Frequently Asked Questions for the NetApp Storage Array

How do I enable REST API based authorization?

To enable REST API based authorization to the cluster array, run the following commands:

vserver services web access show -vserver vserver -name rest -role role

vserver services web access create -vserver vserver -name rest -role role

How do I enable SnapDiff V2 or SnapDiff V3 for Snapshot Cataloging or Backup Copy?

Configuration Requirements for SnapDiff V2

Verify RPC is enabled on the vServer being cataloged or backup copied. Even if a cluster client is being cataloged, the vServer for the volume being cataloged or backup copied must have RPC enabled. On the file server, verify RPC is enabled on the vServer using the following commands:
```
set advanced
```
```
vserver snapdiff-rpc-server show -vserver vserver
```
```
vserver snapdiff-rpc-server on -vserver vserver
```
Verify whether an NFS interface exists between the vServer and the Commvault MediaAgent. Specifically, confirm that there exists a vServer NFS interface on the file server node containing the volume being cataloged using the following commands:
```
vserver nfs show -vserver vserver
```
```
network interface show -vserver vserver -data-protocol nfs
```

Configuration Requirements for SnapDiff V3

Verify RPC is enabled on the vServer being cataloged or backup copied. Even if a cluster client is being cataloged, the vServer for the volume being cataloged or backup copied must have RPC enabled. On the file server, verify RPC is enabled on the vServer using the following commands:
```
set advanced
```
```
vserver snapdiff-rpc-server show -vserver vserver
```
```
vserver snapdiff-rpc-server on -vserver vserver
```
Verify whether an NFS interface exists between the vServer and the Commvault MediaAgent. Specifically, confirm that there exists a vServer NFS interface on the file server node containing the volume being cataloged using the following commands:
```
vserver nfs show -vserver vserver
```
```
network interface show -vserver vserver -data-protocol nfs
```

Verify that the cluster array login is authorized for REST, HTTP, and SSL. For more information on setting up a NetApp cluster login.

To enable REST API based authorization to the cluster array, run the following commands:

vserver services web access show -vserver vserver -name rest -role role

vserver services web access create -vserver vserver -name rest -role role

To enable HTTP and SSH based authorization to the cluster array, run the following commands:

security login show -vserver vserver -user-or-group-name user -application http

security login create -vserver vserver -user-or-group-name IntelliSnapUser -application http -authentication-method password -role role

security login show -vserver vserver -user-or-group-name user -application ssh

security login create -vserver vserver -user-or-group-name IntelliSnapUser -application ssh -authentication-method password -role role

To enable the SnapDiff and license APIs for the cluster array, run the following commands:

security login role show -vserver vserver -role role -cmddirname "snapdiff"

security login role create -vserver vserver -role role -cmddirname "snapdiff" -access all

security login role show -vserver vserver -role role -cmddirname "license"

security login role create -vserver vserver -role role -cmddirname "license" -access all

Note

For SnapDiff V3, the array management entries for the vServer must have tunneling to the selected cluster. SnapDiff V3 requires security key authentication that is supported only on the cluster interface.
NDMP IntelliSnap cataloging using SnapDiff V2/V3 cannot be run on non-Linux MediaAgents. SnapDiff V2 and V3 are supported only for Linux and Windows MediaAgents.

Can I use a non-root user to configure an array or NDMP?

You can use a non-root user for array configuration and NDMP configurations.

7-Mode

For the 7-Mode system, configure the array with a non-root user with the following commands:

To create IntelliSnap role with proper rights:

 
NetApp1> useradmin role add  $[Intellisnap role] -c ”[$[IntelliSnap Management Role]]" -a login-ndmp,login-http-admin,api-*

Example:

NetApp1> useradmin role add IntelliSnap Role -c ”SP Mgmt Role" -a login-ndmp,login-http-admin,api-*

To add a role to the newly created IntelliSnap group:

**NetApp1> useradmin group add Intellisnap group -c ”IntelliSnap Management Group" –r Intellisnap role

Example:

NetApp1> useradmin group add Intellisnap group -c ”SP Mgmt Group" –r Intellisnap role

To create a user for the array credential in the Commvault Control Panel.

**NetApp1> useradmin user add Intellisnap user -c ”[IntelliSnap Management Account]" -n ”S Admin" –g Intellisnap group

Example:

NetApp1> useradmin user add Intellisnap user -c ”SP Mgmt Account" -n ”S Admin" –g IntelliSnap Group

To configure NDMP with the same credentials, follow the steps below:
1. Retrieve the encrypted password for the IntelliSnapuser that you added in the previous commands with the following command.
```
 
NetApp1> ndmpd password Intellisnap user
```
2. In the NDMP Server Properties dialog box, in the NDMP Login and NDMP Password boxes, type the IntelliSnapuser and password.

C-Mode

Cluster Vserver

For the C-Mode system, to configure the array with a non-root user, type the following commands on the cluster Vserver only:

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "metrocluster vserver show" -access readonly

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "metrocluster show" -access all

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "fcp portname" -access readonly

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "vserver fcp show" -access readonly

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "storage aggregate show" -access readonly

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "vserver show" -access readonly

security login role create -vserver vserver_name -role IntelliSnapRole -cmddirname "network" -access readonly

security login role create -vserver vserver_name -role IntelliSnapRole -cmddirname "cluster" -access readonly

security login role create -vserver vserver_name -role IntelliSnapRole -cmddirname "version" -access readonly

security login role create -vserver vserver_name -role IntelliSnapRole -cmddirname "license" -access all

security login role create -vserver vserver_name -role IntelliSnapRole -cmddirname "snapdiff" -access all

security login create -user-or-group-name IntelliSnapUser -application ontapi -authmethod password -role IntelliSnapRole -vserver vserver_name

security login create -user-or-group-name IntelliSnapUser -application ssh -authmethod password -role IntelliSnapRole -vserver vserver_name

security login create -vserver vserver_name -user-or-group-name IntelliSnapUser -application http -authentication-method password -role IntelliSnapRole

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "vserver" -access readonly

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "job show" -access all

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "lun" -access all

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "network interface" -access readonly

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "snapmirror" -access all

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "version" -access all

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "volume" -access all

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "volume efficiency" -access none

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "volume move" -access none

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "vserver cifs" -access all

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "vserver export-policy" -access all

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "vserver fcp" -access all

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "vserver fpolicy" -access all

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "vserver iscsi" -access all

security login role create -vserver vserver_name -role IntelliSnapRole -cmddirname "vserver nfs" -access all

security login role create -vserver vserver_name -role IntelliSnap Role -cmddirname "vserver services ndmp" -access all

security login create -user-or-group-name Intellisnap User -application ontapi -authmethod password -role Intellisnap Role -vserver vserver_name

security login create -user-or-group-name Intellisnap User -application ssh -authmethod password -role Intellisnap Role -vserver vserver_name

security login create -vserver vserver_name -user-or-group-name IntelliSnapUser -application http -authentication-method password -role IntelliSnapRole

vserver services web access create -vserver vserver_name -name rest -role IntelliSnapRole

security login unlock -username IntelliSnapUser -vserver vserver_name

Vserver

For the C-Mode system, to configure the array with a non-root user, type the following commands on the Vserver only: