OnCommand Cloud Manager 3.2 Getting Up and Running

Transcription

1 OnCommand Cloud Manager 3.2 Getting Up and Running April _B0

2

3 Table of Contents 3 Contents Installation and setup workflow... 4 Preparing for installation and setup... 6 Cloud Manager software requirements... 6 Preparing your AWS environment... 8 AWS networking requirements... 9 AWS networking requirements for ONTAP Cloud HA in multiple AZs Sample VPC configurations Granting AWS permissions to Cloud Manager Key manager requirements for ONTAP Cloud encryption AWS Key Management Service requirements Setting up AWS billing and cost management for Cloud Manager Preparing your Azure environment Azure networking requirements Granting Azure permissions to Cloud Manager Enabling programmatic deployments of ONTAP Cloud in Azure Networking and policy reference Security group rules What Cloud Manager does with AWS permissions What Cloud Manager does with Azure permissions Installing OnCommand Cloud Manager Launching a Cloud Manager instance in a standard AWS region Launching a Cloud Manager instance in the AWS GovCloud (US) region Creating a Cloud Manager virtual machine in Azure Installing Cloud Manager on an existing Linux host Setting up OnCommand Cloud Manager Setting up Cloud Manager in the Storage System View Installing an HTTPS certificate for secure access Setting up Cloud Manager to work with AD user accounts Creating tenants Creating user accounts Setting up Cloud Manager for ONTAP Cloud encryption in AWS Setting up Cloud Manager in the Volume View Registering for support What to do after installation and setup Copyright information Trademark information How to send comments about documentation and receive update notifications Index... 58

4 4 Installation and setup workflow Deploying Cloud Manager involves preparing your environment, installing Cloud Manager, and then setting it up in the Storage System View or in the Volume View (supported with standard AWS regions only). The following workflow shows how to install and set up Cloud Manager in the Storage System View: Related concepts Installing OnCommand Cloud Manager on page 35 Setting up OnCommand Cloud Manager on page 41

5 Installation and setup workflow 5 Related tasks Preparing for installation and setup on page 6 Related references What to do after installation and setup on page 54

6 6 Preparing for installation and setup Before you install and set up Cloud Manager, you must prepare your environment and understand the information that you need for installation and setup. Steps 1. Review Cloud Manager requirements on page 6 You must verify support for your configuration, which includes host requirements, web browser requirements, and so on. Most of this information is available in the NetAppInteroperability Matrix; however, because you might not have a NetApp Support Site login, a minimum amount of information is provided to get you started. 2. Prepare your AWS environment on page 8 Your AWS environment must meet a few requirements so that Cloud Manager and ONTAP Cloud operate correctly in AWS. 3. Prepare your Azure environment on page 20 Your Microsoft Azure environment must meet a few requirements so that Cloud Manager and ONTAP Cloud operate correctly in Azure. 4. (Optional) Review details about networking and cloud provider permissions on page 29 You might need to refer to some information as you prepare your cloud environment for Cloud Manager and ONTAP Cloud. Cloud Manager software requirements You must verify support for your configuration, which includes host requirements, web browser requirements, and so on. Most of this information is available in the NetApp Interoperability Matrix; however, because you might not have a NetApp Support Site login, a minimum amount of information is provided to get you started. If you have a NetApp Support Site login, go to the NetApp Interoperability Matrix Tool to search for supported Cloud Manager configurations. Where you can install Cloud Manager You can install the Cloud Manager software in AWS by launching a new instance from the AWS Marketplace or GovCloud EC2 console, in Azure by deploying a new virtual machine from the Azure Marketplace, or on an existing host by downloading and installing the software. The location in which you choose to install Cloud Manager must have connections to the networks in which you want to deploy ONTAP Cloud systems. EC2 instance requirements for AWS Cloud Manager is supported in AWS on the t2.medium instance type. Cloud Manager can run on other EC2 instance types, but they are not supported. Virtual machine requirements for Azure Cloud Manager is supported on the following Azure virtual machine types: A2, D1, D2, D1_v2, and D2_v2. Cloud Manager can run on other virtual machine types, but they are not supported.

7 Preparing for installation and setup 7 Host requirements If you choose to run Cloud Manager on an existing host, the physical or virtual machine must meet minimum requirements: Component Operating system Requirement One of the following: CentOS 7.1 CentOS 7.2 Red Hat Enterprise Linux 7.1 Red Hat Enterprise Linux 7.2 Hypervisor CPU RAM Free disk space A bare metal or hosted hypervisor that is certified to run CentOS or Red Hat Enterprise Linux Red Hat Solution: Which hypervisors are certified to run Red Hat Enterprise Linux? 2.27 GHz or higher with two cores 4 GB 50 GB Port requirements Before you install Cloud Manager on an existing host, you must verify that the following ports are available. If other services are using these ports, Cloud Manager installation fails. Port Purpose 80 Provides HTTP access to the Cloud Manager web console. 443 Provides HTTPS access to the Cloud Manager web console Used by a MySQL database that stores Cloud Manager data Used by the Simplicator service, which is an API proxy for Cloud Manager. There is a potential conflict with port If another instance of MySQL is running on the host, it uses port 3306 by default. You must change the port that the existing MySQL instance uses. You can change the default HTTP and HTTPS ports when you install Cloud Manager. You cannot change the default port for the MySQL database. If you change the HTTP and HTTPS ports, you must ensure that users can access the Cloud Manager web console from a remote host: Modify the security group to allow inbound connections through the ports. Specify the port when you enter the URL to the Cloud Manager web console. Web browser requirements After you install Cloud Manager, you must access the Cloud Manager console from a supported web browser: Web browser Minimum supported version Google Chrome 52 Microsoft Edge 37 Mozilla Firefox 49

8 8 Getting up and running For the full list of supported web browser versions, see the NetApp Interoperability Matrix Tool. Related references AWS networking requirements on page 9 Azure networking requirements on page 20 Preparing your AWS environment Your AWS environment must meet a few requirements so that Cloud Manager and ONTAP Cloud operate correctly in AWS. Before you begin You should be familiar with AWS networking: Virtual Private Clouds (VPCs), subnets, and security groups. AWS Documentation: Your VPC and Subnets Steps 1. Set up your AWS networking. At a minimum, your networking must meet the following requirements: The target VPC must have one or more subnets that have outbound internet access. To deploy ONTAP Cloud systems in subnets or networks separate from Cloud Manager, connections between those networks must be in place. To replicate data across a hybrid cloud or multi-cloud environment, VPN connections between networks must be in place. AWS networking requirements on page 9 AWS networking requirements for ONTAP Cloud HA in multiple AZs on page Grant the required permissions so Cloud Manager can perform operations in AWS. Granting AWS permissions to Cloud Manager on page Subscribe to ONTAP Cloud from the AWS Marketplace so you can launch instances: a. Go to the AWS Marketplace pages for ONTAP Cloud: AWS Marketplace: ONTAP Cloud for AWS AWS Marketplace: ONTAP Cloud for AWS (BYOL) AWS Marketplace: ONTAP Cloud for AWS - High Availability AWS Marketplace: ONTAP Cloud for AWS - High Availability (BYOL) b. Review the terms, and then click Accept. Important: You must not launch ONTAP Cloud instances from the EC2 console. Note: Subscribing is not required to launch ONTAP Cloud in the AWS GovCloud (US) region. AWS Documentation: Controlling Access to AWS Marketplace Subscriptions 4. Depending on your needs, request an increase to default AWS limits for instances and total storage. AWS Documentation: AWS Service Limits

9 Preparing for installation and setup 9 AWS Documentation: Amazon EC2 Service Limits Report Now Available 5. Decide whether you want to encrypt data and meet encryption requirements, if necessary. Learning about Cloud Manager and ONTAP Cloud: Ways to encrypt ONTAP Cloud data in AWS Key manager requirements for ONTAP Cloud encryption on page 15 AWS Key Management Service requirements on page 17 Note: Skip this step if you plan to use Cloud Manager in the Volume View. 6. Optional: Set up AWS billing and cost management so that Cloud Manager can display compute and storage costs for ONTAP Cloud instances. Setting up AWS billing and cost requirements on page 17 Note: Skip this step if you plan to use Cloud Manager in the Volume View. AWS networking requirements A few networking requirements must be met so Cloud Manager can launch and manage ONTAP Cloud instances in AWS. Outbound internet access You can choose whether the subnets in your VPC are public or private, but they must allow outbound internet access. Outbound internet access is required to enable communication between Cloud Manager and AWS services, to access software images in Amazon S3, and to enable technical support from NetApp. If the subnets are private, you can route outbound internet access through a NAT device, proxy server, or VPN connection. If you have a proxy, you must configure Cloud Manager to use it. You can do so when using the Cloud Manager Setup wizard. AWS Documentation: NAT Note the following about providing internet access for NetApp AutoSupport, which is a troubleshooting tool that proactively monitors the health of your storage: For a NAT instance, you must define an inbound security group rule that allows HTTPS traffic from the private subnet to the internet. For VPN configurations, routing and firewall policies must allow AWS HTTP/HTTPS traffic to support.netapp.com. Security groups You do not need to create security groups because Cloud Manager does that for you. Security group rules on page 29 Connection between Cloud Manager and ONTAP Cloud subnets Cloud Manager requires a connection to the subnets in which you launch ONTAP Cloud systems, including the HA mediator. If Cloud Manager is not installed in the target VPC, it must have network connectivity to that VPC. For example, if you install Cloud Manager in Azure or in your corporate network, then you must set up a VPN connection to the VPC in which you launch ONTAP Cloud systems. Connection to the Cloud Manager web console Users must access Cloud Manager from a web browser. If you deploy Cloud Manager in AWS, the easiest way to provide access is by launching Cloud Manager in a public subnet with a public IP

10 10 Getting up and running address. However, if you want to use a private IP address instead, users can access the console through either of the following: A jump host in the VPC that has a connection to Cloud Manager A host in your network that has a VPN connection to the private IP address Connections to ONTAP systems in other networks (Storage System View only) To replicate data between an ONTAP Cloud system in AWS and ONTAP systems in other networks, you must have a VPN connection between the AWS VPC and the other network for example, an Azure VNet or your corporate network. Connection to key managers (Storage System View only) If you want to use the ONTAP Cloud data encryption feature, ONTAP Cloud instances must have a connection to one or more key managers that are either in AWS or in your network. Key manager requirements for ONTAP Cloud encryption on page 15 DNS and Active Directory for CIFS (Storage System View only) If you want to provision CIFS storage, you must set up DNS and Active Directory in AWS or extend your on-premises setup to AWS. The DNS server must provide name resolution services for the Active Directory environment. You can configure DHCP option sets to use the default EC2 DNS server, which must not be the DNS server used by the Active Directory environment. AWS: Active Directory Domain Services on the AWS Cloud Quick Start Reference Deployment AWS networking requirements for ONTAP Cloud HA in multiple AZs Additional AWS networking requirements apply to ONTAP Cloud HA configurations that use multiple Availability Zones (AZs). You should review these requirements before you launch an HA pair because you must enter the networking details in Cloud Manager. Availability Zones This HA deployment model uses multiple AZs to ensure high availability of your data. You should use a dedicated AZ for each ONTAP Cloud instance and the mediator instance, which provides a communication channel between the HA pair. If your region does not have three Availability Zones, try to request more from AWS. Outbound internet access The mediator instance must have outbound internet access so it can communicate with AWS to assist with storage failover. Floating IP addresses for data access ONTAP Cloud HA configurations in multiple AZs use floating IP addresses for NAS client access from within the VPC. These IP addresses can migrate between nodes when failures occur. You must specify three floating IP addresses that are outside of the CIDR blocks for all VPCs in the AWS region in which you deploy the HA configuration. You can think of the floating IP addresses as a logical subnet that is outside of the VPCs in your region. Note: One floating IP address is for cluster management, one is for NFS/CIFS data on node 1, and one is for NFS/CIFS data on node 2.

11 Preparing for installation and setup 11 The following example shows the relationship between floating IP addresses and the VPCs in an AWS region. While the floating IP addresses are outside the CIDR blocks for all VPCs, they are routable to subnets through route tables. You must manually enter the floating IP addresses in Cloud Manager when you create an ONTAP Cloud HA working environment. Cloud Manager allocates the IP addresses to the HA pair when it launches the system. Note: Cloud Manager automatically creates static IP addresses for iscsi access and for NAS access from clients outside the VPC. You do not need to meet any requirements for these types of IP addresses. Floating IP address for SVM management If you use SnapDrive for Windows or SnapCenter with an ONTAP Cloud HA pair, a floating IP address is also required for the SVM management LIF. You must create this LIF after you launch the HA pair. Deploying and managing ONTAP Cloud systems: Setting up ONTAP Cloud Route tables After you specify the floating IP addresses in Cloud Manager, you must select the route tables that should include routes to the floating IP addresses. This enables client access to the ONTAP Cloud HA pair. If you have just one route table for the subnets in your VPC (the main route table), then Cloud Manager automatically adds the floating IP addresses to that route table. If you have more than one route table, it is very important to select the correct route tables. Otherwise, some clients might not have access to the ONTAP Cloud HA pair. For example, you might have two subnets that are associated with different route tables. If you select route table A, but not route table B, then clients in the subnet associated with route table A can access the HA pair, but clients in the subnet associated with route table B cannot access the HA pair. Amazon Web Services (AWS) Documentation: Route Tables

12 12 Getting up and running Connection to NetApp management tools When deployed in multiple AZs, ONTAP Cloud HA configurations use a floating IP address for the cluster management interface, which means external routing is not available. If you want to use NetApp management tools with ONTAP Cloud HA configurations, they must be in the same VPC with similar routing configuration as NAS clients. Example configuration The following image shows an optimal ONTAP Cloud HA configuration in AWS operating as an active-passive configuration: Related information Learning about Cloud Manager and ONTAP Cloud: Overview of ONTAP Cloud HA in a single Availability Zone Sample VPC configurations To better understand how you can deploy Cloud Manager and ONTAP Cloud in AWS, you should review the most common VPC configurations. The most common VPC configurations for Cloud Manager and ONTAP Cloud include the following: A VPC with public and private subnets and a NAT device A VPC with a private subnet and a VPN connection to your network

13 Preparing for installation and setup 13 For information about advanced configurations, see NetApp Technical Report 4352: Networking Configurations for NetApp ONTAP Cloud for Amazon Web Services. A VPC with public and private subnets and a NAT device This VPC configuration includes public and private subnets, an Internet gateway that connects the VPC to the Internet, and a NAT gateway or NAT instance in the public subnet that enables outbound Internet traffic from the private subnet. In this configuration, you can run Cloud Manager in a public subnet or private subnet, but the public subnet is recommended because it allows access from hosts outside the VPC. You can then launch ONTAP Cloud instances in the private subnet. Note: Instead of a NAT device, you can use an HTTP proxy to provide Internet connectivity. AWS Documentation: Configuration Scenario 2 (VPC with Public and Private Subnets) The following graphic shows Cloud Manager running in a public subnet and single node ONTAP Cloud instances running in a private subnet: A VPC with a private subnet and a VPN connection to your network This VPC configuration is a hybrid cloud configuration in which ONTAP Cloud instances become an extension of your private environment. The configuration includes a private subnet and a virtual private gateway with a VPN connection to your network. Routing across the VPN tunnel allows EC2 instances to access the Internet through your network and firewalls. You can run Cloud Manager in the private subnet or in your data center. You would then launch ONTAP Cloud instances in the private subnet. Note: You can also use a proxy server in this configuration to allow Internet access. The proxy server can be in your data center or in AWS. If you want to replicate data between FAS systems in your data center and ONTAP Cloud systems in AWS, you should use a VPN connection so that the link is secure. AWS Documentation: Configuration Scenario 4 (VPC with a Private Subnet Only and Hardware VPN Access) The following graphic shows Cloud Manager running in your data center and single node ONTAP Cloud instances running in a private subnet:

14 14 Getting up and running Granting AWS permissions to Cloud Manager Cloud Manager needs permissions to perform actions in AWS. The Cloud Manager IAM policy defines the AWS actions and resources that Cloud Manager is allowed to use. You must grant the permissions defined in the IAM policy by associating an IAM role with the Cloud Manager instance or by specifying AWS access keys for each Cloud Manager user account. If you provide any fewer than the permissions defined in the IAM policy, then you must perform any operations that Cloud Manager cannot perform. For example, if you do not provide permissions to delete AWS resources, then you must delete those resources yourself. Choices Setting up an IAM role for the Cloud Manager instance on page 14 Granting permissions to IAM users on page 15 Related references What Cloud Manager does with AWS permissions on page 31 Setting up an IAM role for the Cloud Manager instance You can grant AWS permissions to Cloud Manager by associating an IAM role with the Cloud Manager instance when you launch it in AWS. Before you launch the instance, you must create an IAM policy and attach it to an IAM role. About this task You cannot associate an IAM role with an already running instance of Cloud Manager. Steps 1. Download the Cloud Manager IAM policy from the following location: NetApp OnCommand Cloud Manager: AWS and Azure Policies 2. From the IAM console, create your own policy by copying and pasting the text from the Cloud Manager IAM policy. 3. Create an IAM role with the role type Amazon EC2 and attach the policy that you created in the previous step.

15 Preparing for installation and setup 15 Result You now have an IAM role that you can associate with the Cloud Manager instance when you launch it in AWS. After you finish When you launch the Cloud Manager instance in a standard AWS region, you must choose Custom Launch to launch the instance from the EC2 console. Launching from the EC2 console enables you to associate the IAM role with the Cloud Manager instance. Note: Launching from the EC2 console is the only option when launching the Cloud Manager instance in the GovCloud (US) region. Granting permissions to IAM users You can grant AWS permissions to Cloud Manager by specifying AWS access keys for IAM users when you create Cloud Manager user accounts. Before you create the Cloud Manager user accounts, you must grant the required permissions to those IAM users by using the Cloud Manager IAM policy. About this task If you create a Cloud Manager user and enter access keys for an AWS root account user, then that user already has the required permissions. Steps 1. Download the Cloud Manager IAM policy from the following location: NetApp OnCommand Cloud Manager: AWS and Azure Policies 2. From the IAM console, create your own policy by copying and pasting the text from the Cloud Manager IAM policy. 3. Attach the policy to IAM users or groups. AWS Documentation: Managing IAM Policies Result IAM users now have the required permissions. When you create Cloud Manager user accounts, you must specify the AWS access keys for those IAM users. Key manager requirements for ONTAP Cloud encryption You need a supported key management infrastructure to use ONTAP Cloud encryption. Supported key managers An external key manager is a system in your network or in AWS that securely stores authentication keys and provides them upon demand to ONTAP Cloud systems using secure TLS connections. The following key managers are supported: SafeNet Virtual KeySecure k150v SafeNet KeySecure k460 See the NetApp Interoperability Matrix Tool for supported SafeNet OS versions. Each ONTAP Cloud system supports up to four key managers. You should use multiple key managers in a clustered configuration for redundancy.

16 16 Getting up and running Key manager configuration requirements Each key manager must have several certificates, a KMIP server, and a network connection to ONTAP Cloud systems. The key manager must also meet specific requirements if using client certificate authentication. Note that Cloud Manager does not communicate with key managers, so a network connection between Cloud Manager and key managers is not required. A description of the key manager requirements follows: Requirement Key managers must have a server certificate Key managers must trust the signing CA Key managers must have a KMIP server Key managers must have a network connection to ONTAP Cloud systems Key managers must trust the Cloud Manager CA and its root CA, if using client certificate authentication Key managers must check a compatible user name field, if using client certificate authentication Description Key managers need a server certificate to authenticate with ONTAP Cloud systems. The SSL certificate must use the Privacy Enhanced Mail (PEM) Base-64 encoded X.509 format. You select this server certificate when you configure the KMIP server on the key manager. If you plan to use two to four key managers with an ONTAP Cloud system, the same certificate authority (CA) must sign the server certificate for each key manager. The CA that signed the server certificate must be known and trusted by the key manager. Each key manager must have a KMIP server that uses SSL and a specific port. The default and recommended port for ONTAP Cloud is If needed, you can change this port when you set up Cloud Manager. If the key managers are in AWS, they must have a connection to the subnet in which ONTAP Cloud instances are running. If the key managers are in your network, a VPN connection to the VPC provides the required connection. Firewall settings must allow communication through the KMIP port. When you set up Cloud Manager, you configure it to act as an intermediate CA so it can sign ONTAP Cloud client certificates. If a KMIP server requires client certificate authentication, then the Cloud Manager intermediate CA must be known and trusted by key managers. The root CA that signed the Cloud Manager certificate must also be known and trusted by the key manager. If the key manager's KMIP server checks for a user name in client certificates, it must use a field compatible with ONTAP Cloud client certificates. Cloud Manager can create ONTAP Cloud client certificates that include a user name in the CN (Common Name), E ( address), and OU (Organizational Unit) fields. The following graphic depicts these requirements:

17 Preparing for installation and setup 17 Notes: 1. The Cloud Manager intermediate CA and its root CA must be trusted only if the KMIP server requires client certificate authentication. 2. The same CA must have signed the server certificate for both key managers. This CA is called the key manager CA. Related tasks Setting up Cloud Manager for ONTAP Cloud encryption in AWS on page 47 Related information Learning about Cloud Manager and ONTAP Cloud: Ways to encrypt ONTAP Cloud data in AWS Learning about Cloud Manager and ONTAP Cloud: How ONTAP Cloud encryption works AWS Key Management Service requirements If you want to use Amazon EBS encryption with ONTAP Cloud, then you must set up the AWS Key Management Service (KMS). Two requirements must be met to encrypt ONTAP Cloud data using the AWS KMS: An active CMK must exist in your account. The CMK can be an AWS-managed CMK or a customer-managed CMK. You must add IAM users or the IAM role associated with Cloud Manager to the list of key users for a CMK. This gives Cloud Manager permissions to use the CMK with ONTAP Cloud. AWS Documentation: Editing Keys Related information Learning about Cloud Manager and ONTAP Cloud: Ways to encrypt ONTAP Cloud data in AWS Setting up AWS billing and cost management for Cloud Manager Cloud Manager can display the monthly compute costs and storage costs associated with running ONTAP Cloud in AWS. Before Cloud Manager can display the costs, users of AWS payer accounts must set up AWS to store billing reports in an S3 bucket, Cloud Manager must have permissions to

18 18 Getting up and running access that S3 bucket, and AWS report tags must be enabled after you launch your first ONTAP Cloud instance. Before you begin You must have granted AWS permissions to Cloud Manager so it can access an S3 bucket. Granting AWS permissions to Cloud Manager on page 14 About this task Users of AWS payer accounts must set up AWS to store billing reports in an S3 bucket. Cloud Manager uses the information from the reports to show monthly compute and storage costs associated with an ONTAP Cloud instance, as well as storage cost savings from NetApp product efficiency features (if they are enabled). You should refer to AWS for final cost details. The following image shows an example of the AWS costs per month: The following image shows an example of storage cost savings:

19 Preparing for installation and setup 19 Steps 1. Go to the Amazon S3 console and set up an S3 bucket for the detailed billing reports: a. Create an S3 bucket. b. Apply a resource-based bucket policy to the S3 bucket to allow Billing and Cost Management to deposit the billing reports into the S3 bucket. For details about using an S3 bucket for detailed billing reports and to use an example bucket policy, see AWS Documentation: Understand Your Usage with Detailed Billing Reports. 2. From the Billing and Cost Management console, go to Preferences and enable the reports: a. Enable Receive Billing Reports and specify the S3 bucket. b. Enable Cost allocation report. 3. When you create a user account, specify the S3 bucket that you created. Creating user accounts on page 45 Note: If you grant AWS permissions to Cloud Manager by specifying AWS keys, you must create a user account and specify AWS keys for an IAM user created under the payer account or the AWS keys for the payer account itself. 4. After you launch your first ONTAP Cloud instance, go back to Billing and Cost Management Preferences, click Manage report tags, and enable the WorkingEnvironmentId tag. This tag is not available in AWS until you create your first ONTAP Cloud working environment using any account under the AWS payer account. Result Cloud Manager updates the cost information at each 12-hour polling interval.

20 20 Getting up and running After you finish Repeat these steps for other AWS payer accounts for which cost reporting is needed. Related information AWS Documentation: Setting Up Your Monthly Cost Allocation Report AWS Documentation: Controlling Access to Your Billing Information Preparing your Azure environment Your Microsoft Azure environment must meet a few requirements so that Cloud Manager and ONTAP Cloud operate correctly in Azure. Before you begin You should be familiar with Azure networking: Virtual networks (VNets), subnets, and network security groups. Microsoft Azure Documentation: Virtual Network Overview Steps 1. Set up your Azure networking. At a minimum, your networking must meet the following requirements: The target VNet must have one or more subnets that have outbound internet access. To deploy ONTAP Cloud systems in subnets or networks separate from Cloud Manager, connections between those networks must be in place. To replicate data across a hybrid cloud or multi-cloud environment, VPN connections between networks must be in place. Azure networking requirements on page Grant the required permissions so Cloud Manager can perform operations in Azure. Granting Azure permissions to Cloud Manager on page Accept the terms and conditions for ONTAP Cloud and enable programmatic deployments from Cloud Manager. Enabling programmatic deployments of ONTAP Cloud in Azure on page 27 Azure networking requirements You must set up your Azure networking so that Cloud Manager can deploy ONTAP Cloud systems and so those systems can operate properly. Outbound internet access Outbound internet access is required to enable communication between Cloud Manager and Azure services, to access software images in Amazon S3, and to enable technical support from NetApp. You must ensure that network security groups assigned to the VNet or subnets do not block outbound internet access. Note the following: If you have a proxy, you must configure Cloud Manager to use it. You can do so when using the Cloud Manager Setup wizard.

21 Preparing for installation and setup 21 For VPN configurations, routing and firewall policies must allow Azure HTTP/HTTPS traffic to support.netapp.com so ONTAP Cloud can send AutoSupport messages. Security groups You do not need to create security groups because Cloud Manager does that for you. Security group rules on page 29 Connection between Cloud Manager and ONTAP Cloud subnets Cloud Manager requires a connection to the subnets in which you deploy ONTAP Cloud systems. If Cloud Manager is not installed in the target VNet, it must have network connectivity to that VNet. For example, if you install Cloud Manager in AWS or in your corporate network, you must set up a VPN connection to the VNet in which you deploy ONTAP Cloud systems. Connections to ONTAP systems in other networks To replicate data between an ONTAP Cloud system in Azure and ONTAP systems in other networks, you must have a VPN connection between the Azure VNet and the other network for example, an AWS VPC or your corporate network. Connection to the Cloud Manager web console Users must access Cloud Manager from a web browser. If you deploy Cloud Manager in Azure, the easiest way to provide access is by allocating a public IP address. However, if you want to use a private IP address instead, users can access the console through either of the following: A jump host in the VNet that has a connection to Cloud Manager A host in your network that has a VPN connection to the private IP address Granting Azure permissions to Cloud Manager Cloud Manager needs permissions to perform actions in Microsoft Azure. You must grant the required permissions by creating a service principal in Azure Active Directory, assigning the service principal to a custom role, and by obtaining the Azure credentials that you must enter in Cloud Manager when you create user accounts. About this task The following image depicts how Cloud Manager obtains permissions to perform operations in Azure. A service principal object, which is tied to an Azure subscription, represents Cloud Manager in Azure Active Directory and is assigned to a custom role that allows the required permissions.

22 22 Getting up and running If you want to create multiple Cloud Manager user accounts, you have two options: You can perform these steps for one Azure subscription and use the same set of Azure credentials when you create Cloud Manager user accounts. This means all ONTAP Cloud systems would be created using the same Azure subscripion. You can perform these steps for multiple Azure subscriptions and specify unique Azure credentials for each Cloud Manager user account. The option that you choose depends on how strict of a user policy you want to implement. Steps 1. Create a custom role with the required Cloud Manager permissions on page 23 NetApp provides a policy file that you must use to create a custom Azure role. The policy file defines the actions that Cloud Manager can perform in Azure. You must assign this custom role to an Active Directory service principal. 2. Create an Active Directory service principal on page 23 Cloud Manager must authenticate with Azure Active Directory before it can perform operations in Azure. You must create an Active Directory service principal to enable authentication. When you create the service principal, you need to copy Active Directory information so you can enter it in Cloud Manager when you create user accounts. 3. Assign the custom Cloud Manager Operator role to the service principal on page 26 You must bind the service principal to an Azure subscription and assign it the Cloud Manager Operator role so Cloud Manager has permissions to perform operations in Azure. 4. Obtain your Azure subscription ID on page 26 You need to obtain your Azure subscription ID because you must enter it in Cloud Manager when you create user accounts. Cloud Manager needs the ID to log in programmatically to Azure and deploy ONTAP Cloud systems. Related references What Cloud Manager does with Azure permissions on page 33

23 Preparing for installation and setup 23 Creating a custom role with the required Cloud Manager permissions NetApp provides a policy file that you must use to create a custom Azure role. The policy file defines the actions that Cloud Manager can perform in Azure. You must assign this custom role to an Active Directory service principal. Steps 1. Download the Cloud Manager Azure policy from the following location: NetApp OnCommand Cloud Manager: AWS and Azure Policies 2. Modify the JSON file by adding Azure subscription IDs to the assignable scope. You should add the ID for each Azure subscription from which users will create ONTAP Cloud systems. Example "AssignableScopes": [ "/subscriptions/d333af45-0d d-c25fbzzzzzzz", "/subscriptions/54b91999-b3e e-416e0zzzzzzz", "/subscriptions/398e471c-3b42-4ae7-9b59-ce5bbzzzzzzz" 3. Use the JSON file to create a custom role. The following example shows how to create a custom role using the Azure CLI: azure role create --inputfile C:\Policy_for_Cloud_Manager_Azure_3.1.json Result You should now have a custom role called OnCommand Cloud Manager Operator. After you finish Create an Active Directory service principal. Related references What Cloud Manager does with Azure permissions on page 33 Related information Microsoft Azure Documentation: Custom Roles in Azure RBAC Creating an Active Directory service principal Cloud Manager must authenticate with Azure Active Directory before it can perform operations in Azure. You must create an Active Directory service principal to enable authentication. When you create the service principal, you need to copy Active Directory information so you can enter it in Cloud Manager when you create user accounts. Before you begin You must have the appropriate permissions in Azure to create an Active Directory application and assign the application to a role. Microsoft Azure Documentation: Use portal to create Active Directory application and service principal that can access resources

24 24 Getting up and running Steps 1. From the Azure portal, open the Azure Active Directory service. 2. In the menu, click App registrations. 3. Create the service principal: a. Click Add. b. Enter a name for the application, keep Web app / API selected, and then enter any URL for example, c. Click Create. 4. Modify the application to add the required permissions: a. Select the created application. b. Under Settings, click Required permissions and then click Add. c. Click Select an API, select Windows Azure Service Management API, and then click Select.

25 Preparing for installation and setup 25 d. Click Access Azure Service Management as organization users, click Select and then click Done. 5. Create a key for the service principal: a. Under Settings, click Keys. b. Enter a description, select a duration, and then click Save. c. Copy the key value. You need to enter the key value in Cloud Manager when you create user accounts for this subscription. 6. Scroll to the left and copy the application ID for the service principal. Similar to the key value, you need to enter the application ID in Cloud Manager when you create user accounts for this subscription. 7. Obtain the Active Directory tenant ID for your organization: a. In the Active Directory menu, click Properties. b. Copy the Directory ID.

26 26 Getting up and running Just like the application ID and application key, you must enter the Active Directory tenant ID when you create Cloud Manager user accounts. Result You should now have an Active Directory service principal and you should have copied the application ID, the application key, and the Active Directory tenant ID. After you finish Assign the Cloud Manager Operator role to the service principal. Assigning the Cloud Manager Operator role to the service principal You must bind the service principal to an Azure subscription and assign it the Cloud Manager Operator role so Cloud Manager has permissions to perform operations in Azure. Steps 1. From the Azure portal, select Subscriptions in the left pane. 2. Select the subscription. 3. Click Access control (IAM) and then click Add. 4. Select the OnCommand Cloud Manager Operator role. 5. Search for the name of the application (you cannot find it in the list by scrolling). 6. Select the application, click Select, and then click OK. Obtaining your Azure subscription ID You need to obtain your Azure subscription ID because you must enter it in Cloud Manager when you create user accounts. Cloud Manager needs the ID to log in programmatically to Azure and deploy ONTAP Cloud systems. Steps 1. In the Azure portal, select the Subscriptions service.

27 Preparing for installation and setup In the Subscriptions pane, copy the ID for your subscription. After you finish Enter your Azure subscription ID in Cloud Manager when you create user accounts. Related tasks Creating user accounts on page 45 Enabling programmatic deployments of ONTAP Cloud in Azure Before users can deploy ONTAP Cloud in Azure, you must enable programmatic deployments for each Azure subscription. Cloud Manager deploys ONTAP Cloud using API calls, so programmatic deployments must be enabled. Before you begin Your Azure user account must have at least the Contributor role to enable programmatic deployments. If you do not have the appropriate permissions, contact the administrator of your Azure subscription. About this task You must use Cloud Manager to deploy ONTAP Cloud systems. You must not deploy ONTAP Cloud systems from the Azure portal. Steps 1. Go to the Azure Marketplace page for ONTAP Cloud. Microsoft Azure Marketplace: NetApp ONTAP Cloud

28 28 Getting up and running 2. Click Get it now, select the PAYGo or BYOL offering, and click Continue. 3. From the Azure portal, click Want to deploy programmatically? 4. Click Enable for each Azure subscription from which you want to deploy ONTAP Cloud. 5. Click Save. 6. If you want to deploy both ONTAP Cloud BYOL and PAYGo, repeat the steps for the other offering. Result After you create Cloud Manager user accounts and provide the appropriate Azure credentials, users can deploy ONTAP Cloud from Cloud Manager.

29 Preparing for installation and setup 29 Networking and policy reference You might need to refer to some information as you prepare your cloud environment for Cloud Manager and ONTAP Cloud. Security group rules Cloud Manager creates security groups in AWS and Azure that include the inbound and outbound rules that Cloud Manager and ONTAP Cloud need to operate successfully. You might want to refer to the ports for testing purposes or if you prefer to use your own security groups. Security group rules for Cloud Manager Inbound rules Note: The source for inbound rules is /0. Type Port range Used for SSH 22 SSH connections to Cloud Manager HTTP 80 Accessing the Cloud Manager console HTTPS 443 Accessing the Cloud Manager console Outbound rules Type Port range Used for All TCP All All outbound traffic All UDP All All outbound traffic Security group rules for ONTAP Cloud Inbound rules Note: The source for inbound rules is /0. Type Port range Used for All ICMP All Pinging the instance Custom TCP Rule 111 Portmapper Custom TCP Rule 139 NetBIOS Custom TCP Rule SNMP Custom TCP Rule 445 Microsoft SMB Custom TCP Rule 635 NFS mount Custom TCP Rule 749 Kerberos Custom TCP Rule 2049 NFS Custom TCP Rule 3260 iscsi Custom TCP Rule NFS mountd

30 30 Getting up and running Type Port range Used for Custom TCP Rule NDMP Custom TCP Rule Intercluster management and data Custom UDP Rule 111 Portmapper Custom UDP Rule SNMP Custom UDP Rule 635 NFS mount Custom UDP Rule 2049 NFS Custom UDP Rule NFS mountd HTTP 80 System Manager access HTTPS 443 System Manager access SSH 22 SSH to the CLI Outbound rules Type Port range Used for All ICMP All All outbound traffic (SnapMirror and SnapVault) All TCP All All outbound traffic All UDP All All outbound traffic External security group rules for the HA mediator Note: Cloud Manager always creates this security group. You do not have the option to use your own security group. Inbound rules Note: The source for inbound rules is /0. Type Port range Used for SSH 22 SSH connections to the HA mediator TCP 3000 RESTful API access from Cloud Manager Outbound rules Type Port range Used for All TCP All All outbound traffic All UDP All All outbound traffic Internal security group rules for the HA mediator Note: Cloud Manager always creates this security group. You do not have the option to use your own security group. Inbound rules

31 Preparing for installation and setup 31 Type Port range Used for All traffic All Communication between the HA mediator and ONTAP Cloud HA nodes only Outbound rules Type Port range Used for All traffic All Communication between the HA mediator and ONTAP Cloud HA nodes only Related references AWS networking requirements on page 9 Azure networking requirements on page 20 What Cloud Manager does with AWS permissions Cloud Manager uses an AWS account to make API calls to several AWS services, including EC2, S3, CloudFormation, IAM, and the Key Management Service (KMS). You might want to understand what Cloud Manager does with these permissions. Permissions "ec2:startinstances", "ec2:stopinstances", "ec2:describeinstances", "ec2:describeinstancestatus", "ec2:runinstances", "ec2:terminateinstances", "ec2:modifyinstanceattribute", Purpose Launches an ONTAP Cloud instance and stops, starts, and monitors the instance. "ec2:describeroutetables", "ec2:describeimages", Launches an ONTAP Cloud HA configuration. "ec2:createtags", "ec2:createvolume", "ec2:describevolumes", "ec2:modifyvolumeattribute", "ec2:attachvolume", "ec2:deletevolume", "ec2:detachvolume", Tags every resource that Cloud Manager creates with the WorkingEnvironment and WorkingEnvironmentId tags. Cloud Manager uses these tags for maintenance and cost allocation. Manages the EBS volumes that ONTAP Cloud uses as back-end storage. "ec2:createsecuritygroup", "ec2:deletesecuritygroup", "ec2:describesecuritygroups", "ec2:revokesecuritygroupegress", "ec2:authorizesecuritygroupegress", "ec2:authorizesecuritygroupingress", Creates predefined security groups for ONTAP Cloud.

32 32 Getting up and running Permissions "ec2:createnetworkinterface", "ec2:describenetworkinterfaces", "ec2:deletenetworkinterface", "ec2:modifynetworkinterfaceattribute", Purpose Creates and manages network interfaces for ONTAP Cloud in the target subnet. "ec2:describesubnets", "ec2:describevpcs", "ec2:describedhcpoptions", "ec2:createsnapshot", "ec2:deletesnapshot", "ec2:describesnapshots", Gets the list of destination subnets and security groups, which is needed when creating a new working environment for ONTAP Cloud. Determines DNS servers and the default domain name when launching ONTAP Cloud instances. Takes snapshots of EBS volumes during initial setup and whenever an ONTAP Cloud instance is stopped. "ec2:getconsoleoutput", "ec2:describekeypairs", "ec2:describeregions", Captures the ONTAP Cloud console, which is attached to AutoSupport messages. Obtains the list of available key pairs when launching instances. Gets a list of available AWS regions. "ec2:deletetags", "ec2:describetags", Manages tags for resources associated with ONTAP Cloud instances. "cloudformation:createstack", "cloudformation:deletestack", "cloudformation:describestacks", "cloudformation:describestackevents", "cloudformation:validatetemplate", Launches ONTAP Cloud instances. "iam:passrole", "iam:createrole", "iam:deleterole", "iam:putrolepolicy", "iam:createinstanceprofile", "iam:deleterolepolicy", "iam:addroletoinstanceprofile", "iam:removerolefrominstanceprofile", "iam:deleteinstanceprofile", Launches an ONTAP Cloud HA configuration. "s3:getobject", "s3:listbucket" Obtains AWS cost data for ONTAP Cloud. "s3:getbuckettagging", "s3:getbucketlocation", "s3:listallmybuckets", Obtains information about AWS S3 buckets so Cloud Manager can integrate with the NetApp Data Fabric Cloud Sync service.

33 Preparing for installation and setup 33 Permissions "kms:list*", "kms:describe*" Purpose Obtains information about keys from the AWS Key Management Service. Related concepts Granting AWS permissions to Cloud Manager on page 14 What Cloud Manager does with Azure permissions The Cloud Manager Azure policy includes the permissions that Cloud Manager needs to deploy and manage ONTAP Cloud systems in Azure. You might want to understand what Cloud Manager does with these permissions. Permissions "Microsoft.Compute/locations/operations/ read", "Microsoft.Compute/locations/vmSizes/read", "Microsoft.Compute/operations/read", "Microsoft.Compute/virtualMachines/ instanceview/read", "Microsoft.Compute/virtualMachines/powerOff/ action", "Microsoft.Compute/virtualMachines/read", "Microsoft.Compute/virtualMachines/restart/ action", "Microsoft.Compute/virtualMachines/start/ action", "Microsoft.Compute/virtualMachines/ deallocate/action", "Microsoft.Compute/virtualMachines/vmSizes/ read", "Microsoft.Compute/virtualMachines/write", Purpose Creates ONTAP Cloud systems and stops, starts, deletes, and obtains the status of the system. "Microsoft.Compute/disks/delete", "Microsoft.Compute/disks/read", "Microsoft.Compute/disks/write", "Microsoft.Storage/checknameavailability/ read", "Microsoft.Storage/operations/read", "Microsoft.Storage/storageAccounts/listkeys/ action", "Microsoft.Storage/storageAccounts/read", "Microsoft.Storage/storageAccounts/ regeneratekey/action", "Microsoft.Storage/storageAccounts/write" Manages Azure storage accounts and disks, and attaches the disks to ONTAP Cloud systems. "Microsoft.Network/networkInterfaces/read", "Microsoft.Network/networkInterfaces/write", "Microsoft.Network/networkInterfaces/join/ action", Creates and manages network interfaces for ONTAP Cloud systems in the target subnet. "Microsoft.Network/networkSecurityGroups/ read", "Microsoft.Network/networkSecurityGroups/ write", "Microsoft.Network/networkSecurityGroups/ join/action", Creates predefined network security groups for ONTAP Cloud systems.

34 34 Getting up and running Permissions "Microsoft.Network/locations/ operationresults/read", "Microsoft.Network/locations/operations/ read", "Microsoft.Network/virtualNetworks/read", "Microsoft.Network/virtualNetworks/ checkipaddressavailability/read", "Microsoft.Network/virtualNetworks/subnets/ read", "Microsoft.Network/virtualNetworks/subnets/ virtualmachines/read", "Microsoft.Network/virtualNetworks/ virtualmachines/read", "Microsoft.Network/virtualNetworks/subnets/ join/action", Purpose Gets network information about the target VNet and subnet and adds ONTAP Cloud systems to VNets. "Microsoft.Resources/deployments/operations/ read", "Microsoft.Resources/deployments/read", "Microsoft.Resources/deployments/write", Deploys ONTAP Cloud systems from a template. "Microsoft.Resources/deployments/operations/ read", "Microsoft.Resources/deployments/read", "Microsoft.Resources/deployments/write", "Microsoft.Resources/resources/read", "Microsoft.Resources/subscriptions/ operationresults/read", "Microsoft.Resources/subscriptions/ resourcegroups/delete", "Microsoft.Resources/subscriptions/ resourcegroups/read", "Microsoft.Resources/subscriptions/ resourcegroups/resources/read", "Microsoft.Resources/subscriptions/ resourcegroups/write", Creates and manages resource groups for ONTAP Cloud systems. Related tasks Granting Azure permissions to Cloud Manager on page 21

35 35 Installing OnCommand Cloud Manager You can install the Cloud Manager software by deploying Cloud Manager from the Amazon Web Services (AWS) Marketplace, the GovCloud (US) EC2 console, the Microsoft Azure Marketplace, or by installing Cloud Manager on an existing Linux host. The standard method is to deploy Cloud Manager from the AWS Marketplace or the Azure Marketplace. Choices Launching a Cloud Manager instance in a standard AWS region on page 35 Launching a Cloud Manager instance in the AWS GovCloud (US) region on page 36 Creating a Cloud Manager virtual machine in Azure on page 38 Installing Cloud Manager on an existing Linux host on page 39 Launching a Cloud Manager instance in a standard AWS region You can use the Cloud Manager AMI from the AWS Marketplace to launch an EC2 instance in a standard AWS region (a region other than the AWS GovCloud (US) region). This gives you access to the Cloud Manager software, which is automatically installed on the instance. Before you begin You must have an EC2 key pair. AWS uses the key pair to secure the instance's login information. Amazon Web Services (AWS) Documentation: Amazon EC2 Key Pairs If you want to assign a public IP address to the Cloud Manager instance and use the AWS 1-Click Launch option, the public subnet must be already enabled to automatically assign public IP addresses. Amazon Web Services (AWS) Documentation: IP Addressing in Your VPC Otherwise, you must use the Manual Launch option to assign a public IP address to the instance. Steps 1. Go to the Cloud Manager page on the AWS Marketplace. AWS Marketplace: OnCommand Cloud Manager 2. If you want to set up Cloud Manager in the Storage System View, review the available delivery methods. Single AMI launches just the Cloud Manager instance (this is the standard delivery method). The advanced methods launch a stack of the software in a specific configuration: Cloud Manager, ONTAP Cloud, and EBS storage. No matter which method you choose, users can launch ONTAP Cloud instances after you set up Cloud Manager. 3. Under Pricing Details, choose a delivery method, review the estimated price, and then click Continue. You should use the advanced delivery methods only when using Cloud Manager in the Storage System View.

36 36 Getting up and running 4. If you chose the Single AMI delivery method, launch the instance from the 1-Click Launch tab or the Custom Launch tab, depending on how you want to grant AWS permissions to Cloud Manager: Choice You do not want to associate the instance with an IAM role. You want to specify AWS keys for each Cloud Manager user account. Steps a. On the 1-Click Launch tab, specify settings for the instance. Note the following: The t2.medium instance type is supported. Under security group, select Create new based on seller settings to create a pre-defined security group that includes the rules required by Cloud Manager. b. Click Accept Terms and Launch with 1-Click. You want to associate the instance with an IAM role. a. On the Custom Launch tab, click Launch with EC2 Console for your region. b. Choose the t2.medium instance type. c. Select a VPC, subnet, IAM role, and other configuration options that meet your requirements. d. Keep the default storage options. e. Enter tags for the instance, if desired. f. Specify the required connection methods for the Cloud Manager instance: SSH, HTTP, and HTTPS. g. Click Launch. 5. If you chose an advanced delivery method, specify settings for the instance and then launch the software: a. On the Custom Launch tab, specify settings for the instance. b. Click Launch with CloudFormation Console and follow the steps to launch a stack of the software. Result AWS launches the software with the specified settings. The Cloud Manager instance and software should be running in approximately five minutes. After you finish Log in to Cloud Manager by using a web browser and complete the Setup wizard. Related references AWS networking requirements on page 9 Launching a Cloud Manager instance in the AWS GovCloud (US) region Cloud Manager must run in the AWS GovCloud (US) region if you want to launch ONTAP Cloud instances in AWS GovCloud (US). You can gain access to the Cloud Manager software by launching

37 Installing OnCommand Cloud Manager 37 an EC2 instance from the Cloud Manager AMI. The Cloud Manager software is automatically installed on the instance. Before you begin You should have purchased one or more licenses for ONTAP Cloud. Instructions are available at NetApp ONTAP Cloud for GovCloud. Steps 1. Log in to the AWS Management Console for the AWS GovCloud (US) region. 2. Select the EC2 service. 3. From the EC2 Dashboard, click Launch Instance: 4. Click Community AMIs and then search for Cloud Manager or ONTAP Cloud. 5. To the right of the AMI name, click Select: 6. Complete the pages to launch the instance: On this page... Choose Instance Type Configure Instance Do this... Select the t2.medium instance type. Select a VPC and subnet, and then choose other configuration options that meet your requirements.

38 38 Getting up and running On this page... Add Storage Tag Instance Configure Security Group Review Do this... Keep the default settings. Enter tags for the instance, if desired. Create a new security group or choose an existing security group. The security group must include the required rules. AWS networking requirements on page 9 Review the instance launch details, make changes if necessary, and then click Launch. Result AWS launches the Cloud Manager instance with the specified settings. The instance and the Cloud Manager software should be running in approximately five minutes. After you finish Log in to Cloud Manager using a web browser and complete the Setup wizard. Setting up Cloud Manager in the Storage System View on page 41 Creating a Cloud Manager virtual machine in Azure You can use the Cloud Manager virtual machine image from the Azure Marketplace to deploy Cloud Manager in Azure. This gives you access to the Cloud Manager software, which is automatically installed on the virtual machine. Steps 1. Go to the Azure Marketplace page for Cloud Manager. Microsoft Azure Marketplace: NetApp OnCommand Cloud Manager 2. Click Create Virtual Machine. 3. From the Azure portal, click Create and follow the steps to configure the virtual machine. Note the following: Cloud Manager can perform optimally with either HDD or SSD disks. You should choose one of the recommended virtual machine sizes. Cloud Manager software requirements on page 6 It is best to keep the default selection of a new network security group. This new security group includes the required inbound and outbound rules for Cloud Manager. 4. Review your selections and click OK.

39 Installing OnCommand Cloud Manager 39 Example 5. Click Purchase. Result Azure launches the virtual machine with the specified settings. The virtual machine and Cloud Manager software should be running in approximately five minutes. After you finish Log in to Cloud Manager by using a web browser and complete the Setup wizard. Installing Cloud Manager on an existing Linux host You can install the Cloud Manager software on an existing Linux host in your network or in the cloud. This is an alternative to running Cloud Manager on a new system deployed from the AWS Marketplace or the Azure Marketplace. Before you begin You should have reviewed host requirements, which includes the supported operating systems. Cloud Manager software requirements on page 6 About this task Root privileges are not required to install Cloud Manager. Cloud Manager installs the AWS command line tools (awscli) to enable recovery procedures from NetApp support. If you receive a message that installing the awscli failed, you can safely ignore the message. Cloud Manager can operate successfully without the tools.

40 40 Getting up and running Steps 1. Download the software from the NetApp Support Site, and then copy it to the Linux host. NetApp Downloads: Software For help with connecting and copying the file to an EC2 instance in AWS, see AWS Documentation: Connecting to Your Linux Instance Using SSH. 2. Assign permissions to execute the script. Example chmod +x OnCommandCloudManager-V3.2.0.sh 3. Run the installation script:./oncommandcloudmanager-v3.2.0.sh [silent] [proxy=ipaddress] [proxyport=port] [proxyuser=user_name] [proxypwd=password] silent runs the installation without prompting you for information. proxy is required if the Cloud Manager host is behind a proxy server. proxyport is the port for the proxy server. proxyuser is the user name for the proxy server, if basic authentication is required. proxypwd is the password for the user name that you specified. 4. Unless you specified the silent parameter, type Y to continue the script, and then enter the HTTP and HTTPS ports when prompted. If you change the HTTP and HTTPS ports, you must ensure that users can access the Cloud Manager web console from a remote host: Modify the security group to allow inbound connections through the ports. Specify the port when you enter the URL to the Cloud Manager web console. Result Cloud Manager is now installed. At the end of the installation, the Cloud Manager service (occm) restarts twice if you specified a proxy server. After you finish Log in to Cloud Manager using a web browser, and then complete the Setup wizard.

41 41 Setting up OnCommand Cloud Manager The Cloud Manager Setup wizard appears when you access the web console for the first time. You can set up Cloud Manager in the Storage System View or in the Volume View (supported with standard AWS regions only). The Storage System View gives you full control of ONTAP Cloud systems while the Volume View enables you to simply specify the NFS volumes that you need and then Cloud Manager handles system and capacity management. Choices Setting up Cloud Manager in the Storage System View on page 41 Setting up Cloud Manager in the Volume View on page 49 Related information Learning about Cloud Manager and ONTAP Cloud: How the Storage System View works Learning about Cloud Manager and ONTAP Cloud: How the Volume View works Setting up Cloud Manager in the Storage System View You should set up Cloud Manager in the Storage System View if you want full control of ONTAP Cloud systems. About this task If you recently deployed Cloud Manager from the AWS Marketplace or the Azure Marketplace, the Cloud Manager console should be available a few minutes after the instance or virtual machine starts. Steps 1. Open a web browser and enter the following URL: ipaddress can be localhost, a private IP address, or a public IP address, depending on the configuration of the Cloud Manager host. For example, if Cloud Manager is in the public cloud without a public IP address, you must enter a private IP address from a host that has a connection to the Cloud Manager host. port is required if you changed the default HTTP (80) or HTTPS (443) ports. For example, if the HTTPS port was changed to 8443, you would enter After you enter the URL, the Cloud Manager Setup wizard appears. For example, the following displays if you installed Cloud Manager in AWS or in your network:

42 42 Getting up and running 2. Complete the steps in the Setup wizard: On this page... Welcome Do this... a. If Cloud Manager is in AWS or in your network, click Storage System View. b. Click Set up new Cloud Manager. Proxy Setup Let us know who you are Create an admin user Cloud Provider Permissions If the host does not have access to the Internet, enter the location to a proxy server using the syntax and specify a user name and password if basic authentication is required for the server. If your corporate policies dictate that you use a proxy server for all HTTP communication to the Internet, then you must configure Cloud Manager to use that proxy server. The proxy server can be in the cloud or in your network. Specify your site and company name. Specify details to create an administrator user for Cloud Manager. You use this user account to log in to Cloud Manager. Your user name is your address. Cloud Manager does not send s to this address. Specify the cloud provider permissions that Cloud Manager needs to perform actions on your behalf. The permissions are for the Cloud Manager administrator user account. Granting AWS permissions to Cloud Manager on page 14 Granting Azure permissions to Cloud Manager on page 21 Note the following: AWS keys are not required if you associated the Cloud Manager instance with an IAM role. To see AWS storage and compute costs in Cloud Manager, specify an S3 bucket that contains detailed billing reports. Setting up AWS billing and cost management on page 17

43 Setting up OnCommand Cloud Manager 43 On this page... Create your first tenant NetApp Support Site credentials Review Do this... Enter a name, description, and cost center for your first tenant. Enter credentials for a NetApp Support Site account. Keep automatic updates enabled to make sure that you are running the latest version, read and accept the End User License Agreement, choose a capacity management mode, and then click Go. Note the following about the capacity management modes: To automate storage capacity decisions, choose Automatic Mode. Cloud Manager automatically purchases new cloud storage for ONTAP Cloud instances when more capacity is needed, deletes unused collections of disks (aggregates), and moves volumes between aggregates, as needed. Important: In Automatic Mode, Cloud Manager allocates the appropriate cloud resources as needed, without asking for approval. If you want users to make those decisions, then choose Manual Mode. Cloud Manager displays Action Required messages when capacity decisions must be made. It is up to the user to accept the actions. After you finish Continue setting up Cloud Manager by doing the following: Installing an HTTPS certificate for secure access Setting up Cloud Manager to work with Active Directory user accounts Creating additional tenants Creating user accounts so that other users can access Cloud Manager Setting up Cloud Manager so that users can use ONTAP Cloud encryption in AWS Related information Learning about Cloud Manager and ONTAP Cloud: How the Storage System View works Installing an HTTPS certificate for secure access By default, Cloud Manager uses a self-signed certificate for HTTPS access to the web console. You can install a certificate signed by a certificate authority (CA), which provides better security protection than a self-signed certificate. Steps 1. In the upper right of the Cloud Manager console, click the task drop-down list, and then select HTTPS Setup. 2. In the HTTPS Setup page, install a certificate by generating a certificate signing request (CSR) or by installing your own CA-signed certificate:

44 44 Getting up and running Option Generate a CSR Description a. Enter the host name or DNS of the Cloud Manager host (its Common Name), and then click Generate CSR. Cloud Manager displays a certificate signing request. b. Use the CSR to submit an SSL certificate request to a CA. The certificate must use the Privacy Enhanced Mail (PEM) Base-64 encoded X.509 format. c. Copy the content of the signed certificate, paste it in the Certificate field, and then click Install. Install your own CA-signed certificate a. Select Install CA-signed certificate. b. Load both the certificate file and the private key and then click Install. The certificate must use the Privacy Enhanced Mail (PEM) Base-64 encoded X.509 format. Result Cloud Manager now uses the CA-signed certificate to provide secure HTTPS access. The following image shows a Cloud Manager system that is configured for secure access: Setting up Cloud Manager to work with AD user accounts Rather than create new credentials for each Cloud Manager user account, you can set up Cloud Manager so users can log in using your organization's Active Directory (AD) authentication. Steps 1. In the upper right of the Cloud Manager console, click the task drop-down list, and then select Active Directory Setup. 2. Enter details about your Active Directory server and then click Save: Field Name Host Port Description Enter a name to distinguish the server within Cloud Manager. Enter the fully qualified domain name for the Active Directory server. Enter the TCP port that the Active Directory server uses for LDAP.

45 Setting up OnCommand Cloud Manager 45 Field User Name and Password Description Enter the user name and password for an Active Directory user account, and then click Test Connectivity. After you finish Create new user accounts in Cloud Manager by selecting the Active Directory authentication type. Creating tenants You can create additional tenants beyond the single tenant that you created when using the Setup wizard. Having multiple tenants enables you to easily organize and isolate storage resources in groups. Steps 1. Click Tenants. 2. Click the + icon. 3. In the New Tenant page, specify details for the tenant: a. Enter a name, description, and cost center for the tenant. The Description and Cost Center fields are optional. b. Enter credentials for a NetApp Support Site account. 4. Click Save. Result Cloud Manager creates the tenant. Users can create and discover working environments in the tenant. Related information Learning about Cloud Manager and ONTAP Cloud: How you can organize users and storage across tenants Creating user accounts If multiple people in your organization need to use Cloud Manager, then you need to create Cloud Manager user accounts for each user. You can create several types of users: Cloud Manager administrators, tenant administrators, and working environment administrators. Steps 1. In the upper right corner of the Cloud Manager console, click the task drop-down list, and then select Users. 2. In the Users page, click New User.

46 46 Getting up and running 3. In the New User page, specify details for the new user account. Most of the fields in this page are self-explanatory. The following table describes fields for which you might need guidance: Field Authentication Type Address Role Description Select Cloud Manager to create a user account internal to Cloud Manager or select Active Directory if Cloud Manager was set up to work with your organization's Active Directory user accounts. Enter the address that the user must use to log in to Cloud Manager. Cloud Manager does not send s to this address. Select one of the three roles: Cloud Manager Admin: Administers the product and has access to all tenants and working environments. Tenant Admin: Administers a single tenant. Can create and manage all working environments and users in the tenant. Working Environment Admin: Administers one or more working environments in a tenant. When you create a Working Environment Admin user, you need to assign the user to a tenant and, optionally, a working environment. If the selected tenant does not have a working environment, you can modify the assigned working environments later. Note: Working Environment Admin users automatically have privileges to the working environments that they create. AWS Access Key and Secret Key AWS Cost S3 Bucket Azure Permissions Enter the access key and secret key assigned to the user in AWS, unless you associated an IAM role with the Cloud Manager instance. Cloud Manager uses the keys to perform AWS actions on the user's behalf. Identity and Access Management (IAM) users must have specific AWS permissions. You can use a NetApp-provided IAM policy that includes the required permissions. NetApp OnCommand Cloud Manager: AWS and Azure Policies Optionally enter the S3 bucket that contains detailed billing reports. Giving Cloud Manager access to detailed billing reports enables users to see AWS storage and compute costs associated with ONTAP Cloud. If you are using AWS consolidated billing and you specified AWS keys, you do not need to specify the bucket each time you create a user account. You just specify the bucket for one Cloud Manager user account that corresponds to an IAM user created under the AWS payer account, or the payer account itself. Enter the application ID and Azure key for the Active Directory service principal, the subscription ID for the user, and the Active Directory tenant ID for your organization. Cloud Manager needs this information to log in programmatically to Azure. 4. Click Save. Result Cloud Manager creates the user account. The user can now log in to Cloud Manager.

47 Setting up OnCommand Cloud Manager 47 Related tasks Setting up AWS billing and cost management for Cloud Manager on page 17 Setting up Cloud Manager for ONTAP Cloud encryption in AWS The Cloud Manager Admin user must set up Cloud Manager before other users can enable ONTAP Cloud encryption on new ONTAP Cloud systems in AWS. Setup involves configuring Cloud Manager to be an intermediate certificate authority (CA), entering information about key managers, and adding CA certificates for key managers. Before you begin You must have set up key managers and gathered the required information. Key manager requirements for ONTAP Cloud encryption on page 15 About this task NetApp video: Setting up Cloud Manager for ONTAP Cloud encryption Steps 1. Set up Cloud Manager to be an intermediate CA on page 47 Cloud Manager must be an intermediate certificate authority (CA) because it needs to create client certificates for ONTAP Cloud. You set up Cloud Manager to be an intermediate CA by generating a certificate signing request (CSR), getting the CSR signed by a root CA, and then installing the certificate in Cloud Manager. 2. Add key managers and their CA certificates to Cloud Manager on page 48 Cloud Manager needs information about your key managers and CA certificates so users can select them for use with ONTAP Cloud systems. Related information Learning about Cloud Manager and ONTAP Cloud: How ONTAP Cloud encryption works Setting up Cloud Manager to be an intermediate CA Cloud Manager must be an intermediate certificate authority (CA) because it needs to create client certificates for ONTAP Cloud. You set up Cloud Manager to be an intermediate CA by generating a certificate signing request (CSR), getting the CSR signed by a root CA, and then installing the certificate in Cloud Manager. Steps 1. In the upper-right corner of the Cloud Manager console, click the task drop-down list, and then select Encryption Setup. 2. In the Intermediate CA tab, click Generate CSR. Cloud Manager displays a certificate signing request. 3. Use the CSR to submit a certificate request to a CA. The intermediate CA certificate must use the Privacy Enhanced Mail (PEM) Base-64 encoded X. 509 format. 4. Copy the content of the signed certificate and paste it in the Cloud Manager certificate field. 5. Click Install Cloud Manager Certificate.

48 48 Getting up and running Result Cloud Manager is now an intermediate CA it can sign client certificates for ONTAP Cloud systems. The following image shows a Cloud Manager system that is configured to be an intermediate CA: After you finish If a KMIP server requires client certificate authentication, add the Cloud Manager intermediate CA and its root CA to the key manager's list of trusted CAs. This step is necessary because the key manager must verify that ONTAP Cloud client certificates were signed by a trusted CA. Adding key managers and CA certificates to Cloud Manager Cloud Manager needs information about your key managers and CA certificates so users can select them for use with ONTAP Cloud systems. Steps 1. In the Encryption Setup page, click Key Manager. 2. If your key managers use a KMIP port other than 5696, change the port and then click Save. Cloud Manager configures ONTAP Cloud systems to connect to key managers using this port. 3. In the Key Managers table, click Add. 4. In the Add Key Manager dialog box, enter details about the key manager, and then click Add: In this field... Key Manager Name IP Address User Name for Client Certificate Authentication Do this... Enter a unique name to distinguish the key manager. Enter the IP address of the key manager. If the key manager is enabled for client certificate authentication by having the key manager verify a user name from client certificates, specify the field and user name: Select the field in which the key manager should look for a user name. Enter a user name that is defined in the key manager. Cloud Manager generates ONTAP Cloud client certificates with the value defined in the user name field. 5. In the Key Managers' CA Certificates table, click Add. 6. Paste the certificate of the certificate authority (CA) that signed the key manager's server certificate and then click Add. 7. Repeat the steps for any additional key managers and their CA certificates.

49 Setting up OnCommand Cloud Manager 49 Result Cloud Manager is now set up to create ONTAP Cloud systems with encryption enabled. Setting up Cloud Manager in the Volume View You should set up Cloud Manager in the Volume View if you simply want to define the NFS volumes that you need and are comfortable with Cloud Manager making storage management decisions on your behalf. The Volume View is supported with standard AWS regions only. About this task If you recently launched a Cloud Manager instance in AWS, the Cloud Manager console should be available a few minutes after the instance starts. Steps 1. Open a web browser and enter the following URL: You need to use this URL each time that you log in to Cloud Manager. ipaddress can be localhost, a private IP address, or a public IP address, depending on the configuration of the Cloud Manager host. For example, if Cloud Manager is in the public cloud without a public IP address, you must enter a private IP address from a host that has a connection to the Cloud Manager host. port is required if you changed the default HTTP (80) or HTTPS (443) ports. For example, if the HTTPS port was changed to 8443, you would enter After you enter the URL, the Cloud Manager Setup wizard appears: 2. Click Volume View. 3. On the Create your user account page, specify details to create your user account, choose whether to enable automatic updates, read and approve the End User License Agreement, and then click Create. The following table describes fields for which you might need guidance:

50 50 Getting up and running Field Address AWS Permissions Automatically update to the newest version Description Your user name is your address. Cloud Manager does not send s to this address. If you did not associate the Cloud Manager instance with an IAM role, you must specify your AWS credentials so Cloud Manager can perform AWS operations. Granting AWS permissions to Cloud Manager on page 14 You should keep this field enabled to make sure that you are running the latest version. Cloud Manager automatically installs minor updates at 12:00 midnight if no operations are running. Major updates (for example, 3.0 to 4.0) are not automatically installed. You must manually update Cloud Manager when a new major version is available. 4. On the Create New Volume page, select a volume type: Option Create Volume Create HA volume Description Creates a volume attached to a single AWS instance. Creates a volume attached to a single AWS instance and mirrored to another instance to provide high availability in case of failures. Press the Info icon to see additional details about the instances required for an HA volume. 5. If you chose Create Volume, specify details for your first volume, and then click Create. The following table describes fields for which you might need guidance: Field Size AWS Disk Type Description The maximum size for the initial volume is 25.8 TB. Thin provisioning is automatically enabled on the volume, which enables you to create a volume that is bigger than the physical storage currently available to it. Instead of preallocating storage space, space is allocated to each volume as data is written. You should choose the disk type that meets your requirements for both performance and cost. General Purpose SSD disks balance cost and performance for a broad range of workloads. Performance is defined in terms of IOPS. Throughput Optimized HDD disks are for frequently accessed workloads that require fast and consistent throughput at a lower price. Cold HDD disks are meant for backups, or infrequently accessed data, because the performance is very low. Like Throughput Optimized HDD disks, performance is defined in terms of throughput. AWS Documentation: EBS Volume Types The following image shows the Create Volume page filled out:

51 Setting up OnCommand Cloud Manager If you chose Create HA volume, specify details for the volume and then click Create. The following table describes fields for which you might need guidance: Field Size AWS Disk Type Description The maximum size for the initial volume is 25.8 TB. Thin provisioning is automatically enabled on the volume, which enables you to create a volume that is bigger than the physical storage currently available to it. Instead of preallocating storage space, space is allocated to each volume as data is written. You should choose the disk type that meets your requirements for both performance and cost. General Purpose SSD disks balance cost and performance for a broad range of workloads. Performance is defined in terms of IOPS. Throughput Optimized HDD disks are for frequently accessed workloads that require fast and consistent throughput. AWS Documentation: EBS Volume Types Location Nodes and Mediator Floating IP Route Table You should choose a VPC that includes three subnets in three separate Availability Zones. AWS networking requirements for ONTAP Cloud HA in multiple AZs on page 10 If possible, Cloud Manager chooses separate Availability Zones for each instance because it is the optimal configuration. The IP addresses must be outside of the CIDR block for all VPCs in the region. AWS networking requirements for ONTAP Cloud HA in multiple AZs on page 10 If you have more than one route table, it is very important to select the correct route tables. Otherwise, some clients might not have access to the ONTAP Cloud HA pair. AWS networking requirements for ONTAP Cloud HA in multiple AZs on page 10 AWS Documentation: Route Tables The following image shows the Nodes and Mediator page. Each instance is in a separate Availability Zone.

52 52 Getting up and running 7. On the ONTAP Cloud Password dialog box, specify a password and tags: a. Enter the password that Cloud Manager should set for each ONTAP Cloud system that it launches in AWS. The password must be at least eight characters and must contain at least one English letter and one number. The password cannot contain non-english letters or the user account name (admin). You need to use this password if you want to access storage systems directly, or if NetApp support personnel needs to help you recover your storage. b. Click Add AWS tag to storage system, enter a key and an optional value, and then add more tags, if needed. Cloud Manager adds the tags to the resources that it allocates in AWS. Tags enable you to categorize your AWS resources. c. Click Save. Result Cloud Manager is now set up and you can create additional volumes, as needed. The initial volume should be ready in approximately 25 minutes because Cloud Manager must launch ONTAP Cloud in AWS. After you finish Register for support. Related information Learning about Cloud Manager and ONTAP Cloud: How the Volume View works Registering for support You must enter your NetApp Support Site credentials in Cloud Manager before you can get help from NetApp technical support. Entering your credentials registers the ONTAP Cloud systems that host your volumes for support. Steps 1. In the upper right of the Cloud Manager console, click the menu, and then select Support Registration.

53 Setting up OnCommand Cloud Manager Enter your NetApp Support Site user name and password, and then click Register. If you do not have a NetApp Support Site account, follow the link to create an account, and then enter your credentials in Cloud Manager. Result All existing and future ONTAP Cloud systems that host your volumes are now registered for support.