Veritas Access Administrator's Guide

Last Published:
Product(s): Appliances (Version Not Specified)
Platform: 3340
  1. Section I. Introducing Veritas Access
    1. Introducing Veritas Access
      1.  
        About Veritas Access
      2.  
        Accessing the Access CLISH
      3.  
        Navigating the Access CLISH
      4.  
        Getting help using the Access CLISH
      5.  
        Displaying the command history
      6.  
        Using the more command
  2. Section II. Configuring Veritas Access
    1. Adding users or roles
      1.  
        About user roles and privileges
      2.  
        About the naming requirements for adding new users
      3.  
        Adding Master, System Administrator, and Storage Administrator users
    2. Configuring the network
      1.  
        About configuring the Veritas Access network
      2.  
        About bonding Ethernet interfaces
      3.  
        Bonding Ethernet interfaces
      4.  
        Configuring DNS settings
      5.  
        About Ethernet interfaces
      6.  
        Displaying current Ethernet interfaces and states
      7.  
        Configuring IP addresses
      8.  
        Configuring Veritas Access to use jumbo frames
      9.  
        Configuring VLAN interfaces
      10.  
        Configuring NIC devices
      11.  
        Swapping network interfaces
      12.  
        Excluding PCI IDs from the cluster
      13.  
        About configuring routing tables
      14.  
        Configuring routing tables
      15.  
        Changing the firewall settings
      16.  
        IP load balancing
      17.  
        Configuring Veritas Access in IPv4 and IPv6 mixed mode
    3. Configuring authentication services
      1.  
        About configuring LDAP settings
      2.  
        Configuring LDAP server settings
      3.  
        Administering the Veritas Access cluster's LDAP client
      4.  
        Configuring the NIS-related settings
      5.  
        Configuring NSS lookup order
  3. Section III. Managing Veritas Access storage
    1. Configuring storage
      1.  
        About storage provisioning and management
      2.  
        About configuring disks
      3.  
        About configuring storage pools
      4.  
        Configuring storage pools
      5.  
        About quotas for usage
      6.  
        Enabling, disabling, and displaying the status of file system quotas
      7.  
        Setting and displaying file system quotas
      8.  
        Setting user quotas for users of specified groups
      9.  
        About quotas for CIFS home directories
      10.  
        About Flexible Storage Sharing
      11.  
        Limitations of Flexible Storage Sharing
      12.  
        Configuring erasure coding for a Flexible Storage Sharing file system
      13.  
        Workflow for configuring and managing storage using the Veritas Access CLI
      14.  
        Displaying information for all disk devices associated with the nodes in a cluster
      15.  
        Displaying WWN information
      16.  
        Importing new LUNs forcefully for new or existing pools
      17.  
        Initiating host discovery of LUNs
      18.  
        Increasing the storage capacity of a LUN
      19.  
        Formatting or reinitializing a disk
      20.  
        Removing a disk
    2. Configuring data integrity with I/O fencing
      1.  
        About I/O fencing
      2. Configuring disk-based I/O fencing
        1.  
          Replacing an existing coordinator disk
        2.  
          Disabling I/O fencing
        3.  
          Destroying the coordinator pool
      3.  
        Using majority-based fencing
      4.  
        Manually enabling and disabling majority fencing in a non-SSH environment
      5.  
        Shutdown and restart the Veritas Access cluster in a non-SSH environment
    3. Configuring ISCSI
      1.  
        About iSCSI
      2.  
        Configuring the iSCSI initiator
      3.  
        Configuring the iSCSI initiator name
      4.  
        Configuring the iSCSI devices
      5.  
        Configuring discovery on iSCSI
      6.  
        Configuring the iSCSI targets
      7.  
        Modifying tunables for iSCSI
    4. Veritas Access as an iSCSI target
      1.  
        About Veritas Access as an iSCSI target
      2.  
        Managing the iSCSI target service
      3.  
        Managing the iSCSI targets
      4.  
        Managing the LUNs
      5.  
        Managing the mappings with iSCSI initiators
      6.  
        Managing the users
  4. Section IV. Managing Veritas Access file access services
    1. Configuring the NFS server
      1.  
        About using the NFS server with Veritas Access
      2.  
        Using the kernel-based NFS server
      3.  
        Using the NFS-Ganesha server
      4.  
        Switching between NFS servers
      5.  
        Recommended tuning for NFS-Ganesha version 3 and version 4
      6.  
        Accessing the NFS server
      7.  
        Displaying and resetting NFS statistics
      8.  
        Configuring Veritas Access for ID mapping for NFS version 4
      9.  
        Configuring the NFS client for ID mapping for NFS version 4
      10.  
        About authenticating NFS clients
      11. Setting up Kerberos authentication for NFS clients
        1.  
          Adding and configuring Veritas Access to the Kerberos realm
    2. Using Veritas Access as a CIFS server
      1.  
        About configuring Veritas Access for CIFS
      2.  
        About configuring CIFS for standalone mode
      3.  
        Configuring CIFS server status for standalone mode
      4.  
        Changing security settings
      5. About Active Directory (AD)
        1.  
          Configuring entries for Veritas Access DNS for authenticating to Active Directory (AD)
      6. About configuring CIFS for Active Directory (AD) domain mode
        1.  
          Joining Veritas Access to Active Directory (AD)
        2.  
          Verifying that Veritas Access has joined Active Directory (AD) successfully
        3.  
          Using multi-domain controller support in CIFS
        4.  
          About leaving an AD domain
        5.  
          Changing domain settings for AD domain mode
        6.  
          Removing the AD interface
      7.  
        Setting NTLM
      8. About setting trusted domains
        1.  
          Specifying trusted domains that are allowed access to the CIFS server
        2.  
          Allowing trusted domains access to CIFS when setting an IDMAP backend to rid
        3.  
          Allowing trusted domains access to CIFS when setting an IDMAP backend to ldap
        4.  
          Allowing trusted domains access to CIFS when setting an IDMAP backend to hash
        5.  
          Allowing trusted domains access to CIFS when setting an IDMAP backend to ad
        6.  
          About configuring Windows Active Directory as an IDMAP backend for CIFS
        7.  
          Configuring the Active Directory schema with CIFS-schema extensions
        8.  
          Configuring the LDAP client for authentication using the CLI
        9.  
          Configuring the CIFS server with the LDAP backend
        10.  
          Setting Active Directory trusted domains
      9.  
        About storing account information
      10.  
        Storing user and group accounts
      11.  
        Reconfiguring the CIFS service
      12.  
        About mapping user names for CIFS/NFS sharing
      13.  
        About the mapuser commands
      14.  
        Adding, removing, or displaying the mapping between CIFS and NFS users
      15.  
        Automatically mapping UNIX users from LDAP to Windows users
      16. About managing home directories
        1.  
          Setting the home directory file systems
        2.  
          Setting up home directories
        3.  
          Displaying home directory usage information
        4.  
          Deleting home directories and disabling creation of home directories
      17. About CIFS clustering modes
        1.  
          About switching the clustering mode
      18. About migrating CIFS shares and home directories
        1.  
          Migrating CIFS shares and home directories from normal to ctdb clustering mode
        2.  
          Migrating CIFS shares and home directories from ctdb to normal clustering mode
      19.  
        Setting the CIFS aio_fork option
      20. About managing local users and groups
        1.  
          Creating a local CIFS user
        2.  
          Configuring a local group
      21.  
        Enabling CIFS data migration
    3. Configuring an FTP server
      1.  
        About FTP
      2.  
        Creating the FTP home directory
      3.  
        Using the FTP server commands
      4.  
        About FTP server options
      5.  
        Customizing the FTP server options
      6.  
        Administering the FTP sessions
      7.  
        Uploading the FTP logs
      8.  
        Administering the FTP local user accounts
      9.  
        About the settings for the FTP local user accounts
      10.  
        Configuring settings for the FTP local user accounts
      11.  
        File sharing for a scale-out file system using FTP
    4. Using Veritas Access as an Object Store server
      1.  
        About the Object Store server
      2.  
        Use cases for configuring the Object Store server
      3.  
        Configuring the Object Store server
      4.  
        About buckets and objects
      5.  
        File systems used for objectstore buckets
      6.  
        Multi-protocol support for NFS with S3
  5. Section V. Monitoring and troubleshooting
    1. Configuring event notifications and audit logs topics
      1.  
        About event notifications
      2.  
        About severity levels and filters
      3.  
        About SNMP notifications
      4.  
        Configuring an email group
      5.  
        Configuring a syslog server
      6.  
        Exporting events in syslog format to a given URL
      7.  
        Displaying events on the console
      8.  
        Configuring events for event reporting
      9.  
        Configuring an SNMP management server
  6. Section VI. Provisioning and managing Veritas Access file systems
    1. Creating and maintaining file systems
      1.  
        About creating and maintaining file systems
      2.  
        About scale-out file systems
      3.  
        Read performance tunables for a cloud tier in a scale-out file system
      4.  
        About encryption at rest
      5. Considerations for creating a file system
        1.  
          Best practices for creating file systems
        2.  
          Choosing a file system layout type
        3.  
          Determining the initial extent size for a file system
        4.  
          About striping file systems
        5.  
          About creating a tuned file system for a specific workload
        6.  
          About FastResync
        7.  
          About fsck operation
        8.  
          Setting retention in files
        9.  
          Setting WORM over NFS
        10.  
          Manually setting WORM-retention on a file over CIFS
        11.  
          About managing application I/O workloads using maximum IOPS settings
      6.  
        Creating a file system
      7.  
        Bringing the file system online or offline
      8.  
        Listing all file systems and associated information
      9. Modifying a file system
        1.  
          Adding or removing a mirror from a file system
        2.  
          Adding or removing a column from a file system
        3.  
          Increasing the size of a file system
        4.  
          Decreasing the size of a file system
      10. Managing a file system
        1.  
          Defragmenting a file system
        2.  
          Checking and repairing a file system
        3.  
          Configuring FastResync for a file system
        4.  
          Disabling the FastResync option for a file system
        5.  
          Checking and resynchronizing stale mirrors
        6.  
          Setting file system alerts
        7.  
          Displaying file system alert values
        8.  
          Removing file system alerts
      11.  
        Destroying a file system
      12.  
        Upgrading disk layout versions
  7. Section VII. Configuring cloud storage
    1. Configuring the cloud gateway
      1.  
        About the cloud gateway
      2.  
        Configuring the cloud gateway
    2. Configuring cloud as a tier
      1.  
        Configuring the cloud as a tier for scale-out file systems
      2.  
        Moving files between tiers in a scale-out file system
      3. About policies for scale-out file systems
        1.  
          About pattern matching for data movement policies
        2.  
          About schedules for running policies
        3.  
          Creating and scheduling a policy for a scale-out file system
      4.  
        Obtaining statistics on data usage in the cloud tier
  8. Section VIII. Provisioning and managing Veritas Access shares
    1. Creating shares for applications
      1.  
        About file sharing protocols
      2.  
        About concurrent access
      3.  
        Sharing directories using CIFS and NFS protocols
      4.  
        Sharing a file system as a CIFS home directory
      5.  
        About concurrent access with NFS and S3
    2. Creating and maintaining NFS shares
      1.  
        About NFS file sharing
      2.  
        Displaying file systems and snapshots that can be exported
      3.  
        Exporting an NFS share
      4.  
        Displaying exported directories
      5.  
        About managing NFS shares using netgroups
      6.  
        Unexporting a directory or deleting NFS options
      7.  
        Exporting an NFS share for Kerberos authentication
      8.  
        Mounting an NFS share with Kerberos security from the NFS client
      9.  
        Exporting an NFS snapshot
    3. Creating and maintaining CIFS shares
      1.  
        About managing CIFS shares
      2.  
        Exporting a directory as a CIFS share
      3.  
        Configuring a CIFS share as secondary storage for an Enterprise Vault store
      4.  
        Exporting the same file system/directory as a different CIFS share
      5.  
        About the CIFS export options
      6.  
        Setting share properties
      7.  
        Displaying CIFS share properties
      8.  
        Hiding system files when adding a CIFS normal share
      9.  
        Allowing specified users and groups access to the CIFS share
      10.  
        Denying specified users and groups access to the CIFS share
      11.  
        Exporting a CIFS snapshot
      12.  
        Deleting a CIFS share
      13.  
        Modifying a CIFS share
      14.  
        Making a CIFS share shadow copy aware
      15.  
        Creating CIFS shares for a scale-out file system
    4. Using Veritas Access with OpenStack
      1.  
        About the Veritas Access integration with OpenStack
      2. About the Veritas Access integration with OpenStack Cinder
        1. About the Veritas Access integration with OpenStack Cinder architecture
          1. Veritas Access NFS-based Cinder driver
            1.  
              Configuring Veritas Access with OpenStack Cinder
          2.  
            Veritas Access iSCSI based Cinder driver
        2.  
          Configuring OpenStack Cinder
      3. About the Veritas Access integration with OpenStack Manila
        1.  
          OpenStack Manila use cases
        2.  
          Configuring Veritas Access with OpenStack Manila
        3.  
          Creating a new share backend on the OpenStack controller node
        4.  
          Creating an OpenStack Manila share type
        5.  
          Creating an OpenStack Manila file share
        6.  
          Creating an OpenStack Manila share snapshot
    5. Integrating Veritas Access with Data Insight
      1.  
        Veritas Access integration with Data Insight
  9. Section IX. Managing Veritas Access storage services
    1. Compressing files
      1. About compressing files
        1.  
          About the compressed file format
        2.  
          About the file compression attributes
        3.  
          About the file compression block size
      2.  
        Use cases for compressing files
      3.  
        Best practices for using compression
      4. Compression tasks
        1.  
          Compressing files
        2.  
          Showing the scheduled compression job
        3.  
          Scheduling compression jobs
        4.  
          Listing compressed files
        5.  
          Uncompressing files
        6.  
          Modifying the scheduled compression
        7.  
          Removing the specified schedule
        8.  
          Stopping the schedule for a file system
        9.  
          Removing the pattern-related rule for a file system
        10.  
          Removing the modified age related rule for a file system
    2. Configuring SmartTier
      1.  
        About Veritas Access SmartTier
      2.  
        How Veritas Access uses SmartTier
      3.  
        Configuring the policy of each tiered file system
      4.  
        Adding tiers to a file system
      5.  
        Adding or removing a column from a secondary tier of a file system
      6.  
        Configuring a mirror to a tier of a file system
      7.  
        Listing all of the files on the specified tier
      8.  
        Displaying a list of SmartTier file systems
      9.  
        About tiering policies
      10.  
        About configuring the policy of each tiered file system
      11.  
        Best practices for setting relocation policies
      12.  
        Relocating a file or directory of a tiered file system
      13.  
        Displaying the tier location of a specified file
      14.  
        About configuring schedules for all tiered file systems
      15.  
        Configuring schedules for tiered file systems
      16.  
        Displaying the files that may be moved or pruned by running a policy
      17.  
        Allowing metadata information on the file system to be written on the secondary tier
      18.  
        Restricting metadata information to the primary tier only
      19.  
        Removing a tier from a file system
    3. Configuring SmartIO
      1.  
        About SmartIO for solid-state drives
      2.  
        About configuring SmartIO
      3.  
        About SmartIO read caching for applications running on Veritas Access file systems
      4.  
        Setting up SmartIO read caching for Veritas Access
      5.  
        Verifying the VxFS cache area and monitoring the caching
      6.  
        Setting the caching mode
      7.  
        Customizing the caching behavior
      8.  
        Viewing the caching statistics for a cache area
    4. Configuring episodic replication
      1.  
        About Veritas Access episodic replication
      2.  
        How Veritas Access episodic replication works
      3.  
        Starting Veritas Access episodic replication
      4.  
        Setting up communication between the source and the destination clusters
      5.  
        Setting up the file systems to replicate
      6.  
        Setting up files to exclude from an episodic replication unit
      7.  
        Scheduling the episodic replication
      8.  
        Defining what to replicate
      9.  
        About the maximum number of parallel episodic replication jobs
      10.  
        Managing an episodic replication job
      11.  
        Replicating compressed data
      12.  
        Displaying episodic replication job information and status
      13.  
        Synchronizing an episodic replication job
      14.  
        Behavior of the file systems on the episodic replication destination target
      15.  
        Accessing file systems configured as episodic replication destinations
      16. Episodic replication job failover and failback
        1.  
          Process summary
        2.  
          Overview of the planned failover process
        3.  
          Overview of the planned failback process
        4.  
          Overview of the unplanned failover process
        5.  
          Overview of the unplanned failback process
    5. Configuring continuous replication
      1.  
        About Veritas Access continuous replication
      2. How Veritas Access continuous replication works
        1.  
          How data flows in continuous replication synchronous mode
        2.  
          How data flows in continuous replication asynchronous mode
      3.  
        Starting Veritas Access continuous replication
      4.  
        Setting up communication between the source and the destination clusters
      5.  
        Setting up the file system to replicate
      6.  
        Managing continuous replication
      7.  
        Displaying continuous replication information and status
      8.  
        Unconfiguring continuous replication
      9. Continuous replication failover and failback
        1.  
          Process summary
        2.  
          Overview of the planned failover process
        3.  
          Overview of the planned failback process
        4.  
          Overview of the unplanned failover process
        5.  
          Overview of the unplanned failback process
    6. Using snapshots
      1.  
        About snapshots
      2.  
        Creating snapshots
      3.  
        Displaying snapshots
      4.  
        Managing disk space used by snapshots
      5.  
        Bringing snapshots online or taking snapshots offline
      6.  
        Restoring a snapshot
      7.  
        About snapshot schedules
      8.  
        Configuring snapshot schedules
      9.  
        Managing automated snapshots
    7. Using instant rollbacks
      1.  
        About instant rollbacks
      2.  
        Creating a space-optimized rollback
      3.  
        Creating a full-sized rollback
      4.  
        Listing Veritas Access instant rollbacks
      5.  
        Restoring a file system from an instant rollback
      6.  
        Refreshing an instant rollback from a file system
      7.  
        Bringing an instant rollback online
      8.  
        Taking an instant rollback offline
      9.  
        Destroying an instant rollback
      10.  
        Creating a shared cache object for Veritas Access instant rollbacks
      11.  
        Listing cache objects
      12.  
        Destroying a cache object of a Veritas Access instant rollback
  10. Section X. Reference
    1. Appendix A. Veritas Access documentation
      1.  
        Using the Veritas Access product documentation
      2.  
        About accessing the online man pages
    2. Appendix B. Veritas Access tuning
      1.  
        File system mount-time memory usage
    3. Appendix C. Manual steps for addition and deletion of nodes in a non-SSH environment
      1.  
        Adding a new node to a Veritas Access cluster
      2.  
        Deleting a node from a Veritas Access cluster
  11.  
    Index

About encryption at rest

Veritas Access provides advanced security for data at rest by the encryption of data volumes. Encryption is a technology that converts data or information into code that can be decrypted only by authorized users.

You can encrypt Veritas Access data volumes to:

  • Protect sensitive data from unauthorized access.

  • Retire disks from use or ship them for replacement without the overhead of secure wiping of content.

Encryption is implemented using the Advanced Encryption Standard (AES) cryptographic algorithm with 256-bit key size validated by the Federal Information Processing Standard (FIPS) Publication 140-2, (FIPS PUB 140-2) security standard.

When you create file systems in Veritas Access on encrypted volumes using this feature, Veritas Access generates a volume encryption key at the time of file system creation. This encryption key is encrypted (wrapped) using a different key that is retrieved from a Key Management Server (KMS). The wrapped key is stored with the volume record. The volume encryption key is not stored on disk.

Veritas Access supports the use of a KMS that conforms to the OASIS Key Management Interoperability Protocol (KMIP) version 1.1 specification.

During creation of encrypted volumes:

  1. Veritas Access sends a key generation request to the configured KMS using the Key Management Interoperability Protocol (KMIP) protocol.

  2. The KMS responds with a unique identifier. Veritas Access sends the identifier to the KMS to obtain the key that is generated by the KMS.

  3. The KMS responds with the key. Veritas Access generates the random volume encryption key, and encrypts it using the key that is provided by the KMS.

  4. Veritas Access stores the encrypted key and the KMS identifier in the volume record.

During startup of encrypted volumes:

  1. Veritas Access retrieves the encrypted key and the KMS identifier from the volume record.

  2. Veritas Access sends the identifier to the KMS to obtain the key.

  3. The KMS responds with the key. Veritas Access decrypts the encrypted key (stored in the volume record) with the key provided by the KMS.

Note:

Veritas recommends that you use CPUs designed to support Advanced Encryption Standard Instruction Set (or the Intel Advanced Encryption Standard New Instructions (AES-NI) to improve performance.

Veritas recommends that you use IBM Secure Key Lifecycle Manager (SKLM), which supports KMIP protocol version 1.1, as a KMS server for this feature.

To register a Veritas Access cluster with the IBM SKLM KMS server

  1. Install the IBM SKLM server on any system in your environment. You can visit this URL to find the supported IBM SKLM servers with Veritas Access. Obtain the KMS server's public certificate in base64 format using its admin GUI console or the CLI.
  2. In the Veritas Access GUI management console, go to Settings > Services Management to register the Veritas Access cluster with the KMS server.
  3. Ensure that the time on the Veritas Access server and IBM SKLM server are in sync.
  4. Select Provide Key & Certificates to generate self-sign certificates for the Veritas Access cluster. Provide the KMS server's public SSL certificate in the same window.
  5. Configure KMS Server gets activated now. Select this tab to enter the KMS server-related details.
  6. Use the IBM SKLM server's GUI-based management to accept the client request from the Veritas Access cluster and to accept its SSL keys.

You can use the Storage> fs create command to create the file system with the encrypt=on option.

storage> fs create mirrored fs2 1g 2 pool1 protection=disk blksize=8192 
pdir_enable=no encrypt=on

You can use the storage encryption feature in the GUI by activating the secure data storage policy. You can add new NFS and CIFS shares using the activated policy.

Note:

Use the encrypt=on option for all the file system layouts except for largefs.