1、NetAppxDataONTAP8.2RemoteSupportAgentConfigurationGuidefor7-ModeForUsewithDataONTAPNetApp, Inc.495 East JaVa Drive Sunnyvale, CA 94089 U.S.Part number: 215-08023_A0May 2013Telephone:+1(408)822-60Fax:+1(408)822-4501Supporttelephone:+1(888)463-8277Web:Feedback:doccommentsTableofContents3ContentsWhatRe
2、moteSupportAgentis5Remotesupportarchitecture5WhatRemoteSupportAgentdoes6HowRemoteSupportAgentusesAutoSupport7HowRemoteSupportAgentusesHTTPorHTTPS8HowRemoteSupportAgentprovidesdataandnetworksecurity8HowtheSP/RLMprovidesdataandnetworksecurity9WheretofindmoreinformationaboutRemoteSupportAgent10Configur
3、ingRemoteSupportAgent11Predeploymentchecklist11UpgradingtheSP/RLMfirmware11Configuringyour7-Modestoragesystem12ConfiguringRemoteSupportAgentsoftwareon7-Modcsystems13ManagingandmonitoringRemoteSupportAgent17DisablingandenablingRemoteSupportAgent17CommandsformanagingRemoteSupportAgent18rsahelp18rsaset
4、up19rsashow22rsastatus24rsatest25AccessingtheRemoteSupportEnterpriseUI27RemoteSupportEnterpriseservicepagedescriptions29Troubleshooting30Remotesupporterrormessages30Cannotconnecttohost30Cannotresolvehostname30OnCommandSystemManagerhostnamedoesnotmatchconfiguration.31HTTPerror403-accessdenied31HTTPer
5、ror-invalidusernameorpassword31HTTPhealthcheckinterfacebusy3132HTTPoperationtimeoutHTTPversionnotsupportedbyhost32RemoteSupportPolicyisdisabled32RSEhealthcheckinterfacebusy32RSEorproxyconfigurationisnotvalid33U33Unknownhost33WaitingforRLMtimetobeset33Remotesupportproblems34Incorrectfieldinformationi
6、nNetAppControllerSummary34IncorrectinformationinRemoteSupportAgentConfigurationSummary.34Incorrectstoragecontrollerinformation34U34Copyrightinformation35Trademarkinformation36Howtosendyourcomments37Index38WhatRemOteSUPPOrtAgentisRemoteSupportAgent(RSA)isaremotediagnosticsdatacollectorthatisembeddedd
7、irectlyintothestoragecontrollersremotemanagementdevicefirmware.RemoteSupportAgentenablesaNetAppsupportengineertoremotelyrequestanautomateduploadoflogfiles,corefiles,andotherdiagnosticinformationstoredinthestoragecontrollerandtoremotelytriggeranon-demandAutoSupportcollection.TheRemoteSupportAgentispr
8、ovidedinthelatestfirmwareforstoragesystemsthatsupportanonboardServiceProcessor(SP)ortheRemoteLANModule(RLM)add-oncard.RemoteSupportAgentcanonlybeinstalledonsystemswiththeonboardServiceProcessorortheRemoteLANModule.FAS20xxsystemsthathavethebuilt-inBaseboardManagementController(BMC)arcnotsupported.Not
9、e:YoucanaccessandusethebasicSPandRLMfeaturesindependentlyofRemoteSupportAgent.RemotesupportarchitectureRemoteSupportAgentisapartoftheNetAppRemoteSupportDiagnosticsTool,whichhelpsNetAppSupportsolveyourstoragesystemissueswithouttheneedftrstaffintervention.TheNetRemoteSupportDiagnosticsToolconsistsofth
10、efollowingcomponents:AremotemanagementdeviceTheremotemanagementdevicecanbetheSerViCeProcessor(SP)ortheRemoteLANModule(RLM),dependingonthestoragesystemmodel.TheSP/RLMstaysoperationalregardlessoftheoperatingstateofthesystem.Itprovidesremoteplatformmanagementcapabilities,includingremoteaccess,monitorin
11、g,troubleshooting,logging,andalertingfeatures.FormoreinformationabouttheSP/RLM,seetheDataONTAPSystemAdministrationGuidefor7-Mode.RemoteSupportAgent(RSA)RemoteSupportAgentispartoftheSP/RLMfirmware.RemoteSupportEnterprise(RSE)RemoteSupportEnterpriseistheapplicationandsen,eratNetAppthatlistensforthecus
12、tomersRemoteSupportAgentconnectionandprovidestheGUIthataNetAppTechnicalSupportEngineerusestorequestdiagnosticdata.RSAcommunicateswithRSEtoreceivesupportactionrequestsandsenddiagnosticdata.ThefollowingdiagramillustratesthearchitectureoftheNetAppRemoteSupportDiagnosticsToolin7-modcsystems:NetAppSuppor
13、tSupport ServerRemote Support Customer Data RepositoryRelatedinformationNetAppRemoteSupportDiagnosticsToolpage-WhatRemoteSupportAgentdoesRemoteSupportAgentremotelycollectsdata,intelligentlyhandlescorefiles,andsendsnotificationofdownstoragecontrollers.RemotedatacollectionRemoteSupportAgentenablesNetA
14、ppSupporttorequesttheuploadoffilesfromtheetclogandetccrashdirectoriesandtheirsubdirectories.ThesetwodirectoriescontainonlyNetAppstoragecontrollerenvironmentalanddebugginginformationanddonotcontainanycustomersensitivedata.Multiplefilescanberequestedfromthesedirectories,asrequired,duringcasetriage.Rem
15、oteSupportAgentalsoenablesNetAppSupporttoremotelytriggeranAutoSupportmessageonyourstoragecontrollerandhaveacompleteAutoSupportlogreturnedbyusingtheDataONTAPAutoSupportmechanism.IntelligentcorefilehandlingWhenasystempanics,RemoteSupportAgentautomaticallyuploadsthecorefiletoNetAppSupportwithoutyourint
16、ervention.RemoteSupportAgentuploadsacorefileonlyifitisnotcorruptedandthepanicsignaturedoesnotmatchanyknownpanicmessageintheNetApppanicmessagedatabase.Insuchacondition,thecaseisupdatedwiththelatestinformation.RemoteSupportAgenthandlescorefileuploadfailureasfollows:FailureonthestoragecontrollerIfthere
17、isafailureonthestoragecontrollerduringcorefilecollection,RemoteSupportAgentretriesthecorefilecollection.Ifunsuccessful,RemoteSupportAgentterminatestheretryandsendsafailurealarmtoRemoteSupportEnterprise.WhenRemoteSupportEnterprisereceivesthealarm,itnotifiesNetAppSupportthatanautomaticcoreuploadfailed
18、NetAppSupportthenreachesouttocustomercontactstorequestamanualcoreupload.RemoteSupportEnterprisefaultornetworkoutageIntheeventofanetworkfaultoroutageduringafiletransmission,RemoteSupportAgentretriesthefileuploadseveraltimes.NotificationofdownstoragecontrollerWhentheSP/RLMdetectsthatastoragecontrolle
19、risdown,forexample,duetoanabnormalreboot,theSP/RLMautomaticallytriggersanAutoSupportmessagetoNetAppSupport.Aproblemcaseiscreatedandthelistedhardwarecontactisnotified.AutoSupportmustbeenabledforthisfeaturetoworkcorrectly.HowRemoteSupportAgentusesAutoSupportRemoteSupportAgentenablesaNetAppSupportengin
20、eertoremotelytriggeranAutoSupportrequestonthestoragecontrollerandhavetheAutoSupportdatasentbacktoNetAppsupport.WhenAutoSupportisconfiguredandenabledontheNetAppstoragesystem,RemoteSupportAgentenablesNctAppSupporttobeginproblemdiagnosticsimmediatelywithoutwaitingforyoutosendanupdatedAutoSupportmessage
21、ItalsoenablesNetAppSupporttoeffectivelytroubleshootcasesthatoccurduringoffhourswhenyouarcnotavailabletosendanAutoSupportmessage.WhenRemoteSupportAgentsendsacommandtoDataONTAPtotriggeranAutoSupportmessage,themessageisuniquelyidentifiedbythesubjectlinenRemotcSupportAgenttriggeredASUP.*RemoteSupportAg
22、entrequiresthefollowingAutoSupportsettingsconfiguredonthestoragecontroller:optionautosupport.toe-mail_addressesoptionautosupport.mailhost(nameIP_address_of_outbound_SMTPForexample,ifyousubscribetoAutoSupportnotifications,youalsoreceiveAutoSupportmessagesthatarctriggeredbyRemoteSupportAgent.Forinform
23、ationaboutconfiguringandenablingAutoSupport,seetheDataONTAPSystemAdministrationGuidefor7-Modc.HowRemoteSupportAgentusesHTTPorHTTPSRemoteSupportAgentusesHTTPorHTTPStocommunicatewiththestoragecontrollertoinitiatecommandsandtocollectfiles.ItusesHTTPStosendsystemlogsandcorefilesfromtheDataONTAProotvolum
24、etoRemoteSupportEnterpriseontheNetAppSupportside.Duringacasetriage,theSupportteamoftenrequiresthesystemlogsandcorefiles.BecauseRemoteSupportAgentdoesnothavedirecthardwareaccesstothesefiles,itusesHTTPorHTTPStorequestthesefilesfromthestoragecontroller,tomanuallytriggeranAutoSupportmessagefromthestorag
25、esystem,andtomonitortheprogressofcorefileoperations.ItusesHTTPStocommunicatewithRemoteSupportEnterpriseontheNetAppSupportsideandtosendsystemlogsandcorefilesthatarelocatedontheDataONTAProotvolume.RemotedatacollectionbytheNetAppSupportteamislimitedtofileswithintheetccrashandetclogdirectoriesandtheirsu
26、bdirectories.UsingHTTPenablesRemoteSupportAgentsfasteraccesstothediagnosticsdataontheNetAppcontroller.UsingHTTPSenablesenhancedsecurityonthedataflowbetweenRemoteSupportAgentandtheNetAppcontrollerwithinyourintranet.Youshouldselectthebesttransportoptionbasedonperformanceandsecurityconsiderations.HowRe
27、moteSupportAgentprovidesdataandnetworksecurityToensuredataandnetworksecurity,RemoteSupportAgentenablesyoutohavefullcontrolandvisibilityoverallremoteeventsandactivities.RemoteSupportAgentusesthefollowingsecuritymeasures:Connectionsareoutboundonly.ConnectionbetweenRemoteSupportAgentandRemoteSupportEnt
28、erpriseisalwaysinitiatedbyRemoteSupportAgent.Thisensuresthatthereisonlyanoutboundconnectionfromyoursitetotechnicalsupport.RemoteSupportAgentdoesnotallowdial-inaccessfromNetApptoyoursystem.RemoteSupportAgentperiodicallyconnectstoRemoteSupportEnterprise,downloadsanyactionrequests,anduploadsthesystemst
29、atusorresultstosatisfypreviousrequeststoRemoteSupportEnterprise.ThenonalhealthcheckconnectionintervaliseveryfiveminutesforstoragecontrollersthatarenotbeingactivelyassistedbyaNetAppSupportengineerincasetriage.Theconnectioninten,alchangestoevery10secondsifaNetAppSupportengineerrequestsremotedatacollec
30、tionfromthestoragesystem.Thecollectionintervalreturnstothenormalinten,alwithinashorttimeaftercasetriagerequestshavestopped.Allcommunicationsareauthenticated.CommunicationbetweenRemoteSupportAgentandRemoteSupportEnterpriseisencryptedusing128-bitVeriSignsignedSecureSocketLayer(SSL)certificates.RemoteS
31、upportAgentretainsacopyoftheRemoteSupportEnterprisepubliccertificatetoensurethatcommunicationoccursonlywithNetAppSupport.Iftheauthenticationfails,theconnectionisbrokenandnodataissent.Accesstodiagnosticdataiscontrolled.RemoteSupportAgentconnectstotheNetAppSupportserverperiodically,totransferinformati
32、onandrespondtoservicerequests.Afterdataexchange,ifnosession(suchasafiletransfer)isactive,theconnectionisclosed.RemoteSupportAgentdoesnothaveaccesstoyouruserdata.Theonlydirectorytreesthatareaccessiblefromtherootvolumeofthestoragesystemareetccrashandetclogandtheirsubdirectories.Diagnosticdataisstoreds
33、ecurely.DatathatisuploadedfromRemoteSupportAgentisstoredinahighlysecureOracledatabasebehindtheNetAppcorporatefirewall.AccesstothisdataisrestrictedtoauthorizedNetAppSupportpersonnel.AllactionstakenbyNetAppSupportusingRemoteSupportEnterprisearerecordedandcanbeauditedbyaccessingtheRemoteSupportEnterpri
34、seinterfaceatyourNetAppSupportsitelogin.Securityassessmentsareconductedperiodically.SecurityassessmentshelptoensurethatRemoteSupportAgentconformstoindustrybestpracticesforprotectingyourdata.Formoreinformation,seetheThird-PartySecurityAssessmentlinkundertheAdditionalInformationheadingtoexaminetheRemo
35、teLANModuleSecurityAssessmentwhitepaperbySSecuritypoliciesarecheckedatstartup.WhenRemoteSupportAgentstarts,itchecksthesecuritypoliciesthatareconfiguredinthestoragecontroller.RemoteSupportAgentisnotifiedwheneveryouchangethesecuritypolicies.IfthesecuritypolicydoesnotallowcommunicationtotheRemoteSuppor
36、tEnterpriseserver,thenRemoteSupportAgentdoesnotconnecttoRemoteSupportEnterprise.RemoteSupportAgentfeatures,includingremotedatacollection,coreupload,andAutoSupportmessagegeneration,aredisabled.Ifthesecuritypolicyischangedfromallowingcommunicationtonotallowingcommunication,thenRemoteSupportAgentreport
37、sthenewpolicytoRemoteSupportEnterpriseandstopsanysubsequentcontactwithRemoteSupportEnterprise.YoucandisabletheconnectiontoNetAppSupportandallRemoteSupportAgentfeaturesbyusingthersasetupcommandwiththepolicy-enableoptionsettoNo.HowtheSP/RLMprovidesdataandnetworksecurityTheSP/RLMonyourstoragecontroller
38、usessingleoutbound-onlyCthernctconnection,locallysecuredusernameandpasswords,andasingleportfordataandnetworksecuritysupport.AsingleethemetconnectionistheonlyexternalinterfaceontheSP/RLM.TheSP/RLMfirewallpreventsincomingconnectionsfromoutsideyournetwork.Itallowsonlyconnectionsfromwithinyournetworkbyt
39、heDataONTAPadministrationaccounts(inboundSSHonly).ConnectionstoNetAppareoutgoingonly.OnlyanoutgoingconnectiontoNetApponport443isallowed.Datacollectionisonlyfromtheetccrashandetclogandtheirsubdirectories.AdministratoruserIDandpasswordisrequired.TheadministratoruserIDandpasswordthatisconfiguredinDataO
40、NTAPissuppliedtotheconfigurationoftheRemoteSupportAgentsothatitcancommunicatewithDataONTAP.TheSP/RLMcontrolsaccesstothestoragesystem.Thereisnorequirementforaspecialaccount;youcanuseanyaccountaslongasitisintheDataONTAPAdministratorsgroup.Ifmultipleadministratorsaresharingtheaccount,thenarecommendedbe
41、stpracticeistocreateaspecialaccountforRemoteSupportAgentusage.Onlyoneportacceptsconnections.TheonlySP/RLMportthatacceptsconnectionrequestsisSSH(port22).TheonlyoutboundportsallowedareSMTP(port25),SNMP(trapport162),andSSL(port443).WheretofindmoreinformationaboutRemoteSupportAgentYoucanfindadditionalin
42、formationaboutRemoteSupportAgent,SP,RLM,andRemoteSupportEnterpriseindocumentsontheNetAppSupportSite.TheNetAppRemoteSupportDiagnosticsToolsectionoftheNetAppSupportScontainsusefulbackgroundinformation,anFAQsection,andasecurityassessment.TheDataONTAPSystemAdministrationGuidefor7-Modecontainsinfbnationa
43、boutSPandRLM,AutoSupport,andRemoteSupportEnterprise.TheDataONTAPUpgradeandRevert/DowngradeGuidefor7-ModecontainsinformationaboutupdatingtheSPandRLMfirmware.COnfigUringRemOteSUPPOrtAgentConfiguringRemoteSupportAgentconsistsofupgradingtheSPRLM,configuringyourstoragesystem,andthenconfiguringRemoteSuppo
44、rtAgent.PredeploymentchecklistBeforeyoubegintoconfigureRemoteSupportAgent,youshouldbesurethatitsatisfiesyoursecuritypoliciesforInternetaccessandmeetstheserequirements.Ensurethatallofthefollowingaretrue.FormoreinformationaboutDataONTAPcommands,seetheDataONTAPSystemAdministrationGuidefor7-Modeandtheap
45、propriatemanpages.RemoteSupportAgentisprovidedasafirmwareupgradetotheRemoteLANModule(RLM)card.Firmware3.0orlaterisrequired;release4.0orlaterisrecommended.RemoteSupportAgentisincludedintheSen,iceProcessor(SP)firmwareonFASZV2200,3200,and6200systems.FAS20xxsystemsthathavethebuilt-inBaseboardManagementC
46、ontroller(BMC)arenotsupported.Youmusthavea128-bit,encrypted,outboundHTTPSconnectiontotheInternetoverport443.Youmusthavea10/100megabitspersecondfull-duplexEthernetportwithautonegotiationenabled.YoumusthavetheabilitytoaccessthetargetURLAutoSupportmustbeenabledonthestoragesystem.TheSP/RLMmustbeconfigur
47、ed.ThespsetupandrimsetupcommandsdisplaytheSP/RLMconfiguration.SP/RLMmustbeabletosendatestAutoSupportmessage.Theoptionsautosupport.to,optionsautosupport.mailhost,andrimtestautosupportorsptestautosupportcommandsenableyoutoverifywhethertheSP/RLMisabletosendatestmessage.UpgradingtheSP/RLMfirmwareBeforeyouconfigureRemoteSupportAgent,youshouldcheckwhethertheSP/RLMneedsafirmwareupgrade.Steps1. DownloadthelatestSP/RLMfirmware.UsetheDataONTAPconsoleort
