IBM. Clustered Data ONTAP Release Notes. IBM System Storage N series SC

Transcription

1 IBM System Storage N series IBM Clustered Data ONTAP Release Notes SC

2

3 Contents Clustered Data ONTAP Release Notes Changes introduced since Data ONTAP Changes in clustered Data ONTAP Changes in clustered Data ONTAP Changes in clustered Data ONTAP Changes in clustered Data ONTAP Unsupported features Functionality changes in future releases New and changed features in the Data ONTAP 8.2 release family New platform and hardware support Support for 6-Gb/12-Gb SAS 3.0 HBA card Support for 6-TB capacity disks Support for 800-GB SSDs Support for 400-GB SSDs Support for 1.6-TB SSDs Support for Data ONTAP Edge storage systems Support for SAS optical cables Support for shelf hot-remoe Support for 1.2-TB performance disks Support for Flash Cache 2 modules Manageability enhancements FIPS support for HTTPS Audit log for the nodeshell now included in AutoSupport messages Changes to core dump management Changes to management of the autosupport role and account Histogram-based predictions in RAVE Enhancements for managing SSH security configurations Support for installing the root certificate of an SSL serer on the cluster or SVM HTTP access to log, core dump, and MIB files now enabled by default The system node serice-processor commands now support the RLM The system node systemshell command will be remoed from the adanced priilege leel in an upcoming release Enhancement for monitoring system performance Licensing changes for the Data ONTAP 8.2 release family Enhancements for managing digital certificates Security enhancements for managing user accounts and passwords of a role Enhancements of management protocols Enhancements for managing cluster time New command family for managing the SP from Data ONTAP Cluster user accounts of any role can now be configured to access the SP or RLM Enhancements of the SP and RLM shell enironments Copyright IBM Corp iii

4 SP and RLM now support IP6 configuration Storage QoS Enhancements for deliery of AutoSupport messages Enhancements to health monitoring Support for collecting and iewing performance data oer multiple time periods Support for single node clusters Element Manager is no longer aailable SVM enhancements Replacement of Vserer name with Storage Virtual Machine name Support for modifying the SVM language settings SVMs can be peered within a cluster or across clusters Change in size of the SVM's root olume High-aailability pair enhancements New HA mode requirement Faster takeoer with aggregate relocation Storage resource management enhancements Aggregates can be expanded to 64-bit format without adding storage Increased maximum Flash Pool cache sizes for N3150, N3220 and N3240 systems Automated Workload Analyzer for Flash Pool cache sizing Support for FlexCache olumes Increased maximum aggregate size for some platforms Increased maximum olume count for some platforms Multi-disk carrier and single-disk carrier disk sheles can be combined in the same stack Flash Pool aggregates support different RAID types and group sizes for SSD cache Flexibility for calculating maximum Flash Pool SSD cache size in HA configurations Disabled olume guarantees no longer reenabled automatically Fractional resere setting can be set only to 0 or Infinite Volume enhancements Volume copy functionality no longer supported Storage efficiency enhancements Support for aggregate relocation Support for using olume efficiency priorities Support for detecting incompressible data in files Support for reerting olume efficiency metadata Support for data protection FlexClone olumes Support for automatic deletion of FlexClone LUNs FlexArray Virtualization (Gateway) enhancements Gateway functionality renamed as FlexArray Virtualization Support added for FC direct-attached configurations with E-Series back-end storage arrays Licensing requirement for Data ONTAP systems to use array LUNs Licensing enhancement in Gateway systems New storage arrays supported in Data ONTAP Support added for one Data ONTAP FC initiator connecting to multiple array target ports Increased LUN count per Data ONTAP FC initiator Support added for firmware NDU on HP EVA storage arrays Support added for ALUA with EMC CLARiiON and VNX storage arrays Enhancements for setting the target queue depth on a Data ONTAP system that uses array LUNs 44 File access protocol enhancements Limit on symbolic links for SMB access has been remoed Support for enabling short name searches on the CIFS serer i IBM System Storage N series: Clustered Data ONTAP Release Notes

5 New alidation checks when loading netgroup files from a URI Support for checking client access to exports Changes to the way clustered Data ONTAP adertises DFS capabilities Support for Windows NFS3 clients New limits for local UNIX users, groups, and group members Support for netgroup-by-host searches for NIS and LDAP New commands for managing protocols for SVMs Support for managing how UNIX security-style data is presented to SMB clients Support for restricting access for anonymous users LDAP client configurations now support multiple DNs Support for SQL Serer oer SMB solutions Support for LDAP oer SSL/TLS Support for multidomain name mapping searches Support for creating Actie Directory computer accounts for SVMs Support for the default c$ administratie share Enhancements for NAS multiprotocol auditing Support for the KDC Resource SID Compression feature New parameter to specify Kerberos SPN in a different OU Support for VMware Storage oer IP Support for qtree exports Support for Hyper-V oer SMB solutions Support for Remote VSS share-based backups Support for FPolicy on SVMs with FlexVol olumes Support for NAS auditing on SVMs with FlexVol olumes Support for local users and groups Support for SMB 3.0 on SVMs with FlexVol olumes Support for SMB signing Support for BranchCache on SVMs with FlexVol olumes Support for SMB automatic node referrals on SVMs with FlexVol olumes Support for ODX copy offload on SVMs with FlexVol olumes Support for access-based enumeration Support for Preious Versions Support for offline files Support for roaming profiles Support for redirected folders Support for file and directory security tracing on SVMs with FlexVol olumes Support for iewing file security and audit policy information using the CLI Support for managing NTFS file security and audit policies using the CLI Support for displaying information about SMB sessions and open files Support for modifying the CIFS serer domain Support for stopping and starting CIFS serers Export policies now optional for SMB access Default UNIX user automatically created and assigned Support for IP6 with CIFS Maximum ACE limit for NFS4 ACLs has increased Support for NFS oer IP Support for NFS4.1 file delegations Support for end-to-end parallel processing for NFS SAN enhancements SnapVault backups now support LUNs Contents

6 Support for FlexClone LUNs Support for VMware and Microsoft copy offload Support for AIX Support for increased SAN configuration limits Increase in maximum paths from host to LUN for Windows Data protection enhancements Scalability limits for NDMP and dump backup and restore sessions Change to how SnapMirror relationships are shown Protection of data at rest through Storage Encryption Supported NDMP ersion in Data ONTAP 8.2.x Support for KMIP Support for multipath tape access Serial numbers used for tape aliasing NDMP modes for backup and restore operations Increased number of cluster peers SnapMirror transfer speed control within a cluster Support for backing up FlexVol olumes to SnapVault backups Antiirus enhancements Support for offbox antiirus Support for Antiirus Connector Command mapping for Vscan command Requirements for running clustered Data ONTAP Supported systems and cluster configurations Unsupported systems in clustered Data ONTAP Cluster network and management network switch compatibility requirements Storage system, disk, and disk shelf firmware Important cautions Upgrade cautions DNS name serice lookups fail if serers are not reachable oer UDP Incomplete upgrades must be restarted on the correct node Caution when upgrading a system with unsupported network port interface group names Upgrade to Data ONTAP or later is required to enable offbox antiirus Change in how Data ONTAP handles file names containing UTF-16 supplementary characters.. 74 N6210 and N6040 systems with Flash Cache modules not supported Support for striped olumes remoed Support for NFS2 remoed Compatible ersions of management software are required FlexClone license must be enabled after upgrading to Data ONTAP Deduplication is disabled post upgrade due to insufficient space for metadata Stale metadata not automatically remoed during deduplication operations on a olume Setting 7-Mode CIFS option alues might lead to disruptions when upgrading to clustered Data ONTAP Manageability cautions If you reinstall a license key in Data ONTAP 8.2 or later, you must use the new license key format 77 Changes to SP firmware update methods Antiirus cautions Support for on-board antiirus is discontinued from Data ONTAP and later Storage management cautions i IBM System Storage N series: Clustered Data ONTAP Release Notes

7 Disk failures might increase for some disk models after upgrading to this ersion of Data ONTAP 79 File access and protocols cautions Storage system disruption when moing olumes accessed by Windows NFS clients Requirements for NFS4.1 and pnfs Permission denied error when NFS clients try to access NTFS security style olumes Limited support for NFS with IP DNS timeouts might lead to access issues for NFS IP6 clients Changes in failure handling when processing export policy rules Exceeding recommended maximums on CIFS serers might result in disruption of serice Silent failure of chmod, chown, and chgrp commands when run on junction points SMB reconnections might fail after Data ONTAP upgrade High-aailability configuration cautions Change in the storage failoer gieback -require-partner-waiting option Reert and downgrade cautions Offbox antiirus must be disabled before reerting to an earlier release of Data ONTAP Requirement to reset SSH security configurations when downgrading or reerting to a release earlier than Data ONTAP Downgrade or reert operation fails when qtree exports are enabled Licensing implications for reerting a node that is shipped with Data ONTAP 8.2 or later to an earlier release Reerting to a release earlier than Data ONTAP 8.2 might require installation of licenses for some features NTP remains enabled een after you reert to a release earlier than Data ONTAP SP firmware might require a downgrade if you reert or downgrade to an earlier Data ONTAP release Reert considerations for digital certificates If you reert to Data ONTAP or earlier, you must reset some RBAC characteristics Prerequisites for RSH accounts and IP6 firewall policies before reerting to a release earlier than Data ONTAP Before reerting to a release earlier than Data ONTAP 8.1.1, you must delete any existing authentication tunnel ACLs containing more than 400 ACEs are dropped during reert Known problems and limitations Manageability issues Cluster and node naming operations fail due to unsupported. character Some Data ONTAP commands cannot use supported SSL-based protocols as alid URL schemes 91 Multiple takeoer cycles with the flexscale.lopri_blocks option enabled might result in controller failure False alert seen in cluster switch configurations Ctrl-C does not stop commands issued through non-interactie SSH sessions AutoSupport messages for system health alerts might include an incorrect subject when in mixed-ersion state The system health cluster-switch show command might display other deices as switches The dashboard health serer show command takes a long time to run Account locked message not displayed when the maximum number of inalid login attempts is set to 4 or higher Audit log might expose password information as a result of password field queries in some iterator-based ONTAPIs The maximum number of attempted retries alue fails to update Contents ii

8 Health Monitor does not display the current maximum retries alue Setting default thresholds for dashboard alarms to 100% or greater is allowed Networking issues The first VLAN configured oer a port might bring the port down temporarily Error caused by haing a Storage Virtual Machine (SVM) peer relationship without a cluster peer relationship Disabling fast path in some networking enironments SVM issues Serice outage might occur if allowed protocols are not modified correctly on the SVM Root olumes without SVMs might be created during high I/O operations SVM peer relationship might be in an inconsistent state due to simultaneous SVMs operations.. 97 Creating a user account with sadmin-backup role fails when upgraded to clustered Data ONTAP 8.2.x Storage resource management issues Out of space errors could be returned when fractional resere is set to zero Disk-type mixing might occur een when disk type is specified FlexCache olumes not supported on certain storage systems Qtree creation fails on a mixed cluster running Data ONTAP 8.2 and Data ONTAP In-progress olume moe operations might fail during an upgrade Volume moe job cannot proceed after resizing the olume Volume moe operation can stall during baseline transfer Volume moe operations fail if a SnapMirror checkpoint exists Cutoer action of wait displayed as defer_on_failure by the olume moe show command 100 Error message about no space might be due to lack of inodes in the SVM root olume FlexArray Virtualization (Gateway) issues Too many storage deices presented to the Data ONTAP system Some Hitachi or HP XP array LUNs might not be isible Infinite Volume issues Client application errors when accessing Infinite Volume dongle files Example workflows for Infinite Volumes remoed from the OnCommand community site Snapshot policy attribute might need to be modified Storage classes require additional configuration with array LUNs File access and protocols issues NFS file access fails for some NFS clients LDAP oer SSL/TLS name serice lookups fail Loading UNIX group file from URI fails when file contains split groups Access for hosts in netgroups without primary DNS entry fails Access might be denied when using FPolicy with the natie engine Connection requests to CIFS shares using NTLM with a NetBIOS domain name longer than 15 characters or a fully qualified domain name (FQDN) fail CIFS ACLs not updated as expected when using the CLI to modify olumes Changes to the way the actie audit log is iewed using Eent Viewer Changes to support for duplicate CIFS super user accounts UNIX to Windows name mapping fails when domain is empty or uses wildcard Unexpected behaior after loading local UNIX users or groups from a URI Data ONTAP LDAP client does not support reoked certificates CIFS ACLs not updated as expected when using the CLI to modify olumes Change to the maximum number of audit-enabled SVMs supported in the cluster Change in behaior of -allow-suid parameter for export policy rules Changes to how share properties on existing shares are managed iii IBM System Storage N series: Clustered Data ONTAP Release Notes

9 SETATTR request with read delegation stateid from Linux client oer NFS4.1 mount can cause read delegation to be recalled NFS serer -enable-ejukebox parameter change after upgrade Setting ery large NFS4.1 ACLs might fail with error NFS4ERR_REQ_TOO_BIG Group ID limitation for NFS RPCSEC_GSS Dependence of FPolicy on SSL certificates if using mutual authentication Changes to the -superuser parameter of the serer export-policy rule create command Default LDAP client schema is corrected during upgrade Microsoft Windows 7 and Windows 8 clients fail to rename files and directories CIFS node referral feature works only if LIFs are enabled for both CIFS and NFS CIFS widelinks are not accessible from Mac clients Creation of a CIFS serer fails when using credentials from a trusted domain SAN administration issues SAN commands and options resered for future use Transition of a 7-Mode LUN to a clustered Data ONTAP LUN with the lun create command does not work Data protection issues SnapMirror updates fail on destination olume if a missing Snapshot copy on the source system is used Failure of SnapVault transfer in a SnapMirror to SnapVault cascade can halt SnapMirror transfers 113 Different interconnect link speeds can affect SnapVault transfer performance Checking SnapMirror relationship information not up-to-the-minute Issues with using wildcards with load-sharing mirror relationships Upgrading older style data protection mirror relationships SnapVault transfers unexpectedly grow and shrink secondary olumes Aggregate relocation interrupts SnapMirror transfers NDMP remote restores can fail when backup serer is running Microsoft Windows Serer NDMP management not supported for clustered Data ONTAP Tape backup policy during olume moe, SFO, and ARL DAR fails if the file and the LUN hae the same name on the destination olume Changes to published documentation Changes to the clustered Data ONTAP library Changes to Gateway document titles Changes to the File Access Management Guide for CIFS Changes to information about connections allowed to a share Incorrect limit listed for maximum number of symbolic links for SMB access Certain commands must be run from nodes that hae routes to external serers Changes to the requirements for share names when creating home directory shares How to control automatic DFS adertisements in clustered Data ONTAP with a CIFS serer option Managing whether the CIFS serer automatically adertises DFS capabilities Changes to the way paths are recorded in the audit log eent record Determining what the complete path to the audited object is Managing how file security is presented to SMB clients for UNIX security-style data Enabling or disabling the presentation of NTFS ACLs for UNIX security-style data Configuring access restrictions for anonymous users Changes to the System Administration Guide Changes to cluster peer information Supported cluster peer network topologies Contents ix

10 Configuring intercluster LIFs to share data ports Configuring intercluster LIFs to use dedicated intercluster ports Changes to information about saing core dump files Additions to "Monitoring the health of your system" What AutoSupport subsystems are Changes to commands for managing AutoSupport Changes to the Clustered Data ONTAP Physical Storage Management Guide Maintenance center behaior changes SED lockout limits and types Unnecessary step listed in disk sanitization procedure Changes to the Logical Storage Management Guide Obtaining a qtree junction path Incomplete information in "Creating a FlexClone olume" Changes to the Network Management Guide Remoal of LIF addressing restriction Incorrect default behaior for failoer of cluster management LIFs Changes to the Data Protection Guide Restoring a olume from a Snapshot copy in a SnapVault secondary olume Changes to the SAN Administration Guide Title of the Status field in the unified-connect show command output has been renamed Changes to the SAN Configuration Guide Incorrect PVR requirements listed for shared SAN configurations xx multifabric HA configuration has incorrect illustration Changes to the Data Protection Tape Backup and Recoery Guide Changes to the error message Too many actie dumps/restores currently in progress Behaior of incremental dump backup when a FlexVol olume is full Changes to the error message Dumps temporarily disabled on olume, try again topic Changes to the Data Protection Guide Incorrect column title in the table listing SMTape scalability limits Changes to the Manual Page Reference Missing parameter descriptions in the command-line interface Changes to the FlexArray Virtualization Implementation Guide for Third-Party Storage Workaround when LUNs are not isible with Hitachi or HP XP storage arrays Changes to the FlexArray Virtualization Installation Requirements and Reference Guide Incorrect reference to a Gateway guide Websites Copyright and trademark information Trademark information Notices Index x IBM System Storage N series: Clustered Data ONTAP Release Notes

11 Clustered Data ONTAP Release Notes The release notes describe new features, enhancements, and known issues for this release, as well as additional information related to running this release on specific storage systems. About the clustered Data ONTAP release Clustered Data ONTAP is a General Aailability (GA) release and the fourth maintenance release in the Data ONTAP 8.2 release family. It includes innoations and features only aailable in clustered deployments. This release family also includes capabilities that were aailable earlier in 7-Mode releases. Attention: If you hae a 3210 or 3140 storage system with Flash Cache modules installed, do not upgrade to clustered Data ONTAP 8.2. Flash Cache modules are not supported on 3210 or 3140 systems running clustered Data ONTAP 8.2. Data ONTAP 8.2 introduces licensing changes that affect how you manage the licenses of your cluster. For more information about licensing changes, see. For a complete list of functionality changes in the 8.2 release family, see New and changed features in the Data ONTAP 8.2 release family on page 19. Some clustered Data ONTAP features are not supported in this release. For more information, see Unsupported features on page 15. Name change for the Gateway functionality in Data ONTAP RC2 Starting with Data ONTAP RC2, the capability of using LUNs on a storage array, formerly identified as Gateway functionality, has a new name Data ONTAP FlexArray Virtualization Software. Name change for Vserer in Data ONTAP RC1 Beginning with the Data ONTAP RC1 release, Storage Virtual Machine is the new descriptie name for Vserer. In the documentation, the term SVM refers to Vserer. Copyright IBM Corp

12 Name change for cluster capabilities in Data ONTAP 8.2 Beginning with the Data ONTAP 8.2 release, capabilities of the Data ONTAP operating system that were preiously designated by the term Cluster-Mode are now referred to as clustered Data ONTAP. For example, you might be upgrading from Data ONTAP 8.1.x running in Cluster-Mode to clustered Data ONTAP 8.2. The underlying cluster technology is the same. About these release notes It is a best practice for all clustered Data ONTAP users to reiew these release notes. These release notes highlight new capabilities and system behaior introduced in the clustered Data ONTAP 8.2 release family. If Data ONTAP is already running on clusters in your enironment, you should familiarize yourself with releant topics before upgrading to clustered Data ONTAP 8.2 or later. If you are upgrading to this Data ONTAP release or reerting from this release to an earlier release, see the Clustered Data ONTAP Upgrade and Reert/Downgrade Guide for this release. If this is the first deployment of systems running clustered Data ONTAP in your enironment, you should also see the Data ONTAP Information Library page for this release at nseries/ to iew all of the documentation aailable for this release. contains information that has become aailable after the library proided with this release was published. For more information about Data ONTAP releases, see the Data ONTAP Release Model at 2 IBM System Storage N series: Clustered Data ONTAP Release Notes

13 Changes introduced since Data ONTAP 8.2 There hae been a number of changes for this release, including new and changed features, new cautions, and new limitations. If you are new to the clustered Data ONTAP 8.2 release family, go directly to New and changed features in the clustered Data ONTAP 8.2 release family. Changes in clustered Data ONTAP The clustered Data ONTAP release includes support for software enhancements and bug fixes. New known problems and limitations There is a new known issue in this release. Changes in clustered Data ONTAP The clustered Data ONTAP release includes support for hardware enhancements, software enhancements, and bug fixes. New platform and hardware support This release includes support for the following new platform hardware: Support for 6-Gb/12-Gb SAS 3.0 HBA card on page 19 Support for I/O expansion module on the 8060 added For more information, see New platform and hardware support on page 19. New and changed features This release includes the following new and changed features: Networking and security protocol enhancements Load balancing supported for LIFs hosted on VLANs Support for disabling IP6 SLAAC with RA enabled Support for the network ping6 command File access protocol enhancements on page 44 Copyright IBM Corp

14 Limit on symbolic links for SMB access has been remoed on page 44 Support for enabling short name searches on the CIFS serer on page 45 New alidation checks when loading netgroup files from a URI on page 45 Support for checking client access to exports on page 45 Changes to the way clustered Data ONTAP adertises DFS capabilities on page 45 Support for Windows NFS3 clients on page 46 New limits for local UNIX users, groups, and group members on page 47 Support for netgroup-by-host searches for NIS and LDAP on page 47 New commands for managing protocols for SVMs on page 47 New cautions The following cautions are new in this release: Upgrade cautions on page 73 DNS name serice lookups fail if serers are not reachable oer UDP on page 73 File access and protocols cautions on page 80 Storage system disruption when moing olumes accessed by Windows NFS clients on page 80 Limited support for NFS with IP6 on page 81 New known problems and limitations There are new known issues in this release: SVM issues on page 96 Serice outage might occur if allowed protocols are not modified correctly on the SVM on page 96 Infinite Volume issues on page 101 Client application errors when accessing Infinite Volume dongle files on page 102 File access and protocols issues on page 103 NFS file access fails for some NFS clients on page 103 LDAP oer SSL/TLS name serice lookups fail on page 103 Loading UNIX group file from URI fails when file contains split groups on page IBM System Storage N series: Clustered Data ONTAP Release Notes

15 Connection requests to CIFS shares using NTLM with a NetBIOS domain name longer than 15 characters or a fully qualified domain name (FQDN) fail on page 105 Access for hosts in netgroups without primary DNS entry fails on page 104 Access might be denied when using FPolicy with the natie engine on page 104 Data protection issues on page 113 SnapMirror updates fail on destination olume if a missing Snapshot copy on the source system is used on page 113 Remoed problems and limitations The following known problems and limitations hae been remoed in this release: Transition issues System panics during SnapMirror resynchronization while transitioning a 7-Mode olume containing replicated qtrees or LUNs Manageability issues Non-interactie SSH displays password changes in clear text File access and protocols issues Qtrees in FlexClone olume might hae different export policies than qtrees in parent olume NFS export policy rules with locally defined host names cause client mounts to fail HA pair issues Cluster HA configuration is wrongly shown as correct after a mailbox destroy operation on a two-node cluster Documentation changes The following new or changed information supplements the documentation aailable for this release: Changes to the File Access Management Guide for CIFS on page 120 Certain commands must be run from nodes that hae routes to external serers on page 121 Changes introduced since Data ONTAP 8.2 5

16 Changes to the requirements for share names when creating home directory shares on page 121 How to control automatic DFS adertisements in clustered Data ONTAP with a CIFS serer option on page 121 Managing whether the CIFS serer automatically adertises DFS capabilities on page 122 Changes to the way paths are recorded in the audit log eent record on page 123 Determining what the complete path to the audited object is on page 124 Changes to information about connections allowed to a share on page 120 Changes to the System Administration Guide on page 127 Changes to cluster peer information on page 127 Supported cluster peer network topologies on page 127 Configuring intercluster LIFs to share data ports on page 131 Configuring intercluster LIFs to use dedicated intercluster ports on page 133 Changes to the Clustered Data ONTAP Physical Storage Management Guide on page 137 Maintenance center behaior changes on page 137 SED lockout limits and types on page 137 Changes to the Logical Storage Management Guide on page 138 Obtaining a qtree junction path on page 138 Changes to the Network Management Guide on page 139 Default ports roles for 8020 systems are incorrect For more information about other important documentation updates, see Changes to published documentation on page 119. Changes in clustered Data ONTAP The clustered Data ONTAP release includes support for software enhancements and bug fixes. New platform and hardware support This release includes support for the following new platform hardware: Support for 6-TB capacity disks on page 19 6 IBM System Storage N series: Clustered Data ONTAP Release Notes

17 Support for the NS8080 platform For more information, see. New and changed features This release includes the following new and changed features: New cautions The following caution is new in this release: New known problems and limitations There are new known issues in this release: Remoed problems and limitations The following known problems and limitations hae been remoed in this release: SVM issues Some SnapMirror operations fail due to incorrect or missing SVM peer relationship entries File access and protocols issues Renaming a network interface disables Kerberos for that interface Changes introduced since Data ONTAP 8.2 7

18 LDAP name mapping fails due to incorrect schema attribute Directory queries oer SMB that contain consecutie '>' or '?' wildcards proide incorrect results Position alue of name mapping entry not honored Storage resource management issue Long disk list for aggregate creation could cause disruption Antiirus issues Scanning fails after CIFS serer is deleted and recreated Request timeout error causes corresponding scanning operations to fail Documentation changes The following new or changed information supplements the documentation aailable for this release: For more information about other important documentation updates, see. Changes in clustered Data ONTAP The clustered Data ONTAP release includes support for new hardware, software enhancements, and bug fixes. New platform and hardware support This release includes support for the following new platform hardware: Support for the NS8080 platform Support for 800-GB SSDs on page 19 Support for 400-GB SSDs on page 20 Support for 1.6-TB SSDs on page 20 Support for Data ONTAP Edge storage systems on page 20 8 IBM System Storage N series: Clustered Data ONTAP Release Notes

19 Support for SAS optical cables on page 21 Support for shelf hot-remoe on page 21 For more information, see New platform and hardware support on page 19. New and changed features This release includes the following new and changed features. Histogram-based predictions in RAVE on page 23 Enhancements for managing SSH security configurations on page 24 Support for installing the root certificate of an SSL serer on the cluster or SVM on page 24 HTTP access to log, core dump, and MIB files now enabled by default on page 25 The system node serice-processor commands now support the RLM on page 25 The system node systemshell command will be remoed from the adanced priilege leel in an upcoming release on page 26 Enhancement for monitoring system performance on page 26 SVM enhancements on page 35 Replacement of Vserer name with Storage Virtual Machine name on page 35 Storage resource management enhancements on page 36 Aggregates can be expanded to 64-bit format without adding storage on page 37 Increased maximum Flash Pool cache sizes for N3150, N3220 and N3240 systems on page 37 Automated Workload Analyzer for Flash Pool cache sizing on page 37 Multi-disk carrier and single-disk carrier disk sheles can be combined in the same stack on page 38 FlexArray Virtualization (Gateway) enhancements on page 42 Gateway functionality renamed as FlexArray Virtualization on page 42 Licensing requirement for Data ONTAP systems to use array LUNs on page 42 Support added for FC direct-attached configurations with E-Series back-end storage arrays on page 42 Licensing enhancement in Gateway systems on page 43 File access protocol enhancements on page 44 Changes introduced since Data ONTAP 8.2 9

20 Support for SQL Serer oer SMB solutions on page 49 Support for LDAP oer SSL/TLS on page 49 Support for multidomain name mapping searches on page 50 Support for creating Actie Directory computer accounts for SVMs on page 50 Support for the default c$ administratie share on page 51 Enhancements for NAS multiprotocol auditing on page 51 Support for the KDC Resource SID Compression feature on page 51 New parameter to specify Kerberos SPN in a different OU on page 51 Support for VMware Storage oer IP6 on page 52 Support for qtree exports on page 52 Networking and security protocol enhancements SNMP3 creates unique default engine IDs for each SNMP3 agent in the cluster Data protection enhancements on page 63 Scalability limits for NDMP and dump backup and restore sessions on page 63 Protection of data at rest through Storage Encryption on page 64 Increased number of cluster peers on page 66 SnapMirror transfer speed control within a cluster on page 66 Antiirus enhancements on page 66 Support for offbox antiirus on page 66 Support for Antiirus Connector on page 66 Command mapping for Vscan command on page 67 New cautions The following cautions are new in this release: Upgrade cautions on page 73 Incomplete upgrades must be restarted on the correct node on page 73 Upgrade to Data ONTAP or later is required to enable offbox antiirus on page 74 Change in how Data ONTAP handles file names containing UTF-16 supplementary characters on page 74 File access and protocols cautions on page 80 Requirements for NFS4.1 and pnfs on page IBM System Storage N series: Clustered Data ONTAP Release Notes

21 DNS timeouts might lead to access issues for NFS IP6 clients on page 81 Exceeding recommended maximums on CIFS serers might result in disruption of serice on page 83 Reert and downgrade cautions on page 84 Offbox antiirus must be disabled before reerting to an earlier release of Data ONTAP on page 85 Requirement to reset SSH security configurations when downgrading or reerting to a release earlier than Data ONTAP on page 85 Downgrade or reert operation fails when qtree exports are enabled on page 85 Cautions remoed in Data ONTAP The following cautions that were included in the Data ONTAP 8.2 Release Notes hae been remoed in this release: Upgrade cautions SAS optical cables not supported Windows clients cannot access Virtual Hard Drie (VHD) files after upgrading to clustered Data ONTAP 8.2 System disruption occurs if inalid alues exist for file-umask or dir-umask fields after upgrading Data protection cautions NDMP default password must be changed File access and protocols cautions Unable to access existing NFS mounts or create new ones Storage system disruption when adding incomplete NIS domain configuration and rebooting node Downgrade and reert cautions Reert from clustered Data ONTAP 8.2 fails if FPolicy policies with priileged data access are enabled New known problems and limitations There are new known issues in this release: Manageability issues on page 91 False alert seen in cluster switch configurations on page 92 Changes introduced since Data ONTAP

22 The maximum number of attempted retries alue fails to update on page 95 Networking issues on page 95 The first VLAN configured oer a port might bring the port down temporarily on page 95 SVM issues on page 96 Creating a user account with sadmin-backup role fails when upgraded to clustered Data ONTAP 8.2.x on page 97 FlexArray Virtualization (Gateway) issues on page 100 Too many storage deices presented to the Data ONTAP system on page 101 Incorrect default behaior for failoer of cluster management LIFs on page 139 Some Hitachi or HP XP array LUNs might not be isible on page 101 Infinite Volume issues on page 101 Example workflows for Infinite Volumes remoed from the OnCommand community site on page 102 File access and protocols issues on page 103 Data ONTAP LDAP client does not support reoked certificates on page 107 CIFS ACLs not updated as expected when using the CLI to modify olumes on page 105 Change to the maximum number of audit-enabled SVMs supported in the cluster on page 107 Change in behaior of -allow-suid parameter for export policy rules on page 107 SAN configuration issues Data protection issues on page 113 DAR fails if the file and the LUN hae the same name on the destination olume on page 118 Remoed problems and limitations The following known problems and limitations hae been remoed in this release: 12 IBM System Storage N series: Clustered Data ONTAP Release Notes

23 Manageability issues Required delay between password changes is ignored when passwords are set to expire immediately OpenSSH SSH daemon automatically disconnects unresponsie sessions Networking issues Exiting the Cluster Setup wizard may cause VLANs to be created incorrectly Storage resource management issues Splitting or deleting FlexClone child olumes before reerting Configuring ACP to use a different port on a N3220 and N3240 system disables ACP for the local SAS expander Issues with Gateway working with LUNs from storage arrays Some HP 3PAR array LUNs might be reported as unknown deices if zoning is configured before setting the host persona LUNs from a host group with fewer than 16 array LUNs are not isible on some Hitachi and HP storage arrays Infinite Volume issues Infinite Volumes in Data ONTAP 8.2 not supported by System Manager SMB client cannot add new UNIX principal to NTFS file permissions File access and protocols issues Internal CIFS operations might cause performance degradation Performance might be impacted when deleting SVMs with CIFS serers Data ONTAP does not support the KDC Resource SID Compression feature Non-CIFS data LIFs can preent operation of the CIFS Witness protocol Mac clients do not support CIFS automatic node referral BranchCache hash cleanup fails if hash path contains blanks or special characters SAN administration issues The fcp topology show command with the erbose or zoned option fails on ery large fabrics Antiirus issues Vscan serer may fail to access the same files as the client in a load-sharing mirror olume Changes introduced since Data ONTAP

24 Documentation changes The following new or changed information supplements the documentation aailable for this release: Changes to the Logical Storage Management Guide on page 138 Incomplete information in "Creating a FlexClone olume" on page 138 Changes to the Data Protection Guide on page 139 Incorrect column title in the table listing SMTape scalability limits on page 144 Changes to the Network Management Guide on page 139 Incorrect default behaior for failoer of cluster management LIFs on page 139 Changes to the SAN Configuration Guide on page 141 Incorrect PVR requirements listed for shared SAN configurations on page xx multifabric HA configuration has incorrect illustration on page 142 Changes to the Manual Page Reference on page 144 Missing parameter descriptions in the command-line interface on page 144 Changes to the FlexArray Virtualization Installation Requirements and Reference Guide on page 147 Incorrect reference to a Gateway guide on page 147 For more information about other important documentation updates, see Changes to published documentation on page IBM System Storage N series: Clustered Data ONTAP Release Notes

25 Unsupported features Support for some Data ONTAP functionality is discontinued in this release family. NDMP 3 Starting with Data ONTAP 8.2.0, NDMP 3 is not supported. On-board Antiirus On-board Antiirus support is discontinued beginning with Data ONTAP Some references to Antiirus are present in the clustered documentation, in man pages, and in user interfaces. All such references should be ignored. Antiirus commands are not supported and should not be used. For more information, see Support for on-board antiirus is discontinued from Data ONTAP and later. Volume copy Support for olume copy functionality is discontinued beginning in clustered Data ONTAP 8.2. For more information, see Volume copy functionality no longer supported. Copyright IBM Corp

26 16 IBM System Storage N series: Clustered Data ONTAP Release Notes

27 Functionality changes in future releases Support for some features will be discontinued in a future release of Data ONTAP. FlexCache olumes In a future release of Data ONTAP, creating and using FlexCache olumes will not be supported in clustered Data ONTAP. Howeer, FlexVol olumes in clustered Data ONTAP will continue to be supported as origin olumes sering data to FlexCache olumes created on systems running Data ONTAP operating in 7-Mode. Volume guarantees of type file In a future release of Data ONTAP, olume guarantees of type file will not be supported. Any existing olumes with guarantees of type file will be updated to another guarantee type when you upgrade to that release. Priilege leel change to the system node systemshell command In a future release of Data ONTAP, the system node systemshell command, which is used for accessing the systemshell of a node, will no longer be aailable at the clustershell adanced priilege leel. The systemshell is intended only for low-leel diagnostic purposes and should be used only with guidance from technical support. storage disk modify command In a future release of clustered Data ONTAP, the storage disk modify command will not be supported. To change the state of a disk, use the storage disk fail or storage disk unfail command (aailable at the adanced priilege leel). To change disk ownership, use the storage disk assign command. Copyright IBM Corp

28 18 IBM System Storage N series: Clustered Data ONTAP Release Notes

29 New and changed features in the Data ONTAP 8.2 release family You should be familiar with the features that were added or changed in the Data ONTAP 8.2 release family. Some new and changed features in this release might hae been introduced in a maintenance release of an earlier ersion of Data ONTAP. Before upgrading, be sure to consult technical support about new Data ONTAP functionality to determine the best solutions for your business needs. New platform and hardware support The Data ONTAP 8.2 release family supports new hardware. The new platform and hardware are described in this section. For information about supported systems, see Supported Systems for Data ONTAP 8.2. Support for 6-Gb/12-Gb SAS 3.0 HBA card Data ONTAP and later releases support the X2069-R6 host bus adapter (HBA) card. This adapter is a two-port add-in card that supports 12-Gb SAS 3.0 connections. By inserting supported copper or optical QSFP SAS cables, you can connect storage at 12-Gb SAS 3.0 speeds. For information about SAS HBAs and attached storage, see the Clustered Data ONTAP SAN Administration Guide or the Clustered Data ONTAP SAN Configuration Guide. Support for 6-TB capacity disks In Data ONTAP and later releases, 6-TB capacity disks are supported for SAS-connected disk sheles. These disks hae a maximum RAID group size of 14, ersus the typical maximum RAID group size of 20 for capacity disks. The default RAID group size is unchanged at 14. Support for 800-GB SSDs In Data ONTAP and later releases, 800-GB SSDs are supported for SSD-only aggregates and Flash Pool aggregates. For information about which platforms and shelf types support these dries and aggregate types, see the IBM N series Introduction and Planning Guide at Copyright IBM Corp

30 Support for 400-GB SSDs 400-GB SSDs are now supported in SAS-connected storage sheles. For information about which storage sheles and Data ONTAP ersions support these SSDs, see the IBM N series Introduction and Planning Guide at Support for 1.6-TB SSDs 1.6-TB SSDs are now supported in SAS-connected storage sheles. For information about which storage sheles and Data ONTAP ersions support these SSDs, see the IBM N series Introduction and Planning Guide at Support for Data ONTAP Edge storage systems Data ONTAP Edge storage systems use Data ONTAP- technology to run Data ONTAP software in a irtual machine. This enables Data ONTAP to run on high-performance serers supported by VMware Sphere to manage storage in irtualized enironments. Data ONTAP Edge is a storage solution designed for remote offices. In addition to managing local storage and protecting data, Data ONTAP Edge can be configured to use SnapVault and SnapMirror technology. These features enable you to automatically copy and moe data to a central clustered Data ONTAP storage system where it can be archied or used for disaster recoery. The model number for this system is FDM200. This is the first ersion of Data ONTAP Edge that supports clustered Data ONTAP software. Data ONTAP Edge systems hae been aailable with Data ONTAP 7-Mode software beginning with Data ONTAP The hardware platform on which Data ONTAP Edge is installed must meet certain system and irtual machine requirements in order to work properly. For more information, see the IBM N series interoperability matrix at To deploy a Data ONTAP Edge storage system on a host serer, and to manage it as a platform, IBM N series has deeloped the Data ONTAP- administration tool, called dadmin. dadmin must be used to install Data ONTAP Edge storage systems. The Data ONTAP Edge release consists of a single installation package (for example, 821_121 installer.oa) that includes dadmin and Data ONTAP See the Data ONTAP Edge Express Setup Guide for Clustered Data ONTAP for installation instructions. If you need more details about installing your Data ONTAP Edge storage system, refer to the following manuals: Data ONTAP- Administration Tool Installation Guide 20 IBM System Storage N series: Clustered Data ONTAP Release Notes

31 Data ONTAP Edge Installation and Administration Guide for Clustered Data ONTAP After your Data ONTAP Edge system is installed, you use the clustered Data ONTAP 8.2 documentation to manage the storage system like any other IBM N series storage system. Data ONTAP Edge does not support all the functionality of Data ONTAP because it is running on a irtual machine instead of on a hardware controller. See the "Data ONTAP- supported and unsupported functionality" topic in the Data ONTAP Edge Installation and Administration Guide for complete information. Important information There are a few important notes that you need to be aware of when using Data ONTAP Edge with clustered Data ONTAP software: Data ONTAP Edge is aailable as a single-node cluster only. It cannot be joined with another Data ONTAP node to form a multi-node cluster. Data ONTAP Edge 7-Mode systems cannot be upgraded to clustered Data ONTAP Edge systems. SnapVault and SnapMirror relationships must be made to a Data ONTAP storage system that has clustered Data ONTAP software installed, not Data ONTAP 7-Mode software. Since this is the first clustered Data ONTAP release that supports Data ONTAP Edge, there are no reert or downgrade options aailable. Support for SAS optical cables Data ONTAP and later 8.2.x releases support SAS optical cables. Data ONTAP is the first release in the Data ONTAP 8.2 release family for which SAS optical cables are supported. The SAS Storage Cabling and Infrastructure FAQ at media/sas-storage-cabling-and-infrastructure.pdf contains more information about SAS optical cables. Installation information can be found in the EXN3000, EXN3200, and EXN3500 Installation and Serice Guide and the Configuring a stretch MetroCluster system with SAS disk sheles and SAS optical cables document at the the IBM N series support website at support/nseries/. Support for shelf hot-remoe Data ONTAP and later 8.2.x releases support the hot remoal of disk sheles the physical remoal of disk sheles that hae had the data New and changed features in the Data ONTAP 8.2 release family 21

32 eacuated in multipath HA or single-controller-dual-path (multipath) storage systems that are currently up and sering data. You can hot remoe one or more SAS or FC disk sheles from anywhere within a stack or loop of disk sheles, or an entire stack or loop of disk sheles. The following supported configurations and documents containing the shelf hot-remoe procedure can be found on IBM N series support website at Multipath HA and single-controller-dual-path storage systems with SAS disk sheles: DS4243, DS2246, DS4486, and DS4246 Disk Shelf Installation and Serice Guide Multipath HA systems with FC disk sheles: Clustered Data ONTAP High-Aailability Configuration Guide Single-controller-dual-path (multipath) systems with FC disk sheles: Hot-remoing DS14 disk sheles in single-controller-dual-path (multipath) systems running Data ONTAP or later Support for 1.2-TB performance disks In Data ONTAP 8.2 and later releases, 1.2-TB disks are supported for SAS-connected disk sheles. These are performance disks (rather than capacity disks) and their speed is 10K RPM. Support for Flash Cache 2 modules Data ONTAP 8.2 and later releases support the 2-TB, 1-TB, and 512-GB, PCIe-attached Flash Cache 2 modules that use Flash technology. Manageability enhancements This release of Data ONTAP proides new and changed manageability capabilities. FIPS support for HTTPS As of Data ONTAP 8.2.2, support for the Federal Information Processing Standard (FIPS) is aailable for secure web serices (HTTPS). By default, FIPS compliance is disabled. You can enable FIPS compliance by using the -ssl-fips-enabled parameter of the system serices web modify command, and then use the system serices web show command to confirm the online status of FIPS compliance. When FIPS compliance is enabled, SSL3 and SSL2 are disabled, and only TLS1 remains enabled. Data ONTAP preents you from enabling SSL3 or SSL2 when FIPS compliance is enabled. If you enable FIPS and then subsequently disable it, SSL3 and SSL2 remain disabled, but TLS1 is always enabled. 22 IBM System Storage N series: Clustered Data ONTAP Release Notes

33 Audit log for the nodeshell now included in AutoSupport messages As of Data ONTAP 8.2.2, AutoSupport messages now include the nodeshell audit log files of a node and those of the partner node. The nodeshell audit log files (auditlog.*) are stored in the /mroot/etc/log/ directory of a node. Changes to core dump management Data ONTAP preents you from initiating the saing of a core dump file during a takeoer, an aggregate relocation, or a gieback. Changes to management of the autosupport role and account As of Data ONTAP 8.2.2, Data ONTAP preents you from modifying or deleting the autosupport predefined account. It also preents you from adding additional user accounts to the autosupport predefined role. The autosupport predefined role can contain only the autosupport predefined account. The autosupport role and autosupport account are used by AutoSupport OnDemand. Histogram-based predictions in RAVE Starting in Data ONTAP 8.2.1, the speculatie read-ahead engine (RAVE) in WAFL can capture additional temporal data about preious user read requests to a file and use this information to intelligently speculate on future read requests. In prior releases, speculation was based only on information from the current user I/O. This feature is enabled by default. You can enable or disable the use of histograms for storage systems operating in 7-Mode by using the wafl rae use_histogram <alue> command. A alue of 1 enables the feature and a alue of 0 disables it. For more information about performance data and the statistics commands, see the Data ONTAP System Administration Guide for 7-Mode. For clustered systems, you can enable histogram-based predictions as part of the QoS read-ahead settings, and then attach them to a QoS workload. The qos settings read-ahead create modify read_ahead_setting_name -use-histogram true false command enables or disables the functionality. The qos workload modify -read-ahead read_ahead_setting_name -workload workload_name command attaches the read-ahead setting to any workload. For more information about performance data and the statistics commands, see the Clustered Data ONTAP System Administration Guide for Cluster Administrators. New and changed features in the Data ONTAP 8.2 release family 23

34 Enhancements for managing SSH security configurations Starting with Data ONTAP 8.2.1, Data ONTAP enables you to manage SSH security configurations for the cluster and Storage Virtual Machines (SVMs). The SSH security configurations you can manage include the settings for the SSH key exchange algorithms and data encryption algorithms (also known as ciphers). The following SSH security settings for the cluster and SVMs are supported and enabled by default: SSH key exchange algorithms The diffie-hellman-group-exchange-sha256 SSH key exchange algorithm for SHA-2 The diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha1, and diffie-hellman-group1-sha1 SSH key exchange algorithms for SHA-1 Ciphers aes256-ctr aes192-ctr aes128-ctr aes256-cbc aes192-cbc aes128-cbc 3des-cbc You use the security ssh commands to manage the SSH security configurations. Any configuration changes that you make for the cluster apply also to any SVMs that you subsequently create. For more information about managing the SSH security configurations, see the Clustered Data ONTAP System Administration Guide for Cluster Administrators and the security ssh man pages. Support for installing the root certificate of an SSL serer on the cluster or SVM Starting with Data ONTAP 8.2.1, you can install the root certificate of an SSL serer on the cluster or Storage Virtual Machine (SVM) for authenticating the SSL serer to which the cluster or SVM functions as a client. To authenticate an SSL serer (for example, an Actie Directory domain controller that supports LDAP oer SSL) to which the cluster or SVM is a client, you can use the -type serer-ca parameter of the security certificate install command to install the root certificate of the SSL serer. For 24 IBM System Storage N series: Clustered Data ONTAP Release Notes

35 information about managing digital certificates, see the Clustered Data ONTAP System Administration Guide for Cluster Administrators. HTTP access to log, core dump, and MIB files now enabled by default Starting with Data ONTAP 8.2.1, the Serice Processor Infrastructure (spi) web serice is enabled by default to enable a web browser to access the log, core dump, and MIB files of a node in the cluster. In addition, the admin role has access to the spi web serice by default. You can access the spi web serice by pointing a web browser to If your user account does not hae the admin role, your access-control role must be granted access to the spi web serice. By default, the admin user account in the admin role includes the http access method and can access the spi web serice. If you are not using the admin user account, your user account must be set up with the http access method. For more information about managing web serices, see the Clustered Data ONTAP System Administration Guide for Cluster Administrators. The system node serice-processor commands now support the RLM Starting with Data ONTAP 8.2.1, you can use the system node serice-processor commands to manage the Remote LAN Module (RLM) from the Data ONTAP clustershell. The rlm commands in the nodeshell are deprecated in faor of the system node serice-processor commands. You can use the system node serice-processor commands to perform the following RLM management tasks: Set up or modify the RLM network configuration (system node serice-processor network modify) Display the RLM network configuration (system node serice-processor network show) Display the RLM information (system node serice-processor show) Reboot the RLM and optionally specify the RLM firmware image (primary or backup) to use (system node serice-processor reboot-sp) Display the details of the currently installed RLM firmware image (system node serice-processor image show) Update the RLM firmware (system node serice-processor image update) Display the status for the latest RLM firmware update (system node serice-processor image update-progress show) New and changed features in the Data ONTAP 8.2 release family 25

36 The system node systemshell command will be remoed from the adanced priilege leel in an upcoming release The systemshell is intended only for low-leel diagnostic purposes and should be used only with guidance from technical support. In an upcoming release, the system node systemshell command, which is used for accessing the systemshell of a node, will no longer be aailable at the clustershell adanced priilege leel. Enhancement for monitoring system performance Starting with Data ONTAP 8.2.1, calculation of the cpu busy counter has been improed. This change ensures that the alue of the cpu busy counter more accurately reflects CPU utilization of the storage controller. This counter is used to ealuate when the system is reaching the limits of its capabilities and/or to manage workloads to keep CPU utilization under 50% when performing nondisruptie operations. The cpu busy counter is isible in the CPU column of the sysstat command and the cpu busy column of the statistics show-periodic command. Licensing changes for the Data ONTAP 8.2 release family Data ONTAP 8.2 introduces licensing changes that affect how you manage the licenses of your cluster. The following licensing changes apply to the Data ONTAP 8.2 release family: How licensed features are mapped to packages has changed. Data ONTAP feature licenses are issued as packages, each of which contains multiple features or a single feature. A package requires a license key, and installing the key enables you to access all features in the package. For example, installing the key for the SnapManager Suite package on a node entitles the node to use all SnapManager products in the package. For information about the features that require licenses in the Data ONTAP 8.2 release family, see the knowledgebase article Data ONTAP 8.2 Licensing Oeriew and References. Data ONTAP no longer displays license states for indiidual features that are part of a license package; instead, Data ONTAP manages and displays entitlements at the license package leel. A standard Data ONTAP license, also known as a node-locked license, is issued for a node with a specific serial number and is not alid on other nodes. Installing a standard, node-locked license entitles the node to the licensed functionality. The Data ONTAP 8.2 release family treats a license installed prior to Data ONTAP 8.2 as a standard license. Therefore, in a cluster running Data 26 IBM System Storage N series: Clustered Data ONTAP Release Notes

37 ONTAP 8.2 or later, all nodes automatically hae the standard license for the package that the preiously licensed functionality is part of. For the cluster to use licensed functionality, at least one node must be licensed for the functionality. It might be out of compliance to use licensed functionality on a node that does not hae an entitlement for the functionality. The length of a license key has been increased to 28 characters. Licenses installed in a release earlier than Data ONTAP 8.2 continue to work after you upgrade to Data ONTAP 8.2 or later. Howeer, if you need to reinstall a license in Data ONTAP 8.2 or later (for example, you deleted a preiously installed license and want to reinstall it in Data ONTAP 8.2 or later, or you perform a controller replacement procedure for a node in the cluster running Data ONTAP 8.2 or later), Data ONTAP requires that you enter the license key in the new, 28-character format. Note: If you wipe clean a node and reinstall it with a ersion that is earlier than Data ONTAP 8.2, you need to use a license key format that is supported for the release that you are installing. For information about how to obtain the license keys, see the knowledgebase article Data ONTAP 8.2 Licensing Oeriew and References. The cluster base license is still required for the cluster setup, but it no longer has an associated node count or any effect on feature license erification. To use functionality that requires a license, in addition to installing the cluster base license, you must also install a license for the package that offers the functionality. Starting with Data ONTAP 8.2, the high-aailability (HA) functionality no longer requires a license. You still must set the mode parameter of the storage failoer modify command to ha to enable the HA functionality. Data ONTAP commands for managing licenses hae been enhanced. The system license add command now enables you to add multiple license keys at a time. The system license show command output has a different format and displays additional details. The system license delete command now enables you to specify the serial number of the node whose license you want to delete. The new command system license status show displays all packages that require licenses and their current license status. The new command system license clean-up enables you to display or remoe expired or unused licenses. New and changed features in the Data ONTAP 8.2 release family 27

38 For information about managing feature licenses, see the Clustered Data ONTAP System Administration Guide for Cluster Administrators. Enhancements for managing digital certificates Data ONTAP 8.2 introduces seeral enhancements for managing digital certificates. Data ONTAP 8.2 and later releases support the following functionality for digital certification: Data ONTAP now supports mutual authentication of digital certificates between the serer and a client. You can use the following capabilities for mutual authentication: Generate a self-signed root CA certificate for the cluster or Storage Virtual Machine (SVM) to act as a Certificate Authority (CA) Enable client authentication on the cluster or SVM Sign a certificate signing request (CSR) by using the self-signed root CA certificate Install intermediate certificates of a third-party CA that signed the CSR for the client You can install intermediate certificates of a third-party CA for the certificate chain of serer authentication. You can reoke a compromised CA-issued digital certificate. You can enable cluster or SVM users to be authenticated by digital certificates. For cluster user accounts, digital certificate authentication is supported only with the http and ontapi access methods. For SVM user accounts, digital certificate authentication is supported only with the ontapi access method. You can now manage digital certificates (security certificate) at the admin priilege leel. SVM administrators can now manage digital certificates for their own SVMs. The security certificate file show command now requires the diagnostic priilege leel, which is resered for technical support. For information about managing digital certificates, see the Clustered Data ONTAP System Administration Guide for Cluster Administrators. Security enhancements for managing user accounts and passwords of a role To enhance user account security, Data ONTAP 8.2 and later releases enable you to manage additional settings for user accounts and passwords in an access-control role. 28 IBM System Storage N series: Clustered Data ONTAP Release Notes

39 You can use parameters of the security login role config modify command to modify the following settings for an access-control role: The required number of special characters in a password (-passwd-min-special-chars) Whether users must change their passwords when logging in to their accounts for the first time (-require-initial-passwd-update) The number of days after which a password expires (-passwd-expiry-time) The number of inalid login attempts that triggers the account to be locked automatically (-max-failed-login-attempts) The number of days for which an account is locked if inalid login attempts reach the allowed maximum (-lockout-duration) For information about the security login role config modify command and the default settings, see the man page. Enhancements of management protocols Data ONTAP 8.2 and later releases support seeral enhancements for RSH, SSH, and Telnet. The following list describes the enhancements: RSH is a supported access method for cluster user accounts. RSH is disabled by default. RSH must be enabled in the management firewall policy that is used by the cluster or node management LIFs so that RSH requests can go through the firewall. To use RSH to access the cluster, you must hae a cluster user account that is configured to use RSH as an access method. The -application parameter of the security login commands supports rsh as an access method for cluster user accounts. Storage Virtual Machine (SVM) users cannot use RSH as an access method. Data ONTAP supports a maximum of 50 concurrent RSH sessions per node. IP6 connections are supported oer SSH, Telnet, and RSH. IP6 connections require that IP6 be configured and enabled on the cluster and that firewall policies be configured with IP6 addresses. The Data ONTAP 8.2 release family supports OpenSSH client ersion 5.4p1 and OpenSSH serer ersion 5.4p1. New and changed features in the Data ONTAP 8.2 release family 29

40 For more information about these enhancements, see the Clustered Data ONTAP System Administration Guide for Cluster Administrators. For more information about configuring and enabling IP6, see the Clustered Data ONTAP Network Management Guide. Enhancements for managing cluster time Starting with Data ONTAP 8.2, the Network Time Protocol (NTP) is always enabled on the cluster. If you manually set the time, the setting takes effect on all nodes in the cluster. The following list describes the cluster time management changes: NTP is always enabled on the cluster. As before, for the cluster to synchronize with an external time source, you must also configure the NTP serers by using the system serices ntp serer commands. To disable NTP (not recommended), you must contact technical support. Starting with Data ONTAP 8.2, the system serices ntp config commands, used for enabling NTP and displaying whether NTP is enabled, are aailable only at the diagnostic priilege leel and for technical support only. If you set the cluster time manually, the setting takes effect on all nodes in the cluster. This capability ensures a consistent time setting across all nodes in the cluster. The system node date commands hae been deprecated in faor of the cluster date commands, which manage the time at the cluster leel. New command family for managing the SP from Data ONTAP Starting with Data ONTAP 8.2, the system node serice-processor commands are aailable for managing the Serice Processor (SP) from the Data ONTAP clustershell. The sp and software install nodeshell commands are deprecated in faor of the new commands. The system node serice-processor commands replace the sp nodeshell commands for the following tasks: Set up or modify the SP network configuration (system node serice-processor network modify) Display the SP network configuration (system node serice-processor network show) Display the SP information (system node serice-processor show) Reboot the SP and optionally specify the SP firmware image (primary or backup) to use (system node serice-processor reboot-sp) 30 IBM System Storage N series: Clustered Data ONTAP Release Notes

41 Display the details of the currently installed SP firmware image (system node serice-processor image show) Enable or disable the SP automatic firmware update (system node serice-processor image modify) Manually update the SP firmware and specify the update settings (system node serice-processor image update) Display the status for the latest SP firmware update (system node serice-processor image update-progress show) In addition, the software install nodeshell command is no longer supported for the SP firmware update. It is replaced by the system node serice-processor image update command. Cluster user accounts of any role can now be configured to access the SP or RLM Starting with Data ONTAP 8.2, you can enable a cluster user account of any role to access the Serice Processor (SP) or Remote LAN Module (RLM). The access to the SP or RLM no longer requires that the cluster user account hae the admin role. A cluster user account of any role can access the SP or RLM if it is created with the -application parameter of the security login create command set to serice-processor and the -authmethod parameter set to password. As before, Storage Virtual Machine (SVM) user accounts do not hae access to the SP or RLM. Enhancements of the SP and RLM shell enironments The shell enironment for the SP or RLM is separate from that of the serial console and requires independent login authentication. The SP or RLM console mirrors output that is displayed on a concurrent serial console session. When you initiate a console session from the SP or RLM CLI, you are prompted for the serial console credential. Also, on a platform that has the SP, when you access the SP CLI from a serial console session, you are prompted for the SP CLI credential. The SP or RLM console session mirrors output that is displayed on a concurrent serial console session. Howeer, the concurrent serial console session does not mirror the SP or RLM console session. The SP or RLM console session does not mirror output of concurrent SSH sessions. SP and RLM now support IP6 configuration Starting with Data ONTAP 8.2, you can configure the SP or the RLM with IP6 addresses. New and changed features in the Data ONTAP 8.2 release family 31

42 To configure IP6 connections for the SP or the RLM, IP6 must already be configured and enabled for Data ONTAP. For more information about IP6 configuration, see the Clustered Data ONTAP Network Management Guide. You use the system node serice-processor network modify command with the -address-type parameter to configure the SP of a node. You use the system node serice-processor network modify command in the clustershell to configure the RLM of a node. For information about configuring the SP or the RLM, see the Clustered Data ONTAP System Administration Guide for Cluster Administrators. Storage QoS Data ONTAP 8.2 introduces Storage QoS, which can help you manage the risks that accompany meeting performance objecties for workloads. You can use Storage QoS to limit the throughput to workloads to a Storage Virtual Machine (SVM), or to groups of olumes or LUNs within an SVM, and to monitor IOPS and MBps performance. You can reactiely limit workload performance to ensure fair resource usage. If you hae a cloud infrastructure, you might proactiely limit workloads, as defined by their serice leels. For example, you can preent runaway workloads from impacting other workloads in a shared storage infrastructure by applying a throughput limit to the runaway workload. In a serice-proider enironment, you can proactiely set throughput limits at an SVM leel, where an SVM maps to a tenant. This throughput limit ensures a consistent performance for each tenant as you add more tenants to the shared storage infrastructure and preents tenants from affecting each other's workload performance. Storage QoS is supported on clusters that hae up to eight nodes. For information about how to use Storage QoS, see the Clustered Data ONTAP System Administration Guide for Cluster Administrators. Enhancements for deliery of AutoSupport messages This release of Data ONTAP proides the new AutoSupport OnDemand feature, deliery of the fully qualified domain name (FQDN) to SMTP mail serers, and user space core reports in daily AutoSupport messages. AutoSupport OnDemand Starting in Data ONTAP 8.2, AutoSupport OnDemand is a new AutoSupport feature that ensures that technical support has the data it needs to proide quick incident resolution and preentie support. 32 IBM System Storage N series: Clustered Data ONTAP Release Notes

43 AutoSupport OnDemand periodically sends HTTPS requests to technical support to obtain deliery instructions. The deliery instructions can include requests to generate new AutoSupport messages, retransmit preiously generated messages, and disable deliery of messages for specific trigger eents. The requests go to the same technical support location that AutoSupport messages are sent to. AutoSupport OnDemand is enabled by default. It automatically communicates with technical support if AutoSupport is configured to send messages to technical support and the transport protocol is HTTPS. For more information about AutoSupport OnDemand, see the Clustered Data ONTAP System Administration Guide for Cluster Administrators. FQDN deliery to SMTP mail serers Starting in Data ONTAP 8.2, when sending connection requests to SMTP mail serers, AutoSupport now specifies the FQDN of the node if DNS is configured. In preious releases, AutoSupport specified only the host name. Using the FQDN instead of the host name proides better compliance with mail protocol standards, such as RFC 2821 and Because it is best practice to configure mail serers to erify that the name proided by the client is a resolable FQDN and to reject the otherwise, this enhancement allows successful deliery of AutoSupport messages using SMTP. User space core reports Starting with Data ONTAP 8.2.1, when a user space application crashes and restarts, it produces a core dump and a core report. The core report was preiously collected as part of the weekly AutoSupport message. It is now collected as part of the daily AutoSupport message for management logs. The core dump itself can be uploaded separately, if desired. Enhancements to health monitoring Data ONTAP 8.2 includes seeral enhancements to health monitoring. Monitoring cluster network switches and management network switches The cluster switch health monitor continuously monitors cluster network switches and management network switches for temperature, utilization, interface configuration, redundancy (cluster network switches only), and fan and power supply operation. New and changed features in the Data ONTAP 8.2 release family 33

44 The health monitor automatically attempts to discoer and monitor switches; howeer, monitoring might not happen automatically in some situations. You should erify that the health monitor can monitor your switches. For more information about discoery and switch monitoring, see the Clustered Data ONTAP System Administration Guide for Cluster Administrators. Monitoring Hyper-V oer SMB configurations The node connectiity health monitor in Data ONTAP 8.2 monitors SMB connections to ensure nondisruptie operations to Hyper-V applications. Support for collecting and iewing performance data oer multiple time periods Starting in Data ONTAP 8.2, you can collect and iew performance data oer multiple time periods simultaneously. In prior releases, you could use the statistics show command to monitor cluster performance for only a single time period. In Data ONTAP 8.2, you collect a data sample by using the statistics start command and (optionally) the statistics stop command. You display data from a sample by using the statistics show command. You can collect more than one sample at a time. Note: You must collect a sample before you can use the statistics show command. For more information about performance data and the statistics commands, see the Clustered Data ONTAP System Administration Guide for Cluster Administrators. Support for single node clusters Data ONTAP 8.2 adds support for single node clusters, which you can deploy if your workload only requires a single node but does not need nondisruptie operations. For example, you could deploy a single node cluster to proide data protection for a remote office. In this scenario, the single node cluster would use SnapMirror and SnapVault to replicate the site's data to the primary data center. In a single node cluster, the HA mode is set to non_ha, which enables the node to use all of the nonolatile memory (NVRAM) on the NVRAM card. In addition, single node clusters do not use a cluster network, and you can use the cluster ports as data ports that can host data LIFs. 34 IBM System Storage N series: Clustered Data ONTAP Release Notes

45 Howeer, single node clusters do not support storage failoer, Infinite Volumes, storing cluster configuration backups in the cluster, or any operation that requires more than one node. For more information about setting up a single node cluster, see the Clustered Data ONTAP Software Setup Guide. Element Manager is no longer aailable Starting with Data ONTAP 8.2, Element Manager (including ClusterView) is no longer aailable. You can use the Data ONTAP command-line interface or OnCommand System Manager, a web-based graphical management interface, to manage the cluster. Not all Data ONTAP functionality is supported by OnCommand System Manager. For information about OnCommand System Manager, see IBM N series support website at: SVM enhancements The clustered Data ONTAP 8.2 release family proides new features related to SVMs, such as SVM peer infrastructure. Replacement of Vserer name with Storage Virtual Machine name To aoid confusion, it is important that you understand that starting with clustered Data ONTAP 8.2.1, Storage Virtual Machine (SVM) is the new descriptie name for Vserer. In the documentation, the term SVM refers to Vserer. The Data ONTAP command-line interface (CLI) continues to use the term Vserer in the output, and serer as a command or parameter name has not changed. Support for modifying the SVM language settings Starting with clustered Data ONTAP 8.2, you can modify the SVM language and specify the language setting of the olumes in the SVM. You cannot modify the language of an SVM with Infinite Volume. When you create a FlexVol olume without specifying the language, the olume inherits the language from the SVM it belongs to. After you set the language of a FlexVol olume, you cannot modify it. When you modify the SVM language, the language of its olumes is not modified. For more information about modifying the SVM language, see the Clustered Data ONTAP System Administration Guide for Cluster Administrators. New and changed features in the Data ONTAP 8.2 release family 35

46 For more information about specifying a olume's language setting, see the Clustered Data ONTAP Logical Storage Management Guide. SVMs can be peered within a cluster or across clusters Starting with clustered Data ONTAP 8.2, a cluster administrator can create SVM peer relationships to set up a backup and recoery mechanism between olumes of the peered SVMs either existing within a cluster (intracluster) or in the peered clusters (intercluster). In clustered Data ONTAP 8.2, only SnapMirror data protection relationship can be set up by using the SVM peer infrastructure. For more information about SVM peer relationships, see the Clustered Data ONTAP System Administration Guide for Cluster Administrators. Change in size of the SVM's root olume Starting with clustered Data ONTAP 8.2, the SVM root olume is created with 1 GB size to preent any failures caused by lack of space or inodes when mounting olumes in the SVM root olume. For more information about the SVM root olumes, see the Clustered Data ONTAP System Administration Guide for Cluster Administrators. High-aailability pair enhancements This Data ONTAP release includes new features and enhancements relating to HA pairs. New HA mode requirement The HA license is no longer required in Data ONTAP 8.2, yet there are specific Data ONTAP commands for setting the HA mode. The HA mode must be enabled using the storage failoer modify command. The HA mode must be enabled before storage failoer can be enabled. Faster takeoer with aggregate relocation In Data ONTAP 8.2, the storage failoer takeoer command automatically changes aggregate ownership of aggregates on the target node to the partner node. This results in a faster takeoer. The aggregate ownership is automatically returned to the target node during gieback. Storage resource management enhancements This Data ONTAP release includes a number of enhancements for performance, resiliency, and management capabilities for storage resources. 36 IBM System Storage N series: Clustered Data ONTAP Release Notes

47 Aggregates can be expanded to 64-bit format without adding storage Starting with Data ONTAP 8.2.1, you can expand a 32-bit aggregate to the 64-bit format without adding storage to the aggregate. Conerting to the 64-bit format enables you to use Data ONTAP features that require 64-bit aggregates, such as compression, Flash Pool aggregates, and dedupe- and compression-aware SnapVault. Increased maximum Flash Pool cache sizes for N3150, N3220 and N3240 systems The maximum size for Flash Pool caches has increased in Data ONTAP To determine the maximum Flash Pool cache size for your system model, see the IBM N series Introduction and Planning Guide. Automated Workload Analyzer for Flash Pool cache sizing Starting with Data ONTAP 8.2.1, the Automated Workload Analyzer (AWA) functionality is aailable. AWA is enabled on an aggregate and proides real-time workload analysis to estimate the recommended Flash Pool cache size and to predict cache hit rates. AWA can be used on both Flash Pool aggregates and HDD-only aggregates. It can be used on a controller with a Flash Cache module installed. You access the AWA functionality by using the wafl awa command, aailable through the nodeshell at the adanced priilege leel. Support for FlexCache olumes Starting with clustered Data ONTAP 8.2, you can use FlexCache olumes in a clustered Data ONTAP enironment to cache frequently read data. FlexCache olumes help improe read performance because the data can be sered directly without haing to access the source. You can use FlexCache olumes to cache the data contained in a clustered Data ONTAP olume within the Storage Virtual Machine (SVM) that contains the source olume. You can also cache the data outside the cluster by using a caching system that runs Data ONTAP operating in 7-Mode. For more information about FlexCache olumes in a clustered Data ONTAP enironment, see the Clustered Data ONTAP Logical Storage Management Guide. For information about caching a FlexVol olume outside of a cluster by using Data ONTAP operating in 7-Mode, see the Data ONTAP Storage Management Guide for 7-Mode. Increased maximum aggregate size for some platforms The maximum aggregate size has increased for some platforms in Data ONTAP 8.2. For more information, see the IBM N series Introduction and Planning Guide at New and changed features in the Data ONTAP 8.2 release family 37

48 Increased maximum olume count for some platforms Data ONTAP 8.2 supports up to 1,000 olumes on some platforms. To see the maximum number of olumes for a specific platform, see the IBM N series Introduction and Planning Guide at nseries/. Multi-disk carrier and single-disk carrier disk sheles can be combined in the same stack Starting with Data ONTAP 8.2.1, you can combine multi-disk carrier disk sheles with single-disk carrier disk sheles (standard disk sheles) in the same stack. Flash Pool aggregates support different RAID types and group sizes for SSD cache For earlier ersions of Data ONTAP, the SSD cache always had the same RAID type and RAID group size as the HDD RAID groups. Starting in Data ONTAP 8.2, the SSD cache RAID type and RAID group size can be configured differently from the HDD RAID groups. Flexibility for calculating maximum Flash Pool SSD cache size in HA configurations There is a platform-dependent maximum size for the Flash Pool SSD cache. Starting in Data ONTAP 8.2, the cache -size limits apply to the HA configuration as a whole, and can be split arbitrarily between the two nodes, proided that the total limit for the HA configuration is not exceeded. In preious ersions of Data ONTAP, the maximum Flash Pool SSD cache size was applied indiidually to both nodes in an HA configuration. For more information about how Flash Pool cache capacity is calculated, see the Clustered Data ONTAP Physical Storage Management Guide. Disabled olume guarantees no longer reenabled automatically Starting with Data ONTAP 8.2, after more space becomes aailable Data ONTAP no longer automatically reenables the guarantee for olumes with disabled guarantees. This gies the administrator control oer when a olume with a disabled guarantee consumes space to enable its guarantee. Fractional resere setting can be set only to 0 or 100 In preious ersions of Data ONTAP, you could set the fractional resere setting for a FlexVol olume to any alue, from 0 to 100. Starting with Data ONTAP 8.2, the fractional resere setting can be set only to 0 or 100. If you upgrade a system to Data ONTAP 8.2 with olumes whose fractional resere settings are between 1 and 99, the fractional resere setting for those olumes is set to IBM System Storage N series: Clustered Data ONTAP Release Notes

49 Infinite Volume enhancements You can use the new Clustered Data ONTAP Infinite Volumes Management Guide to help you proision Infinite Volumes in the same cluster as FlexVol olumes, access Infinite Volumes through more protocols, automatically place data into storage classes, protect Infinite Volumes with an extended set of data protection configurations, and use incremental tape backup. Clustered Data ONTAP Infinite Volumes Management Guide Starting with Data ONTAP 8.2.1, you can use the Clustered Data ONTAP Infinite Volumes Management Guide to help you plan, create, monitor, and expand Infinite Volumes with and without storage classes. The new guide also describes how to configure and manage data protection mirror relationships and incremental tape backup for Infinite Volumes with and without storage classes. For more information about these features and capabilities, see the Clustered Data ONTAP Infinite Volumes Management Guide. Cluster and aggregate sharing Multiple Storage Virtual Machines (SVMs) with Infinite Volume can share a cluster with multiple SVMs with FlexVol olumes. Infinite Volumes can share aggregates with each other and with FlexVol olumes. Multiple constituents of an Infinite Volume can reside on the same aggregate. File access and protocol improements In addition to NFS3, clients can access Infinite Volumes through SMB 1.0 (CIFS), NFS4.1, and pnfs. Infinite Volumes use the unified security style, which enables all clients to iew and set file permissions, regardless of the file permissions that are currently in effect on a gien file or directory. Unified security style also facilitates access checks using both Windows and UNIX credentials. Storage classes and data policies You can optimize storage by grouping it into storage classes that correspond to specific goals. Incoming files can be automatically placed into the appropriate storage class according to rules based on file name, file path, or file owner. New and changed features in the Data ONTAP 8.2 release family 39

50 Data protection improements Infinite Volumes support data protection mirror relationships with Infinite Volumes in other clusters as well as fanout and bidirectional configurations. Data protection mirror relationships for Infinite Volumes now support Data ONTAP 8.2 and later capabilities, which proide SVM peering support that allows SVM administrators to manage data protection mirror relationships for Infinite Volumes. Each Infinite Volume has a namespace mirror constituent to proide data protection for the namespace constituent. Tape backup improements Incremental tape backup is aailable for Infinite Volumes using a SnapDiff-supported backup application that supports backup and restore using NFS or CIFS protocols. Platform support expanded Infinite Volumes are now supported on more platforms. For the current list of platforms supported by Infinite Volumes, see the IBM N series Introduction and Planning Guide at support/nseries/. Volume copy functionality no longer supported The olume copy functionality is deprecated in Data ONTAP 8.2. You can use other Data ONTAP features to achiee the same results. You can substitute the following functionality to perform tasks for which you preiously used the olume copy functionality: Moe olumes from one aggregate to another while presering deduplication and compression saings by using the olume moe feature. Create space and time efficient copies of a olume within the same aggregate by using the FlexClone olume feature. Copy a olume to another aggregate by first using the FlexClone olume feature to copy the olume. Then, copy the FlexClone olume to a different aggregate by using the olume moe feature. This method does not copy Snapshot copies from the original olume. Copy a olume to another aggregate by first using the SnapMirror feature to replicate the olume to a destination olume. Then, break the relationship to make the copy a read-write olume. This method preseres all of the Snapshot copies from the original olume on the destination olume. 40 IBM System Storage N series: Clustered Data ONTAP Release Notes

51 Storage efficiency enhancements You can find information about new and changed storage efficiency capabilities. Support for aggregate relocation Data ONTAP 8.2 supports relocation of aggregate ownership within an HA pair. During planned takeoer eents such as nondisruptie software upgrades or controller replacements, aggregate relocation automatically and serially relocates data aggregates to the partner node. This results in a faster takeoer. Aggregate relocation can also be used for nondisruptie controller upgrade operations. Support for using olume efficiency priorities Starting with Data ONTAP 8.2, you can assign olume efficiency priorities to prioritize the olume efficiency operations that are running on a olume. You can set the priority to either best-effort or background. You can use the olume efficiency priorities to maximize the utilization of system resources when running efficiency operations. For more information about assigning a priority for a olume efficiency operation, see the olume efficiency policy modify command man page. Support for detecting incompressible data in files Data ONTAP 8.2 introduces the ability to check if a file is incompressible and for large files, you can check if a compression group within a file is incompressible. Incompressible data detection saes the system resources used by inline compression to compress incompressible data. For more information about incompressible data detection, see the Clustered Data ONTAP Logical Storage Management Guide. Support for reerting olume efficiency metadata Starting with Data ONTAP 8.2, you can reert the format of the efficiency metadata in a olume to a specific ersion of Data ONTAP. For more information about reerting olumes with efficiency metadata, see the Clustered Data ONTAP Upgrade and Reert/Downgrade Guide and the man page for the olume efficiency reert-to command. Support for data protection FlexClone olumes Starting with Data ONTAP 8.2, you can create data protection FlexClone olumes to create space-efficient copies of SnapVault secondary olumes. Data protection FlexClone olumes share common blocks with their parent FlexVol olumes. Howeer, you cannot split a data protection FlexClone olume from its parent olume. New and changed features in the Data ONTAP 8.2 release family 41

52 For information about creating data protection FlexClone olumes, see the Clustered Data ONTAP Logical Storage Management Guide. Support for automatic deletion of FlexClone LUNs Starting with Data ONTAP 8.2, you can configure the autodelete settings of a FlexVol olume to automatically delete FlexClone LUNs when the free space in a olume decreases below a particular threshold alue. For more information about configuring a FlexVol olume for automatic deletion of FlexClone LUNs, see the Clustered Data ONTAP Logical Storage Management Guide. FlexArray Virtualization (Gateway) enhancements This Data ONTAP release includes a number of new features and enhancements for FlexArray Virtualization (Gateway). Gateway functionality renamed as FlexArray Virtualization Starting with Data ONTAP 8.2.1, the capability of using LUNs on a storage array, formerly identified as the Gateway functionality, has a new name Data ONTAP FlexArray Virtualization Software. The capability of using array LUNs continues to be aailable as a licensed feature on Data ONTAP. Support added for FC direct-attached configurations with E-Series back-end storage arrays Starting with Data ONTAP 8.2.1, FC direct-attached configurations are supported on the E-Series back-end storage arrays. For more information about the supported direct-attached configurations, see the IBM N series interoperability matrix at storage/network/interophome.html. Licensing requirement for Data ONTAP systems to use array LUNs Starting with Data ONTAP 8.2, the V_StorageAttach license package must be installed for Gateway systems to access LUNs on storage arrays. For Gateway systems upgraded from preious Data ONTAP 8.x releases to 8.2, the license is automatically updated to the V_StorageAttach license package. The V_StorageAttach license must be installed on each Data ONTAP node with which you want to use array LUNs; it is not a single license for the cluster. 42 IBM System Storage N series: Clustered Data ONTAP Release Notes

53 Licensing enhancement in Gateway systems Starting in Data ONTAP 8.2.1, Gateway systems do not reboot if the V_StorageAttach license package is not installed within 72 hours. Howeer, the license must be installed to be able to access LUNs on storage arrays. New storage arrays supported in Data ONTAP 8.2 Support for new storage arrays is added in Data ONTAP 8.2. For information about the supported storage arrays, see the IBM N series interoperability matrix at interophome.html. Also see the FlexArray Virtualization Implementation Guide for Third-Party Storage for information about parameter settings for these storage arrays to work with Data ONTAP systems that uses array LUNs, supported configurations for the storage arrays, and so on. Support added for one Data ONTAP FC initiator connecting to multiple array target ports Starting with Data ONTAP 8.2, you can connect a Data ONTAP FC initiator port to a maximum of four target ports on separate storage arrays. Connecting an FC initiator port to four target ports on the same storage array is also supported; howeer, this configuration can be used only with storage arrays whose LUN masking, presentation, or host group capability allows for different LUN group presentations to the same FC initiator based on the target port being accessed. See the FlexArray Virtualization Installation Requirements and Reference Guide for the rules for implementing this type of configuration. See your storage array documentation for information about whether your storage array supports a Data ONTAP FC initiator connecting to multiple target ports on the same storage array. Increased LUN count per Data ONTAP FC initiator The number of array LUNs that can be isible oer an FC initiator has been increased in Data ONTAP 8.2. There are limits on how many array LUNs can be isible oer an FC initiator port. These limits ary in different Data ONTAP releases. See the FlexArray Virtualization Best Practices Guide for information about the considerations for and number of array LUNs supported per initiator. Support added for firmware NDU on HP EVA storage arrays Starting with Data ONTAP 8.2, you can increase Data ONTAP system resiliency so that the system is not disrupted if target ports go offline during the firmware upgrade. New and changed features in the Data ONTAP 8.2 release family 43

54 To know more about the commands that you can use to increase the system resiliency, see the FlexArray Virtualization Implementation Guide for Third-Party Storage. Support added for ALUA with EMC CLARiiON and VNX storage arrays Starting with Data ONTAP 8.2, support has been added for ALUA (Asymmetric Logical Unit Access) with EMC CLARiiON and VNX arrays. By default, support for ALUA is enabled in Data ONTAP; to use it, ALUA must be enabled on the storage array. You should enable ALUA only on new configurations. You should not enable ALUA in an existing configuration. See the FlexArray Virtualization Implementation Guide for Third-Party Storage for more information. Enhancements for setting the target queue depth on a Data ONTAP system that uses array LUNs New commands are added in Data ONTAP 8.2 for configuring the target port queue depth and displaying information about the target queue depth. Additionally, the default target queue depth setting is increased. Prior to Data ONTAP 8.2, the target queue depth could be set (by using nodeshell) per Data ONTAP system, and that setting applied to all target ports on all storage arrays. Clustered Data ONTAP 8.2 introduces new commands that enable you to set the target queue depth per storage array or on a per-port basis on a storage array. For more information, see the FlexArray Virtualization Installation Requirements and Reference Guide. File access protocol enhancements This Data ONTAP release includes a number of new features and enhancements for file access and protocols management. For detailed information about these features, see the Clustered Data ONTAP File Access Management Guide for CIFS or the Clustered Data ONTAP File Access Management Guide for NFS. Limit on symbolic links for SMB access has been remoed In clustered Data ONTAP releases earlier than clustered Data ONTAP in the 8.2 release family, there was a limit of 2,048 symbolic links for SMB access per cluster. This limit has been remoed in clustered Data ONTAP and later in the 8.2 release family and in clustered Data ONTAP 8.3 and later releases. 44 IBM System Storage N series: Clustered Data ONTAP Release Notes

55 Support for enabling short name searches on the CIFS serer Starting with Data ONTAP 8.2.3, you can enable the CIFS serer to perform searches on short names using a new adanced-leel CIFS serer option. If this option is enabled, a search query tries to match 8.3 file names along with long file names. You can enable or disable this option at any time by using the following command: serer cifs options modify -is-search-short-names-enabled {true false} The default is not to perform searches on short names. New alidation checks when loading netgroup files from a URI Beginning with Data ONTAP 8.2.3, Data ONTAP now checks the netgroup file for formatting or syntax errors. If such errors are present, Data ONTAP displays a warning. These new alidation checks can help preent you from loading an incorrect netgroup file, which could cause unintended and undesirable client access issues. For information about formatting guidelines for the netgroup file, see the man page for the serer serices netgroup load command. Support for checking client access to exports Beginning with Data ONTAP 8.2.3, you can now check access for a specific client to a specific olume or qtree export using the serer export-policy check-access command. This enables you to test export policies to ensure that they work as intended and troubleshoot client access issues. For more information, see the man page for the serer export-policy check-access command. Changes to the way clustered Data ONTAP adertises DFS capabilities Starting with clustered Data ONTAP in the 8.2 release family, a new CIFS serer option, -is-adertise-dfs-enabled, is aailable to control whether CIFS serers automatically adertise DFS capabilities to SMB 2.x and SMB 3.0 clients that connect to shares. Clustered Data ONTAP uses DFS referrals in the implementation of SMB access to symbolic links. For more information see the Changes to documentation section of the release notes. New and changed features in the Data ONTAP 8.2 release family 45

56 Support for Windows NFS3 clients Beginning with Data ONTAP 8.2.3, Data ONTAP now supports client access from Windows NFS3 clients. This means that clients running Windows operating systems with NFS3 support can now access files on NFS3 exports on the cluster. Requirements Before using Windows NFS3 clients for file access on the cluster, you must understand some requirements and ensure that your enironment complies with them. By default, Windows NFS3 client support is disabled. To enable it on Storage Virtual Machines (SVMs), use the following command: serer nfs modify -serer sm_name -3-ms-dos-client enabled On all SVMs that support Windows NFS3 clients, you must disable the -enable-ejukebox and -3-connection-drop parameters by using the following command: serer nfs modify -serer serer_name -enable-ejukebox false -3-connection-drop disabled Windows NFS3 clients use soft mounts by default. Howeer, you must always use hard mounts when mounting exports on the storage system from Windows NFS3 clients by specifying the -o mtype=hard option. Windows NFS3 clients must include the string ROOT-path between the IP address or host name and the junction path to properly mount the export: \\IPaddress_or_hostname\ROOT-path\junction_path Example: mount -o mtype=hard \\ \ROOT-path\ol\ol1 z:\ Limitations When using Windows NFS3 clients for file access on the cluster, you must understand some limitations to ensure successful file access. Windows NFS3 clients will not be able to see the correct aailable space and used space of the olume. Windows NFS3 clients do not support the network status monitor (NSM) protocol. As a result, Windows NFS3 client sessions might experience disruptions during storage failoer and olume moe operations. 46 IBM System Storage N series: Clustered Data ONTAP Release Notes

57 New limits for local UNIX users, groups, and group members As an alternatie to managing users and groups in external name serers, you can also create UNIX users and groups locally on the storage system. Beginning with Data ONTAP 8.2.3, Data ONTAP introduces limits for the maximum number of UNIX users and groups in a cluster, and commands to manage these limits. Support for netgroup-by-host searches for NIS and LDAP Beginning with Data ONTAP 8.2.3, Data ONTAP can perform netgroup-by-host searches in NIS directories as well as LDAP directories that are configured to support it. This new functionality can significantly speed up netgroup searches when processing export policy rules to ealuate client access. NIS database netgroup-by-host searches do not require any configuration because Data ONTAP can automatically take adantage of this functionality if a netgroup.byhost map is present. To perform LDAP database netgroup-by-host searches, you can enable and configure this functionality in the LDAP client configuration at the adanced priilege leel using the serer serices ldap client create and serer serices ldap client modify commands. See the man pages for the commands for more information. New commands for managing protocols for SVMs New commands are aailable that improe management of protocols for SVMs. These new commands enable you to display and modify file access protocols more easily and more reliably. To modify protocols for SVMs, use these new commands: serer add-protocols serer remoe-protocols Support for managing how UNIX security-style data is presented to SMB clients Starting with Data ONTAP 8.2.2, Data ONTAP supports a new CIFS serer option that enables you to choose how to present file security to SMB clients for UNIX security-style data. Data ONTAP can present data residing in UNIX security-style olumes to SMB clients with NTFS ACLs or without NTFS ACLs. For information about configuring the CIFS serer option that manages how UNIX data is presented to SMB clients, see the Changes to published documentation section. New and changed features in the Data ONTAP 8.2 release family 47

58 Support for restricting access for anonymous users Starting with Data ONTAP 8.2.2, Data ONTAP supports restricting access for anonymous, unauthenticated users. You can configure Data ONTAP to restrict all access, to restrict only enumeration, or to not restrict access for anonymous users. For information about configuring access restrictions for anonymous, unauthenticated users, see the Changes to published documentation section of the Clustered Data ONTAP Release Notes. LDAP client configurations now support multiple DNs Beginning with Data ONTAP 8.2.2, you can now specify multiple distinguished names (DNs) when configuring the -user-dn, -group-dn, and -netgroup-dn parameters of an LDAP client configuration. You can modify LDAP client configurations by using the serer serices ldap client modify command. When you use this command at the adanced priilege leel, you can specify separate base and scope alues for the user DN, group DN, and netgroup DN of the LDAP client configuration by using the -user-dn, -group-dn, and -netgroup-dn parameters, respectiely. These parameters oerride the general default search base and scope for user, group, and netgroup searches. Preiously you could only specify one DN for each parameter. Beginning with Data ONTAP 8.2.2, you can specify multiple DNs for each parameter by separating them with a semicolon (;) and enclosing the entire DN list with quotation marks ("). If you configure multiple user or group DNs and a DN contains a semicolon, you must add an escape character (\) immediately before the semicolon in the DN. Example The following command configures the LDAP client configuration NFS for the Storage Virtual Machine (SVM) s1 with two user DNs: serer serices ldap client modify -serer s1 -client-config NFS -user-dn "cn=users,dc=domain,dc=win2k8,dc=example,dc=com;cn=test,dc=domain, dc=win2k8,dc=example,dc=com" -user-scope subtree The scope that you specify applies to the entire list of DNs for the corresponding parameter. In the example, the specified user scope subtree applies to both DNs in the user DN list, meaning that LDAP user searches search the entire subtree for both specified DNs. 48 IBM System Storage N series: Clustered Data ONTAP Release Notes

59 Support for SQL Serer oer SMB solutions Starting with Data ONTAP 8.2.1, you can use continuously aailable SMB 3.0 file shares to store Microsoft SQL Serer user and system databases on olumes residing in Storage Virtual Machines (SVMs) with FlexVol olumes, while at the same time proiding nondisruptie operations (NDOs) for both planned and unplanned eents. The Data ONTAP SQL Serer oer SMB solution proides the following capabilities: New functionality aailable with SMB 3.0, including the continuously aailable share property, which enables clients connecting through continuously aailable SMB 3.0 shares to surie disruptie eents such as takeoer and gieback Witness protocol enhanced failoer capabilities The Witness protocol proides enhanced client failoer capabilities for SMB 3.0 continuously aailable shares. Witness facilitates faster failoer because it bypasses the LIF failoer recoery period. It notifies SQL Serer application serers when a node is unaailable without needing to wait for the SMB 3.0 connection to time out. Nondisruptie operations for the following: Planned takeoer and gieback Unplanned takeoer Planned aggregate relocation (ARL) Data ONTAP upgrade To perform a nondisruptie upgrade, all nodes in the cluster must be running a ersion of clustered Data ONTAP that supports this functionality. Note: The SQL Serer oer SMB solution also supports nondisruptie olume moes and LIF failoer and migration for SMB, which are generally supported on clustered Data ONTAP with SMB 2.0 and later. For information about configuring and managing SQL Serer oer SMB Data ONTAP solutions, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for LDAP oer SSL/TLS Starting with Data ONTAP 8.2.1, Data ONTAP supports LDAP oer SSL/TLS to secure communication between the Storage Virtual Machine (SVM) LDAP client and the LDAP serer. This allows LDAP to secure authentication between the LDAP client and serer and to encrypt all data transfers to and from the LDAP serer. New and changed features in the Data ONTAP 8.2 release family 49

60 LDAP supports two methods to encrypt communications using SSL/TLS: traditional LDAPS and STARTTLS. LDAPS communication usually occurs oer a special port, commonly 636. Howeer, STARTTLS begins as a plaintext connection oer the standard LDAP port (389), and that connection is then upgraded to SSL/TLS. Clustered Data ONTAP uses STARTTLS for securing LDAP communication, and uses the default LDAP port (389) to communicate with the LDAP serer. LDAP oer SSL/TLS on the SVM should not be configured to use port 636 because this causes LDAP connections to fail. The LDAP serer must be configured to allow connections oer LDAP port 389; otherwise, LDAP SSL/TLS connections from the SVM to the LDAP serer fail. LDAP oer SSL/TLS is supported oer IP4. LDAP oer SSL/TLS is not supported oer IP6 in this Data ONTAP release. For information about configuring LDAP oer SSL/TLS on the SVM, see the Clustered Data ONTAP File Access Management Guide for CIFS and the Clustered Data ONTAP File Access Management Guide for NFS. Support for multidomain name mapping searches Starting with Data ONTAP 8.2.1, Data ONTAP supports multidomain name mapping searches. This enables Data ONTAP to search eery bidirectional trusted domain to find a match when performing UNIX user to Windows user name mapping. When performing multidomain name mapping searches, all discoered bidirectionally trusted domains are searched for matches to the replacement pattern until a matching result is returned. Alternatiely, you can configure a list of preferred trusted domains, which is used instead of the list of discoered bidirectionally trusted domains. For information about managing multidomain name mapping search configurations, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for creating Actie Directory computer accounts for SVMs Starting with Data ONTAP 8.2.1, you can create and manage Actie Directory (AD) computer accounts for Storage Virtual Machines (SVMs) een if you do not hae CIFS licensed on any of the cluster nodes. You can also configure and manage preferred domain controllers for the AD computer account. You might want to create an AD computer account for the SVM instead of creating a CIFS serer for one of the following reasons: CIFS is not licensed on the cluster but you want the SVM to be a member serer in an AD domain. 50 IBM System Storage N series: Clustered Data ONTAP Release Notes

61 You do not want to offer file serices and other alue-add CIFS functionality on the SVM. For information about managing multidomain name-mapping search configurations, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for the default c$ administratie share Starting with Data ONTAP 8.2.1, Data ONTAP automatically creates the c$ share when you create a CIFS serer on the Storage Virtual Machine (SVM). The c$ share is an administratie share that the cluster or SVM administrator can use to access and manage the SVM root olume. For information about using the c$ administratie share, see the Clustered Data ONTAP File Access Management Guide for CIFS. Enhancements for NAS multiprotocol auditing Starting with Data ONTAP 8.2.1, NAS multiprotocol auditing supports the EVTX audit eent-log format. Additionally, Data ONTAP now supports manually rotating the audit eent logs by using a CLI command. For more information about NAS multiprotocol auditing enhancements, see the Clustered Data ONTAP File Access Management Guide for CIFS and the Clustered Data ONTAP File Access Management Guide for NFS. Support for the KDC Resource SID Compression feature Beginning in Data ONTAP 8.2.1, the Key Distribution Center (KDC) can use the Resource SID Compression feature when Actie Directory serers are hosted on Windows Serer Microsoft introduced an enhancement to its Kerberos implementation for Windows Serer 2012 that was later called KDC Resource SID Compression, in which the KDC automatically compresses the group security identifiers (SIDs) in the resource domain. This compression can reduce the size of the serice ticket and reduce application authentication failures caused by large ticket sizes. To compress resource SIDs, the KDC stores the SID of the resource domain of which the target resource is a member. The KDC inserts only the RID portion of each resource SID into the ResourceGroupIds portion of the authentication data. New parameter to specify Kerberos SPN in a different OU The serer nfs kerberos-config modify command now includes the new -ou parameter. This parameter enables you to create the serice principal name (SPN) in a different OU of the Kerberos realm. See the man page for the command for more information. New and changed features in the Data ONTAP 8.2 release family 51

62 Support for VMware Storage oer IP6 Beginning with Data ONTAP 8.2.1, VMware Storage is also supported oer IP6 networks. For more information about VMware Storage APIs for Array Integration (VAAI) features in a Data ONTAP NFS enironment, see the Clustered Data ONTAP File Access Management Guide for NFS. Support for qtree exports Beginning with Data ONTAP 8.2.1, you can now export qtrees by applying export policies directly to qtrees. This means that the number of exports is no longer limited to the number of olumes on your storage system, enabling you to manage your exports more flexibly and on a more granular basis. Qtree exports are aailable for NFS3 exports only. For more information, see the Clustered Data ONTAP File Access Management Guide for NFS. Support for Hyper-V oer SMB solutions With the new capabilities proided in Data ONTAP 8.2 and later releases, you can now use continuously aailable SMB 3.0 file shares to store Hyper-V irtual machine files on olumes residing in Storage Virtual Machines (SVMs) with FlexVol olumes, while at the same time proiding nondisruptie operations (NDOs) for both planned and unplanned eents. The Data ONTAP Hyper-V oer SMB solution proides the following capabilities: New functionality aailable with SMB 3.0, including the continuously aailable share property, which enables clients connecting through continuously aailable SMB 3.0 shares to surie disruptie eents such as takeoer and gieback Witness protocol enhanced failoer capabilities The Witness protocol proides enhanced client failoer capabilities for SMB 3.0 continuously aailable shares. Witness facilitates faster failoer because it bypass the LIF failoer recoery period. It notifies Hyper-V serers when a node is unaailable without needing to wait for the SMB 3.0 connection to time out. NDOs for the following: Planned takeoer and gieback Unplanned takeoer Planned aggregate relocation (ARL) Data ONTAP upgrade 52 IBM System Storage N series: Clustered Data ONTAP Release Notes

63 To perform a nondisruptie upgrade, all nodes in the cluster must be running a ersion of clustered Data ONTAP that supports this functionality. Note: The Hyper-V oer SMB solution also supports nondisruptie olume moes and LIF failoer and migration for SMB, which are generally supported on clustered Data ONTAP with SMB 2.0 and later. Microsoft Remote VSS support that extends the VSS infrastructure to support shadow copy of SMB shares With these new extensions, it is possible for Remote VSS-enabled backup serices, such as SnapManager for Hyper-V, to take application consistent shadow copies for irtual machines that store data and configuration files on shares. ODX copy offload support for seeral Hyper-V specific use cases, including the following: To perform ODX copy offload pass-through with Hyper-V to copy data within or across irtual hard disk (VHD) files or to copy data between mapped SMB shares and connected iscsi LUNs within the same cluster To initialize a disk with zeros, using a well-known zeroed token, when creating fixed-sized VHDs To migrate irtual machine storage if the source and destination storage is on the same cluster Note: The Hyper-V oer SMB solution also supports standard ODX copy offload operations that are generally supported on SVMs with FlexVol olumes with ODX copy offload enabled. To configure the Hyper-V oer SMB solution, the Microsoft Hyper-V serers must support Hyper-V oer SMB; therefore, the Hyper-V serers must be configured on Windows 2012 Serer or later. Both stand-alone and clustered Hyper-V serer configurations are supported. For information about configuring and managing Hyper-V oer SMB Data ONTAP solutions, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for Remote VSS share-based backups Data ONTAP 8.2 and later releases proide support for Microsoft Remote VSS (Volume Shadow Copy Serices) share-based backups on SVMs with FlexVol olumes. Remote VSS is an extension of the existing Microsoft VSS infrastructure that supports shadow copies of SMB shares by Remote VSS-enabled backup serices such as SnapManager for Hyper-V. New and changed features in the Data ONTAP 8.2 release family 53

64 With Data ONTAP 8.2, you can use Remote VSS to perform share-based backups of Hyper-V irtual machine files that are stored on a CIFS serer and are accessed using SMB 3.0 continuously aailable shares. For information about using Remote VSS share-based backups, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for FPolicy on SVMs with FlexVol olumes Data ONTAP 8.2 and later releases proide support for the FPolicy feature on Storage Virtual Machines (SVMs) with FlexVol olumes. FPolicy is a file access notification framework that uses policies to monitor and manage NFS and SMB file access eents. The Data ONTAP framework creates and maintains the FPolicy configuration, monitors file eents, sends notifications to external FPolicy serers, and manages connections between SVMs and the external FPolicy serers. External FPolicy serers are applications serers that can proide file monitoring and management serices such as monitoring and recording file access eents, proiding quota serices, performing file blocking based on defined criteria, and proiding data migration serices using hierarchical storage management applications. If you do not want to use external FPolicy serers, FPolicy also proides natie file screening, which you can use to configure simple file blocking based on file extensions. For information about creating and managing FPolicy configurations, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for NAS auditing on SVMs with FlexVol olumes Data ONTAP 8.2 and later releases proide support for NAS auditing on Storage Virtual Machines (SVMs) with FlexVol olumes. Auditing is a security measure that enables you to track and log NFS and SMB file and folder access eents based on criteria specified in system access control list (SACL) entries. Auditing NAS access eents helps you track potential security problems and proides eidence of any file or folder access security breaches. For information about setting up and managing NAS auditing on Data ONTAP, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for local users and groups Data ONTAP 8.2 and later releases proide support for local users and groups on Storage Virtual Machines (SVMs). The CIFS serer can use local users for CIFS authentication and can use local users and groups for authorization when determining share, file, and 54 IBM System Storage N series: Clustered Data ONTAP Release Notes

65 directory access rights. Local and domain users and groups can also be assigned priileges. Priileges are well-known rights that can be granted to local and domain users and groups to perform User Rights Management tasks on the CIFS serer. For information about configuring and managing local users and groups, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for SMB 3.0 on SVMs with FlexVol olumes Data ONTAP 8.2 and later releases proide support for SMB 3.0 on Storage Virtual Machines (SVMs) with FlexVol olumes. Data ONTAP supports SMB 3.0 enhancements that proide the following functionality: Continuously aailable share property Persistent handles Remote VSS for SMB shares Witness protocol ODX copy offload BranchCache ersion 2 For information about configuring and using SMB 3.0 functionality on Data ONTAP, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for SMB signing Data ONTAP 8.2 and later releases proide support for SMB signing, which helps to ensure that network traffic between the CIFS serer and the client is not compromised. By default, Data ONTAP supports SMB signing when requested by the client. Optionally, you can configure the CIFS serer to require SMB signing. For Storage Virtual Machines (SVMs) with FlexVol olumes, Data ONTAP supports SMB signing on SMB 1.0, SMB 2.x, and SMB 3.0. For SVMs with Infinite Volume, Data ONTAP supports SMB signing on SMB 1.0. For information about using SMB signing with Data ONTAP, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for BranchCache on SVMs with FlexVol olumes Data ONTAP 8.2 and later releases support BranchCache caching. BranchCache was deeloped by Microsoft to enable caching of content on computers local to requesting clients. The Data ONTAP implementation of BranchCache can reduce wide-area network (WAN) utilization and proide improed access response time when users in a branch office access content stored on a Storage Virtual Machine (SVM) with FlexVol olumes using SMB. New and changed features in the Data ONTAP 8.2 release family 55

66 With BranchCache enabled, Windows BranchCache clients first retriee content from the SVM oer SMB, and then cache the content on a computer within the branch office. If another client in the branch office requests the same content, the SVM determines whether the cached content is still up-to-date and, if it is, sends the client metadata about the cached content. The client then uses the metadata to retriee content directly from the locally based cache. Data ONTAP 8.2 and later releases support both BranchCache 1 and BranchCache 2. For more information about configuring and managing BranchCache, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for SMB automatic node referrals on SVMs with FlexVol olumes Data ONTAP 8.2 and later releases proide support for SMB automatic node referrals on Storage Virtual Machines (SVMs) with FlexVol olumes. SMB automatic node referrals increase SMB client performance by automatically redirecting the requesting client to a LIF on the SVM node that is hosting the FlexVol olume in which the data resides. For information about configuring SMB automatic node referrals on Data ONTAP, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for ODX copy offload on SVMs with FlexVol olumes Data ONTAP 8.2 and later releases proide support for Microsoft Offloaded Data Transfer (ODX; also known as copy offload) on Storage Virtual Machines (SVMs) with FlexVol olumes. ODX enables direct data transfers within or between compatible storage deices without transferring the data through the host computer. Data ONTAP supports ODX for both the CIFS and SAN protocols. The source can be either a CIFS share or LUNs, and the destination can be either a CIFS share or LUNs. For information about configuring and using ODX copy offload on SVMs with FlexVol olumes, see the Clustered Data ONTAP File Access Management Guide for CIFS and the Clustered Data ONTAP SAN Administration Guide. Support for access-based enumeration Starting with Data ONTAP 8.2, Data ONTAP proides folder security on shares with access-based enumeration (ABE). When ABE is enabled on an SMB share, users who do not hae permission to access a shared folder or file underneath it (whether through indiidual or group permission restrictions) do not see that shared resource displayed in their enironment. 56 IBM System Storage N series: Clustered Data ONTAP Release Notes

67 For SVMs with FlexVol olumes, Data ONTAP supports ABE on SMB 1.0, SMB 2.x, and SMB 3.0. For SVMs with Infinite Volume, Data ONTAP supports ABE on SMB 1.0. For information about using ABE with Data ONTAP, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for Preious Versions Starting with Data ONTAP 8.2, Data ONTAP supports Microsoft Preious Versions, which proides a method for users to browse through the Snapshot copies or to restore data from a Snapshot copy without a storage administrator's interention by using the Preious Versions tab in the Windows Properties box. Preious Versions is not configurable. It is always enabled. If the storage administrator has made Snapshot copies aailable on a share, then the user can use the Preious Versions tab to access or recoer files contained in Snapshot copies. For Storage Virtual Machines (SVMs) with FlexVol olumes, Data ONTAP supports Preious Versions on SMB 1.0, SMB 2.x, and SMB 3.0. For SVMs with Infinite Volume, Data ONTAP supports Preious Versions on SMB 1.0. For information about using the Preious Versions feature with Data ONTAP, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for offline files Starting with Data ONTAP 8.2, Data ONTAP supports the Microsoft offline files feature, or client-side caching, which allows files to be cached on the local host for offline use. Users can use the offline files functionality to continue working on files een when they are disconnected from the network. For Storage Virtual Machines (SVMs) with FlexVol olumes, Data ONTAP supports Microsoft's offline files on SMB 1.0, SMB 2.x, and SMB 3.0. For SVMs with Infinite Volume, Data ONTAP supports Microsoft's offline files on SMB 1.0. For information about configuring offline files with Data ONTAP, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for roaming profiles Starting with Data ONTAP 8.2, Data ONTAP supports roaming profiles on Storage Virtual Machines (SVMs) with FlexVol olumes and on SVMs with Infinite Volume. Configuring roaming profiles proides adantages to the New and changed features in the Data ONTAP 8.2 release family 57

68 user, such as automatic resource aailability, regardless of where the user logs in. Roaming profiles also simplify the administration and management of user profiles. For SVMs with FlexVol olumes, Data ONTAP supports Microsoft's roaming profiles on SMB 1.0, SMB 2.x, and SMB 3.0. For SVMs with Infinite Volume, Data ONTAP supports Microsoft's roaming profiles on SMB 1.0. For information about using roaming profiles with Data ONTAP, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for redirected folders Starting with Data ONTAP 8.2, you can use folder redirection on a CIFS serer, which enables users or administrators to redirect the path of a local folder to a location on a CIFS serer share. It appears as if redirected folders are stored on the local Windows client, een though the data is stored on an SMB share. For Storage Virtual Machines (SVMs) with FlexVol olumes, Data ONTAP supports Microsoft's folder redirection on SMB 1.0, SMB 2.x, and SMB 3.0. For SVMs with Infinite Volume, Data ONTAP supports Microsoft's folder redirection on SMB 1.0. For information about using redirected folders with Data ONTAP, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for file and directory security tracing on SVMs with FlexVol olumes Data ONTAP 8.2 and later releases proide support for security tracing of client operations oer SMB on Storage Virtual Machines (SVMs) with FlexVol olumes. Security tracing enables you to configure a filter that detects client operations oer SMB, and traces all access checks matching that filter. You can then iew the tracing results, which proides a conenient summary of the reason that access was allowed or denied. For information about configuring and using security traces to erify the security settings for SMB access on files and folders on SVMs with FlexVol olumes, or if you are faced with an access problem, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for iewing file security and audit policy information using the CLI Data ONTAP 8.2 and later releases proide support for iewing information about file security and audit policies on Storage Virtual Machines (SVMs) with FlexVol olumes by using the Data ONTAP CLI. 58 IBM System Storage N series: Clustered Data ONTAP Release Notes

69 You can use the CLI to display information about file security and audit polices applied to data contained within olumes and qtrees with the following security styles: NTFS UNIX mixed You can use the CLI to display information about audit policies for auditing access eents oer the following NAS protocols: SMB (all ersions) NFS4.x For information about using the CLI to iew information for file security and audit policies on SVMs with FlexVol olumes, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for managing NTFS file security and audit policies using the CLI Data ONTAP 8.2 and later releases proide support for managing NTFS file security and audit policies on Storage Virtual Machines (SVMs) with FlexVol olumes by using the Data ONTAP CLI. This remoes the need to use a remote client to manage file security. Using the CLI can significantly reduce the time it takes to apply security on many files and folders by enabling you to use a single command. You can manage NTFS file security and audit policies using the CLI on olumes and qtrees with NTFS security style and on olumes and qtrees with mixed security style. For information about using the CLI to manage NTFS file security and audit policies on SVMs with FlexVol olumes, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for displaying information about SMB sessions and open files Data ONTAP 8.2 and later releases proide support for displaying information about established SMB sessions and open files. You can use this information to monitor SMB actiity on the Storage Virtual Machine (SVM). Data ONTAP 8.2 has two new commands, serer cifs session show and serer cifs session file show, that you can use to monitor SMB actiity. For more information about using these commands, see the Clustered Data ONTAP File Access Management Guide for CIFS. New and changed features in the Data ONTAP 8.2 release family 59

70 Support for modifying the CIFS serer domain Data ONTAP 8.2 and later releases proide support for modifying the CIFS serer domain. You can moe a CIFS serer to another domain or rejoin a domain without first deleting the CIFS serer by using the serer cifs modify command. Note: The DNS configuration for a particular Storage Virtual Machine (SVM) must support the target domain. For information about modifying CIFS serers, see the man page for the serer cifs modify command. For information about reconfiguring DNS, see the serer dns modify command. Support for stopping and starting CIFS serers Starting with Data ONTAP 8.2, you can stop and start CIFS serers. Stopping the CIFS serer might be useful when performing tasks while users are not accessing data oer SMB shares. You can restart SMB access by starting the CIFS serer. When you stop the CIFS serer, established sessions are terminated and their open files are closed. For information about stopping and starting CIFS serers, see the Clustered Data ONTAP File Access Management Guide for CIFS. Export policies now optional for SMB access For releases earlier than Data ONTAP 8.2, SMB export policies are mandatory. Starting with Data ONTAP 8.2, export policies for SMB access are optional and are disabled by default. A new CIFS option controls whether export policies are enabled for SMB access. When setting up a new CIFS serer on your Storage Virtual Machine (SVM), the usage of export policies for SMB access is disabled by default. You can enable export policies for SMB access if you want to control access based on authentication protocol or on client IP addresses or host names. When upgrading a cluster from ersions of Data ONTAP earlier than 8.2, this option is automatically enabled on CIFS serers in the cluster that are using export policies to control SMB access. There is no unexpected change to configured access controls when you upgrade to a ersion of Data ONTAP where export policies for SMB access is optional. For information about changes to the use of export policies for SMB access, see the Clustered Data ONTAP File Access Management Guide for CIFS. 60 IBM System Storage N series: Clustered Data ONTAP Release Notes

71 Default UNIX user automatically created and assigned Starting with Data ONTAP 8.2, Data ONTAP automatically creates the default user named pcuser and the group named pcuser, and adds the default user to the pcuser group when you create the Storage Virtual Machine (SVM). When you create a CIFS serer, Data ONTAP automatically configures pcuser as the default UNIX user. The pcuser user UID is The pcuser group GID is For information about using the default UNIX user, see the Clustered Data ONTAP File Access Management Guide for CIFS. Support for IP6 with CIFS Starting with Data ONTAP 8.2 and later, CIFS clients can access files on a Storage Virtual Machine (SVM) oer an IP6 network. After you enable IP6 on the cluster and properly configure data LIFs, CIFS oer IP6 works immediately. You do not hae to enable any other SVM or CIFS serer specific options. For more information about using IP6 with CIFS, see the Clustered Data ONTAP File Access Management Guide for CIFS. For more information about configuring IP6 networks, see the Clustered Data ONTAP Network Management Guide. Maximum ACE limit for NFS4 ACLs has increased The maximum number of ACEs for each ACL has been increased to 1,024. This enables you to add significantly more ACEs to ACLs than in preious ersions of Data ONTAP. The default alue, as defined by the -4-acl-max-aces parameter, is 400 but you can now increase it up to 1,024 by using the serer nfs modify command. Support for NFS oer IP6 Starting with Data ONTAP 8.2, NFS clients can access files on your storage system oer an IP6 network. Support for NFS4.1 file delegations Data ONTAP now supports NFS4.1 read and write file delegations on Storage Virtual Machines (SVMs) with FlexVol olumes. This allows Data ONTAP to delegate further handling of opening and writing requests to an NFS client opening a file. As a result, network traffic between the client and storage system is reduced and performance is improed. NFS4.1 file delegations are not supported on SVMs with Infinite Volume. New and changed features in the Data ONTAP 8.2 release family 61

72 Support for end-to-end parallel processing for NFS Beginning with Data ONTAP 8.2, Data ONTAP incorporates end-to-end parallel processing for all supported ersions of NFS. This change results in arious performance improements for NFS operations. Note: This change only applies to NFS oer IP4. SAN enhancements This Data ONTAP release includes new features and enhancements for SAN. For detailed information about these features, see the Clustered Data ONTAP SAN Administration Guide. SnapVault backups now support LUNs Starting with Data ONTAP 8.2, you can back up olumes containing LUNs to a SnapVault backup. You can restore all LUNs in a olume, or you can restore a single LUN from the SnapVault backup. Volumes containing LUNs are supported for XDP (SnapVault) relationships. You always back up an entire olume with all of its LUNs to a SnapVault backup. Howeer, you can choose to restore a single LUN. You can also access the latest Snapshot copy of a LUN directly from the SnapVault backup. This direct access is read-only. For more information about backing up LUNs to and restoring LUNs from a SnapVault backup, see the Clustered Data ONTAP Data Protection Guide and the Clustered Data ONTAP SAN Administration Guide. Support for FlexClone LUNs Beginning in Data ONTAP 8.2.0, you can use FlexClone LUNs to protect your data. A FlexClone LUN is a point-in-time, writable copy of another LUN in an actie olume or in a Snapshot copy. By default when you create a FlexClone LUN, the FlexClone auto delete function is enabled by default. Howeer, you must configure the olume to enable the FlexClone LUN auto delete function. If you do not want a particular a FlexClone LUN to be automatically deleted, you must set the auto delete parameter to "disable" for that FlexClone LUN. For more information, see the Clustered Data ONTAP SAN Administration Guide. 62 IBM System Storage N series: Clustered Data ONTAP Release Notes

73 Support for VMware and Microsoft copy offload Data ONTAP and later supports VMware and Microsoft copy offload operations to increase performance and network throughput. Copy offload directly copies the data within the storage system rather than going through the host network. For more information, see the Clustered Data ONTAP SAN Administration Guide. Support for AIX AIX is supported in SAN for clustered Data ONTAP 8.2. Support for increased SAN configuration limits Beginning with clustered Data ONTAP 8.2, certain SAN configuration limits hae increased. Limit Nodes per cluster LUNs per node LUNs per cluster Storage Virtual Machines (SVMs) 750 New Maximum 8 (based on platform type) 8,192 (based on platform type) 49,152 (based on platform type) Increase in maximum paths from host to LUN for Windows For a Windows host, the maximum number of paths from the host to a single LUN is 32. The limit is correctly reflected in the Clustered Data ONTAP SAN Configuration Guide. Data protection enhancements You need to know where you can find information about the new and changed data protection capabilities. Scalability limits for NDMP and dump backup and restore sessions Starting with Data ONTAP 8.2, the maximum number of NDMP and dump backup and restore sessions depends on the system memory of a storage system. To perform NDMP or dump backup and restore sessions simultaneously on a storage system, you must be aware of this maximum number. The following table lists the scalability limits for dump backup and restore sessions: New and changed features in the Data ONTAP 8.2 release family 63

74 System memory Less than 16 GB 4 Greater than or equal to 16 GB but less than 24 GB Greater than or equal to 24 GB 32 Maximum number of dump backup and restore sessions 16 If you use the ndmpcopy command to copy data between storage systems, two sessions are established: dump backup and dump restore. The following table lists the scalability limits for NDMP sessions: System memory Less than 16 GB 8 Greater than or equal to 16 GB but less than 24 GB Greater than or equal to 24 GB 36 Maximum number of NDMP sessions 20 You can obtain the system memory of your storage system by using the sysconfig -a command (aailable through the nodeshell). For more information about using this command, see the man pages. Change to how SnapMirror relationships are shown Starting with Data ONTAP 8.2, only SnapMirror relationships that hae a destination olume on the local cluster are shown by the snapmirror show command. Prior to this release, SnapMirror relationships that hae either source or destination olumes are shown by the snapmirror show command. You can show SnapMirror relationships that hae a source olume on the local cluster by using the snapmirror list-destinations command. For more information, see the Clustered Data ONTAP Commands: Manual Page Reference. Protection of data at rest through Storage Encryption Clustered Data ONTAP introduces the new Storage Encryption feature that enables you to protect your data at rest by automatically encrypting all data written to disk. The feature is aailable on certain supported storage controllers and disk sheles that contain disks with built-in encryption functionality. 64 IBM System Storage N series: Clustered Data ONTAP Release Notes

75 For detailed information about feature requirements, configuration, and management, see the Clustered Data ONTAP Software Setup Guide and the Clustered Data ONTAP Physical Storage Management Guide. Supported NDMP ersion in Data ONTAP 8.2.x Starting with Data ONTAP 8.2, only NDMP 4 is supported. NDMP 3 is not supported. In Data ONTAP 8.1.x, NDMP 3 and 4 are supported. In Data ONTAP 8.0.x, NDMP 2, 3, and 4 are supported. Support for KMIP 1.1 Beginning with Data ONTAP 8.2.2, Key Management Interoperability Protocol (KMIP) 1.1 is supported in addition to KMIP 1.0. This enables you to configure Data ONTAP to use key management serers using KMIP 1.1 for storing authentication keys used by Storage Encryption. Related information: Support for multipath tape access You can configure multiple paths from the storage system to access tape dries in a tape library. If one path fails, then the storage system can use the other paths to access tape dries without haing to immediately repair the failed path. This ensures that tape operations can be restarted. For more information about multipath tape access, see the Clustered Data ONTAP Data Protection Tape Backup and Recoery Guide. Serial numbers used for tape aliasing A serial number (SN) is a unique identifier for a tape drie or a medium changer. Starting with Data ONTAP 8.2, Data ONTAP generates aliases based on SN instead of the WWN. The alias remains the same regardless of the multiple connections paths to the tape drie or medium changer. This helps storage systems to track the same tape drie or medium changer in a tape library configuration. For more information about serial numbers, see the Clustered Data ONTAP Data Protection Tape Backup and Recoery Guide NDMP modes for backup and restore operations Starting with Data ONTAP 8.2, you can choose to perform tape backup and restore operations either at a node leel (node-scoped NDMP mode) as you hae been doing until now or at a Storage Virtual Machine (SVM) leel. In the SVM-scoped NDMP mode of operation, NDMP serice must be enabled on the SVM. New and changed features in the Data ONTAP 8.2 release family 65

76 For more information about node-scoped NDMP mode and SVM-scoped NDMP mode, see the Clustered Data ONTAP Data Protection Tape Backup and Recoery Guide. Increased number of cluster peers The number of clusters that you can peer has increased to allow a higher fan-in ratio for SnapMirror relationships. You can fan in 63 clusters to 1 cluster. SnapMirror transfer speed control within a cluster The control of the speed of a SnapMirror transfer, called throttling, includes SnapMirror relationships within a cluster. Before the Data ONTAP release, the control applied to SnapMirror relationships that went across cluster peers. Support for backing up FlexVol olumes to SnapVault backups Starting with Data ONTAP 8.2, you can back up FlexVol olumes to a SnapVault backup. You create a SnapVault relationship to back up selected Snapshot copies of a primary olume to a secondary olume. You can create a schedule, SnapMirror policy, and rule to transfer Snapshot copies, to retain a number of Snapshot copies, and to define what Data ONTAP does when the retention limit is reached. For more information about backing up FlexVol olumes to a SnapVault backup, see the Clustered Data ONTAP Data Protection Guide. Antiirus enhancements This Data ONTAP release includes new features and enhancements relating to Antiirus. Support for offbox antiirus Starting with Data ONTAP 8.2.1, the offbox antiirus feature is supported. This feature uses third-party antiirus software to scan and clean files on the storage system using CIFS. For more information about this feature, see the Clustered Data ONTAP Antiirus Configuration Guide. Support for Antiirus Connector Starting with Data ONTAP 8.2.1, the Antiirus Connector software is required for irus scanning. You must install the Antiirus Connector software on the Vscan serers to enable communication between the system running clustered Data ONTAP and the Vscan serer. 66 IBM System Storage N series: Clustered Data ONTAP Release Notes

77 You must download the Antiirus Connector setup file from the IBM N series support site and sae it to a directory on your hard drie. For information about installing and configuring the Antiirus Connector, see the Clustered Data ONTAP Antiirus Configuration Guide. Command mapping for Vscan command Starting with Data ONTAP 8.2.1, the offbox antiirus feature is introduced and supported. This has resulted in new mapping for the 7-Mode Vscan command. The Vscan command now maps to the serer scan command. New and changed features in the Data ONTAP 8.2 release family 67

78 68 IBM System Storage N series: Clustered Data ONTAP Release Notes

79 Requirements for running clustered Data ONTAP 8.2 You need to ensure that you hae the required storage systems and firmware to run clustered Data ONTAP software for the Data ONTAP 8.2 release family. To find the capacity and maximum olume size of your storage system model, see the IBM N series Introduction and Planning Guide at Supported systems and cluster configurations To ensure that your systems and cluster configurations are supported to run Data ONTAP 8.2 releases, you should check your configuration on the Hardware Unierse before upgrading clustered nodes or before adding new nodes to an existing cluster. The maximum number of nodes supported per cluster depends on the hardware platform model and whether NAS or SAN protocols are running. A cluster can be homogenous (all nodes are the same platform model) or mixed (nodes with different platform models); mixed clusters are supported with some restrictions. The maximum number of nodes within a cluster is determined by the platform that supports the fewest number of nodes. Clusters must consist of high-aailability (HA) pairs, and nodes within an HA pair must be the same platform model. To know about the Data ONTAP systems that use array LUNs and supported Data ONTAP 8.2.x releases, see the IBM N series Introduction and Planning Guide. For more information, see the IBM N series Introduction and Planning Guide at Unsupported systems in clustered Data ONTAP Some storage systems are not supported starting with the clustered Data ONTAP 8.2 release family. The following storage systems are not supported: N7800 N7600 N5600 Copyright IBM Corp

80 N5300 N3400 Note: Any mention of these unsupported platforms in the remainder of the documentation library is an oersight and will be remoed in a future release. Cluster network and management network switch compatibility requirements The software, firmware, and reference configuration files (RCFs) used by Cisco cluster and management Ethernet switches must be compatible with clustered Data ONTAP. When planning a Data ONTAP deployment or upgrade, you must consult the cluster network and network management compatibility matrix for your switches to determine whether updates are also required to the switch configurations. Storage system, disk, and disk shelf firmware You need to confirm that you hae the latest firmware for your storage system, disks, and disk sheles. The following storage system components hae firmware that sometimes requires upgrading: Storage systems (also known as system firmware or motherboards) Disk dries Disk sheles Storage system firmware It is best to upgrade to the latest ersion of system firmware for your storage system. For a list of aailable system firmware, see the System Firmware Release Table on the IBM N series support site. Note: The latest system firmware is included with Data ONTAP upgrade packages. Disk firmware For information about the latest disk firmware, see the Drie & Firmware Matrix on the IBM N series support site. Note: New disk firmware is sometimes included with Data ONTAP upgrade packages. 70 IBM System Storage N series: Clustered Data ONTAP Release Notes

81 Disk shelf firmware For information about the latest disk shelf and ESH (Embedded Switched Hub) firmware, see the Disk Shelf & ESH Firmware Matrix on the IBM N series support site. Requirements for running clustered Data ONTAP

82 72 IBM System Storage N series: Clustered Data ONTAP Release Notes

83 Important cautions Before upgrading to this release of Data ONTAP, you need to read the important cautions to identify and resole issues that might affect the operation of your storage systems. Upgrade cautions If you are upgrading to this Data ONTAP release, you should reiew the cautions and take appropriate action for any that apply in your enironment. For more information about procedures and planning, see the Clustered Data ONTAP Upgrade and Reert/Downgrade Guide. DNS name serice lookups fail if serers are not reachable oer UDP In preious releases of clustered Data ONTAP, DNS name serice lookups used TCP. Beginning with Data ONTAP 8.2.3, DNS name serice lookups now use UDP by default instead. If Data ONTAP cannot reach DNS serers oer UDP, those name serice lookups for NFS exports will fail after upgrading. To aoid NFS mount failures after upgrading, your enironment must allow access to your DNS serers oer UDP. Incomplete upgrades must be restarted on the correct node If an upgrade is incomplete on a node, you must log into the node on which the upgrade is incomplete before attempting to restart the upgrade by using the adanced system node upgrade-reert upgrade command. The system node upgrade-reert upgrade command restarts an incomplete upgrade on the local node only, not on any of the other nodes in the cluster. Caution when upgrading a system with unsupported network port interface group names If you upgrade a storage system configured with unsupported interface group names, the interface groups cannot be modified or deleted after the upgrade without assistance. Interface group names must follow the standard naming syntax: "a<number><letter>". The alue of <number> can be You should rename any ports with unsupported names prior to upgrading your system to Data ONTAP 8.2. To rename the interface groups: 1. Migrate LIFs from the interface group that is being renamed: network interface migrate Copyright IBM Corp

84 2. Remoe the ports from the interface group: network port ifgrp remoe-port 3. Delete the interface group: network port ifgrp delete 4. Create a new interface group with the correct syntax: network port ifgrp create 5. Add ports to the interface group: network port ifgrp add-port Starting with Data ONTAP 8.2, the system requires use of the standard naming syntax for interface groups. Interface groups that were created in earlier releases of Data ONTAP allowed the creation of interface groups with nonstandard names. Upgrade to Data ONTAP or later is required to enable offbox antiirus Starting with Data ONTAP 8.2.1, the offbox antiirus feature is supported. To enable the offbox antiirus feature, you must ensure that all the nodes in the cluster are running Data ONTAP or later. Change in how Data ONTAP handles file names containing UTF-16 supplementary characters Starting with Data ONTAP 8.2.1, there is a change in how Data ONTAP handles file names containing UTF-16 supplementary characters that you must be aware of if your enironment uses such file names. Unicode character data is typically represented in Windows applications using the 16-bit Unicode Transformation Format (UTF-16). Characters in the basic multilingual plane (BMP) of UTF-16 are represented as single 16-bit code units. Characters in the additional 16 supplementary planes are represented as pairs of 16-bit code units that are referred to as surrogate pairs. When you create file names on the storage system that contain inalid supplementary characters, Data ONTAP now rejects the file name and returns an inalid file name error. When you create file names on the storage system that contain alid supplementary characters, Data ONTAP now by default rejects the file name and returns an inalid file name error. To aoid this issue, use only BMP characters in file names and aoid using supplementary characters. If you require Data ONTAP to accept file names with alid supplementary characters, contact technical support for assistance. 74 IBM System Storage N series: Clustered Data ONTAP Release Notes

85 N6210 and N6040 systems with Flash Cache modules not supported If you hae a N6210 or N6040 system with Flash Cache modules installed, do not upgrade to clustered Data ONTAP 8.2 or later 8.2.x releases. Flash Cache modules are not supported on N6210 or N6040 systems running clustered Data ONTAP 8.2 or later 8.2.x releases. Support for striped olumes remoed Beginning with clustered Data ONTAP 8.2, striped olumes are no longer supported. You should not upgrade to clustered Data ONTAP 8.2 if there are striped olumes in your enironment. To aoid issues, contact technical support before attempting to upgrade. Note: You can restore data backed up to tape from a striped olume in Data ONTAP 8.1.x and earlier to a FlexVol olume in clustered Data ONTAP 8.2. Support for NFS2 remoed Beginning with Data ONTAP 8.2, NFS2 is no longer supported and all NFS2 functionality has been remoed from Data ONTAP. If you still require the use of the NFS2 protocol in your enironment, do not upgrade to Data ONTAP 8.2 or later until you hae discontinued use of NFS2. Compatible ersions of management software are required After you upgrade to Data ONTAP 8.2 or later, the license-list-info ZAPI is no longer supported. As a result, you must install Data ONTAP management software ersions that are supported by Data ONTAP 8.2 or later. The Data ONTAP management software affected by this change includes, but is not limited to, the SnapDrie and SnapManager products, Virtual Storage Console, and Operations Manager products. For the complete list of affected Data ONTAP management software, specific ersions, and alerts, see the IBM N series interoperability matrix website at storage/network/interophome.html. For the Data ONTAP API changes, including new and deprecated APIs, see the NMSDK API Documentation page on the NetApp Community. Third-party applications or scripts written to use the license-list-info ZAPI will fail after the upgrade to Data ONTAP 8.2 or later. Therefore, if you use third-party applications, you should contact the endors to obtain an update that is supported for Data ONTAP 8.2 or later. Important cautions 75

86 FlexClone license must be enabled after upgrading to Data ONTAP 8.2 If you hae a flex_clone license, you must turn on the licensed_feature.flex_clone option after you upgrade to Data ONTAP 8.2. Use the following command to enable this option: options licensed_feature.flex_clone.enable on If you do not turn on this option, your Storage features will not work properly. Deduplication is disabled post upgrade due to insufficient space for metadata In systems running Data ONTAP 8.2.x, you must ensure that there is sufficient space on the aggregate and on the olume to upgrade the deduplication metadata. You can use the df command to check the space aailable on the aggregate and on the olume. Deduplication metadata can occupy up to 7 percent of the total physical data contained within the olume: In an aggregate, deduplication metadata can occupy up to 3 percent of the total physical data contained within the olume. In a olume, deduplication metadata can occupy up to 4 percent of the total amount of data contained within the olume. In case of insufficient space, the upgrade succeeds, but deduplication is disabled on the olume until you explicitly enable deduplication on the olume. To reenable deduplication on this olume, contact technical support for assistance. Stale metadata not automatically remoed during deduplication operations on a olume Stale deduplication-related metadata can exist in FlexVol olumes and aggregates on your system, resulting in slow deduplication processing or your systems running out of space. Your systems can experience this problem if you are upgrading from a Data ONTAP 8.1 release prior to 8.1.2P4, if deduplication is enabled on any FlexVol olume, and if a FlexVol olume or the associated aggregate is more than 70 percent full. If these conditions exist, contact technical support before proceeding with an upgrade to Data ONTAP IBM System Storage N series: Clustered Data ONTAP Release Notes

87 Setting 7-Mode CIFS option alues might lead to disruptions when upgrading to clustered Data ONTAP 8.2 Setting certain 7-Mode CIFS-specific options on a controller running clustered Data ONTAP 8.1.x or 8.2.x and then upgrading to a later ersion of 8.2.x might lead to recursie serice disruptions. CIFS registry options are specific to 7-Mode and hae no functionality in clustered Data ONTAP, so this issue occurs only in clustered Data ONTAP and not in 7-Mode. Aoid setting 7-Mode CIFS option alues on a clustered Data ONTAP controller prior to upgrade. Manageability cautions If you are a storage system administrator, you should familiarize yourself with these manageability issues. If you reinstall a license key in Data ONTAP 8.2 or later, you must use the new license key format Starting with Data ONTAP 8.2, all license keys are 28 characters in length. Licenses installed prior to Data ONTAP 8.2 continue to work after you upgrade to Data ONTAP 8.2 or later. Howeer, if you need to reinstall a license when you are running Data ONTAP 8.2 or later, the old key is not accepted. The Data ONTAP 8.2 release family accepts a license key only in the new, 28-character format. Changes to SP firmware update methods Starting with Data ONTAP 8.2, a baseline SP firmware image is packaged with the Data ONTAP image. By default, the SP automatic update functionality is enabled. You hae the option to manually trigger an SP update. Data ONTAP 8.2 and later releases include an SP firmware image that is called the baseline image. You do not need to download the baseline SP firmware image separately. If a new ersion of the SP firmware becomes subsequently aailable, you hae the option to download it from IBM N series support website and update the SP firmware to the downloaded ersion without upgrading the Data ONTAP ersion. Data ONTAP offers the following methods for managing SP firmware updates: The SP automatic update functionality is enabled by default, allowing the SP firmware to be automatically updated in the following scenarios: Important cautions 77

88 When you upgrade to a new ersion of Data ONTAP The Data ONTAP upgrade process automatically includes the SP firmware update, proided that the SP firmware ersion bundled with Data ONTAP is newer than the SP ersion running on the node. When you download a ersion of the SP firmware from the IBM N series support website and the downloaded ersion is newer than the one that the SP is currently running You hae the option to disable the SP automatic update functionality by using the system node serice-processor image modify command. Howeer, it is best to leae the functionality enabled. Disabling the functionality can result in suboptimal or nonqualified combinations between the Data ONTAP image and the SP firmware image. Data ONTAP enables you to trigger an SP update manually and specify how the update should take place by using the system node serice-processor image update command. You can specify the following options: The SP firmware package to use ( -package ) You can update the SP firmware to a downloaded package by specifying the package file name. The system node image package show command displays all package files (including the files for the SP firmware package) that are aailable on a node. Whether to use the baseline SP firmware package for the SP update ( -baseline ) You can update the SP firmware to the baseline ersion that is bundled with the currently running ersion of Data ONTAP. Whether to update the entire firmware image or only the changed portions ( -update-type ) If updating the entire firmware image, whether to also reset log settings to the factory default and clear contents of all logs maintained by the SP, including the eent logs, IPMI logs, and forensics logs ( -clear-logs ) For information about the system node serice-processor image update command, see the man page. Data ONTAP enables you to display the status for the latest SP firmware update by using the system node serice-processor image update-progress show command. Any existing connection to the SP is terminated when the SP firmware is being updated. This is the case whether the SP firmware update is automatic or manually triggered. 78 IBM System Storage N series: Clustered Data ONTAP Release Notes

89 Antiirus cautions If your storage system is configured with antiirus features, you should reiew the important cautions and take appropriate action before upgrading or reinstalling. Support for on-board antiirus is discontinued from Data ONTAP and later Starting with Data ONTAP 8.1.3, support for on-board antiirus is discontinued. Therefore, you must disable on-board antiirus and unschedule all the antiirus on-demand (AVOD) jobs before upgrading to Data ONTAP and later. Storage management cautions You should reiew these issues and take appropriate action before upgrading or reinstalling. Disk failures might increase for some disk models after upgrading to this ersion of Data ONTAP Starting with Data ONTAP 8.1.2, the software install or upgrade includes new disk shelf firmware ersions for DS14mk2 AT and DS4243 disk sheles that proide enhanced disk error detection and prediction capabilities. Therefore, after upgrading to this ersion of Data ONTAP, you might experience an increase in the number of disk failures for certain disk shelf and disk models. Increased disk failures after upgrading to this ersion of Data ONTAP is expected behaior, especially if you are upgrading from a ersion of Data ONTAP that did not include the new firmware ersions. You should follow standard best practices for spares when you upgrade, to ensure that sufficient spares are always aailable. The following table shows the disk shelf and disk models that might show an increased failure rate after upgrading: Storage enclosure Part number Output from sysconfig -a Capacity DS14mk2 AT X/SP-269A-R5 X269_SMOOS01TSSX 1 TB X/SP-268A-R5 X268_SMOOST75SSX 750 GB X/SP-267A-R5 X267_SMOOST50SSX 500 GB X/SP-262B-R5 X262_SMOOST25SSX 250 GB DS4243 X/SP-302A-R5 X302_SMOOS01TSSM 1 TB X/SP-310A-R5 X310_SMOOST50SSM 500 GB Important cautions 79

90 File access and protocols cautions This information addresses file access and protocols cautions. Reiew the following section for important information regarding file access and protocols management. Storage system disruption when moing olumes accessed by Windows NFS clients If you moe a olume accessed by Windows NFS clients and an application on the client creates NLM byte range locks, under certain race conditions, the destination controller can encounter a panic while copying the protocol lock state. This results in a disruption to client data access. To aoid this issue, do not moe olumes while they are mounted by Windows NFS clients. To moe olumes that might be currently mounted by Windows NFS clients, perform the following steps: 1. Identify any actie Windows NFS clients: serer locks show -serer sm_name -protocol nlm -type share-leel 2. Unmount all mounts from Windows NFS3 clients 3. Disable Windows NFS3 client access: serer nfs modify -serer sm_name -3-ms-dos-client disabled 4. Perform the desired olume moe operations 5. Enable Windows NFS3 client access: serer nfs modify -serer sm_name -3-ms-dos-client enabled 6. Remount the Windows NFS3 clients Requirements for NFS4.1 and pnfs If you want to use clustered Data ONTAP and later with NFS4.1 or pnfs in your enironment with Red Hat Enterprise Linux (RHEL), you must ensure that your RHEL clients meet certain requirements. Clients must be running RHEL 6.5 or later. In addition, they also must hae the Red Hat patches for the following issues installed to aoid possible client disruptions during storage failoer and LIF moes: : NFS4 missing chunk of back port patch from bz causes hang : NFS4 state manager NFS4ERR_BADSESSION loop : NFS4.1 fix a swap-nfs4_state_manager race For more information about RHEL, these issues, and patch aailability, see 80 IBM System Storage N series: Clustered Data ONTAP Release Notes

91 Permission denied error when NFS clients try to access NTFS security style olumes NFS clients receie a Permission denied error when trying to access NTFS security style olumes on the storage system. This issue can occur when Data ONTAP cannot map the user ID (UID), and group ID (GID) of the primary group if one exists, of the NFS user to alid names through any of the UNIX authorization sources defined by the name serice switch. The default Windows user for the NFS serer has no effect because a alid UNIX user name and group name is required before the default Windows user credentials are used to authorize access. If you cannot configure NIS or LDAP to map UIDs to user names and primary GIDs, you should set up local users and primary groups on the storage system for users requiring access. Limited support for NFS with IP6 Beginning with clustered Data ONTAP 8.2.1, NFS support with IP6 networks is limited to certain export policy rule configurations. You must understand what these limitations are to successfully use NFS with your IP6 network enironment. The following export policy rule configurations are supported for IP6: Matching clients to host names that can be resoled by DNS lookups to IP6 addresses Matching clients to IP6 addresses in dotted formats Matching clients to IP6 addresses with a subnet mask expressed as a number of bits Matching clients to a netgroup that contains only IP4 or IP6 addresses The following export policy rule configurations are not supported for IP6: Matching clients to domain names Matching clients to a netgroup that contains one or more host names DNS timeouts might lead to access issues for NFS IP6 clients Under certain circumstances, high load on the storage system or DNS timeouts can result in access issues for NFS clients connecting oer IP6. When you define client matching in export policy rules with netgroups, Data ONTAP must connect to the DNS serer to resole netgroups. If the storage system is under high loads, or the DNS requests take too long and time out, the netgroup resolution can fail. As a result, the export policy rule cannot be used and access for NFS clients might fail. Important cautions 81

92 This issue can affect NFS clients connecting oer an IP6 network. NFS clients connecting oer an IP4 network should not experience this issue. Changes in failure handling when processing export policy rules Beginning with Data ONTAP 8.2.2, Data ONTAP handles certain failures when processing export policy rules differently from preious releases. The changes affect how Data ONTAP responds to NFS clients when encountering these failure scenarios. In preious releases, Data ONTAP could incorrectly grant or deny access based on export rules when such a failure occurred. Export policy rules determine NFS client access to exports on the storage system. When you create export policy rules, you decide which NFS clients the rules apply to. You can match a rule to NFS clients using arious formats, such as domain names, host names, IP addresses, and netgroups. When an NFS client connects to the storage system and requests access, Data ONTAP attempts to match the client to export policy rules to determine whether to grant access. If the client match format of the export policy rule uses domain names, host names, or netgroups, Data ONTAP might need to contact configured external name serices such as DNS, NIS, and LDAP. If there is a failure in determining client access, and therefore Data ONTAP cannot determine client access at this time, Data ONTAP responds to the client in a manner that should result in the client retrying. This results in less seere consequences for the client and increases the chances of the NFS client eentually succeeding in completing the operation after one or more retries. Failures that are handled in this manner include the following: Name serice not configured or disabled Name serer temporarily down Network problems Timeout waiting for response Internal failures When encountering such a failure in preious releases, Data ONTAP either sent an access denied error to the client, or incorrectly granted access. Another related change is which Storage Virtual Machine (SVM) DNS configuration Data ONTAP uses for DNS lookups. In preious releases, Data ONTAP attempted to resole DNS requests by using the DNS configuration of the data SVM, and if that failed for any reason, it tried using the DNS configuration of the admin SVM. Beginning with Data ONTAP 8.2.2, Data ONTAP attempts DNS lookups by using the DNS configuration of the admin SVM only if there is no DNS configuration for the data SVM. 82 IBM System Storage N series: Clustered Data ONTAP Release Notes

93 Exceeding recommended maximums on CIFS serers might result in disruption of serice Exceeding recommended maximums on CIFS serers might lead to a disruption of serice. For example, you should not exceed recommended maximums on the number of CIFS local users and groups that you can create on the cluster. The recommended maximums for local users and groups are as follows: 1,000 local users per cluster 1,000 local groups per cluster 20,000 memberships per cluster The local users and groups and memberships can be distributed amongst all CIFS serers on the cluster; howeer, the total number on the cluster should not exceed the recommended maximums. The recommendations are not hard limits; howeer, exceeding the recommended maximums might lead to a disruption of serice on the cluster. The number of local users and groups and memberships that you can create before a serice disruption occurs aries and is dependent on ariables such as hardware platform, software configuration, and workloads. Silent failure of chmod, chown, and chgrp commands when run on junction points When NFS3 or NFS4.x clients attempt to modify file attributes using a chmod, chown, or chgrp command for a path that represents a junction point on olumes with UNIX security style, the operation appears successful but actually fails silently. If the client attribute cache is enabled, it is populated with incorrect information. This issue is caused by Data ONTAP sending the file system ID (FSID) of the new olume in response to commands to modify junction points, but the client does not expect a changed FSID and aborts the operation without notice. This issue has been obsered specifically with Red Hat Enterprise Linux (RHEL) 6.3, as well as other recent Linux releases with kernel ersion 3.2 and later. Contact your Linux endor for more information about which OS ersions are affected and which ersions contain a fix. If your Linux clients are affected by this issue, you can use one of the following workarounds. Important cautions 83

94 When modifying file attributes on a junction point, append a slash (/) or slashdot (/.) to the junction path. Before modifying file attributes on a junction point, cd into the directory and then back out again. SMB reconnections might fail after Data ONTAP upgrade If you upgrade from a ersion of Data ONTAP that does not support SMB 3.0 to a ersion of Data ONTAP that does, reconnections to mapped SMB shares from Windows 8 or Windows 2012 Serer might fail with an Inalid Signature error. Data ONTAP 8.2 and later releases support SMB 3.0. This issue occurs because Windows 8 and Windows 2012 Serer do not support dynamic dialect change on the file serer. This is a Windows client issue. For information about a workaround for this issue, see Microsoft KB article Microsoft KB : support.microsoft.com/kb/ High-aailability configuration cautions You should reiew this issue and take appropriate action when managing HA pairs in your storage system. Change in the storage failoer gieback -require-partner-waiting option Starting with Data ONTAP 8.2.2, the storage failoer gieback command's -require-partner-waiting option is aailable only at the adanced priilege leel. Use of the clustered Data ONTAP -require-partner-waiting option with the false argument results in a longer disruption because the storage is gien back een if the partner node is unaailable to take back the storage. For information on storage failoer operations, see the Clustered Data ONTAP High-Aailability Configuration Guide. Reert and downgrade cautions If you are reerting or downgrading from this release to an earlier release, you should reiew the cautions and take appropriate action for any that apply in your enironment. For more information about procedures and planning, see the Clustered Data ONTAP Upgrade and Reert/Downgrade Guide. 84 IBM System Storage N series: Clustered Data ONTAP Release Notes

95 Offbox antiirus must be disabled before reerting to an earlier release of Data ONTAP Before reerting to a release earlier than Data ONTAP 8.2.1, you must ensure that offbox antiirus is disabled on all the Storage Virtual Machines (SVMs) in a cluster. If you do not disable offbox antiirus on all the SVMs, you will not be able to reert to an earlier release. Requirement to reset SSH security configurations when downgrading or reerting to a release earlier than Data ONTAP If you downgrade or reert to a release earlier than Data ONTAP 8.2.1, you must run the security ssh prepare-to-downgrade command at the adanced priilege leel to reset the SSH security configurations of the cluster and all Storage Virtual Machines (SVMs) to the default settings used in the earlier release. Downgrade or reert operation fails when qtree exports are enabled Exporting qtrees is not supported in releases earlier than Data ONTAP If you plan to downgrade or reert to an earlier release, you must first take certain actions; otherwise, the downgrade or reert operation fails. By default, qtrees use the parent export policy of the containing olume. Beginning with Data ONTAP 8.2.1, you can assign specific export policies to export qtrees directly. When you assign a specific export policy to a qtree for the first time in a release that supports this capability, Data ONTAP automatically enables the capability. If you later decide to downgrade or reert from a release that supports qtree exports to another release, Data ONTAP checks whether the target release supports qtree exports. If it does, the downgrade or reert operation continues. If it does not, Data ONTAP checks whether the qtree exports capability is enabled. If the qtree exports capability is not enabled, meaning that you neer assigned specific export policies to qtrees, the downgrade or reert operation continues. If it is enabled, the downgrade or reert process fails and you receie an error message, informing you that you must take certain actions first. The type of action depends on whether you are attempting a downgrade or a reert operation. Important cautions 85

96 If you are attempting to... You must first perform these steps... Downgrade 1. Remoe all qtree exports: olume qtree modify -serer * -olume * -qtree * -export-policy "" 2. Set the priilege leel to adanced: set priilege adanced 3. Disable the qtree exports capability: olume qtree prepare-for-downgrade 4. Return to the admin priilege leel: set priilege admin Reert Remoe all qtree exports: olume qtree modify -serer * -olume * -qtree * -export-policy "" After you complete these steps, you can then proceed with the downgrade or reert operation. If you downgrade or reert to a release that supports qtree exports, the process is nondisruptie to clients. Howeer, if you downgrade or reert to a release that does not support qtree exports, clients must remount, een if they were mounting a olume. Licensing implications for reerting a node that is shipped with Data ONTAP 8.2 or later to an earlier release You need to be aware of the licensing implications if you hae a node that is shipped with Data ONTAP 8.2 or later and you want to reert it to a release in the Data ONTAP 8.1 release family. If a node is shipped with Data ONTAP 8.2 or later and you reinstall it with a release in the Data ONTAP 8.1 release family, you must reinstall the cluster base license with a key format that is supported by the Data ONTAP 8.1 release family. In addition, if you plan to use licensed functionality on the node, you must also install a key for the appropriate license package in the format supported by the Data ONTAP 8.1 release family. To obtain a license key for the reinstalled node, contact your sales representatie. Reerting to a release earlier than Data ONTAP 8.2 might require installation of licenses for some features If you gained access to licensed or entitled features by upgrading to Data ONTAP 8.2 or later and these features required a license prior to Data ONTAP 8.2, you might need to install a license after reerting. This is the case if a license was not preiously installed for the release you reert to. The licensing models for Data ONTAP 8.2 are different from earlier releases. Some functionality that required a license prior to Data ONTAP 8.2 might be aailable for free or as part of a package that you are licensed to install in 86 IBM System Storage N series: Clustered Data ONTAP Release Notes

97 Data ONTAP 8.2 or later. If you did not install a license for the functionality prior to Data ONTAP 8.2 and you reert to the earlier release, you might need to install a license so that you can continue to use the functionality after the reert. For information about the Data ONTAP 8.2 licensing model and the features that require licenses, see the knowledgebase article Data ONTAP 8.2 Licensing Oeriew and References. NTP remains enabled een after you reert to a release earlier than Data ONTAP 8.2 Starting with Data ONTAP 8.2, NTP is always enabled. If you reert to an earlier release, NTP remains enabled regardless of the prior setting for NTP when you were running the earlier release. For releases earlier than Data ONTAP 8.2, you can use the system serices ntp config commands to enable or disable NTP and display whether NTP is currently enabled. Note: Enabling NTP alone does not trigger the cluster to synchronize with an external time source. You must also configure the NTP serers by using the system serices ntp serer commands. SP firmware might require a downgrade if you reert or downgrade to an earlier Data ONTAP release If your current SP firmware ersion is not supported for the Data ONTAP release you are downgrading or reerting to, you might need to manually install a supported SP firmware ersion for the earlier Data ONTAP release. If the SP automatic update functionality is enabled (the default), downgrading or reerting to Data ONTAP or later does not require a manual SP firmware update. The SP firmware is automatically updated to the newest compatible ersion that is supported by the Data ONTAP ersion you reerted or downgraded to. Howeer, if the SP automatic update functionality is disabled (not recommended), or if you are downgrading or reerting to a release earlier than Data ONTAP 8.2.1, after the Data ONTAP reert or downgrade process is complete, you must take the action to manually install an SP firmware ersion that is supported for the Data ONTAP ersion you reerted or downgraded to. Important cautions 87

98 Reert considerations for digital certificates Before reerting to a release earlier than Data ONTAP 8.2, you must remoe the non-serer types of digital certificates and the user logins that hae the cert authentication method. You must delete the following before the reert; otherwise, the reert procedure will fail: All digital certificates except for the serer type (security certificate show -type serer) Logins of cluster and Storage Virtual Machine (SVM) user accounts that hae the authentication method set to using digital certificates (security login show -authmethod cert) These capabilities are supported only on Data ONTAP 8.2 and later. If you reert to Data ONTAP or earlier, you must reset some RBAC characteristics If you reert to Data ONTAP or earlier, Data ONTAP prompts you to run the security login role config reset command to reset some role-based access control (RBAC) characteristics to their default alues. You must run the security login role config reset command to reset the following RBAC characteristics prior to the reert : The required number of special characters in a password (reset to 0) Whether users must change their passwords when logging in to their accounts for the first time (reset to disabled) The number of days after which a password expires (reset to unlimited) The number of inalid login attempts that triggers the account to be locked automatically (reset to 0) The number of days for which an account is locked if inalid login attempts reach the allowed maximum (reset to 0) Prerequisites for RSH accounts and IP6 firewall policies before reerting to a release earlier than Data ONTAP 8.2 RSH and IP6 connections are supported only for Data ONTAP 8.2 and later releases. Before reerting to an earlier release, you must manually remoe RSH user accounts and the IP6 firewall policies that were added for enabling clear-text protocols (RSH and Telnet). Otherwise, the reert process will fail. The security login show command with the -application rsh parameter displays user accounts that are set up for RSH access. The security login delete command deletes a login method for a specified user. 88 IBM System Storage N series: Clustered Data ONTAP Release Notes

99 The system serices firewall policy show command displays firewall policies. The system serices firewall policy delete command remoes a serice from a firewall policy. For more information about these commands, see the man pages. Before reerting to a release earlier than Data ONTAP 8.1.1, you must delete any existing authentication tunnel AD domain users access to the cluster is supported only on Data ONTAP and later releases. If you reert to an earlier release, Data ONTAP prompts you to delete any existing authentication tunnel that is used for authenticating AD domain users cluster access. You can display the authentication tunnel by using the security login domain-tunnel show command. You can delete the authentication tunnel by using the security login domain-tunnel delete command. After you reert to a release earlier than Data ONTAP 8.1.1, AD domain users no longer hae access to the cluster. ACLs containing more than 400 ACEs are dropped during reert Support for up to 1,024 ACEs in NFS4 ACLs is a new feature in Data ONTAP 8.2. Reerting to a preious release family requires action if you hae NFS4 ACLs in your enironment that contain more than 400 ACEs. If you perform a file system reert to a Data ONTAP 8.1 release, any ACLs containing more than 400 ACEs are dropped. If you perform a cluster reert to a Data ONTAP 8.1 release, the reert fails if any Storage Virtual Machine (SVM) on the cluster has the option -4-acl-max-aces set to more than 400. To aoid this issue, you should do the following: 1. Identify all ACLs containing more than 400 ACEs. 2. Modify them to contain 400 or fewer ACEs. 3. Set the option -4-acl-max-aces to 400 or less for all SVMs in the cluster. Important cautions 89

100 90 IBM System Storage N series: Clustered Data ONTAP Release Notes

101 Known problems and limitations Some unexpected and potentially undesired post-upgrade behaiors, and in some cases workarounds to aoid these behaiors, hae been identified. Manageability issues You should be familiar with the known issues and limitations in the management interface that affect your ability to manage the storage system. These issues include problems with command behaior, command output, or error messages presented in the Data ONTAP CLI or web interface and problems with UNIX or operating system commands used to interface with your storage system. Cluster and node naming operations fail due to unsupported. character Cluster and node names should not use the. character. If you create a cluster, rename a cluster, or rename a node with a. character, the operation fails with an unclear error message. Related information: Some Data ONTAP commands cannot use supported SSL-based protocols as alid URL schemes SSL-based protocols fail when trying to erify the certificate from the remote serer. In this scenario, the cluster cannot find the chain of digital signatures to erify the authenticity of the serer certificate for some commands. The affected commands include, but are not limited to, the following: system coredump upload system node image update system node firmware download (adanced priilege leel) system configuration backup upload (adanced priilege leel) system configuration backup download (adanced priilege leel) Multiple takeoer cycles with the flexscale.lopri_blocks option enabled might result in controller failure The Flex Cache flexscale.lopri_blocks option enables caching of blocks that are not normally cached, including blocks that are written to disk through the NFS, CIFS, and iscsi protocols. This option is not enabled by default. Copyright IBM Corp

102 When you execute multiple takeoer and gieback cycles in quick succession, a low-memory condition occurs on the controller, which might cause subsequent gieback operations to fail. This issue occurs due to a software change introduced in Data ONTAP RC1 to delay the inalidation of memory tags during a takeoer process. Een if the gieback is successful, this issue could also cause other potential problems, including slow responsieness or a controller panic. False alert seen in cluster switch configurations The cluster switch health monitor might raise a false alert that a switch is missing in a cluster. There is no workaround for this issue. Howeer, you can increase the polling interal by using the system health cluster-switch polling-interal modify command to decrease the frequency with which you receie the alert. Starting with Data ONTAP 8.2.1, this command is aailable at the adanced priilege leel. In Data ONTAP 8.2, this command is aailable at the admin priilege leel. Ctrl-C does not stop commands issued through non-interactie SSH sessions If you issue a command through a non-interactie SSH session and then you attempt to interrupt the command by pressing Ctrl-C, the command continues to run. For example, this issue occurs if you enter the following command and then press Ctrl-C: $ ssh admin@ qos statistics performance show Ctrl-C does not interrupt the following commands when you issue them through a non-interactie SSH session: cluster peer job watch-progress qos statistics statistics show-periodic system node image show-update-progress If the Ctrl-C key sequence does not interrupt a running command as expected, that command runs until you reboot the node or restart the mgwd process. Contact technical support for instructions to restart the mgwd process. To work around this issue, do any of the following: Specify the -t parameter with the ssh command, if your ersion of SSH supports it. 92 IBM System Storage N series: Clustered Data ONTAP Release Notes

103 For example: $ ssh -t admin@ qos statistics performance show Specify the -iterations parameter when you run the qos statistics or statistics show-periodic commands in a non-interactie SSH session. For example: $ ssh admin@ qos statistics performance show -iterations 10 Start an interactie SSH session before you run the command. AutoSupport messages for system health alerts might include an incorrect subject when in mixed-ersion state When upgrading to Data ONTAP 8.2, the cluster can operate in a mixed-ersion state, in which some nodes are running 8.2 and some are running 8.1. While in this state, the cluster switch health monitor might generate health alerts. These alerts trigger AutoSupport messages that include an incorrect subject. The subject of the AutoSupport message states that the alert is from the "SAS Connectiity Monitor," which is incorrect. The cluster switch health monitor generated the alert. The health alerts themseles are alid. You can use the information in the AutoSupport messages to respond to the issue. This issue does not occur when all nodes are running Data ONTAP 8.2. The system health cluster-switch show command might display other deices as switches When you run the system health cluster-switch show command, the output might display other deices for example, serers or the nodes in your cluster as switches. You can ignore this information or run a command to delete it. A deice that is not a switch might display in the system health cluster-switch show command output if the deice has a connection to the cluster and it supports the Cisco Discoery Protocol (CDP) or the Industry Standard Discoery Protocol (ISDP). For example, the system health cluster-switch show command displays nodes as switches in the following configurations: In a configuration where both controllers are in a single chassis and internally connected through the midplane In a two-node switchless configuration Known problems and limitations 93

104 The command output is incorrect. The health monitor monitors switches only. You can ignore the information or remoe it by using the system health cluster-switch delete command, which is aailable at the adanced priilege leel. The dashboard health serer show command takes a long time to run The dashboard health serer show command can take seeral minutes to complete. The time that it takes to run the command depends on the number of Storage Virtual Machines (SVMs) and how much information those SVMs contain. If the command takes too long to run, you can use other commands to determine the health of your SVMs. To erify that... All aggregates and olumes are online The appropriate data access protocols are enabled for each SVM Use the following commands... storage aggregate show -state!online olume show -state!onlinethese commands display aggregates and olumes that are not in the online state. serer nfs show serer cifs show serer fcp show All LIFs hae an operational status of up All LIFs are on their home ports All data ports are up serer iscsi show network interface show -status-oper down This command displays LIFs that are down. network interface show -is-home false This command displays LIFs that are not on their home SVM and port in the network. network port show -link!up This command displays ports that are not in the up state. Account locked message not displayed when the maximum number of inalid login attempts is set to 4 or higher An account is locked when a user s inalid login attempts exceed the maximum (defined by the -max-failed-login-attempts parameter of the security login role config modify command.) If -max-failed-login- 94 IBM System Storage N series: Clustered Data ONTAP Release Notes

105 attempts is set to 4 or higher, no message is displayed to indicate the account s locked status when too many inalid login attempts are made. Audit log might expose password information as a result of password field queries in some iterator-based ONTAPIs A known security issue exists where some iterator-based Data ONTAP APIs (ONTAPIs) fail to reject requests containing queries on password fields. Such queries might result in the gien password alues being exposed in the audit log. The maximum number of attempted retries alue fails to update The system health controller sp upgrade show -instance command output does not display updates to the maximum number of attempted retries alue. There is no workaround for this issue. Health Monitor does not display the current maximum retries alue The Health Monitor does not update the Auto Update Maximum Retries alue, which is displayed by the system health controller sp upgrade show -instance command. There is no workaround for this issue. Setting default thresholds for dashboard alarms to 100% or greater is allowed You can modify the default alue for cpu busy, port latency, op latency,, aggregate-used, and port problems alarms to greater than 100%. Also, resetting the default alues back to - is not supported in this ersion of Data ONTAP. There is no workaround for this issue. Networking issues You should familiarize yourseles with the known limitations with features related to networking. The first VLAN configured oer a port might bring the port down temporarily When you configure a VLAN for the first time oer a port, the port might go down temporarily. When you configure a VLAN oer a port for the first time, the port might go down. This can cause the network to be temporarily disconnected. Howeer, the subsequent VLAN additions do not affect the port. Known problems and limitations 95

106 Error caused by haing a Storage Virtual Machine (SVM) peer relationship without a cluster peer relationship It is possible to hae an SVM peer relationship to an SVM on another cluster without haing a cluster peer relationship to that cluster. In this situation, the error message not authorized for that command is displayed. This can happen when the cluster peer and SVM peer relationships are properly configured, but then the cluster peer relationship is lost. The relationship can be lost when a cluster becomes unaailable, a cluster peer relationship is lost on one of the clusters, or intercluster connections (intercluster LIFs or data LIFs) cause the cluster peer to become unaailable. Reestablish the cluster peer relationship if this happens. In rare instances, this can also happen if you create the SVM peer relationship immediately after creating the cluster peer relationship. Disabling fast path in some networking enironments Fast path is enabled by default in all nodes in the cluster. Howeer, you might hae to disable fast path in certain enironments in which fast path does not function optimally. About this task IP fast path is a mechanism that uses the network interface of an inbound request to send the response quickly by bypassing a routing table lookup. Fast path is enabled by default for all TCP and NFS oer UDP connections. You might hae to disable fast path if you are working in configurations of Cisco PC, HP NIC teaming, or asymmetric routing enironments. Procedure 1. From the nodeshell, enter the following command: options nodescope.reenabledoptions ip.fastpath 2. To disable fast path, enter the following command: options ip.fastpath.enable off SVM issues You must be aware of the known issues related to SVM management and administration. Serice outage might occur if allowed protocols are not modified correctly on the SVM When you modify the list of allowed protocols by specifying the protocols for the -allowed-protocols parameter of the serer modify command, the 96 IBM System Storage N series: Clustered Data ONTAP Release Notes

107 specified list of protocols oerwrites the existing allowed protocols list. As a result, data access from that SVM might be disrupted. You must restore data access by adding the protocols that were part of the allowed protocols list. Related information: Root olumes without SVMs might be created during high I/O operations In clustered Data ONTAP 8.2.x, creating the root olume as part of creating a Storage Virtual Machine (SVM) might take a longer time due to high I/O operations. During this process, if the SVM is deleted, the root olume is created, but it is not associated with any SVM. You must contact technical support to resole this issue. SVM peer relationship might be in an inconsistent state due to simultaneous SVMs operations For an intercluster SVM peer relationship that is in pending state, if the cluster administrator of the local cluster deletes the SVM peer relationship and the cluster administrator of the peer cluster accepts the SVM peer relationship simultaneously, then the state of the SVM peer relationship in both the clusters might be inconsistent. You must delete the entries of such SVM peer relationships from the cluster by using the serer peer delete command. Creating a user account with sadmin-backup role fails when upgraded to clustered Data ONTAP 8.2.x When you create a user account with sadmin-backup role after upgrading to clustered Data ONTAP 8.2.x either from 8.1.x or 8.2.0, the user creation operation fails. You must create a custom role with the same commands as listed in the sadmin-backup role and create a new user account for the custom role. Storage resource management issues This section describes known issues with features that enable you to manage your storage resources effectiely. Out of space errors could be returned when fractional resere is set to zero Fractional resere, also called LUN oerwrite resere, enables you to turn off oerwrite resere for space-resered LUNs and files in a FlexVol olume. This can help you maximize your storage utilization, but if your enironment is Known problems and limitations 97

108 negatiely affected by write operations failing due to lack of space, you must understand the requirements that this configuration imposes. Setting fractional resere to 0 increases your storage utilization. Howeer, an application accessing data residing in the olume could experience a data outage if the olume is out of free space, een with the olume guarantee set to olume. With proper olume configuration and use, howeer, you can minimize the chance of writes failing. Data ONTAP proides a best effort write guarantee for olumes with fractional resere set to 0 when all of the following requirements are met: Deduplication is not in use Compression is not in use FlexClone files are not in use ODX and FlexClone copy offload are not in use Volume guarantee is set to olume File or LUN reserations are enabled Volume Snapshot resere is set to 0 Volume Snapshot copy automatic deletion is enabled with a commitment leel of destroy, a destroy list of lun_clone,ol_clone,cifs_share,file_clone,sfsr, and a trigger of olume This setting also ensures that FlexClone LUNs are deleted when necessary. Note that if your rate of change is high, in rare cases the Snapshot copy automatic deletion could fall behind, resulting in the olume running out of space, een with all of the aboe required configuration settings in use. In addition, you can optionally use the olume autogrow capability to decrease the likelihood of olume Snapshot copies needing to be deleted automatically. If you enable the autogrow capability, you must monitor the free space in the associated aggregate. If the aggregate becomes full enough that the olume is preented from growing, more Snapshot copies will probably be deleted as the free space in the olume is depleted. If you cannot meet all of the aboe configuration requirements and you need to ensure that the olume does not run out of space, you must set the olume's fractional resere setting to 100. This requires more free space up front, but guarantees that data modification operations will succeed een when the technologies listed aboe are in use. Disk-type mixing might occur een when disk type is specified You can configure Data ONTAP to allow mixing of capacity or performance disk types when creating or adding to aggregates. When you specify a disk type with the -disktype parameter, if disk-type mixing is enabled, Data ONTAP might use an equialent disk type rather than the type you specified. 98 IBM System Storage N series: Clustered Data ONTAP Release Notes

109 FlexCache olumes not supported on certain storage systems FlexCache olumes are not supported on the following storage systems running clustered Data ONTAP 8.2: N6040, N6060, N6210 and N6240. Qtree creation fails on a mixed cluster running Data ONTAP 8.2 and Data ONTAP The qtree create command fails on a mixed cluster running Data ONTAP 8.2 and Data ONTAP In a mixed cluster with at least one controller running Data ONTAP and the effectie cluster ersion is not Data ONTAP 8.2.1, the qtree create command on the controller running Data ONTAP fails with the following error: Error: command failed. Failed to create qtree "qtree-name" in olume "olume-name" Vserer "serer-name". Reason: Cannot assign export policy to qtree. An effectie cluster ersion of Data ONTAP or later is required for this operation. To preent the failure of qtree creation on a mixed cluster running Data ONTAP 8.2 and Data ONTAP 8.2.1, you must execute the qtree create command on the controllers running Data ONTAP 8.2 and upgrade all the controllers in the cluster to Data ONTAP In-progress olume moe operations might fail during an upgrade In-progress olume moe operations might fail during an upgrade. To aoid this issue, ensure that there are no olume moe operations in progress before you begin the upgrade. Volume moe job cannot proceed after resizing the olume If the size of a olume increases after a olume moe start, such that it is now greater than the aailable size on the destination aggregate, the moe stops and the error message no space left on deice is displayed. About this task You can resize the olume such that there is enough space on the destination aggregate, but the olume moe will not continue. Complete the following steps to moe the olume: Procedure 1. Find the stalled olume moe job by using the olume moe show command. 2. Delete the olume moe job by using the olume moe abort command. 3. Retry the olume moe job by using the olume moe start command. Known problems and limitations 99

110 Volume moe operation can stall during baseline transfer A olume moe operation can stall during a baseline transfer because of a olume access error. If this occurs end the olume moe operation by using the olume moe abort command. Volume moe operations fail if a SnapMirror checkpoint exists If a SnapMirror transfer leaes a checkpoint, for example, if you deleted a SnapMirror relationship by using the snapmirror delete command, olume moe operations fail. You can resole this issue in one of two ways: If you no longer want the relationship, you can remoe the checkpoint by using the snapmirror abort command with the -h parameter. If you want to retain the checkpoint, let the olume moe operation fail. You might want to retain the checkpoint on disk because you do not want the transfer to restart from the beginning, especially for long running SnapMirror transfers, for example, SnapVault transfers. Cutoer action of wait displayed as defer_on_failure by the olume moe show command If you specify a olume moe operation with a cutoer action of wait, the Specified Action For Cutoer field of the olume moe show command output changes from wait to defer_on_failure after you trigger the cutoer of the hard-deferred job. Knowing this behaior can help you aoid confusion if you expect to see wait when you started the job with the cutoer action of wait. Error message about no space might be due to lack of inodes in the SVM root olume When a olume creation operation fails and the error message returned is No space left on deice, it could be due to a lack of inodes in the Storage Virtual Machine (SVM) root olume rather than a lack of space in the aggregate. If you get this message and there is free space aailable in your aggregate, make sure that your SVM root olume conforms to the required minimum size of 1 GB. FlexArray Virtualization (Gateway) issues You should understand the known problems and limitations related to using Data ONTAP systems with storage arrays. 100 IBM System Storage N series: Clustered Data ONTAP Release Notes

111 Too many storage deices presented to the Data ONTAP system Starting with Data ONTAP 8.2.1, a low-memory Data ONTAP system (a storage system with physical memory of 8 GB or less) might not be able to detect some of the presented disks and array LUNs if the number of storage deices discoered by the Data ONTAP system exceeds the maximum number of assignable deices allowed for that platform. In such a situation, the output of the storage error show command shows that some disks and array LUNs are not discoered. If you run into this issue, you should reboot your storage system. For information about the maximum number of storage deices allowed for different platforms, see the IBM System Storage N series Introduction and Planning Guide. Some Hitachi or HP XP array LUNs might not be isible In the case of Data ONTAP systems that support array LUNs, if the FC initiator ports are zoned with Hitachi or HP XP array target ports before the storage array parameters are set and the LUNs are mapped to the host groups, you might not be able to see any LUNs presented to the Data ONTAP interface. In this situation, Data ONTAP generates one of the following EMS messages: [fci.deice.login.reject:info] The PLOGI transmitted by port XX was rejected by port_id 0xYYYY with reason code 0x9 'Inalid R_CTL Field', explanation code 0x29 'Insufficient Resources to Support Login' [fci.deice.login.reject:info]: The PLOGI transmitted by port XX was rejected by port_id 0xYYYY with reason code 0x3 'Nx_Port Not Aailable, Temporary', explanation code 0x29 'Insufficient Resources to Support Login' Workaround If zoning is configured prior to setting the parameters and mapping the LUNs to the host groups, you can resole the problem of LUNs not being isible by performing a path reinitialization to force a rediscoery of the array LUNs that are mapped from a Hitachi or HP XP storage array. For information on the path reinitialization process, see Workaround when LUNs are not isible with Hitachi or HP XP storage arrays. Infinite Volume issues You should be aware of known issues and limitations with features related to Infinite Volumes. Known problems and limitations 101

112 Client application errors when accessing Infinite Volume dongle files A client application might encounter errors if the application accesses Infinite Volume dongle files. You can configure some client applications to filter and exclude dongle files from directory lists to aoid such errors. Related information: Example workflows for Infinite Volumes remoed from the OnCommand community site Example data protection workflows for Infinite Volumes used with OnCommand Workflow Automation 2.1 and later hae been remoed from the OnCommand community site. You can use OnCommand System Manager 3.1 and later or the command-line interface to perform most data protection operations instead. The following example workflows for Infinite Volumes hae been remoed from the OnCommand Workflow Automation space in the OnCommand community: Break Infinite Volume SnapMirror Relationship Resync SnapMirror Relationship for Infinite Volumes Reerse Resync SnapMirror Relationship for Infinite Volumes You can use the command-line interface or System Manager to break and resynchronize a data protection mirror relationship for an Infinite Volume regardless of whether the Infinite Volume uses storage classes. Howeer, if you increase the size of an Infinite Volume with storage classes after you break the data protection mirror relationship, you must contact technical support to resynchronize the data protection mirror relationship. Snapshot policy attribute might need to be modified If a node reboots unexpectedly immediately after you add or remoe the schedule of a Snapshot policy that is used by an Infinite Volume, the expected change might not take effect. To make the change take effect, you must set the Snapshot policy attribute of the Infinite Volume to the same Snapshot policy name by using the olume modify command with the -serer, -olume, and -snapshot-policy parameters. This issue can occur if a node reboots unexpectedly immediately after you use the olume snapshot policy add-schedule or olume snapshot policy remoe-schedule commands. 102 IBM System Storage N series: Clustered Data ONTAP Release Notes

113 Storage classes require additional configuration with array LUNs When you use array LUNs to proide storage for storage classes of an Infinite Volume, you must customize the predefined workflows distributed with OnCommand Workflow Automation to use a DISK_TYPE of LUN, and the array LUN must proide storage for only one storage class of the Infinite Volume. When you use array LUNs to proide storage for an Infinite Volume without storage classes, you are not required to use OnCommand Workflow Automation or to customize the predefined workflows. For more information, see the Clustered Data ONTAP Infinite Volumes Management Guide. File access and protocols issues If your storage system is deployed in a NAS enironment, you should reiew the known problems and limitations regarding file access and protocols management and take appropriate action. NFS file access fails for some NFS clients If you use netgroups in export policy rules for client matching, you must be aware of a DNS configuration requirement. If this requirement is not met, Data ONTAP cannot properly match clients in netgroups, resulting in access denial for some NFS clients. Data ONTAP performs a reerse DNS lookup on the IP address of clients to compare against the host names contained in a netgroup when matching clients with export policy rules containing a netgroup. The reerse DNS lookup and the resulting host name comparison must succeed for Data ONTAP to properly match clients. If the comparison fails, NFS file access fails for the client. For this reason, if you use netgroups in export policy rules and your netgroups contain host names, all host names in netgroups must hae both forward (A) and reerse (PTR) DNS records. In addition, if an IP address of a client has multiple PTR records, all those host names must be members of the netgroup. LDAP oer SSL/TLS name serice lookups fail If you hae configured LDAP configurations for Storage Virtual Machines (SVMs) to use LDAP oer SSL/TLS for secure communications with LDAP serers, but the LDAP serers in your enironment do not support TLS and only support SSL, LDAP name serice lookups will fail. Known problems and limitations 103

114 By default, a new LDAP client configuration that is securing LDAP communication using StartTLS uses TLS, an eolution of the SSL protocol. It does not fall back to the traditional and less secure SSL2 protocol. If the LDAP serers in your enironment do not support TLS, name serice lookups fail as a result. If you encounter this situation, you should upgrade your LDAP serers to a ersion that supports TLS. This allows the LDAP client to use TLS to secure communications with LDAP serers for the highest leel of security. If that is not feasible, you can allow the use of SSL2 by manually configuring the LDAP client of the SVM with the following command: serer serices ldap client modify -serer serer_name -client-config ldap_client_config_name -allow-ssl true Loading UNIX group file from URI fails when file contains split groups If you use the serer serices unix-group load-from-uri command to load a UNIX group file, and the file has UNIX groups separated oer multiple lines, the operation fails with a duplicate entry error. The local UNIX group data base remains unchanged. Entries such as the following cause loading the file to fail: group1:*:123:member1,member2,member3 group1:*:123:member4,member5,member6 group1:*:123:member7,member8,member9 You must specify groups on a single line for loading the file to succeed: group1:*:123:member1,member2,member3,member4,member5,member6,member7,member8,member9 Access for hosts in netgroups without primary DNS entry fails In preious releases, hosts specified in netgroups that did not hae a primary DNS entry were allowed access by resoling the DNS CNAME or round-robin host names to IP addresses. Beginning with Data ONTAP 8.2.3, hosts specified in netgroups must hae a primary DNS entry, otherwise access fails. Access might be denied when using FPolicy with the natie engine Directory access is denied when an FPolicy policy that uses the natie engine is enabled on a share or olume and the option -is-file-extension-checkon-directories-enabled is set to the default alue ( false ) in the scope configured for the policy. With this configuration, because the file extensions are not checked for directories, any directory operation is denied if it falls under the scope of the policy. 104 IBM System Storage N series: Clustered Data ONTAP Release Notes

115 Connection requests to CIFS shares using NTLM with a NetBIOS domain name longer than 15 characters or a fully qualified domain name (FQDN) fail If a CIFS client sends a request to connect to a CIFS share using NTLM, clustered Data ONTAP expects the NetBIOS domain name to be no more than 15 characters. If the proided domain name is longer than 15 characters or it is a FQDN, the request fails. Related information: CIFS ACLs not updated as expected when using the CLI to modify olumes If you use the olume modify command to change the UNIX permissions, owner, or group of a olume with a CIFS access control list (ACL), the command produces different permissions than those that result from the same changes made from an NFS client. Changes to the way the actie audit log is iewed using Eent Viewer Starting with Data ONTAP and later releases in the 8.2 family, there are changes to the way that the actie audit log from an audit-enabled Storage Virtual Machine (SVM) is iewed using Microsoft Eent Viewer. If the audit consolidation process is running on the cluster, the consolidation process appends new records to the actie audit log file. This actie audit log can be accessed and opened oer an SMB share in Eent Viewer. In addition to iewing existing audit records, Eent Viewer has a refresh option that enables you to refresh the content in the console window. In Data ONTAP releases earlier than 8.2.2, the newly appended records are iewable in Eent Viewer when the console is refreshed. Starting with Data ONTAP 8.2.2, whether the newly appended logs are iewable in Eent Viewer depends on whether oplocks are enabled on the share used to access the actie audit log. Oplocks setting on the share Enabled Behaior Eent Viewer opens the log that contains eents written to it up to that point in time. The refresh operation does not refresh the log with new eents appended by the consolidation process. Known problems and limitations 105

116 Oplocks setting on the share Disabled Behaior Eent Viewer opens the log that contains eents written to it up to that point in time. The refresh operation refreshes the log with new eents appended by the consolidation process. For more information about managing auditing on SVMs, see the Clustered Data ONTAP File Access Management Guide for CIFS. Changes to support for duplicate CIFS super user accounts Prior to clustered Data ONTAP 8.2.1, you could create multiple CIFS super user accounts for the same user on a Storage Virtual Machine (SVM) if the domain name for each account was entered using a different format. Starting with clustered Data ONTAP 8.2.1, duplicate CIFS super user accounts are not supported. If you upgrade from a clustered Data ONTAP release earlier than to clustered Data ONTAP and later releases, any duplicate users are retained; howeer, you cannot create new duplicate names on the SVM. If desired, you can delete any duplicate accounts on the SVM by first displaying the list of CIFS super user accounts using the serer cifs superuser show command, and then deleting any duplicate users in the CIFS super user configuration by using the serer cifs superuser delete command. UNIX to Windows name mapping fails when domain is empty or uses wildcard If you created a name mapping where the pattern either does not specify a domain name at all and leaes it empty or uses a wildcard (*), the name mapping fails. As a result, access from UNIX clients to olumes with NTFS security style fails. To aoid this issue, erify that all name mappings specify a domain name in the pattern. Unexpected behaior after loading local UNIX users or groups from a URI If you load local UNIX users or groups from a file into Data ONTAP using the serer serices unix-user load-from-uri and serer serices unix-group load-from-uri commands, you might experience unexpected client access behaior if the file contained duplicate entries. 106 IBM System Storage N series: Clustered Data ONTAP Release Notes

117 In this scenario, Data ONTAP might silently oerwrite entries when it encounters duplicate GIDs, UIDs, or names, leading to incorrect entries being used when ealuating client access. To aoid this issue, erify that the file does not contain any duplicate entries before loading it into Data ONTAP. Data ONTAP LDAP client does not support reoked certificates When LDAP oer SSL/TLS is enabled, the Data ONTAP LDAP client on the Storage Virtual Machine (SVM) does not support reoked certificates. The LDAP client treats reoked certificates as if they are not reoked. CIFS ACLs not updated as expected when using the CLI to modify olumes If you use the olume modify command to change the UNIX permissions, owner, or group of a olume with a CIFS access control list (ACL), the command produces different permissions than those that result from the same changes made from an NFS client. Change to the maximum number of audit-enabled SVMs supported in the cluster There has been a change to the maximum number of audit-enabled Storage Virtual Machines (SVMs) supported in the cluster. The maximum number of audit-enabled SVMs supported in a cluster is 50. Change in behaior of -allow-suid parameter for export policy rules Beginning with Data ONTAP 8.2.1, there is a change in the behaior of the -allow-suid parameter for export policy rules when it is set to false. When you set the -allow-suid parameter in an export policy rule to true, clients can modify the SUID or SGID of files, directories, and olumes. When you set the -allow-suid parameter in an export policy rule to false, clients can do the following: Data ONTAP release Behaior 8.2 and earlier Clients cannot modify the SUID or SGID of files, directories, and olumes and later Client cannot modify the SUID or SGID of files. Client can modify the SUID or SGID of directories and olumes. For more information about export policy rules, see the Clustered Data ONTAP File Access Management Guide for NFS. Known problems and limitations 107

118 Changes to how share properties on existing shares are managed Data ONTAP 8.2 and later releases proide seeral new commands to manage share properties on existing shares. The following new commands enable you to easily manage only the share properties on existing shares: serer cifs share properties add Adds properties to the list of share properties for a specified share. serer cifs share properties remoe Remoes share properties from the list of share properties for a specified share. serer cifs share properties show Displays the list of share properties for existing shares. These commands are used only for existing shares. Share properties are still initially added when creating a share by using the serer cifs share create command with the -share-properties parameter. Note: You can no longer modify share properties on existing shares by using the serer cifs share modify command. For more information about managing share properties, see the Clustered Data ONTAP File Access Management Guide for CIFS. SETATTR request with read delegation stateid from Linux client oer NFS4.1 mount can cause read delegation to be recalled If a client sends a SETATTR request with the read delegation stateid, Data ONTAP incorrectly recalls the read delegation from the client, which can lead to the client receiing an error for the SETATTR request. Only Linux clients using NFS4.1 mounts with NFS4.1 read delegations are affected by this issue. This issue can occur when an application running on a Linux client issues an open() call with flags O_CREAT O_EXCL O_RDONLY for a file on an NFS4.1 mount on the storage system. Data ONTAP then grants a read delegation to the client in response. If the client then sends a SETATTR request with the read delegation stateid to set some attributes on the file, Data ONTAP incorrectly recalls the read delegation from the client, resulting in the open() call failure. To aoid this issue, disable NFS4.1 read delegations on the affected Storage Virtual Machine (SVM) by entering the following command: serer nfs modify -serer serer_name -4.1-read-delegation disabled 108 IBM System Storage N series: Clustered Data ONTAP Release Notes

119 NFS serer -enable-ejukebox parameter change after upgrade When you upgrade a cluster to Data ONTAP or later, the setting for the parameter -enable-ejukebox for all existing NFS serers on all Storage Virtual Machines (SVMs) is changed to true. The default alue for the -enable-ejukebox parameter when creating a new NFS serer on SVMs also has been changed to true. This change, as well as some internal Data ONTAP changes, preent spurious ENOENT (file not found) errors that might disrupt client applications. Setting ery large NFS4.1 ACLs might fail with error NFS4ERR_REQ_TOO_BIG When you try to set an extremely large NFS4.1 ACL, the SETATTR and GETATTR requests might fail and return the error message NFS4ERR_REQ_TOO_BIG. This can occur due to an improper internal limit in Data ONTAP. This issue has been obsered specifically when setting NFS4.1 ACLs with 1,024 ACEs and user names oer 45 characters long. To aoid this issue, use one of the following workarounds: Keep the length of the user_name@domain_name string used in ACEs to 45 characters or fewer when setting large NFS4.1 ACLs. Use NFS4.0 instead to set ACLs. Group ID limitation for NFS RPCSEC_GSS Although Data ONTAP supports generic security serices for RPC (RPCSEC_GSS) for NFS3 and later, you should be aware of a limitation related to the number of group IDs for UNIX users. Data ONTAP supports up to 32 group IDs when handling NFS user credentials using RPCSEC_GSS authentication. If a user has more than 32 group IDs in their credentials, the remaining group IDs are truncated. To aoid authentication issues due to this limitation, ensure that users do not belong to more than 32 groups. Dependence of FPolicy on SSL certificates if using mutual authentication If you configure FPolicy external engines to use mutual authentication when connecting Storage Virtual Machine (SVM) data LIFs to external FPolicy serers, you must install a public certificate and key file on the SVM. You must not delete this certificate while any FPolicy policies are using the installed certificate. If the certificate is deleted while FPolicy is using it for mutual authentication when connecting to an external FPolicy serer, you cannot reenable a disabled Known problems and limitations 109

120 FPolicy policy that uses that certificate. The FPolicy policy cannot be reenabled in this situation een if a new certificate with the same settings is created and installed on the SVM. If the certificate has been deleted, a workaround to this issue exists. To work around this issue, you need to install a new certificate, create new FPolicy external engines that use the new certificate, and associate the new external engines with the FPolicy policy that you want to reenable by modifying the FPolicy policy. For information about configuring mutual authentication for FPolicy, see the Clustered Data ONTAP File Access Management Guide for CIFS. Changes to the -superuser parameter of the serer export-policy rule create command The -superuser parameter of the serer export-policy rule create command determines what happens if the storage system receies a client access request with the user ID 0, meaning as a superuser. There are seeral changes to the -superuser parameter that you need to be aware of. Beginning with Data ONTAP 8.2.0, the behaior of the -superuser parameter has changed in the following ways: The neer option is no longer aailable when creating new export policy rules. Existing rules that you created in earlier releases and already contain this option are retained and continue to work after upgrading. The neer option functions the same way as the none option. The default alue of the -superuser parameter has changed from neer to none. The dependency between the -superuser and the -anon parameters no longer exists. You can set the -anon parameter to any alue regardless of the setting of the -superuser parameter. For more information about the serer export-policy rule create command and the -superuser parameter, see the Clustered Data ONTAP File Access Management Guide for NFS. Default LDAP client schema is corrected during upgrade The default LDAP client schema AD-SFU that was proided by Data ONTAP 8.1 does not work with Windows Serices for UNIX (SFU) or Identity Management for UNIX (IDMU). During the upgrade to Data ONTAP 8.2 this problem is corrected. 110 IBM System Storage N series: Clustered Data ONTAP Release Notes

121 When you upgrade from Data ONTAP 8.1 to Data ONTAP 8.2, the following happens: The incorrect default LDAP client schema AD-SFU is renamed to AD-SFU-Deprecated. LDAP clients that were using the AD-SFU schema are modified to use the renamed AD-SFU-Deprecated schema. A new default LDAP client schema named AD-SFU is created with the following correct attributes: Schema Template: AD-SFU Comment: RFC 2307 posixaccount Object Class: User RFC 2307 posixgroup Object Class: Group RFC 2307 nisnetgroup Object Class: mssfu30nisnetgroup RFC 2307 uid Attribute: samaccountname RFC 2307 uidnumber Attribute: mssfu30uidnumber RFC 2307 gidnumber Attribute: mssfu30gidnumber RFC 2307 cn (for Groups) Attribute: cn RFC 2307 cn (for Netgroups) Attribute: name RFC 2307 userpassword Attribute: mssfu30password RFC 2307 gecos Attribute: name RFC 2307 homedirectory Attribute: mssfu30homedirectory RFC 2307 loginshell Attribute: mssfu30loginshell RFC 2307 memberuid Attribute: mssfu30memberuid RFC 2307 membernisnetgroup Attribute: mssfu30membernisnetgroup RFC 2307 nisnetgrouptriple Attribute: mssfu30memberofnisnetgroup ONTAP Name Mapping windowsaccount Attribute: windowsaccount Microsoft Windows 7 and Windows 8 clients fail to rename files and directories When a Microsoft Windows 7 or Windows 8 client accesses an SMB share, it can fail intermittently to rename files and directories on the mapped share. This can lead to a situation where attempts by Microsoft Office applications to sae documents on the share fail. This issue is caused by a bug in the Windows 7 and Windows 8 clients for which a hot fix is aailable from Microsoft. The bug is described and information about how to obtain the hot fix is proided in the Microsoft KB articles Microsoft KB : support.microsoft.com/kb/ (Windows 7) and Microsoft KB : support.microsoft.com/kb/ (Windows 8). The KB articles also proide information about a workaround for this issue if you do not want to apply the hot fix. CIFS node referral feature works only if LIFs are enabled for both CIFS and NFS CIFS automatic node referral, also called autolocation, works only if logical interfaces (LIFs) are enabled for both CIFS and NFS. CIFS node referral is a feature that improes performance. CIFS clients are gien referrals to allow them to connect to a data LIF that is local to the root of the CIFS share being mapped. For example, if a CIFS share's root is hosted Known problems and limitations 111

122 in node-1, performance is better if access is gien through a LIF hosted in node-1. The feature can fail to work if the target node contains data LIFs that are enabled only for the NFS protocol, or enabled only for the CIFS protocol. Although the node referral feature can fail to work, data access is not affected. The CIFS client maps the share using the original LIF that the client used to connect to the cluster. If you want to use a data LIF as a potential referral for CIFS clients, create data LIFs with both NFS and CIFS enabled (-data-protocol nfs,cifs). For example, you can use the following command: network interface create -lif lifname -serer serername -role data -data-protocol cifs,nfs... CIFS widelinks are not accessible from Mac clients When a user attempts to connect to a share using widelinks from a Mac OS X client, the attempt fails. Widelinks are not accessible from Mac OS X clients. Windows clients make a Distributed File System (DFS) referral request after Data ONTAP returns the special error code STATUS_PATH_NOT_COVERED. The CIFS widelink feature uses this behaior in its implementation. In its DFS response, Data ONTAP can proide a referral that is configured by an administrator. The mapped referral allows a CIFS client to follow a UNIX symlink. Although Mac OS supports DFS, Mac OS clients do not behae exactly like Windows clients in the way they handle the special DFS error code. Apple bug has been created to document and track the issue. Customers encountering this issue with Mac support for widelinks should contact Apple regarding this bug. Creation of a CIFS serer fails when using credentials from a trusted domain When trying to create a CIFS serer using the credentials of a user from a trusted domain, Data ONTAP fails to locate the Kerberos Key Distribution Center (KDC) for the trusted domain. As a result, the CIFS serer creation fails. When you create a CIFS serer, use credentials from the domain specified in the DNS configuration for the Storage Virtual Machine (SVM) associated with the CIFS serer. SAN administration issues You should be familiar with the known issues related to block access protocols. 112 IBM System Storage N series: Clustered Data ONTAP Release Notes

123 SAN commands and options resered for future use In Data ONTAP 8.2.0, some SAN commands and options are resered for future use. The following commands and options are resered for future use: lun create -class lun show -class lun bind create all options Do not use these commands and options. Transition of a 7-Mode LUN to a clustered Data ONTAP LUN with the lun create command does not work Do not create a clustered Data ONTAP LUN from 7-Mode LUN in a clustered Data ONTAP system using the lun create command. If you use the lun create -file-path command to create a clustered Data ONTAP LUN from a 7-Mode LUN in a clustered Data ONTAP system, you get the following error: Error: command failed: Inalid argument Data protection issues If you use data protection products, you might need to familiarize yourself with releant data protection issues. For more information about these issues, see either the Clustered Data ONTAP Data Protection Guide or the Clustered Data ONTAP Data Protection Tape Backup and Recoery Guide. SnapMirror updates fail on destination olume if a missing Snapshot copy on the source system is used If a dump operation is in progress on the destination olume using a Snapshot copy that is missing on the source system, then the next SnapMirror update will try to delete this Snapshot copy, but next update operation fails because the Snapshot copy is being used by the in-progress dump operation. Ensure that the Snapshot copy that is used by the dump operation is not deleted on the source olume. This is an expected behaior of the SnapMirror feature. Failure of SnapVault transfer in a SnapMirror to SnapVault cascade can halt SnapMirror transfers A SnapVault transfer failure in a SnapMirror to SnapVault cascade after the SnapVault destination reaches its maximum Snapshot copy limit can result in Known problems and limitations 113

124 accumulating Snapshot copies on the SnapVault source and destination olumes. Also, this can halt Snapshot creation on the primary and further SnapMirror transfers. In the SnapMirror to SnapVault cascade configuration, clustered Data ONTAP only replicates SnapMirror created Snapshot copies to the SnapVault destination. Before replicating a Snapshot copy, Data ONTAP creates a lock on the Snapshot copy on the SnapMirror destination. The lock is propagated to the corresponding Snapshot copy on the SnapMirror source. The locks are cleared after the SnapMirror and SnapVault transfers complete successfully. The default SnapMirror policy that controls the number of Snapshot copies that are retained allows up to 251 Snapshot copies. After the 251 limit is reached, the transfer of the newest SnapMirror created Snapshot copy from the SnapMirror destination to the SnapVault destination results in the deletion of the oldest SnapMirror created Snapshot copy from the SnapVault destination. If a failure occurs between the transfer and deletion phase, it is possible that 252 Snapshot copies are retained. Data ONTAP does not expect the number of Snapshot copies to be greater than 251; therefore, subsequent SnapVault transfers fail. The failure also affects the locks on the SnapMirror destination and primary olume of the cascade. Locks are not released because the SnapVault transfer neer finished. SnapMirror continues to lock newer Snapshot copies to transfer to the SnapVault destination. With each subsequent SnapVault transfer failure, more locks are not released. The accumulation of Snapshot copies on the SnapMirror source can reach the limit of 255 Snapshot copies. At that point, no more Snapshot copies can be created nor can Snapshot copies be transferred. To aoid this issue, you should add an sm_created rule to the SnapMirror policy associated with the SnapVault relationship and set its keep count to a alue less than 251. The following command adds the sm_created rule to the XDPDefault default SnapVault policy, and retains 245 Snapshot copies: cluster1::> snapmirror policy add-rule -serer s1 -policy XDPDefault -snapmirror-label sm_created -keep 245 Different interconnect link speeds can affect SnapVault transfer performance In a SnapVault fanout configuration, the transfer speed of SnapVault relationships using fast links can be reduced by SnapVault relationships using slower links if they are configured with schedules that update simultaneously. 114 IBM System Storage N series: Clustered Data ONTAP Release Notes

125 A slow link is one with transmission speeds of less than 1 MB/s with latencies of greater than 50 ms RTT (Round Trip Time). To aoid this issue, you should schedule SnapVault transfers that occur on slow links at a different time from SnapVault transfers that occur on fast links. Checking SnapMirror relationship information not up-to-the-minute The snapmirror show command with the -destination-path parameter does not guarantee up-to-date status information about a SnapMirror relationship. Like status information retrieed through any other inocation of the snapmirror show command, this information can be up to three minutes old. Issues with using wildcards with load-sharing mirror relationships Use of wildcards when you quiesce or resume a load-sharing mirror destination olume might display benign errors. This is because when you run the commands to quiesce or resume on one load-sharing mirror relationship, the commands operate on the set of load-sharing mirrors. When the snapmirror quiesce command runs on one load-sharing relationship of the load-sharing set, it quiesces all of the destination olumes for the set of load-sharing mirrors. Using wildcards to perform the quiesce operation on all of the load-sharing mirror in the set is not necessary. Likewise, when the snapmirror resume command runs on one load-sharing mirror relationship, the command enables transfers to occur on the set of load-sharing mirrors and wildcards are not necessary. Upgrading older style data protection mirror relationships Data protection mirror relationships that you hae before upgrading to Data ONTAP 8.2 use a different relationship syntax and are not upgraded when you upgrade Data ONTAP. You must upgrade the Data ONTAP 8.1.x relationship syntax style to the Data ONTAP 8.2 and later syntax style if you want to use new features and improements. About this task After you upgrade a cluster, the cluster is fully operational with no disruption to existing serices. Howeer, data protection mirror relationships will not be able to take adantage of the new release's features because changing the syntax of the data protection mirror relationships from Data ONTAP 8.1.x syntax to Data ONTAP 8.2 and later syntax is not included in the upgrade. Note: If you hae data protection mirror relationships that span cluster peers, you must upgrade both destination and source clusters to clustered Data ONTAP 8.2 before upgrading older style data protection mirror relationships. With Data ONTAP 8.2.1, conersion of data protection mirror relationships from the 8.1.x style to the 8.2 and later style is initiated when you create a Storage Virtual Machine (SVM) peer relationship. Known problems and limitations 115

126 To take adantage of the new features, you must create an SVM peer relationship. Creating an SVM peer relationship automatically initiates the conersion of Data ONTAP 8.1.x style data protection mirror relationships to Data ONTAP 8.2 style data protection mirror relationships. SVM peering requires unique SVM names. You should name SVMs with a unique fully qualified domain name (FQDN), for example, dataverser.hq or mirrorvserer.offsite. Using the FQDN naming style makes it much easier to make sure of uniqueness. Procedure 1. Show the relationship-capability of the data protection mirror relationships by using the snapmirror show command with the -fields relationship-capability parameter. 2. Create SVM peer relationships: a. On one of the clusters of the cluster peer relationship, create SVM peer relationships by using the serer peer create command. If you hae more than one SnapMirror relationship that uses the same two SVMs, then you need to create only one SVM peer relationship. b. On the other cluster of the cluster peer relationship, accept the SVM create request by using the serer peer accept command. c. If there is a name conflict, change the name of one of the SVMs by using the serer rename command. In addition to creating the SVM peer relationship, Data ONTAP upgrades the data protection mirror relationships to Data ONTAP 8.2 style relationships. Note: Load-sharing mirror relationships cannot be upgraded to the Data ONTAP 8.2 style. The Relationship capability field of the detailed iew of the snapmirror show command will show as Pre Ensure that all of the data protection mirror relationships are displayed as healthy and hae relationship-capability of 8.2 and aboe by using the snapmirror show command with the -instances parameter. SnapVault transfers unexpectedly grow and shrink secondary olumes If the primary olume consists of a large number of small files, you might see the secondary olume grow and shrink during the transfer. On subsequent transfers, you might see the same behaior, een for small data transfers. This is expected behaior. Aggregate relocation interrupts SnapMirror transfers If you relocate an aggregate that contains olumes inoled in a SnapMirror transfer, the aggregate relocation takes precedence. 116 IBM System Storage N series: Clustered Data ONTAP Release Notes

127 When the aggregate relocation finishes, you can complete the SnapMirror transfers, either by manually restarting the transfers or by waiting for the scheduled SnapMirror transfer update. NDMP remote restores can fail when backup serer is running Microsoft Windows Serer 2003 Due to an issue with the TCP Window Scaling Option (RFC 1323), attempts to perform an NDMP remote restore in a cluster by using Data ONTAP 8.0 or later can fail when the tape deice is attached to a backup serer running Windows Serer When this problem occurs, the storage system console displays the following message: RESTORE: Message from Read socket: Undefined error: 0 RESTORE: RESTORE IS ABORTED This failure occurs when the storage system sends a TCP zero window update with an acknowledgement (ACK) number X and then sends a window update with ACK number X + k. The backup serer running Windows Serer 2003 ignores the update and consequently, does not adance its send window. After continued failed attempts, the backup serer running Windows Serer 2003 silently drops the connection. Then the storage system aborts the restore attempt. But due to TCP Keep-Alie, this can occur after a few hours hae passed. To work around this problem, disable the TCP Window Scaling option on the backup serer running Windows Serer 2003 before initiating a remote restore. For more information about disabling this option, see Microsoft Support article number Related information: Microsoft Support: support.microsoft.com/kb/ NDMP management not supported for clustered Data ONTAP 8.2 You cannot use System Manager to enable, disable, or stop the NDMP serice on storage systems running clustered Data ONTAP 8.2. Howeer, for storage systems running clustered Data ONTAP 8.1 or a later ersion in the 8.1 release family, NDMP management is supported. Workaround Use the command-line interface to manage the NDMP serice if your storage system is running clustered Data ONTAP 8.2. Tape backup policy during olume moe, SFO, and ARL You can continue performing incremental tape backup and restore operations after olume moe, SFO (storage failoer), and ARL (aggregate relocation) Known problems and limitations 117

128 operations in the Storage Virtual Machine (SVM)-scoped NDMP mode only if your backup application supports the Cluster Aware Backup (CAB) extension. If your backup application does not support the CAB extension or if you are using the node-scoped NDMP mode, then you can continue performing an incremental backup operation only if you migrate the LIF that is configured in the backup policy to the node that hosts the destination aggregate. Otherwise, after olume migration, you must perform a baseline backup before performing the incremental backup operation. Note: For SFO operations, the LIF configured in the backup policy must migrate to the partner node. For more information, see the Clustered Data ONTAP Data Protection Tape Backup and Recoery Guide. DAR fails if the file and the LUN hae the same name on the destination olume When DAR (Direct Access Recoery) of a file whose file name is the same as a LUN name on the destination olume is performed, then the DAR fails. For a successful restore, perform DAR of the file again. 118 IBM System Storage N series: Clustered Data ONTAP Release Notes

129 Changes to published documentation Additional information has become aailable after the documentation proided with this release was published. The information in this section should be used in conjunction with the materials originally published for this release. Changes to the clustered Data ONTAP library Seeral new titles hae been added to the library in the 8.2 release family, and one book is no longer aailable. All titles hae been renamed to include the clustered Data ONTAP terminology. All technical documentation referring to clustered capabilities hae new titles in Data ONTAP 8.2 and later releases. For example, the Data ONTAP 8.1 Network Management Guide for Cluster-Mode is now the Clustered Data ONTAP 8.2 Network Management Guide. In addition, the following modifications hae been made to library content for the clustered Data ONTAP 8.2 release family: 8.1 content 8.2 change Release changed Antiirus Protection Management Guide (embedded antiirus functionality) Discontinued 8.2 Documentation Map New title: Documentation Roadmap 8.2 System Administration Guide Vserer Administrator Capabilities Oeriew Guide Not aailable Information about Infinite Volumes that was preiously in the Logical Storage Management Guide, Data Protection Guide, and Data Protection Tape Backup and Recoery Guide New title: System Administration Guide for Cluster Administrators New title: System Administration Guide for SVM Administrators New guide: Antiirus Configuration Guide (external antiirus functionality) New guide: Infinite Volumes Management Guide Copyright IBM Corp

130 8.1 content 8.2 change Release changed Information about CIFS and NFS protocols that was preiously in the File Access and Protocols Management Guide Two new guides: File Access Management Guide for CIFS and File Access Management Guide for NFS Changes to Gateway document titles Starting with Data ONTAP 8.2.1, the titles of the Gateway documents are changing because of the change in name of the Gateway functionality to FlexArray Virtualization Software. The new titles of the Gateway guides in Data ONTAP (and later releases) are as follows: Titles prior to Data ONTAP Gateway Systems Implementation Guide for Third-Party Storage Gateway Systems Installation Requirements and Reference Guide Updated titles from Data ONTAP onwards FlexArray Virtualization Implementation Guide for Third-Party Storage FlexArray Virtualization Installation Requirements and Reference Guide Changes to the File Access Management Guide for CIFS Additional information has become aailable since the last reision of the Clustered Data ONTAP File Access Management Guide for CIFS. Changes to information about connections allowed to a share The topic Creating an SMB share on a CIFS serer is amended with additional information about connections allowed to a share. The maximum number of tree connects allowed in a single session is 4096 and is not configurable. Incorrect limit listed for maximum number of symbolic links for SMB access The topic Limits when configuring UNIX symbolic links for SMB access states that there is a limit of 2,048 symbolic links for SMB access per Storage Virtual Machine (SVM). This is incorrect. This limit has been remoed in clustered Data ONTAP and later releases in the 8.2 release family. 120 IBM System Storage N series: Clustered Data ONTAP Release Notes

131 Certain commands must be run from nodes that hae routes to external serers Certain serer cifs and serer actie-directory commands that result in communication with external serers must be run from nodes with LIFs that hae routes to external serers. These LIFs can be either data LIFs or the node's management LIF. To ensure that all commands in these command families succeed, you should run them from nodes that contain LIFs with routes to external serers. Changes to the requirements for share names when creating home directory shares To ensure that you can successfully create home directory shares, you should be aware that the requirements for share names when creating home directory shares has changed. Starting with clustered Data ONTAP and later in the 8.2 release family, the share name must contain either the %w or the %u ariable. The share name can additionally contain the %d ariable (for example, %d/%w) or a static portion in the share name (for example, home1_%w). In addition to containing one of the required ariables, if the share name contains one of the literal strings %w, %u, or %d, you must precede the literal string with a % (percent) character to preent clustered Data ONTAP from treating the literal string as a ariable (for example, %%w). If your home directory configuration contains static share names and you upgrade to clustered Data ONTAP or later in the 8.2 release family or clustered Data ONTAP 8.3 or later, the static home directory share names are not changed and are still alid. Howeer, you cannot create any new home directory shares that do not contain either the %w or %u ariable. Requiring that one of these ariables is included in the user's home directory share name ensures that eery share name is unique across the home directory configuration. If desired, you can change static home directory share names to names that contain either the %w or %u ariable. How to control automatic DFS adertisements in clustered Data ONTAP with a CIFS serer option A CIFS serer option has been added that controls how DFS capabilities are adertised to SMB clients when connecting to shares. Because clustered Data ONTAP uses DFS referrals when clients access symbolic links oer SMB, you should be aware of what the impact is when disabling or enabling this option. In clustered Data ONTAP 8.2 through 8.2.2, the CIFS serers on Storage Virtual Machines (SVMs) always adertise to SMB clients that they are DFS Changes to published documentation 121

132 capable. Howeer, een though the CIFS serers always adertise that they are DFS capable, symbolic link access for SMB is managed on a share-by-share basis by setting a share parameter. By using the share parameter, you can set symbolic link access for SMB to one of three access leels: Enabled for read and write access Enabled for read-only access Disabled, either by setting the alue of this parameter to hide symlinks or by setting the parameter to null ( ) Starting with Data ONTAP in the 8.2 release family, a CIFS serer option determines whether the CIFS serers automatically adertise that they are DFS capable to SMB clients. By default, this option is enabled and the CIFS serer always adertises that it is DFS capable to SMB clients (een when connecting to shares where access to symbolic links is disabled). If you want the CIFS serer to adertise that it is DFS capable to clients only when they are connecting to shares where access to symbolic links is enabled, you can disable this option. You should be aware of what happens when this option is disabled: The share configurations for symbolic links is unchanged. If the share parameter is set to allow symbolic link access (either read-write access or read-only access), the CIFS serer adertises DFS capabilities to clients connecting to that share. Client connections and access to symbolic links continue without interruption. If the share parameter is set to not allow symbolic link access (either by disabling access or if the alue for the share parameter is null), the CIFS serer does not adertise DFS capabilities to clients connecting to that share. Because clients hae cached information that the CIFS serer is DFS capable and it is no longer adertising that it is, clients that are connected to shares where symbolic link access is disabled might not be able to access these shares after the CIFS serer option is disabled. After the option is disabled, you might need to reboot clients that are connected to these shares, thus clearing the cached information. These changes do not apply to SMB 1.0 connections. Managing whether the CIFS serer automatically adertises DFS capabilities You can set a CIFS serer option to determine whether CIFS serers automatically adertise DFS capabilities to SMB 2.x and SMB 3.0 clients 122 IBM System Storage N series: Clustered Data ONTAP Release Notes

133 connecting to shares. You can disable automatic adertisements in cases where you hae applications that will not make connections to shares that adertise DFS capabilities. About this task Clustered Data ONTAP uses DFS referrals in the implementation of symbolic links for SMB access. You should keep the following in mind when deciding whether to enable or disable this option: If automatic DFS adertisements are enabled, the CIFS serer always adertises DFS capabilities to SMB 2.x and SMB 3.0 clients connecting to a share regardless of whether symbolic link access for CIFS is enabled on that share. This is the default setting. If automatic DFS adertisements are disabled, the CIFS serer adertises DFS capabilities to SMB 2.x and SMB 3.0 clients only when the clients are connecting to shares where symbolic link access is enabled (either read-write or read-only access) and does not adertise DFS capabilities to clients if they are connecting to shares where symbolic link access is disabled. Clients that are connected to shares where symbolic link access is disabled might not be able to access these shares after the CIFS serer option is disabled. This is because the clients hae cached information that the CIFS serer is DFS capable, and it is no longer adertising that it is. This causes reconnections to SMB shares to fail. There are two ways to manage this: Before disabling the option, you can change the share setting on all shares to allow either read-write or read-only access. If it is not possible to change the settings for shares where symbolic link access is disabled, after the option is disabled, you can reboot any affected clients that are connected to these shares, thus clearing the cached information. Procedure 1. Set the priilege leel to adanced: set -priilege adanced 2. Configure the DFS referral option setting: serer cifs options modify -serer serer_name -is-adertise-dfs-enabled {true false} 3. Verify that the option is set to the desired alue: serer cifs options show -serer serer_name 4. Return to the admin priilege leel: set -priilege admin Changes to the way paths are recorded in the audit log eent record Starting with Data ONTAP in the 8.2 release family, the way that the path is recorded in the <ObjectName> tag in audit log eent records has Changes to published documentation 123

134 changed. The path now contains the name of the olume that contains the path and the relatie path from the root of the olume instead of the junction path to the audited object. This results in changes to the SMB file and folder access eents that can be audited topic. The last sentence in the note should be replaced: Original sentence If a user accesses a file with the path /data/data1/dir1/file.txt, the path used in the <ObjectName> tag in the eent contained in the audit logs is /data1/dir1/file.txt. Replacement sentence If a user accesses a file in the olume named data1 with the junction path /data/data1/ and file path /data/data1/dir1/file.txt, the path used in the <ObjectName> tag in the eent contained in the audit logs is (data1); /dir1/file.txt. Determining what the complete path to the audited object is The object path printed in the <ObjectName> tag for an audit record contains the name of the olume (in parentheses) and the relatie path from the root of the containing olume. If you want to determine the complete path of the audited object, including the junction path, there are certain steps you must take. Procedure 1. Determine what the olume name and relatie path to audited object is by looking at the <ObjectName> tag in the audit eent. In this example, the olume name is data1 and the relatie path to the file is /dir1/file.txt: <Data Name="ObjectName"> (data1);/dir1/file.txt </Data> 2. Using the olume name determined in the preious step, determine what the junction path is for the olume containing the audited object: olume show -junction -olume data1 Junction Junction Vserer Volume Language Actie Junction Path Path Source s1 data1 en_us.utf-8 true /data/data1 RW_olume 3. Determine the full path to the audited object by appending the relatie path found in the <ObjectName> tag to the junction path for the olume: /data/data1/dir1/file.text 124 IBM System Storage N series: Clustered Data ONTAP Release Notes

135 Managing how file security is presented to SMB clients for UNIX security-style data You can choose how you want to present file security to SMB clients for UNIX security-style data by enabling or disabling the presentation of NTFS ACLs to SMB clients. There are adantages with each setting, which you should understand to choose the setting best suited for your business requirements. By default, Data ONTAP presents UNIX permissions on UNIX security-style olumes to SMB clients as NTFS ACLs. There are scenarios where this is desirable, including the following: You want to iew and edit UNIX permissions by using the Security tab in the Windows Properties box. You cannot modify permissions from a Windows client if the operation is not permitted by the UNIX system. For example, you cannot change the ownership of a file you do not own, because the UNIX system does not permit this operation. This restriction preents SMB clients from bypassing UNIX permissions set on the files and folders. Users are editing and saing files on the UNIX security-style olume by using certain Windows applications, for example Microsoft Office, where Data ONTAP must presere UNIX permissions during sae operations. There are certain Windows applications in your enironment that expect to read NTFS ACLs on files they use. Under certain circumstances, you might want to disable the presentation of UNIX permissions as NTFS ACLs. If this functionality is disabled, Data ONTAP presents UNIX security-style olumes as FAT olumes to SMB clients. There are specific reasons why you might want to present UNIX security-style olumes as FAT olumes to SMB clients: You only change UNIX permissions by using mounts on UNIX clients. The Security tab is not aailable when a UNIX security-style olume is mapped on an SMB client. The mapped drie appears to be formatted with the FAT file system, which has no file permissions. You are using applications oer SMB that set NTFS ACLs on accessed files and folders, which can fail if the data resides on UNIX security-style olumes. If Data ONTAP reports the olume as FAT, the application does not try to change an ACL. Enabling or disabling the presentation of NTFS ACLs for UNIX security-style data You can enable or disable the presentation of NTFS ACLs to SMB clients for UNIX security-style data (UNIX security-style olumes and mixed security-style olumes with UNIX effectie security). Changes to published documentation 125

136 About this task If you enable this option, Data ONTAP presents files and folders on olumes with effectie UNIX security style to SMB clients as haing NTFS ACLs. If you disable this option, the olumes are presented as FAT olumes to SMB clients. The default is to present NTFS ACLs to SMB clients. Procedure 1. Set the priilege leel to adanced: set -priilege adanced 2. Configure the UNIX NTFS ACL option setting: serer cifs options modify -serer serer_name -is-unix-nt-acl-enabled {true false} 3. Verify that the option is set to the desired alue: serer cifs options show -serer serer_name 4. Return to the admin priilege leel: set -priilege admin Configuring access restrictions for anonymous users By default, an anonymous, unauthenticated user (also known as the null user) can access certain information on the network. You can use a CIFS serer option to configure access restrictions for the anonymous user. About this task This information describes how to configure a new CIFS serer option that is aailable with Data ONTAP and later releases in the Data ONTAP 8.2 release family. The -restrict-anonymous CIFS serer option corresponds to the RestrictAnonymous registry entry in Windows. Anonymous users can list or enumerate certain types of system information from Windows hosts on the network, including user names and details, account policies, and share names. You can control access for the anonymous user by specifying one of three access restriction settings: Value no-restriction (default) no-enumeration no-access Description Specifies no access restrictions for anonymous users. Specifies that only enumeration is restricted for anonymous users. Specifies that access is restricted for anonymous users. Procedure 1. Set the priilege leel to adanced: set -priilege adanced 126 IBM System Storage N series: Clustered Data ONTAP Release Notes

137 2. Configure the restrict anonymous setting: serer cifs options modify -serer serer_name -restrict-anonymous {no-restriction noenumeration no-access} 3. Verify that the option is set to the desired alue: serer cifs options show -serer serer_name 4. Return to the admin priilege leel: set -priilege admin Changes to the System Administration Guide Additional information has become aailable since the last reision of the Clustered Data ONTAP System Administration Guide for Cluster Administrators. Changes to cluster peer information Some information about cluster peer topologies and connectiity in the Clustered Data ONTAP System Administration Guide for Cluster Administrators was not updated for Data ONTAP 8.2.x and should be updated to contain the correct information. The following updated topics show the correct information about cluster peer topologies and configuring intercluster connectiity: Supported cluster peer network topologies Configuring intercluster LIFs to share data ports Configuring intercluster LIFs to use dedicated intercluster ports Supported cluster peer network topologies To proide data protection, all of the intercluster LIFs of one cluster must be able to communicate with all of the intercluster LIFs of the cluster peer using pair-wise full-mesh connectiity. You need to understand how this connectiity works for different cluster topologies. Pair-wise full-mesh connectiity applies only to the two clusters in the peer relationship. All of the intercluster LIFs of all the nodes in one cluster must be able to communicate with all of the intercluster LIFs of all the nodes in the other cluster. You cannot designate specific intercluster LIFs to work for specific cluster peer relationships. Intercluster LIFs can be configured on different subnets on a single node or within a cluster. There are no restrictions on which networks intercluster LIFs may be configured or how many networks may be used for intercluster communication. Using the concept of pair-wise full-mesh connectiity helps you to build more complex cluster peer topologies. Understanding how this connectiity works Changes to published documentation 127

138 for two cluster, cluster cascade, and cluster fan-out or fan-in topologies will help you to create iable intercluster networks without adding intercluster networks that are unnecessary. Intercluster networking between two clusters Creating an intercluster network between two clusters is the basic cluster peer configuration. For example, you want to create an intercluster network between two clusters, Cluster A and Cluster B. Cluster A has two intercluster LIFs, A1 and A2, and Cluster B has two intercluster LIFs, B1 and B2. The LIFs are connected as follows: A1 communicates with B1 and A1 communicates with B2 and A2 communicates with B1 and A2 communicates with B2 Intercluster networking in a cluster cascade When you connect three clusters in a cascade, all of the intercluster LIFs of the primary cluster must be able to communicate with all of the intercluster LIFs of the secondary cluster. Likewise, all of the intercluster LIFs of the secondary cluster must be able to communicate with all of the intercluster LIFs of the tertiary cluster. You do not need to create an intercluster network between the primary cluster and the tertiary cluster if you do not want to connect the two clusters in a cluster peer relationship. For example, you want to create an intercluster network between Cluster A and Cluster B and an intercluster network between Cluster B and Cluster C. Cluster A has two intercluster LIFs, A1 and A2, Cluster B has two intercluster LIFs, B1 and B2, and Cluster C has two intercluster LIFs, C1 and C2. The intercluster LIFs between Cluster A and Cluster B are connected as follows: A1 communicates with B1 and A1 communicates with B2 and A2 communicates with B1 and A2 communicates with B2 and The intercluster LIFs between Cluster B and Cluster C are connected as follows: 128 IBM System Storage N series: Clustered Data ONTAP Release Notes

139 B1 communicates with C1 and B1 communicates with C2 and B2 communicates with C1 and B2 communicates with C2 You might hae a cluster cascade configured in which you want the tertiary cluster to connect to the primary cluster if something happens to the secondary cluster. An example is if you hae a disaster recoery relationship between the primary cluster and the secondary cluster, and a backup relationship between the secondary cluster and the tertiary cluster, and you want the tertiary cluster to communicate with the primary cluster if something happens to the secondary cluster. If this configuration is what you want, then the intercluster LIFs of the tertiary cluster must be able to communicate with all of the intercluster LIFs of the primary cluster. Therefore, in addition to the connections preiously mentioned, you would also hae the following intercluster LIF connections between Cluster C and Cluster A: A1 communicates with C1 and A1 communicates with C2 and A2 communicates with C1 and A2 communicates with C2 Changes to published documentation 129

140 Intercluster networking in a cluster fan-out or fan-in When you connect clusters in a fan-out or fan-in configuration, the intercluster LIFs of each cluster that connects to the primary cluster must be able to communicate with all of the intercluster LIFs of the primary cluster. You do not need to connect intercluster LIFs between the remote clusters if the remote clusters do not need to communicate with each other. For example, you want to create an intercluster network between Cluster A and Cluster B and an intercluster network between Cluster A and Cluster C. Cluster A has two intercluster LIFs, A1 and A2, Cluster B has two intercluster LIFs, B1 and B2, and Cluster C has two intercluster LIFs, C1 and C2. The intercluster LIFs between Cluster A and Cluster B are connected as follows: A1 communicates with B1 and A1 communicates with B2 and A2 communicates with B1 and A2 communicates with B2 The intercluster LIFs between Cluster A and Cluster C are connected as follows: A1 communicates with C1 and A1 communicates with C2 and A2 communicates with C1 and A2 communicates with C2 Cluster B is not connected to Cluster C. If you do want a cluster peer relationship between two remote clusters in addition to the fan-in or fan-out configuration, then use the concept of pair-wise full-mesh connectiity to create an intercluster network between them. 130 IBM System Storage N series: Clustered Data ONTAP Release Notes

141 Intercluster networking with a router If you want to use intercluster networks for dedicated purposes, you can use a router. A router can forward data along the networks for which you configure the router without the need to connect to eery intercluster LIF on the peer cluster. One example of how a router might be used is if you want to designate one intercluster network for local back up and you want to designate another intercluster network to a storage serice proider. In the following example, if you are not peering Cluster B and Cluster C, then the router can disallow all communication between the intercluster LIFs of Cluster B and Cluster C. Configuring intercluster LIFs to share data ports Configuring intercluster LIFs to share data ports enables you to use existing data ports to create intercluster networks for cluster peer relationships. Sharing data ports reduces the number of ports you might need for intercluster networking. About this task Creating intercluster LIFs that share data ports inoles assigning LIFs to existing data ports. In this procedure, a two-node cluster exists in which each node has two data ports, e0c and e0d, and these data ports are in the default IPspace. These are the two data ports that are shared for intercluster replication. You must configure intercluster LIFs on the peer cluster before you can create cluster peer relationships. In your own enironment, you replace the ports, networks, IP addresses, subnet masks, and subnets with those specific to your enironment. Changes to published documentation 131