I'm studying ONTAP tools and would like to better understand your perspective on the tool. I think the value it adds to administration is fantastic. But I'm also concerned about the risks if an attacker gains access to vCenter and can also directly damage the storage, such as deleting datastores, Snapmirrors, etc.

1) Is this risk worth the tradeoff for management agility?

2)How do you significantly reduce these risks? 

3) Does it work well with Multi-Admin Approvals?

The role named "VSC Provision" has these custom privileges that appear to be added that apply only for ONTAP:

We are trying to direct ONTAP Tools for VMware 9.13 straight to the SVM on a cluster. I've been finding a lot of different documentation on this process and feel like I've followed each of these as closely as possible but it just does not seem to work. I get messages like "can't discover controllers" and stuff like that even though I do believe I have the correct role set up in ONTAP for the svm. I will also share that the OTV appliance does not have any network access to the cluster management IP, only has network access to the SVM management LIF which is on the same network as the OTV appliance.  Does anyone here in this forum know if this will work with this configuration where the OTV appliance can't talk to the cluster mgmt IP at all?

NetApp are phasing out the use of ZAPI and have messages everywhere about it.  Its even mentioned during upgrades.  

During the upgrade of our storage array for our VMware environment we were notified that ZAPI had been used in the last 30 days.   The only system other than the ESX hosts that communicates with the storage is ONTAP tools for VMware vSphere.

Reading the ONTAPI communique 

https://mysupport.netapp.com/info/communications/ECMLP2880232.html

Which leads to the FAQ 
https://kb.netapp.com/Advice_and_Troubleshooting/Miscellaneous/FAQs_on_ZAPI_to_ONTAP_REST_API_transformation_for_CPC_(Customer_Product_Communiques)_notification
This  indicates that there is an "API transition" and to "Refer to the respective product roadmap".   When can I find this roadmap? 

The latest Active IQ (9.13) release notes do not mention  ONTAPi/ZAPI  anywhere .   So when will a version be released that is not using ZAPI?  

Is there a way to control storage system discovery in OnTAP Tools? For years this tool discovers 30+ storage units that aren't NetApp which just clutters up the screen. I prefer a nice clean screen of just the objects I need to manage. Is there a "hack" to prevent the automatic discovery from occurring, or at least to streamline it?

Hello,

Today's logic with iGroup is way too strict and creates an unwanted situation. As documented in the following KB:  VSC and VASA_Provider/Why does Virtual Storage Console (VSC) create "rcu_generated_alua" iGroup and Storage Replication Adapter: What determines if a new initiator group or export policy is created during a failover operation? , we learn a new iGroup gets created if the system doesn't find an equivalent iGroup with all initiators. So far, nothing's wrong but the problem appears when you have an iGroup with all detected initiators but with extra initiators used by your backup system whose requirement is to connect on a LUN to backup or restore. Your only way to back to your original IGroup is to "force" unmap, map the LUN again and rediscover your system storage. It creates a system service disturbance which is a situation no one wants.

Now, you add your extra initiators to an automatically created iGroup by either VSC or SRM well next time you do a similar operation like creating a LUN/NFS or failOver, it will try to create a new iGroup or choose an iGroup with exact same list of initiators/export. 

Would it be possible to switch or leave the operator to decide to use minimal requirements (detected initiators) instead of strict requirements?

Regards,

Oli

Hi,

Do you have technical limitations in running the appliance with ext3?  We have been wondering why the appliance didn't want to start anymore. It was expecting a user input due to an fsck error on the root partition, hiding the output on a different TTY didn't help either!

An upgrade to ext4 would not be too much.

Regards,

Oli

We have VSC plugin installed in vSphere since a long time ago. Often, we can also see "vsc" account being used, for instance creating a Datastore in vSphere as shown in logs. I don't know how VSC works from high level. 

1.  Would somebody has to log into vSphere as "vsc" and performed the task? I couldn't find such logins from vSphere.
2. Or, would that person can perform the task remotely from VSC server without logins? If yes, how can trace back to that server from vSphere?

3. How can I check if VSC is still installed vSphere/vcenter? As you can see from the attachment, when I click on Virtual Storage Console, I don't see much information there. 

Obviously, I don't know much about VSC, and need your help. 

A colleague  installed a VSC appliance V9.7.1P1 however named it "SVC" instead of "VSC" and we would like to rename the device, however I'm not sure how to do that as there do not seem to be any options for it.

We are using the VSC with vCenter/SRM in order to load in the SRA into vCenter.

Is this possible?

Hello,

I am attempting to reduce rights to the bare minimum on local OnTAP service accounts to increase our security posture. I've created a custom role for the VSC service account that just allows for discovery, however it occurred to me that we can probably go further. 

We use VSC for one single purpose only: to verify our ESX host settings match NetApp best practices. The only thing we do is browse to Overview and click Edit ESXi Host Settings when we have a new ESX host added. With this in mind: do we need an account on the cluster at all? Do we have to perform discovery if all we do is apply appropriate settings to ESX hosts? In other words: do I even need a local service account at all? Would love to hear any suggestions or thoughts!

Hi Team,

I would like to know whether the VSC latest version have included rapid cloning utility feature to clone the virtual machine.

If not can you please give me a workaround how I can rapidly clone virtual machine using VSC.

Appreciate your response.

Thank you

Hello,

I am trying to understand how Protocol End Points work in the context of deploying VVol Datastores over a fibrechannel SAN network. I have successfully deployed a VVol Datastore on my FAS-8040 using the VASA Provider with the required storage profiles for my testing. I was also able to create a VM and added that to the VVol Datastore, after associating the storage policies of its files to the created VVol datastore. When I power on the VM and analyze the trace captures, I see that all the communication happens only to the PE LUN, which I believe is correctly working. But, I was curious to know how the ESX Hosts learn about the other Sub LUNs for the metadata(config), vmdk and the swap LUNs created inside the Virtual Volume. More importantly, I was curious to know if the ESX Hosts learn about the Sub or the Secondary LUN Ids.  From the screenshots placed below, the vmdk LUNs do not appear to have a LUN ID which is also confusing to me, since I thought there a binding of the Secondary LUN ID to a Protocol End Point LUN. Where can I find the Secondary LUN ID to PE binding using CLI or system Manager?

 Also, as part of my investigation, on one of the Inquiry exchanges to the PE LUN, I see that the VPD contains a LUN with the SCSI name "naa.600A0980383035694F2B495A67654356". This has also been attached in the screenshots below. However, when I look up the available LUNs through system manager, I dont see this LUN listed in the vServer that hosts my VVols. I was  curious to know what this LUN could be be. Lastly, I was also interested to know how do the ESX Hosts bind to the vmdk LUNs, if they dont send any Report LUNs or Inquiry commands to these LUNs.  I would really appreciate your feedback with this.

Hi,

because I had problems with VSC Windows Installation discovering the Storage on my VCSA 6.5, I downloaded and installed VSC 7.0 (virtual appliance) yesterday.

Installation worked pretty well, but if I click on the Virtual Storage Console Icon in VCenter Web Client, VSC hangs with message "Loading Storage System Details" - without no other error/warning message.

I read that VSC 7.0 does not support linked mode, the system will then also be stuck at the same loading message, but along with an error message that states that linked configuration is not supported.

I have no linked mode configured, but I do use VCenter HA. Could that be the problem or do you have another idea?

Restarting VCenter and/or VSC did not solve the problem.

VSC 7.0

VCSA 6.5.0.5600 

ONTAP 9.1P5

Regards

Andreas

Hello community,

we are currently using VSC 9.6. If storage systems are added with a vscadmin who has received his privileges from the current RBAC User Creator Tool, the complete VSC will crash and have to be set up again.

The following messages appear - among others - in the VSC.LOG:

2019-12-09 06:39:47,930 [qtp557725225-3896 - /vsc/remoting/exoforceRmiExporter?sessionId=40f538d75057f26d857ae13c9113ae69fc380937&serviceUrl=https://vmc_serv.stadtdo.de:443/sdk] WARN (ZAPIInvoker) - invokeZAPI(0): failed OntapConnectionImpl{ipAddress=fas27501.stadtdo.de, userName=vscadmin, port=443, ssl=true} API failed. Insufficient privileges: user 'vscadmin' does not have read access to this resource (errno=13003) null
2019-12-09 06:39:47,930 [qtp557725225-3896 - /vsc/remoting/exoforceRmiExporter?sessionId=40f538d75057f26d857ae13c9113ae69fc380937&serviceUrl=https://vmc_serv.stadtdo.de:443/sdk] ERROR (RMIServiceImpl) - getAllStorageSystems - Error getting controllers -
Unable to load volumes for: AbstractController: id: bbfe3d81-7ae0-11e9-ba14-00a098fbe31aname: SVM_NFS-VMW02ip address: fas27501.stadtdo.de. Caused by: Insufficient privileges: user 'vscadmin' does not have read access to this resource (errno=13003)

Unfortunately I don't know which privileges are missing. It can only be due to the privileges, because it works if I give the vscadmin admin rights.

Any idea?

Many thanks and greetings

Michael

Hi

I have problems deploying VSC appliance 9.6 in vsphere. Appliance can't configure static ipv4 network. It uses allways dhcp, i dont have. I can configure ipv4 network manually from maintenance mode later, but it dont help, hostname is still invalid. Server can resolve hostname, hostname ir registered in dns.

Any ideas?

Hello,

did anybody try VSC 7.1 with vSphere 6.7 yet? I deployed the VSC appliance, it successfully registered to vCenter as shown in VSC maintenance screen and in vcenter/mob extensionManager, but its icon does not appear in vCenter nor is it displayed in the client plugins list in vCenter 6.7.

I already tried it using different browsers and rebooted the vCenter VCSA 6.7.

We recentrly migrated from a physical vCenter to a the vCenter appliance.  during this process I discovered that our version of the VSC was on limited support (LS).  Everything seemed okay, however after several weeks the job on one datastore started to fail.  I opened a case only to discover that VSC 6.2.2 is now on EOS.  The job was getting stuck at 41% or 44%.  There was the following error repeated for several operations:

<messages><timestamp>2019-04-11T03:47:37.119-07:00</timestamp><level>ERROR</level><thread>backup2 acc5cea68a94b1878df193ed57528ba3</thread><location>com.netapp.common.flow.TaskInstanceTemplate</location><msgKeyClass>com.netapp.common.flow.MsgKey</msgKeyClass><msgKeyValue>FLOW_OPERATION_TASK_FAILURE</msgKeyValue><parameters><parameter>VmSnapshotCreateDelay</parameter><parameter>Cannot complete login due to an incorrect user name or password.</parameter></parameters><message>FLOW-11019: Failure in VmSnapshotCreateDelay: Cannot complete login due to an incorrect user name or password.</message></messages>

I wanted to post my solution here to aid others if possible.  Unfortuantely we are not in position to refresh hardware/ontap regularly so that contributes to the problem.

FAS 2240 / Ontap 8.2.3 7-mode / VSC 6.2.2 / vCenter 6.5 update 2

Solution:  I moved to a datastore that wasn't being backed up  and only protected by SnapMirorr for DR

Has anyone got VSC7.2.1 working with VCSA 6.7U1b? I have removed the previous VSC extensions and upgraded VCSA from VSC 6.5U1 to 6.7U1b. Then I deployed a fresh VM from VSC7.2.1 to connect to the VCSA 6.7U1b. However, it always shows these two NetApp extensions "incompatible."

All,

Some of you are familiar with our previous "kamino" powershell cmdlets/module.  The problem with that is that is was focused on one particular functional area of VSC:   Provisioning & Cloning.

That simply does not scale well.

So we went back to the drawing board, and did some renaming of the code.

Caveats:

• Functionally, these are identical actions to the previous kamino cmdlets.
• We have renamed things to be more generic, or all-encompassing, as we begin down the path of adding APIs for many tasks in the VSC.
• We understand that many of you already have scripts in place using the older stuff, but please understand, all you need to change is the module that gets loaded, and the cmdlet names used.

Going forward:

• As we add new APIs to VSC, we will also be adding equivalent cmdlets for that functionality.

If you have any questions, or run into any issues with the toolkit/module, please post them here!

Usage:

PS> Import-Module C:\Path-to-DLL\NetAppVSC.dll

PS> Get-Command -Module NetAppVSC

CommandType     Name

-----------     ----

Cmdlet          Connect-vsc

Cmdlet          Get-vscManagedObjectRef

Cmdlet          Get-vscVirtualMachine

Cmdlet          Get-vscVmFileSpec

Cmdlet          New-vscControllerSpec

Cmdlet          New-vscDatastore

Cmdlet          Remove-vscDatastore

Cmdlet          Set-vscDatastoreSize

Cmdlet          Start-vscClone

Cmdlet          Start-vscRedeploy

Thanks!

UPDATE:  Due to some inconsistencies we have found with the .dll (we think compiling corruption on the final build) we've pulled this down temporarily so that it doesn't proliferate further, and will get a new version up ASAP.  Please remember that this isn't something officially sanctioned by NetApp, but something that 1 or 2 of us are doing in our spare time.  Thank you for your patience, and we'll get it back very soon, I promise!

UPDATE: I am posting the original rebranded toolkit!  Please let know how this works!

-Nick