For years, protecting VMware datastores with ONTAP tools meant an all-or-nothing choice: protect an entire host cluster, or protect nothing at all. With ONTAP Tools for VMware vSphere 10.6, that trade-off goes away. This release introduces Granular Datastore Protection, a new right-sized deployment option for smaller environments, expanded audit logging for security-conscious teams, and networking and lifecycle improvements that make day-to-day operations simpler.
Let’s get into it.
Granular Datastore Protection: Protect Only What Needs Protecting
The headline feature in 10.6 is Granular Datastore Protection (GDP), which shifts both SnapMirror active sync (SMas) and most traditional SnapMirror replication policies from only protecting entire host clusters down to individual VMFS datastores. Instead of protecting every datastore in a cluster whether it needs it or not, vCenter administrators can now choose exactly which datastores belong in a protection group — and add, remove, or delete them one at a time without disturbing the rest.
What is a protection group? It’s a vCenter-local representation of a consistency group (CG) in ONTAP 9 on AFF, ASA, FAS, and software-defined systems. We chose to use the term “protection group” in ONTAP tools to be aligned with VMware’s terminology. What this ultimately means is that you can now create and manage CGs directly in the vCenter UI.
So, what does this mean for new ONTAP tools users?
- Selective protection — mix protected and unprotected datastores freely within the same host cluster.
- Operational flexibility — modify protection groups without tearing down protection for an entire cluster.
- Multiple protection groups per cluster — replicate different datastores to different storage virtual machines (SVMs) or targets as business needs dictate.
- Incremental adoption — protect new datastores as they’re created, or bring existing ones into a group over time.
Ok, what if you are an existing user of ONTAP tools? It's simple — upgrades from ONTAP tools 10.4 and 10.5 seamlessly migrate existing host-cluster protection settings to the new model, no manual reconfiguration or import required.
GDP supports SnapMirror active sync's "Automated Failover Duplex (AFD)" policy across uniform and non-uniform vSphere Metro Storage Cluster (vMSC) topologies — giving architects far more precision when designing business continuity for mixed-criticality workloads. GDP can also use traditional asynchronous SnapMirror policies, though that would not be a vMSC configuration.
For a deep dive into GDP, check out the blog that Rajiv and I wrote about it: SnapMirror Active Sync + ONTAP tools for VMware vSphere Granular Datastore Protection (OTV10.6) - NetApp Community
A Lighter Footprint, Right Out of the Box
Not every environment needs a heavyweight appliance. ONTAP tools 10.6 introduces an Extra Small (XS) deployment size — just 6 vCPUs and 12 GB of RAM per node — and makes it the default Day-0 deployment profile for traditional provisioning and protection workloads. That’s a noticeable reduction from the previous Small footprint (9 vCPU / 18 GB), removing a resource barrier that had kept smaller environments and edge sites from adopting ONTAP tools.
Also new in this release, CPU hot add and memory hot plug are now enabled by default, so scaling up to small, medium, or large later requires no manual reconfiguration on fresh 10.6 deployments, nor do you have to shut down the appliance to reconfigure it if you forgot to do so during the initial deployment.
Stronger Security Visibility with Expanded Audit Logging
Security and compliance teams get a significant upgrade in 10.6. ONTAP tools now captures detailed audit logs (including full request and response bodies), discovery and cleanup jobs, and maintenance console operations — complete with username, timestamp, and correlation IDs for full traceability. Logs are retained for 30 days by default (configurable), protected by automated integrity checks that raise alerts on tampering or deletion, and can be forwarded to external systems like VCF Operations for Logsvia syslog. Enterprise security teams increasingly require this level of visibility. With ONTAP tools 10.6, it’s now built directly into the appliance.
Faster NFS Datastores with nconnect Support
NFS performance got a major boost with nconnect support back in 8.0u2. But it lacked any kind of GUI or API (I wrote a blog about it here: Automate nconnect and snapshot offload for NFS datastores and turn your VMware storage up to 11 - NetApp Community). It is now configurable directly during NFSv3 and NFSv4 datastore provisioning. By establishing multiple TCP connections over a single IP address, nconnect lets ESXi hosts distribute file operations across those connections in round-robin fashion — unlocking more of the available network bandwidth for NFS workloads without any change to the storage network topology. With nconnect, NFS datastores deliver SAN-level performance with NAS-level simplicity.
ONTAP tools 10.6 can even modify the maximum nconnect limit of your ESXi hosts from the default limit of 4 up to the maximum supported 8.
When it comes to nconnect integration, there is one caveat to be aware of: due to a limitation in the vCenter SDK, a plugin can’t modify nconnect settings after the datastore is mounted. However, starting with vSphere 9.0, you can change these settings in the datastore's host connectivity menu. Additionally, you can use the script that I shared earlier.
Cleaner Lifecycle Management
Even good old-fashioned housekeeping gets easier with ONTAP tools 10.6. A new force-delete flag for vCenter removal lets administrators clean up stale or unreachable vCenter entries — including automatic ONTAP tools plugin unregistration — without being blocked by lingering storage backend or datastore associations, provided no vVol datastores or active protection are involved.
Under the hood, ONTAP tools 10.6 also dynamically switches from ntpd to chronyd for time synchronization (with automatic migration on upgrade), re-implements and optimizes the authentication service for a smaller resource footprint and faster startup, and reorganizes log storage under a dedicated /var/log/otvng directory for cleaner troubleshooting and log rotation.
Availability
ONTAP Tools for VMware vSphere 10.6 launched on July 24, 2026, and supports ONTAP 9.16.1 through 9.19.1 alongside VMware Cloud Foundation (VCF) 5.2.1 through 9.0, and vSphere 8.0U3 through 9.0(the appliance can be deployed on ESXi 9.1). More version qualifications may be coming, so stay tuned for further updates. Direct upgrades are supported from ONTAP tools 10.4 and 10.5, with existing host-level protection settings automatically migrated to the new Granular Datastore Protection model.
In summary, whether you’re running a lean single-site deployment or a stretched, multi-site VMware environment protected by SnapMirror Active Sync, ONTAP tools 10.6 gives you finer control, a smaller footprint, and better visibility — all without compromising on the enterprise-grade protection NetApp customers count on.
