netapp concept

ACP

How Data ONTAP uses ACP to increase storage availability

ACP, or Alternate Control Path, is a protocol that enables Data ONTAP to manage and control the DS4243 disk shelf storage subsystem. It uses a separate network (alternate path) from the data path, so management communication is not dependent on the data path's being intact and available.

You do not need to actively manage the DS4243 storage subsystem. Data ONTAP automatically monitors and manages the subsystem without operator intervention. However, you must provide the required physical connectivity and configuration parameters to enable the ACP functionality.

Note: You can install DS4243 disk shelves without configuring ACP. However, for maximum storage availability and stability, you should always have ACP configured and enabled.

After you enable ACP, you can use the storage show acp and acpadmin list all commands to display information about your ACP subsystem.

-----
Service Processor

A Service Processor (SP) provides remote management capabilities, including console redirection, logging and power control. It also extends AutoSupport by sending additional system event alerts. For example, the SP monitors the system temperatures, voltages, currents, and fan speeds. When an environmental sensor has reached an abnormal condition, the SP logs the abnormal readings, notifies Data ONTAP of the issue, and sends alerts and 'down system' notifications as necessary through an AutoSupport message, regardless of whether the storage system can send AutoSupport messages.

The SP is an integral, behind-the-scenes part of NetApp storage system products, starting with the 32xx Series.

So, for storage systems with the SP, there are two additional types of AutoSupport messages—SP-generated AutoSupport messages about the storage system, and storage system-generated AutoSupport messages about the SP.

SP-generated AutoSupport messages include the following information:

• In the subject line—A notification from the SP of the storage system, listing the system condition or event that caused the AutoSupport message and the log level.
• In the message body—The SP configuration and version information, the storage system ID, serial number, model, and host name.
• In the attachments—The system event logs, the system sensor state as determined by the SP, and the console logs. (The console logs are omitted if the autosupport.content option is set to minimal.)

What systems have Service Processor available to them?

All FAS22x0, FAS25xx, FAS32x0, FAS62x0 and FAS8xxx series storage systems have Service Processors.

Basic commands:

date - Outputs the date and time
exit - Exits the SP session and disconnects the client
events - Commands that report system events and event information
help - Command for help
priv - Allows to show & set the session mode
sp - Commands specifically affecting the SP
rsa - Commands for Remote Support Agent configuration
system - System-level commands from the SP
version - Display the version of SP firmware

Subcommands:

events all - Outputs all system events to the console
events info - Displays system events log information to the console
events newest - Displays the newest available system events
events oldest - Displays the oldest system events
events search - Searches and outputs system events to the console
priv show - Displays the current user mode
priv set - Returns to standard/admin user mode
priv set admin - Changes into admin user mode
priv set advanced - Changes into advanced user mode
priv set diag - Changes into diagnostic user mode
sp reboot - Reboots the SP
sp status - Displays SP Ethernet status information (the same output as 'ifconfig' for a specific adapter)
sp update - Performs an update of the SP firmware
sp uptime - Displays the current uptime of the SP
rsa setup - Performs a setup of the Remote Support Agent. Type 'rsa setup help' for additional options.
rsa show - Displays the configuration for Remote Support Agent. Type 'rsa show help' for additional options.
rsa test - Tests the Remote Support Agent configuration. Type 'rsa test help' for additional options.
rsa status - Displays the status of the Remote Support Agent. Type 'rsa status help' for additional options.
rsa help - Displays the Remote Support Agent help menu.
system battery - Battery related commands
system battery show - Displays the system battery status
system console - Toggles to the system console
system core - Dumps the system core and resets the filer
system log - Displays the system console logs on the console
system power - Command set for controlling system power
system power cycle - Toggles the system power off, then back on
system power off - Powers the system off
system power on - Powers the system on
system power status - Displays the system power status
system reset - Command set for resetting the system using the selected firmware
system reset backup - Reboots/resets the system using the backup firmware
system reset current - Reboots/resets the system using the current firmware
system reset primary - Reboots/resets the system using the primary firmware
system sensors - Command set for controlling system sensors
system sensors show - Displays the status of environmental sensors
system sensors get - Displays the status of a specific environmental sensor
system sensors set-thresh - Sets the threshold for a specific environmental sensor
system sensors set-fan - Sets the speed for a specific fan
system sensors monitor - Displays control sensors monitoring
system sensors thermal-mgmt - Sets specific thermal management controls
system fru - Command set for FRU
system fru show - Displays FRU information for currently installed hardware
system fru list - Displays the current list of FRU ID numbers on the screen

Commands available only in the Diagnostic mode:

ping - Sends ICMP echo request packets to network hosts
ping6 - Sends ICMPv6 echo request packets to network hosts
traceroute - Performs a trace route to a specific network host
nslookup - Queries the nameserver for the IP address of the given host optionally using a specified DNS server
gdb ssh - Starts the GDB service via secure SSH mode
gdb status - Prints the GDB service status
gdb stop - Stops the GDB service
gdb telnet - Starts the GDB service via insecure telnet mode
sp log audit - Print SP command history (available in diag or advanced mode)
sp log debug - Print all SP debug information (available in diag or advanced mode)
sp log messages - Print SP messages file (available in diag or advanced mode)
sp fw-test - Executes a test of the SP firmware
sp switch - Executes read/write/dump registers of the SP
sp switch-version - Displays the switch config prom version
sp switch-update - Performs and update of the sp switch config prom
sp hw-test - Executes a test of the SP hardware
sp loopback-test - Executes a loopback test
sp extended-self-test - Executes the extended self test of the SP
sp self-test - Executes a self test of the SP
system debug_port - Displays the debug port status
system battery flash - update battery firmware from an URL image
system battery verify - compare battery firmware against an URL image or default build image
system battery auto_update - query status or enable/disable battery firmware auto update upon next SP boot
system bbsp - Displays the BIOS BMC Status Port (BBSP)
sp ddr-version - sp ddr autoload prom version
sp ddr-update - update ddr autoload prom
system fan - Fan commands
system fan version - Displays fan firmware versions
system fan update - Performs an update of the fan firmware
system forensics enable - enable system forensics collection
system forensics disable - disable system forensics collection
system forensics set-time-limit - set maximum time limit in seconds for forensics collection
system forensics show - show system forensics configuration settings
system forensics log - display or clear system forensics logs
system forensics log dump - dump system forensics logs
system forensics log clear - clear system forensics logs
system forensics config - system forensics configuration
system forensics config clear - clear forensics config file and use default configuration
system forensics config update - update forensics config file from a url
system forensics config dump - show forensics config file
system fru log show - display fru log
system fru log clear - clear fru log
system fru led - led related commands
system fru led show - display fru led state
system fru led set - set fru led state
system mpc - Marvell prom controller commands
system mpc version - Displays the Marvell prom controller firmware version
system mpc update - Performs an update of the Marvell prom controller firmware

Data ONTAP commands for the Service Processor:

7-Mode:
sp help - Displays general help
sp help <command> - Displays either general help or help for a specific sp-based command
sp setup - Interactively configures the Service Processor
sp status - Displays the status of the Service Processor
sp test autosupport - Tests the Service Processor by sending an AutoSupport message
sp reboot - Reboots the Service Processor

Clustered Data ONTAP:
system node run -node <nodename> sp help - Displays general help
system node run -node <nodename> sp help <command> - Displays either general help or help for a specific sp-based command
system node run -node <nodename> sp setup - Interactively configures the Service Processor
system node run -node <nodename> sp status - Displays the status of the Service Processor
system node run -node <nodename> sp test autosupport - Tests the Service Processor by sending an AutoSupport message to all ASUP recipients
system node run -node <nodename> sp test snmp - Send test SNMP trap from SP to SNMP traphosts configured in Data ONTAP 
system node run -node <nodename> sp reboot - Reboots the Service Processor
system node run -node <nodename> sp update - Invokes the service processor update process
system node run -node <nodename> sp update-status - Displays the status of the Service Processor update process

-----

NetApp port and cabling

A FAS3240 (single-chassis HA) for example has two SAS, two GBIC slots, two GBICs with FCP modules, five RJ45 and a USB – and that’s without using the two PCI expansion slots or the chassis I/O expansion.

Here I’ll break down the ports you see on the back of a FAS3240 and describe the three “new” management methods e0M, SP and ACP.

The documentation that ships with the controller has a good legend to help decipher the icons printed by each connection:

And a picture of the chassis, just in case you are not standing next to it.

I’ll go left-to-right

7: SAS cables for your external SAS shelves. 0a, 0b. If you ordered your filer with SAS shelves it should have shipped with cables. Note that you can multi-path shelves with SAS just like FCP.

8: HA cables. c0a, c0b. If you buy a multi-chassis filer (ie you want a FAS3240 with the expansion module you’ll get two physical chassis) or want to do metro-cluster. Note also – these are 10G Ethernet ports but they have OS-set IP addresses and cannot be used for anything but HA.

6: FCP. 0c, 0d. Used for connecting to Fibre Channel switches, shelves or tape drives (for NDMP backups)

3: e0a and e0b. Two 1GB Ethernet adapters for network access and traditional management. iSCSI, CIFS, NFS, http will all use these ports.

4: Unlocked management. e0M / SP combo port. This is the successor to BMC/RLM out-of-band management port. It adds a twist in that port e0M on the filer shares this port (there is an internal hub). You can configure just the SP port (sp setup) and use it for out-of-band management, you can also configure e0M from the filer which will use this port for in-band management – Filerview, System Manager etc. Note that you are required to have e0M on a separate IP network than your other ethernet ports, and it is required to be on the same network as the Service Processor. It is possible data (iSCSI, NFS, CIFS) traffic will go out this port as a last resort – but it won’t have it’s own default gateway. This needs to be on a dedicated management-only network. Do not configure e0M unless you intend to use it – the filer will default management traffic to it if it is configured.

5: Locked management. e0P. Used for Alternate Control Path (ACP) Out-Of-Band (OOB) management of SAS shelves More and More

1/2: Serial port and RJ45-to-DB9 adapter. Used to manage the filer via console. Note you’ll need one of these if you have a modern system to connect the old-school serial cable up to your modern USB port. Don’t forget putty also.

Not labeled: USB. Currently described as “unused”

Always configure SP. Don’t configure e0M unless SP is connected to a dedicated management network. Always connect the ACP cables (hey, you paid for it!).
Always multipath SAS and FCP when you have the ports available.
Always take the lifeboat with the motor.

---

Many of the specifics of the DS2246 are encoded in the product name:

  DSxxxx: Disk shelf
  DS2xxx: 2U
  DSx24x: 24 drives
  DSxxx6: 6Gbps SAS (aggregate 24Gb/sec)

---

http://www.sysadmintutorials.com/tutorials/netapp/netapp-disk-shelf-cabling-examples/

Netapp Disk Shelf Cabling Examples

This page is dedicated to a few examples I’ve put together in Visio to highlight the correct SAS and ACP cabling combinations for Netapp disk shelf cabling.

Two types of controllers and two types of disk shelves are used in these examples. They are:

• Netapp FAS2040
• Netapp FAS3240
• Disk Shelf DS4243
• Disk Shelf DS2246

A few notes before we get started:

• Netapp FAS2040 use single-path HA
• SAS Cables can be SAS copper or SAS optical or a mix.  EXCEPT Shelf-to-Shelf connections in a stack must be all SAS copper cables or all SAS optical cables. If the Shelf-to-Shelf cable is SAS copper then the controller to shelf cable must also be SAS copper. If the Shelf-to-Shelf cable is SAS optical then the controller to shelf cable must also be SAS optical.
• SAS optical cables connected to disk shelves require a disk shelf firmware that supports SAS optical cables
• The total end-to-end path, from controller to the last shelf, cannot exceed 510 meters.
• Square Ports are always cabled to circles ports, and circle ports are always cabled to square ports. Never cable square ports to square ports or circle ports to circle ports.
• The illustrations below show the Green Cable as the SAS cable and the Red Cable as the ACP cable.

Let’s dive into some examples.

FAS2040 – 1 Netapp Disk Shelf

This example shows a Netapp FAS2040 with 2 controllers connected to a single DS4243 or DS2246 Netapp disk shelf.

FAS2040 – 2 Netapp Disk Shelves

This example follows on from the previous example by adding an additional disk shelf for a total of 2 disk shelves.

FAS2040 – 3 Netapp Disk Shelves

This example follows on from the previous example by adding another additional disk shelf for a total of 3 disk shelves.

FAS3240 – 1 Netapp Disk Shelf

This example shows 2 Netapp FAS3240’s connected to a single DS4243 Netapp disk shelf.

FAS3240 – 2 Netapp Disk Shelves

This example follows on from the previous example by adding an additional disk shelf for a total of 2 disk shelves.

FAS3240 – 3 Netapp Disk Shelves

This example follows on from the previous example by adding an additional disk shelf for a total of 3 disk shelves.

FAS3240 – 6 Netapp Disk Shelves in 2 Seperate Stacks

In this example we use 3 Netapp DS4243 disk shelves in Stack 1 and 3 Netapp DS2246 disk shelves in Stack 2. The requirement for this configuration is 4 SAS ports. I have added the 4-Port SAS expansion card Netapp X2065A into each controller.

If you have any technical questions about this tutorial or any other tutorials on this site, please open a new thread in the forums and the community will be able to help you out.

FIPS 140-2

Federal Information Processing Standard (FIPS) Publication 140-2: Security Requirements for Cryptographic Modules

RHEL 6 FIPS 140-2 compliant https://access.redhat.com/solutions/137833

Resolution

Red Hat Enterprise Linux 6 is now certified for FIPS compliance. Please see Government standards

Refer article on How can I make Red Hat Enterprise Linux 5 FIPS 140-2 compliant?

Prerequisites

dracut-fips and optionally dracut-fips-aesni
libgcrypt
nss-tools
openswan
openssh-clients
openssh-server
openssl

Steps to Configure

Edit /etc/sysconfig/prelink and disable prelinking.

• Note: This file is provided by the prelink package, if this is not installed you can skip this step.

PRELINKING=no

Run command prelink and revert binaries and libraries to their original content before they were prelinked.

# prelink -u -a

Install the appropriate FIPS enabled version of dracut.

# yum install dracut-fips 

If using AESNI(Advanced Encryption Standard Instruction Set) install dracut-fips-aesni.

# yum-config-manager --enable rhel-6-server-optional-rpms
# yum install dracut-fips-aesni

Note: you will need to add the Server Optional RPMs repository for dracut-fips-aesni.

---

Back up your current /boot/initramfs image, and run dracut with the -f flag to build a new FIPS enabled initramfs.

# cp /boot/initramfs-2.6.32-358.el6.x86_64.img /boot/initramfs-nofips-2.6.32-358.el6.x86_64.img
# dracut -v -f

Edit /etc/grub.conf and append fips=1 to the kernel line.

If the /boot or /boot/efi resides on a separate partition the kernel parameterboot=<partition of /boot or /boot/efi must also be added.
Note: the /boot partition must be on a separate partition and not part of the / partition.

Missing this step can result in a failure of the FIPS integrity test at boot, noted in the following article:

Kernel panic after making Red Hat Enterprise Linux 6 FIPS 140-2 compliant.

Use df /boot to figure out what goes into the boot parameter and append it to the kernel line in/etc/grub.conf.

kernel /vmlinuz quiet rhgb ... fips=1 boot=/dev/sda1

Reboot the host.

# reboot

At this point in time the Kernel is running in FIPS mode following the Kernel Crypto API Cryptographic Module and its security policies.

---

While the Kernel is running in FIPS mode not all other services / tools are (unless they are FIPS aware). In the cases where tools are not FIPS aware you will need to do some additional configuration.

Example:

Edit /etc/ssh/sshd_config and add the following. Protocol 2 should already be uncommented in most cases.
- Note: also configure SSHD / SSH to use pre-defined list of ciphers.

Protocol 2
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
Macs hmac-sha1

Run the Netscape Cryptographic Module Utility and enable FIPS mode.
- IE: Create a FIPS compliant keystore/truststore.

# modutil -fips true -dbdir /etc/ipsec.d

Diagnostic Steps

Verify that FIPS has been enabled, the below will return "1" if FIPS is enabled.

# cat /proc/sys/crypto/fips_enabled

If using dracut-fips-aesni verify the AES modules are loaded

# lsmod | grep aes

aesni_intel            12915  0 
cryptd                  8006  1 aesni_intel
aes_x86_64              7914  1 aesni_intel
aes_generic            27609  2 aesni_intel,aes_x86_64

RHEL 5 FIPS 140-2 compliant https://access.redhat.com/articles/38655

Resolution

¶Ensure access to the following accredited packages is available:

|**Name**|**Version**|
|-|-|
|kernel|2.6.18-164.2.1.el5|
|libgcrypt|1.4.4-5.el5|
|openssl|0.9.8e-12.el5|
|openswan|2.6.21-5.el5_4.3|
|nss|3.12.6-2.el5_4|
|selinux-policy|2.4.6-255.el5_4.2|
|fipscheck-lib|1.2.0-1.el5|

Kernel

¶Verify the version of libgcrypt running is 1.4.4-5.el5 [1].

rpm -qi libgcrypt

¶Ensure prelinking is disabled [1]:

change the line "PRELINKING=yes" to "PRELINKING=no" in /etc/sysconfig/prelink

¶If the libraries were already prelinked, the prelink should be  undone on all the system files using the following command [5]:

prelink -u -a 

¶Recreate the initial RAM disk [1].

¶for x86_64 based platforms:

mkinitrd --with-fips -f /boot/initrd-$(uname -r).img $(uname -r)

¶for IA64 based platforms:

mkinitrd --with-fips -f /boot/efi/efi/redhat/initrd-$(uname -r).img $(uname -r)

¶Append the following to the current Linux kernel line in the /etc/grub.conf [1].

fips=1

¶For example:

# grub.conf generated by anaconda  
#  
# Note that you do not have to rerun grub after making changes to this file  
# NOTICE:  You have a /boot partition.  This means that  
# all kernel and initrd paths are relative to /boot/, eg.  
# root (hd0,0)  
# kernel /vmlinuz-version ro root=/dev/VolGroup00/LogVol00  
# initrd /initrd-version.img  
# boot=/dev/vda  
default=0  
timeout=5  
splashimage=(hd0,0)/grub/splash.xpm.gz  
hiddenmenu  
title Red Hat Enterprise Linux Server (2.6.18-194.el5)  
  root (hd0,0)  
  kernel /vmlinuz-2.6.18-194.el5 ro root=/dev/VolGroup00/LogVol00 rhgb quiet fips=1  
  initrd /initrd-2.6.18-194.el5.img

¶To verify that FIPS mode is enabled, check the contents of /proc/sys/crypto/fips_enabled [6]

cat /proc/sys/crypto/fips_enabled

¶If the value returned is 1 then FIPS mode is enabled, if the value returned is 0 then FIPS mode is disabled.

¶If in the future you need to update the kernel, a new FIPS enabled initrd will be built automatically if mkinitrd sees that  /proc/sys/crypto/fips_enabled has a 1 in it. So, once you are in FIPS mode, the kernel will continue to stay in FIPS mode across updates.

OpenSSH

¶If using OpenSSH Server or Client, ensure the following values are set in the/etc/ssh/sshd_config and ~/.ssh/config file respectively [3][4]:

• Either no "Ciphers" option or the option with a subset out of  "aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc";
• Either no "MACs" option or the option with "hmac-sha1";
• "Protocol 2" must be specified.

¶To check if changes to the sshd_config need to be made the following checks can be run:

#egrep -i 'aes128-ctr|aes192-ctr|aes256-ctr|aes128-cbc|3des-cbc|aes192-cbc|aes256-cbc' /etc/ssh/sshd_config
#egrep -i 'hmac' /etc/ssh/sshd_config
#egrep -i 'protocol' /etc/ssh/sshd_config

¶Make changes to meet these requirements.

OpenSSL

¶Verify the version of openssl running is 0.9.8e-12.el5 [5].

rpm -qi openssl

Openswan

¶Verify the version of openswan running is 2.6.21-5.el5_4.3 [6]:

rpm -qi openswan

¶Verify the version of nss running is 3.12.6-2.el5_4 [6]:

rpm -qi nss

¶Verify the version of selinux-policy is 2.4.6-255.el5_4.2 [6]:

rpm -qi selinux-policy

¶The database for the cryptographic keys used by the pluto daemon must be initialized after it has been created as documented in the README.nss documentation with the following command assuming that the database is stored in the directory /etc/ipsec.d/

modutil -fips true -dbdir /etc/ipsec.d