export Configuration:” Allow All .

Note: From here you may also want to create a new custom policy, or select from an existingone.

12. “Host IP Addresses:” <leave blank> (this is the default value).

Note: No specific address is needed because you are setting “Volume Export Configuration” to“Allow All”. Alternately, you could include a specific set of NFS network IPs for a set of VMwareESX host or hosts in this field to avoid the need to use an export policy.

13. Click Provision Storage.

7

8

910

11

12

13

Figure 3-95:

14. While provisioning executes, you will see the Progress Messages that you can scroll through for details.Observe that the datastores were each created with names 1-8.

15. Note the warning about the routing configuration problem on the SVM. Application provisioningperforms a numbers of error checks as it runs, and when it encounters problems it will warn of an issuethat may need further attention. If the error is serious enough to prevent application provisioning fromcompleting, in many cases the provisioning process will actually roll back changes that were appliedearlier in the execution so as to not leave a partially configured mess for you to manually clean up.

16. Click Done.


14

15

16

Figure 3-96:

Remediating the SVM network route learning lies outside of this lab's scope, so this lab exercise is complete.

3.8 Appendix: Additional Administrative Users and RolesClustered Data ONTAP supports the concept of administrative users with roles. Each of these users is associatedwith a particular role that defines the commands that it can use when administering the cluster. Clustered DataONTAP provides a number of predefined roles that you can use, and you can create your own customized roles,if required.

In System Manager, roles and users are grouped separately under the cluster and the SVM. If you use the CLI,you will see roles and users together with the same commands.

3.8.1 Cluster-Scoped Users and Roles

In this section, you will look at the users and roles that apply to the whole cluster. You can use System Managerto add an access-control role and specify the command or command directory that the role's users can access.You can also control the level of access the role has to the command or command directory, and specify a querythat applies to the command or command directory.

1. In Chrome, select the tab for cluster1.


2. Click Configurations.3. In the left pane, in the “Cluster User Details” section, click Roles.4. The “Roles” pane lists the predefined cluster-wide roles that come with clustered Data ONTAP.

1

2

3

4

Figure 3-97:

Next, take a look at the cluster-wide users. You can use System Manager to add, edit, and manage acluster user account, and specify a login user method to access the storage system.

5. In the left pane, click Users.6. In the “Users” pane, click Add.


5

6

Figure 3-98:

The “Add User” dialog box opens. Use this dialog box to create a new limited-permission administrativeuser for the cluster.

7. Set the user name to intern, and the password to netapp123.8. Click Add next to the “User Login Methods” pane.9. Set the “Application” field to ssh.10. Set the “Role” field to readonly.11. Click OK.


7

8

9 10

11

Figure 3-99:

The new user login method you just entered is displayed in the “User Login Methods” list.12. Click Add at the bottom of the dialog box.


12

Figure 3-100:

The “Add User” dialog box closes, and you return to the System Manager window.13. If Chrome prompts you to save the password for this site, click Never.

13

Figure 3-101:

14. The newly created “intern” account is now included in the list of accounts displayed in the “Users” pane.


14

Figure 3-102:

15. Start a new PuTTY session to cluster1, and log in as the user intern, using the password netapp123.Try listing the commands that are available by entering the ? command. Observe that the volumecreate, or aggregate create commands (among others) are not available because the “readonly”role you assigned to the “intern” account prevents access to commands that modify the clusterconfiguration.

3.8.2 SVM Users and Roles

In this section, you will look at the users and roles that are local to a single SVM.

1. In Chrome, click the browser tab for cluster1.2. In the command bar at the top of the window, click the SVMs.3. Select svm1 from the list of SVMs.


1

2

3

Figure 3-103:

4. Click the SVM Settings sub-tab.5. In the left pane, in the “SVM User Details” section, click Roles.6. The “Roles” pane now shows a list of predefined SVM-specific roles. In the “Roles” pane, select the

vsadmin-backup entry.7. Click Edit.


4

5

6

7

Figure 3-104:

The “Edit Role” dialog box opens.8. Scroll down the Role Attributes list to see the commands that are available to a user with this role. Note

that this role has full access to some commands, read-only access to others, and no access to the rest.9. Click Cancel to discard any changes you might have made in this dialog box.


8

9

Figure 3-105:

The “Edit Roles” dialog box closes and focus returns to the System Manager window. Take a look at theother roles for this SVM and observe how their permissions differ.

10. In the left pane, select Users.11. In the “Users” pane, select the vsadmin user.12. If you look at the “User Login Methods” area at the bottom of the Users pane, you can see that the

vsadmin user has the vsadmin role.


10

11

12

Figure 3-106:

13. Open a PuTTY session and connect to cluster1. Try to log in to cluster1 as vsadmin, with the passwordNetapp1!.

login as: vsadminUsing keyboard-interactive authentication.Password:Access [email protected]’s password:

Remember that the user vsadmin is specifically for administering the SVM svm1. To manage an SVMwith delegated SVM-scoped administration, you must log in to the management LIF for the SVM; in thiscase, svm1.

Identify the management LIF for the svm1 SVM.14. Close the PuTTY window.15. In System Manager, in the command bar at the top of the window, select Network.16. Select the Network Interfaces tab.17. In the network interface list, select the entry for svm1_admin_lif1, and observe it's assigned IP

address.


15

16

17

Figure 3-107:

Tip: Alternatively, use the cluster management CLI and type network interface show whenlogged in as the cluster administrator (user admin password Netapp1!) to obtain this IP address.

18. The management LIF for svm1 is named “svm1-mgmt” with the IP address 192.168.0.147. There isalso a connection entry in PuTTY named “cluster1-svm1”. Using the cluster1-svm1 connection entry inPuTTY, the username vsadmin, and the password Netapp123, connect to svm1 over SSH.

Note: If prompted whether to accept cluster1-svm1's ssh key, respond yes.

login as: vsadminUsing keyboard-interactive authentication.Password:svm1::>

19. As the vsadmin “user”, attempt to modify a network port or create a new aggregate by issuing thenetwork port modify command and the storage aggregate create command.

svm1::> network port modifyError: "port" is not a recognized commandsvm1::> storage aggregate createError: "storage" is not a recognized command

These commands are not available to you as the vsadmin user, because control of logical entitiesinside svm1 is delegated to vsadmin, while network ports and storage aggregates are physical entitiescontrolled by the cluster administrator.

20. As the vsadmin user, issue the volume new -aggregate ? command.

cluster1::> volume new -aggregate ? <aggregate name> Aggregate Namecluster1::>

Attention: You can create new volumes as the vsadmin user, but only on specific aggregates.The reason is that when the svm1 SVM was set up, the cluster administrator configured svm1


to allow volume creation on these aggregates. To view this list, issue the vserver show svm1 -fields aggr-list command.

cluster1::> vserver show -fields aggr-listvserver aggr-list------- -----------------------------------------------------------------------svm1 aggr1_cluster1_01,aggr1_cluster1_02,aggr2_cluster1_01,aggr2_cluster1_02cluster1::>

21. As the vsadmin user, issue the network interface modify command.

svm1::> network interface modifyError: "modify" is not a recognized command

Attention: You cannot modify network interfaces as the vsadmin user. The vsadmin userhas the vsadmin role, which provides read-only access to the “network interface” commanddirectory.

22. Close your PuTTY session.

3.9 Appendix: Active Directory Authentication TunnelingTo authorize cluster administrators by using Active Directory, you must set up an authentication tunnel througha CIFS-enabled SVM. You must also create one or more cluster user accounts for the domain users. Thisfunctionality requires that CIFS is licensed on the cluster.

This lab environment already has a CIFS-enabled SVM, which is “svm1”. Use svm1 to set up the authenticationtunnel.

Before you begin, verify your lab configuration.

1. Open a PuTTY session to cluster1, and log in as the user admin, with the password Netapp1!.2. Verify that no domain authentication tunnel currently exists.

cluster1::> security login domain-tunnel showThis table is currently empty.

3. After you verify that a domain authentication tunnel does not exist, verify that the CIFS-enabled SVM(svm1) is a member of the appropriate domain, “DEMO.NETAPP.COM”.

cluster1::> vserver cifs show -vserver svm1 Vserver: svm1 CIFS Server NetBIOS Name: SVM1 NetBIOS Domain/Workgroup Name: DEMO Fully Qualified Domain Name: DEMO.NETAPP.COMDefault Site Used by LIFs Without Site Membership: Authentication Style: domain CIFS Server Administrative Status: up CIFS Server Description: List of NetBIOS Aliases: -cluster1::>

4. After you verify that the CIFS-enabled SVM svm1 is a member of the appropriate domain, set up adomain authentication tunnel.

cluster1::> security login domain-tunnel create -vserver svm1

5. With the authentication tunnel configured, a new authentication method is available to you, “domain”.Use this new authentication method to create a new cluster administrator.

cluster1::> security login create -authentication-method domain -user-or-group-name DEMO\Administrator -application ssh

6. Close your PuTTY session.

cluster1::> exit


7. You can now log in to the cluster as a domain administrator, using the DOMAIN\username syntax. Opena new PuTTY session as described in the “Accessing the Command Line” section. When promptedfor a username and password, enter DOMAIN\Administrator as the user name, and Netapp1! as thepassword.

login as: DEMO\AdministratorUsing keyboard-interactive authentication.Password:cluster1::>

8. Exit the PuTTY session.

cluster1::> exit

3.10 Automated Nondisruptive UpgradesONTAP 8.3 added support for automated, nondisruptive software upgrades. These commands bring the ONTAPpackage into the cluster, perform validation of the cluster to verify that it is prepared for the upgrade, and thenperform the actual upgrade. Underneath, there are downloads, takeovers, and givebacks still being performed,but the cluster infrastructure will drive the process. The administrator is able to view the progress; pause, resume,or cancel an upgrade; and view the cluster update history. Go to the http://support.netapp.com/ site to obtain theONTAP image package.

Automated nondisruptive upgrades are available to update ONTAP 8.3 to later ONTAP versions. The code to runthe automated upgrades was introduced in ONTAP 8.3, so a traditional approach is required to get from version8.2 to version 8.3.

This lab examines the commands used to upgrade the cluster, but does not execute those commands. Thecommands are executed in the cluster1 CLI.

The cluster image directory contains the commands and command subdirectories used to perform automatednondisruptive upgrades. Examine the options that are available under this command directory.

cluster1::> cluster imagecluster1::cluster image> ? cancel-update Cancel an update package> Manage the cluster image package repository pause-update Pause an update resume-update Resume an update show Display currently running image information show-update-history Display the update history show-update-log Display the update transaction log show-update-progress Display the update progress update Manage an update validate Validates the cluster's update eligibilitycluster1::cluster image>

The cluster image package command directory contains the commands used to manage the software packagesthat contain future versions of ONTAP. Examine the options that are available under this directory.

cluster1::cluster image> packagecluster1::cluster image package> ? delete Remove a package from the cluster image package repository get Fetch a package file from a URL into the cluster image package repository show Display currently installed image information show-repository Display information about packages available in the cluster image package repositorycluster1::cluster image package>

Use the cluster image update command to upgrade a cluster once a new package has been added to the clusterpackage repository. Enter the cluster image command directory, and examine the parameters that are availablewith the cluster image update command.

cluster1::cluster image package> ..

http://support.netapp.com/


cluster1::cluster image> update ? [-version] <text> Update Version [[-nodes] <nodename>, ...] Node [ -estimate-only [true] ] Estimate Only [ -pause-after {none|all} ] Update Pause (default: none) [ -ignore-validation-warning {true|false} ] Ignore Validation (default: false) [ -skip-confirmation {true|false} ] Skip Confirmation (default: false) [ -force-rolling [true] ] Force Rolling Update [ -stabilize-minutes {1..60} ] Minutes to stabilize (default: 8)cluster1::cluster image>


4 Version History

Version Date Document Version History

1.0 October 2014 Insight 2014

1.0.1 December 2014 Updates for Lab on Demand

1.1 October 2015 Insight 2015

Refer to the Interoperability Matrix Tool (IMT) on the NetApp Support site to validate that the exactproduct and feature versions described in this document are supported for your specific environment.The NetApp IMT defines the product components and versions that can be used to constructconfigurations that are supported by NetApp. Specific results depend on each customer's installation inaccordance with published specifications.

NetApp provides no representations or warranties regarding the accuracy, reliability, or serviceability of anyinformation or recommendations provided in this publication, or with respect to any results that may be obtainedby the use of the information or observance of any recommendations provided herein. The information in thisdocument is distributed AS IS, and the use of this information or the implementation of any recommendations ortechniques herein is a customer’s responsibility and depends on the customer’s ability to evaluate and integratethem into the customer’s operational environment. This document and the information contained herein may beused solely in connection with the NetApp products discussed in this document.

Go further, faster®

© 2016NetApp, Inc. All rights reserved. No portions of this document may be reproduced without prior written consentof NetApp, Inc. Specifications are subject to change without notice. NetApp, the NetApp logo, Data ONTAP®,ONTAP®, OnCommand®, SANtricity®, FlexPod®, SnapCenter®, and SolidFire® are trademarks or registeredtrademarks of NetApp, Inc. in the United States and/or other countries. All other brands or products are trademarks orregistered trademarks of their respective holders and should be treated as such.

http://support.netapp.com/matrix/mtx/login.do

advanced concepts for netapp ontap 9 · advanced concepts for netapp ontap 9 2 ... describe...

Documents