HA, QoS & Security

High availability: takeover & giveback

• Nodes are deployed in HA pairs; each node's NVRAM is mirrored to the partner over the HA interconnect. If a node fails (or is taken down for maintenance), the partner takes over: it serves the failed node's aggregates, LIFs, and data — no data loss, because writes were in mirrored NVRAM.
• Takeover can be planned (storage failover takeover -ofnode X, used for hardware maintenance) or unplanned (panic/power loss).
• Giveback (storage failover giveback -ofnode X) returns storage to the home node once it's healthy.
• While in takeover, performance is roughly halved (one node serving two) — plan maintenance windows accordingly.
• Related: nondisruptive operations (NDO) — LIF migration, volume move (volume move start), and rolling upgrades let you do most work without client impact.

# HA status and control
storage failover show
storage failover takeover -ofnode node2
storage failover giveback -ofnode node2
# Volume migration (NDO)
volume move start -vserver vs1 -volume vol1 -destination-aggregate aggr2

Storage QoS

• QoS policy groups cap throughput (IOPS and/or MB/s) on volumes, LIFs, or SVMs — protect the noisy neighbor, guarantee a baseline for critical apps.
• Adaptive QoS (AQoS) (ONTAP 9.3+) — throughput limits that scale with volume size: you define expected and peak IOPS per TB (e.g., 500 IOPS/TB expected, 1000 peak). As the volume grows, its limit grows. Much easier to manage at scale than fixed limits.
• QoS is also the measurement surface: qos statistics volume show gives per-volume latency/throughput — the fastest way to find a hot volume.

# Fixed QoS
qos policy-group create -policy-group pg_critical -vserver vs1 -max-throughput 10000IOPS,500MBps
volume modify -vserver vs1 -volume vol_crit -qos-policy-group pg_critical
# Adaptive QoS
qos adaptive-policy-group create -name apg_gold -vserver vs1 -expected-iops-per-tb 500 -peak-iops-per-tb 1000
volume modify -vserver vs1 -volume vol_gold -qos-adaptive-policy-group apg_gold
# Measure
qos statistics volume show -vserver vs1 -volume vol_crit -interval 5

Security

Encryption

• NVE (NetApp Volume Encryption) — software AES-256 encryption per volume, on any supported disk. Keys come from an external KMIP server or the built-in Onboard Key Manager (OKM). NVE for AFF since ONTAP 9.1, FAS a bit later. (Verify exact versions.)
• NAE (NetApp Aggregate Encryption, ONTAP 9.4+) — encrypts whole aggregates with per-volume keys; less overhead than per-volume NVE, recommended default for new encrypted systems.
• SEDs (self-encrypting drives / FIPS drives) — hardware encryption at the disk; combined with NAE/NVE for defense in depth.
• Key management is the operational crux: lost keys = unrecoverable data. Back up keys; OKM requires quorum (multiple nodes).

# Encryption status
security key-manager onboard show
volume show -fields encryption,encrypt
storage aggregate show -fields encryption-type

Access control & hardening

• RBAC: built-in roles (admin, vsadmin, vsadmin-protocol, …) and custom roles per command/object. Users login via SSH/HTTP; auth via local passwords, AD/LDAP, or certificates.
• FPolicy — per-SVM file access policies: monitor/block operations (used for ransomware detection, DLP, and home-directory quotas integration).
• Firewall/service policies — control which management services are reachable on which LIFs.
• SnapLock for WORM retention (see data protection).
• Keep AutoSupport enabled — it feeds Active IQ and is the fastest path to support/insight.

# RBAC examples
security login create -vserver vs1 -user-or-group-name ops -application ssh -authmethod password
security login show
security role show -vserver vs1

Monitoring & events

• EMS (Event Management System) — the event log is your first stop: event log show, filter by severity/time/message name.
• System health — system health alert show for hardware issues (disks, shelves, fans, batteries).
• Performance — statistics and qos statistics volume show (see the performance guide).
• Jobs — job show for long-running operations (moves, efficiency scans, upgrades).
• AutoSupport — autosupport show / autosupport invoke -type test.

# Events & health
event log show -severity ERROR -time ">now-24h"
system health alert show
job show -type volume-move
autosupport show

Exam traps to know

• Takeover is about storage failover between HA partners; it doesn't move data — the partner serves the same aggregates.
• Adaptive QoS scales with volume size; fixed QoS doesn't. Question will tell you which scenario needs which.
• NVE encrypts per volume; NAE encrypts per aggregate. Keys via KMIP or Onboard Key Manager.
• RBAC is per vserver (data SVM) or cluster; vsadmin can't manage other SVMs' objects.
• event log show for software/EMS events; system health alert show for hardware.
• QoS limits are ceilings (max), not guarantees, unless you configure expected/peak correctly with AQoS.

Next: Practice questions →