ONTAP production readiness checklist

Walk this in order with the workload owner, network, identity, security and recovery teams. A checked box means the decision is documented and its command evidence is saved—not merely that the command ran.

How to use it

Capture output with date, cluster, ONTAP release, reviewer and ticket. Replace every placeholder, use least privilege, and verify syntax with ? on the installed release. Examples below are realistic illustrations.

cluster::> system image get -version
NetApp Release 9.19.1: Mon Aug 10 00:00:00 UTC 2026
cluster::> cluster identity show
Cluster UUID: 5c2b...e771
Cluster Name: prod-cluster-01

1. SVM design

☐ Choose tenancy deliberately. Use separate SVMs where workload/tenant isolation, administration, namespace, networking or DR lifecycle requires it; avoid one SVM per trivial share. Record the decision in the SVM administration guide.
☐ Name for lifecycle. Names identify environment, tenant and service without embedding a controller that will change.
☐ Verify allowed protocols, root volume and operational state.

cluster::> vserver show -vserver app-prod -fields subtype,allowed-protocols,rootvolume,state
vserver   subtype allowed-protocols rootvolume    state
app-prod  default nfs,cifs         app_prod_root running
cluster::> volume show -vserver app-prod -volume app_prod_root -fields junction-path,state
vserver   volume         junction-path state
app-prod  app_prod_root  /             online

2. Network

☐ Map LIF purpose and failure domain. Document IPspace, broadcast domain, home port, failover policy and DNS name; see network & port reference.
☐ Test LIF failover. Every candidate port must reach the same VLAN and upstream path.
☐ Validate MTU end to end. A large ONTAP port MTU is useless if switches or hosts disagree.
☐ Separate traffic where policy requires. Management, data and intercluster reachability should match firewall rules.

cluster::> network interface show -vserver app-prod -fields address,home-node,home-port,failover-policy,status-oper
vserver   lif       address      home-node home-port failover-policy status-oper
app-prod  nfs_lif1  192.0.2.31   node1     e0c       system-defined up
app-prod  nfs_lif2  192.0.2.32   node2     e0c       system-defined up
cluster::> network interface failover-groups show -vserver app-prod
Vserver   Group         Targets
app-prod  data-prod     node1:e0c, node2:e0c

cluster::> network port show -fields mtu,link,speed-admin,speed-oper
node  port mtu  link speed-admin speed-oper
node1 e0c  9000 up   auto        100000
node2 e0c  9000 up   auto        100000

3. Protocols

☐ Select by client and availability needs. Compare NFSv3/v4.1, SMB3, iSCSI, FC and NVMe-oF in protocol choice; check client and ONTAP interoperability.
☐ NFS: review export-policy rules, client matches, protocol/security flavors and superuser mapping.
☐ SMB: validate domain join, share ACLs plus NTFS permissions, signing/encryption requirements and continuous-availability needs.
☐ SAN: validate igroups, mappings and multipathing; see iSCSI on ONTAP.

cluster::> vserver export-policy rule show -vserver app-prod -policyname app-nfs
Policy   Rule Access Protocol Client Match  RO Rule RW Rule
app-nfs  1    nfs4            192.0.2.0/24 sys     krb5p
cluster::> vserver cifs share show -vserver app-prod
Vserver   Share  Path       Properties
app-prod  apps   /apps      oplocks,browsable

4. Capacity

☐ Set the space guarantee consciously. Thin provisioning transfers monitoring responsibility; see FlexVol deep dive.
☐ Define Snapshot reserve and deletion behavior. Model overwrite rate and retention, not only usable data.
☐ Configure autosize boundaries. A maximum without aggregate headroom is not protection.
☐ Preserve aggregate reserve. Include parity, spares, WAFL reserve, snapshots, clones and growth; see aggregate capacity.

cluster::> volume show -vserver app-prod -fields size,available,percent-used,space-guarantee,percent-snapshot-space
vserver  volume size  available percent-used space-guarantee percent-snapshot-space
app-prod apps   10TB  6.2TB     38%          none            5%
cluster::> volume autosize -vserver app-prod -volume apps
Maximum Size: 15TB
Minimum Size: 8TB
Mode: grow_shrink

cluster::> storage aggregate show-space -aggregate node1_aggr1
Aggregate: node1_aggr1
Feature                         Used       Used%
Volume Footprints               38.4TB     71%
Aggregate Metadata               1.2TB      2%
Available                        14.5TB     27%

5. Data protection

☐ Map each dataset to RPO/RTO. Choose Snapshot retention, asynchronous/synchronous replication and application consistency from requirements; see snapshots & copy-on-write and DR strategy.
☐ Verify snapshot policies and schedules. Labels must match SnapMirror policy rules where applicable.
☐ Prove the replica is healthy and current. “SnapMirror exists” is not a recovery test.
☐ Run a recovery exercise. Record DNS, network, identity, host and application steps plus failback.

cluster::> volume snapshot policy show -policy app-prod-hourly
Policy: app-prod-hourly
Schedule  Count  Prefix   SnapMirror Label
hourly    24     hourly   hourly
daily      7     daily    daily
cluster::> snapmirror show -destination-vserver dr-app -fields status,healthy,lag-time,last-transfer-end-timestamp
Source Path         Destination Path Status Healthy Lag Time
app-prod:apps       dr-app:apps_dr  Idle   true    00:12:18

6. Security

☐ Apply least-privilege RBAC. Named accounts, only required applications, break-glass controls; see administrator authentication & RBAC.
☐ Back up encryption-key material off-system. Prove external or onboard key-manager health and recovery for NVE/NAE; see security hardening.
☐ Decide ransomware controls. Configure and operationalize ARP and/or FPolicy where supported; alerts without responders are not controls.
☐ Review management exposure. Restrict management LIFs and disable unused services only after dependency testing.

cluster::> security key-manager external show-status
Node   Vserver  Key Server         Status
node1  cluster1 kmip1.example.com  available
node2  cluster1 kmip1.example.com  available
cluster::> security login show -fields application,authentication-method,role
vserver user/group application authentication-method role
cluster1 alice    ssh         publickey             storage-ops

7. Monitoring

☐ Enable and test AutoSupport. Confirm support delivery and internal routing; see AutoSupport, EMS & Active IQ.
☐ Route actionable EMS events. Test syslog/SNMP/email delivery and ownership.
☐ Capture a performance baseline. Preserve a normal peak sample and document a support capture path; see performance monitoring & perfstat.
☐ Set capacity/health alerts. Thresholds must leave enough time for procurement and change.

cluster::> system node autosupport show -fields state,support,transport
node   state  support transport
node1  enable enable  https
node2  enable enable  https
cluster::> system node autosupport check show
Node   Category    Status Detail
node1  http-https  ok     Connectivity check passed

cluster::> event notification show
Filter Name       Destination Name
important-events  ops-syslog
cluster::*> statistics start -object system|volume -sample-id preprod_peak -duration 15
Statistics collection is being started for Sample-id: preprod_peak

8. Operations

☐ Plan the upgrade path. Check release compatibility, firmware/DQP, application and host matrices, rollback and maintenance window in the upgrade runbook.
☐ Keep configuration backups off-box. Schedule creation and copy archives to a controlled external repository.
☐ Document runbooks. Include escalation, shutdown/startup, capacity response, certificate/key renewal, failover and DR.
☐ Retain admin audit evidence. Review access and changes; see audit & event logging.
☐ Review avoidable failure modes. Use common ONTAP mistakes as the final peer-review prompt.

cluster::> system configuration backup show
Node   Backup Name                       Time
node1  prod-cluster-01.8hour.2026-08-27  8/27/2026 16:00:00
node2  prod-cluster-01.daily.2026-08-27   8/27/2026 00:10:00
cluster::> cluster image show-update-progress
There is no update in progress.

9. Pre-go-live command pack

Run this immediately before the change gate, investigate every exception, and attach the complete output. A quiet error log does not replace hardware, network and recovery tests.

cluster::> system node autosupport show -fields state,support,transport
node   state  support transport
node1  enable enable  https
node2  enable enable  https

cluster::> event log show -time >24h -severity EMERGENCY,ALERT,ERROR
There are no entries matching your query.

cluster::> storage failover show
Node   Partner Possible State Description
node1  node2   true     Connected to node2
node2  node1   true     Connected to node1

cluster::> cluster ring show -unitname mgmt
Node   UnitName Epoch DB Epoch DB Trnxs Master Online
node1  mgmt     42    42       817      node1  master
node2  mgmt     42    42       817      node1  secondary

cluster::> volume show -fields state,percent-used,space-guarantee
vserver  volume         state  percent-used space-guarantee
app-prod app_prod_root  online 1%           none
app-prod apps           online 38%          none

cluster::> storage aggregate show -fields state,percent-used
aggregate    state  percent-used
node1_aggr1  online 73%
node2_aggr1  online 69%

cluster::> snapmirror show -fields status,healthy,lag-time
source-path    destination-path status healthy lag-time
app-prod:apps  dr-app:apps_dr   Idle   true    00:12:18

cluster::> network interface show -fields status-admin,status-oper,is-home
vserver  lif       status-admin status-oper is-home
app-prod nfs_lif1  up           up          true
app-prod nfs_lif2  up           up          true

cluster::> system health status show
Status
---------------
ok
cluster::> system health alert show
There are no entries matching your query.

Go/no-go rule: no unexplained health alert, offline/degraded protection, failed HA capability, misplaced/unreachable data LIF, untested recovery dependency or capacity exception crosses the gate. Exact commands and output fields vary; check your version.