Tintri VMstore System Administration Manual

Transcription

1 SYSTEM ADMIN MANUAL Tintri VMstore System Administration Manual Rev. J

2 Tintri, the Tintri logo, Tintri VMstore, and FlashFirst are trademarks or registered trademarks of Tintri, Inc. All other trademarks or service marks are the property of their respective holders and are hereby acknowledged Tintri, Inc. All rights reserved. 303 Ravendale Dr., Mt. View CA

3 Table Of Contents Preface 1 How this documentation is organized...1 Tintri Customer Service... 2 Adding VMware Datastores 3 Using VMware vcenter...3 Creating an NFS folder for submount using the datastore browser 4 Adding submounts using VMware vcenter...4 Adding RHEV Storage Domains 5 Using RHEV-M... 5 Creating a submount directory in Tintri NFS... 6 Adding a submount storage domain... 6 Configuring Settings 7 Configuring Data IPs...7 Setting the SMB hostname... 9 Adding and removing Datastore IPs... 9 Configuring Hypervisor managers...10 Testing server connectivity vcenter permissions and privileges Adding and removing hypervisor accounts...13 Configuring NFS access...13 Configuring Protection...14 Setting up the default snapshot schedule...15 Setting up default replication...16 Configuring Alerts...16 Configuring SNMP targets...17 Setting up a remote syslog server...18 Enabling maintenance mode...18 Configuring Autosupport...19 Configuring DNS...20 iii

4 Configuring Management access...20 Setting up local users...21 Setting up external groups...23 Changing your password...24 Configuring Certificates...25 Uploading Host Certificates...25 Uploading CA Certificates...26 Configuring Date and time Configuring Directory services...28 Configuring for Active Directory Protocol...28 Configuring for Lightweight Directory Access Protocol...29 LDAP Configuration Parameters...30 Configuring Hyper-V shares...32 Configuring LACP Configuring Licenses Adding an Encryption License...35 Enabling Encryption...35 Configuring Local password...36 Configuring SNMP Accessing SNMP MIB files Configuring Replication...38 Setting up a destination...38 Creating a new replication IP...39 Assigning an IP to a replication card...39 Setting up throttle throughput...40 Rotating keys...41 Pausing replication...42 Upgrading Tintri OS Software...42 Navigating the Dashboard 45 Interpreting VMstore performance metrics...45 Using the performance reserves gauge...46 Using the space capacity gauge Using the protection display Using the performance reserves / space changers iv

5 Performance reserves changers Space changers Navigating the VMstore 50 Interpreting the VMstore system-wide graphs...50 Comparing metrics...51 Examining data trends...51 Viewing the history...52 Evaluating metrics...52 IOPS (Input/Output Operations per Second)...52 Throughput MBps (Megabytes per Second) Latency Reserves Flash % Space Bytes Remaining Replication MBps...55 Navigating Virtual Machines 56 Searching for Virtual Machines...56 Showing graphs Setting up protection Protecting with a snapshot schedule Protecting by replication...58 Pausing/Resuming replication...59 Taking snapshots...60 Taking crash-consistent snapshots...60 Taking VM-consistent snapshots...61 Viewing related snapshots...61 What is a clone?...61 Cloning VMs...62 Making a second copy Restoring a VM Restoring a replica Pinning to Flash Refreshing details...65 v

6 Navigating Virtual disks 66 Showing graphs...66 Pinning to Flash Refreshing details Navigating Snapshots 68 What is a snapshot?...68 Cloning snapshots...69 Deleting a snapshot...69 Refreshing details...69 Performing a search...69 Customizing search options Navigating Service Groups 71 Viewing service groups...71 Creating a service group Customizing the replication snapshot schedule Navigating Alerts 74 Viewing the message list Commenting on alerts and notices Marking alerts and notices Archiving alerts and notices Refreshing the inbox or archive Viewing the archive, inbox and audit log details Scripting 77 Diagnosing VMstore 78 Diagnosing options VMstore information Generate support bundle / autosupport report Support bundle Autosupport Browse and download reports Visit support.tintri.com or support@tintri.com...80 vi

7 Diagnosing Hardware 81 Accessing the hardware...81 Understanding Controller components...82 Controller Role: Active...82 Controller Role: Standby...82 Understanding resource, hardware and memory components CPU & Memory Hardware Temperature & Fans Accessing Admin, Data & Replication network details Understanding Admin network details...85 Admin network port state...85 Admin port configuration...85 Admin IP address configuration...86 Understanding Data network details...86 Data network port state Data port configuration Jumbo frame Data IP address configuration NFS access Understanding Replication network details...88 Repl network port state...88 Repl port configuration...89 Repl IP address configuration...89 Encrypting Hardware 90 Accessing hardware encryption...90 Rotating key...91 Rebooting 92 Rebooting the primary controller...92 Shutting down the datastore...92 Logging out of the system...92 Contacting Support 93 How do I contact Customer Support? vii

8 How do I open a Support Case?...93 How do I add notes to Case Notifications?...93 What are Escalations?...93 How do I escalate a Support Case?...94 What resources are available on the Support Portal?...94 How do I register a VMstore?...94 How do I create additional Member Users?...94 Where can I access Contact and VMstore information?...94 What do I do if I need to replace hardware components?...95 Component replacement service level agreements...95 Troubleshooting Slow VMs 96 How do I find the performance bottleneck?...96 Is the host causing the bottleneck?...96 Is the network causing the bottleneck? Is the storage causing the bottleneck? Is the bottleneck caused by flash misses? Is the bottleneck caused by misbehaving VMs? Is the bottleneck caused by VMware snapshots?...98 Troubleshooting Space Limitations 99 How do I find the culprit VM?...99 How do I create more space?...99 Troubleshooting VM auto alignment 101 What is auto alignment? What is the cost of a misaligned I/O? How much performance gain can I expect from auto alignment? Troubleshooting Replication 103 What is replication? How do I set up replication? How do I know if a replica is up to date? How do I handle lag alerts? How do I restore VMs? Frequently Asked Questions 105 Can the datastore handle more VMs? viii

9 How do I check for available space? How do I deal with space limitation issues? How do I find the performance bottleneck? How do I handle lag alerts? How do I know if a replica is up to date? How do I prioritize which VMs are replicated first? How do I restore VMs? How do I set up replication? How much performance gain can I expect from auto alignment? Is the bottleneck caused by flash misses? Is the bottleneck caused by misbehaving VMs? Is the bottleneck caused by VMware snapshots? Is the host causing the bottleneck? Is the network causing the bottleneck? Is the storage space causing the bottleneck? What is auto alignment? What is a clone? What is a snapshot? What is a Synthetic disk? What is a Synthetic VM? What is a Virtual Disk? What is a VM? What is pinning? What is replication? What is the cost of a misaligned I/O? Which VMs are busier than usual? Appendix A, Virtual Machines 110 Managing VMs Understanding tables Understanding graphs Understanding CPU & Memory Appendix B, Pinning to Flash 115 Pinning to Flash Things to consider ix

10 Determining additional performance reserves Appendix C, Space Savings 117 How are space savings factors and percentages calculated? Space savings, Compression and Clone dedup Compression Clone dedup Total system Clone dedup Per VM or VDisk Clone dedup Why is my compression factor so low? Why is my compression factor so high? Why is my Clone dedup factor so low? Why is my Clone dedup factor so high? Is there a normal range for space savings? Glossary 120 Index 129 x

11 Preface This guide describes the administration functions required to add storage, configure settings, manage and diagnose your VMstore and hardware, poll the health status of your VMstore and reboot or shutdown your Tintri system. How this documentation is organized This documentation contains the following sections: Adding VMware Datastores on page 3 explains how to a new storage network file system and submounts using VMware vsphere Client. Adding RHEV Storage Domains on page 5 explains how to a new storage network file system and submounts using the RHEV Manager. Configuring Settings on page 7 describes how to configure your VMstore. Navigating the Dashboard on page 45 explains how to interpret VMstore performance, performance reserves & space capacity gauges and protection display. Navigating the VMstore on page 44 describes how to interpret system-wide graphs, data trends, data history and metrics. Navigating Virtual Machines on page 56 explains how to search for VMs, display graphs, setup protection, manage snapshots, clone, pin and refresh VM details. Navigating Virtual disks on page 66 describes how to show graphs, pin to flash and refresh details. Navigating Snapshots on page 68 describes how to manage snapshots. Navigating Service Groups on page 71 describes the process for setting up disaster recovery protection between VMstores. Navigating Alerts on page 74 describes how to view, comment, mark, archive and refresh the message list. Scripting on page 77 explains how to poll the health status of your VMstore. Diagnosing VMstore on page 78 describes how to view VMstore info, generate bundles/reports, browse and download reports and access the support site. Diagnosing Hardware on page 81 helps you troubleshoot hardware or network related issues, and provides an at-a-glance view of all configured IP addresses. Encrypting Hardware on page 90 explains how to encode the HDD and SSD disks on your VMstore with an encryption key. Rebooting on page 92 explains how to reboot the primary controller. Contacting Support on page 93 describes what to do if you encounter issues. Appendix A, Virtual Machines on page 110 describes how to manage VMs, and understand tables and graphs. Appendix B, Pinning to Flash on page 115 explains pinning to Flash, things to consider when pinning and how to determine additional performance reserves for a particular VM or virtual disk needs. Appendix C, Space Savings on page 117 describes how Space savings, Compression and Clone dedup factors are calculated. 1

12 Tintri Customer Service Online Support Web Portal: Phone Toll free: Tintri ( ), Option 2 Phone Local: , Option 2 International: Please visit for local numbers. Support@Tintrí.com 2

13 Adding VMware Datastores Using the VMware vsphere Client, you can add Tintri storage NFS as datastores. If you have provided multiple data IP addresses during the initial configuration, add each IP address as a separate datastore. Once the hypervisor manager knows about the new datastore, you can then start loading VMs onto it. Using VMware vcenter To add Tintri Network File System (NFS), you must first click New domain in the storage container: 1. Enter the data IP address, you specified during the VMstore initial setup, in the Server field. 2. Enter /tintri in the Folder field, as the folder name. 3. Provide a descriptive name in the Datastore Name field. Figure 1-1 Add a new storage network file system using the VMware vcenter. 3

14 Creating an NFS folder for submount using the datastore browser To add submounts using the datastore browser: 1. Click into the Datastores and Datastore Clusters view. 2. Right-click on a datastore and select Browse Datastore... Figure 1-2 Adding submounts using the datastore browser. 3. Click the Create a new folder icon in the Datastore Browser window. 4. Enter a name for the new folder submount. 5. Click Ok. Adding submounts using VMware vcenter You can add submounts to a storage network file system by adding a submount folder name in the Folder field. For example, a submount with the name sales is entered as: /sales. Figure 1-3 Adding submounts using VMware vcenter. New VMs can then be deployed in the submount datastore and will be displayed in the UI VMs list with the submount datastore name displayed in the Storage container column and the submount folder location displayed in the Hypervisor path column. Additional submounts can be added through the datastore browser. Note: Was this chapter helpful? Click Documentation Feedback and let us know. 4

15 Adding RHEV Storage Domains Using the RHEV Manager, you can add Tintri storage NFS as storage domains. If you have provided multiple data IP addresses during the initial configuration, add each IP address as a separate storage domain. Once the hypervisor manager knows about the new datastore, you can then start loading VMs onto it. Using RHEV-M To add Tintri NFS as storage domain, you must first click New domain in the storage container: 1. Provide a storage domain name in the Name field. 2. Select the appropriate Data Center. 3. Select the appropriate Use Host. 4. Enter the data IP address, followed by :/tintri in the Export Path field. 5. Click OK. Figure 2-1 Add a new storage network file system using the RHEV Manager. 5

16 Creating a submount directory in Tintri NFS Using any Linux machine to mount Tintri NFS: 1. Enter mount <datastore IP/FQDN>:/tintri /<local directory>. 2. Enter cd <local directory>. 3. Enter mkdir <local directory>/<submount directory>/ sales. Adding a submount storage domain Using RHEV-M to add the submount directory as your submount storage domain: 1. Provide a storage domain name in the Name field. 2. Select the appropriate Data Center. 3. Select the appropriate Use Host. 4. Enter the data IP address, followed by :/tintri/sales in the Export Path field. Figure 2-2 Adding submounts using RHEV-M. 5. Click OK. New VMs can be deployed in the submount storage domain and will be displayed in the UI VMs list with the submount storage domain name displayed in the Storage container column and the submount folder location displayed in the Hypervisor path column. Additional submounts can be added through the same process. Note: Was this chapter helpful? Click Documentation Feedback and let us know. 6

17 Configuring Settings You can configure the settings of your VMstore by accessing the Settings option on the application bar. Figure 3-1 Configuring Settings. This chapter covers the following: Configuring Data IPs Configuring Hypervisor managers Configuring NFS access Configuring Protection Configuring Alerts Configuring Autosupport Configuring DNS Configuring Management access Configuring Certificates Configuring Date and time Configuring Directory services Configuring LACP Configuring Licenses Configuring Local password Configuring SNMP Configuring Replication Uprading Tintri OS Software Configuring Data IPs You can change how the physical datastore is displayed in the hypervisor manager by configuring the datastore IP addresses. Enabling the jumbo frames option allows VMstore to support the sending and receiving of jumbo frames. 7

18 The jumbo MTU (Maximum Transmission Unit) size may be set else where in the data center to accommodate larger operation sizes, and the VMstore can be set to simply work with jumbo frames without setting the maximum MTU. Caution: The VMstore, network and ESX Server must be configured with the same jumbo frame settings. Erroneous mismatches between jumbo frame settings can result in poor performance and network connectivity issues. Figure 3-2 Configuring Datastore IPs. To access network information for data traffic: 1. Click Data IPs. 2. Enter the Datastore data IP. 3. Enter the Netmask. 4. Enter the Gateway. 5. Enter the VLAN id. 6. Select the Jumbo frame: Disabled or Enabled option. 7. Click Save. Note: You can use the console user interface to change the network information for administrative traffic. The VMstore must be mounted by datastore IP addresses only. Mounting a datastore by FDQN or hostname may result in a number of functionality issues with the UI, cloning, etc. 8

19 Setting the SMB hostname The SMB hostname is used by SCVMM and Hyper-V hosts to access VMs on the VMstore and will be set as a cifs/ Service Principal Name on the VMstore s computer account in Active Directory. Figure 3-3 Setting the SMB hostname. To set the SMB hostname, enter a fully-qualified name that resolves in DNS to one of the Datastore data IP addresses. This must be resolvable in DNS. The Test SMB hostname button may be clicked at any time to perform some tests around the name, as it currently appears in the SMB hostname field. Adding and removing Datastore IPs You can add a maximium of 64 datastores of network data needed for data traffic. Changing the data IP address may result in VMs becoming unreachable. To add or remove data IP addresses, use the and options. Figure 3-4 Adding and removing Datastore IPs. Caution: The VMstore must be mounted by datastore IP addresses only. Mounting a datastore by FDQN or hostname may result in a number of functionality issues with the UI, cloning, etc. 9

20 Configuring Hypervisor managers You can change and assign which hypervisor manager the datastore serves. The VMware vcenter settings is where the VMstore gets virtual machine information for vsphere, and the RHEV-M (Red Hat Enterprise Virtualization Manager) setting is where the VMstore gets virtual machine information for RHEV. Figure 3-5 Configuring Hypervisor managers. To add a hypervisor manager: 1. Click Hypervisor managers to access the default settings. 2. Select either the vcenter, RHEV-M or Hyper-V option. 3. Enter the vcenter, RHEV-M or Hyper-V. 4. Enter the Username. When configuring for RHEV-M, enter the username followed when using the Internal OpenLDAP directory; or followed by the proper domain when using AD or other LDAP. Figure 3-6 Enter the username followed or proper domain name. 5. Enter the Password. 6. Click Save. Note: Specifying the username and password of a vcenter account with read-only permissions is insufficient. 10

21 Hyper-V hypervisor hosts do not need to have a username and password specified as with VMware or RHEV-M. Instead, the VMstore s Active Directory computer account credentials are used. In order to grant the VMstores access, Hyper-V hosts should have their corresponding VMstores made local administrators. Figure 3-7 Configuring Hyper-V. Testing server connectivity Click the Test hypervisor manager text link, to test the hypervisor server s connectivity and credentials. If connectivity is successful, OK is displayed next to the link. The VM view has a Hypervisor Type column that can be used to filter VMs by hypervisor server. Figure 3-8 Testing server connectivity. vcenter permissions and privileges The GUI allows each vcenter credential to be independently configured. In addition to the read-only role, the vcenter server requires the following permissions and privileges: For vcenter Server 4.1 Resource -> Assign Virtual machine to resource pool. Virtual Machine -> Inventory -> Register. Virtual Machine -> Provisioning -> Customize. Virtual Machine -> Provisioning -> Read customization specifications. Virtual Machine -> Provisioning -> Mark as Virtual Machine. Virtual Machine -> State -> Create Snapshot. Virtual Machine -> State -> Remove Snapshot. Virtual Machine -> State -> Revert Snapshot. Virtual Machine -> Configuration -> Rename. 11

22 Virtual Machine -> Configuration -> Settings. For vcenter Server 5.0 Resource -> Assign Virtual machine to resource pool. Virtual Machine -> Inventory -> Register. Virtual Machine -> Provisioning -> Customize. Virtual Machine -> Provisioning -> Read customization specifications. Virtual Machine -> Provisioning -> Mark as Virtual Machine Virtual Machine -> State -> Create Snapshot. Virtual Machine -> State -> Remove Snapshot. Virtual Machine -> State -> Revert Snapshot. Virtual Machine -> Configuration -> Set Annotation. Virtual Machine -> Configuration -> Settings. For vcenter Server 5.1 Resource -> Assign Virtual machine to resource pool. Virtual Machine -> Inventory -> Register. Virtual Machine -> Provisioning -> Customize. Virtual Machine -> Provisioning -> Read customization specifications. Virtual Machine -> Provisioning -> Mark as Virtual Machine. Virtual Machine -> Snapshot management -> Create Snapshot. Virtual Machine -> Snapshot management -> Remove Snapshot. Virtual Machine -> Snapshot management -> Revert Snapshot. Virtual Machine -> Configuration -> Advanced. Virtual Machine -> Configuration -> Set Annotation. Virtual Machine -> Configuration -> Settings. For vcenter Server 5.5 Resource -> Assign Virtual machine to resource pool. Virtual Machine -> Inventory -> Register. Virtual Machine -> Provisioning -> Customize. Virtual Machine -> Provisioning -> Read customization specifications. Virtual Machine -> Provisioning -> Mark as Virtual Machine. Virtual Machine -> Snapshot management -> Create Snapshot. Virtual Machine -> Snapshot management -> Remove Snapshot. Virtual Machine -> Snapshot management -> Revert Snapshot. Virtual Machine -> Configuration -> Advanced. Virtual Machine -> Configuration -> Set Annotation. Virtual Machine -> Configuration -> Settings. For RHEV-M All Administration privileges. Note: VMstores needing to query Hyper-V hosts for VM information will need to be made local Administrators of the Hyper-V host. Make the VMstores a member of an Active Directory group, and make that Active Directory group a member of the Administrators group on each of the Hyper-V hosts. Adding additional VMstores is then just a case of adding the new VMstore s Active Directory computer account to the same Active Directory group as the other VMstores. 12

23 Adding and removing hypervisor accounts You can use an IP address to avoid being affected by DNS failures. Changing the data IP address may result in VMs becoming unreachable. A maximium of 16 accounts can be added. To add or remove an account, use the and options. Figure 3-9 Adding and removing hypervisor accounts. Configuring NFS access You can specify which hosts in your environment can talk to the datastore by creating a white list of IP addresses. Only hosts with these specific IP addresses are allowed to access the datastore. Figure 3-10 Configuring NFS access. To specify an IP address or range of IP addresses, click NFS access. By default, all hosts are allowed to mount the datastore. To limit access: 1. Click NFS access to access the default settings. 2. Select the Only selected IPs allowed option. 3. Enter an IP address in the first field. An identical numeric value autopopulates in the second field. 13

24 4. Optional: Enter a sequentially higher IP address in the second field, if you choose to share VMs that are hosted on multiple IP addresses within that sequential range. 5. Click Save. To share more than one range of sequential IP addresses, use the and options. Figure 3-11 Configuring NFS access for only selected IPs. In the example above, any hosts trying to mount and to is denied access. The following IP addresses have been specified: All IP addresses ranging from: to The IP address: All IP addresses ranging from: to Configuring Protection System-wide default protection, which includes the snapshot schedule and replication, enables the VMstore to take routine snapshots of all VMs at regular pre-determined times and send those snapshots to the appropriate destination. Note: If a hypervisor does not support VM-consistent snapshots and you set up a default schedule with VM-consistent snapshots using that hytpervisor, then crash-consistent snapshots will be taken for that hypervisor instead of VM-consistent snapshots. Figure 3-12 Configuring the Snapshot schedule. 14

25 Setting up the default snapshot schedule To configure the default snapshot schedule for all VMs: 1. Click Protection to access the default settings. 2. Select and specify the Daily and Monthly options. You can also click on the Monthly text link to tweak what months the snapshots are to be taken. 3. Specify the day/s the snapshots are to be taken and exceptions to exclude from scheduling. 4. Enter the amount of time the snapshots are to be kept on the local machine in the Keep field. 5. Specify the Crash-consistent or VM-consistent options. 6. Click Save. You can take snapshots more than once a day by entering specific times, separated by a comma, in the Daily field. For example: to create snapshots every six hours, enter: 12:00am, 6:00am, 12:00pm, 6:00pm. Figure 3-13 Configuring the Snapshot schedule. To configure the snapshot schedule for weekly, monthly and quarterly options: 1. Click the more >> text link. 2. Select and specify the Hourly, Weekly, and Quarterly options. You can also click on the Monthly and/or Quarterly text links to tweak what months and/or months within the quarter the snapshots are to be taken. 3. Specify the day/s the snapshots are to be taken and exceptions to exclude from scheduling. 4. Enter the amount of time the snapshots are to be kept on the local machine. 5. Specify the Crash-consistent or VM-consistent options. 6. Click Save. Note: Reducing retention does not affect snapshots with pre-existing schedules. 15

26 Setting up default replication To configure default replication for all VMs, click Configure replication. For more details, refer to Configuring Replication on page 38. Figure 3-14 Configuring replication. Configuring Alerts VMstore triggers an for alert conditions, such as using more than 80% of performance resources or the temperature of the chassis is too high. Alert messages are also displayed in the alert inbox. Figure 3-15 Configuring alerts. To change how you receive alerts from a datastore: 1. Click Alerts to set up a recipient for alert notifications. 2. Adjust the slider to increase the amount of alerts and notification s to be sent. The Alerts only option is selected by default and only sends s for alerts. The middle setting sends s for important notices pertaining to failover, upgrades, disk activity, etc. The Alerts and all notices setting sends s for all alerts and all notices. 16

27 3. Specify the appropriate addresses in the From and To fields. 4. Specify the Outgoing SMTP Host. 5. Click the Test link for each of the above, three fields. If successful, OK is displayed next to the link. Figure 3-16 Configuring alerts. 6. Click more to specify mail server login requirements and secure connections. 7. Select Require mail server login and enter a Username and Password (optional). 8. Select a Secure connection option: No, TLS, or SSL. 9. Specify the SMTP port. 10. Specify the SMTP SSL port, if the Secure connection: SSL option was previously selected. 11. Click Save. Configuring SNMP targets To configure simple network management protocol (SNMP), click edit... in the SNMP targets section. For more details, refer to: Upgrading Tintri OS Software on page 42. Figure 3-17 Configuring SNMP targets. 17

28 Setting up a remote syslog server You have the option to automatically forward logs to a remote syslog server. Figure 3-18 Configuring a remote server. To set up a remote syslog server to receive logs: 1. Enter a domain in the Forward logs to field. 2. Click the Test forwarding link. If successful, OK is displayed next to the field. Enabling maintenance mode You have the option to delay s and SNMP traps so you do not receive alerts during field upgrades and installations. Figure 3-19 Entering maintenance mode. To enable maintenance mode: 1. Select the State: Enable option. 2. Click the Start time: Edit... option and specify when Time/Date maintenance begins. 3. Click the End time: Edit... option and specify when Time/Date maintenance ends. 18

29 4. Click Save. If maintenance is completed before the specified end time, select the State: Disable option. Figure 3-20 Entering maintenance mode. Note: During maintenance, an alert is displayed on the application bar. Configuring Autosupport The Autosupport service generates reports that provide information needed to help you quickly resolve any issues you may be experiencing. Autosupport is optional and highly recommended. The health information of your VMstore is uploaded nightly. A larger version of these nightly reports is the support bundle. Provide these reports to our support person as needed. To view an archive of generated reports, browse to: logs/tintri/phonehome/archive/. Figure 3-21 Configuring Autosupport service. To enable or disable the autosupport service: 1. Click Autosupport. 19

30 2. Select the Send Tintri Autosupport reports option. 3. Enter the Contact name. 4. Enter the address of the contact. 5. Enter the Phone number of the contact. 6. Enter the VMstore location. 7. Enter the Web proxy if your VMstore sits behind a firewall. 8. Enter the Web proxy. 9. Enter the Port. 10. Enter the Username. 11. Enter the Password. 12. Click Save. Configuring DNS It is important to ensure DNS information is accurate and resolved hostnames are reachable in the network. Figure 3-22 Configuring DNS. To change how hostnames are resolved: 1. Click DNS. 2. Enter the Primary DNS. 3. Enter the Secondary DNS. 4. Click Save. Configuring Management access The Tintri appliance comes with a pre-existing admin user role. Role-Based Access Control (RBAC) enables you to add local users with no active directory services, and external groups with varying levels of user privilege. 20

31 Admin/user privilege roles are: Super admin. Ability to perform any management task within the Tintri appliance. The pre-existing admin user is a member of the Super admin role. Storage admin. Ability to perform storage management tasks but cannot view or manipulate appliance security attributes. Read only. Ability to view but cannot modify storage management attributes. Figure 3-23 Configure Management access. Setting up local users To setup local management users: 1. Click Management access. 2. Click enter the username. 3. Enter the password in the password and confirm password fields. Figure 3-24 Configure Management access. 4. Click Role and select the appropriate user privilege: Read only, Storage admin, or Super admin. 21

32 5. Click Save. Figure 3-25 Configure Management access. Local manager passwords can be reset by mousing over the user display name or role and clicking reset password. Added managers can be deleted by mousing over the user display name or role and clicking delete user. Local managers with the role of Super admin cannot be deleted. Figure 3-26 Configure Management access. 22

33 Setting up external groups Before setting up external groups, you first need to enable directory services to simplify user account management. To enable directory services, click Enable and refer to Configuring Directory services on page 28 to complete the setup. Figure 3-27 Setting up external groups. To setup external groups: 1. Click for external groups. 2. Enter the Group name in the Group field. 3. Click Role and select the appropriate user privilege: Read only, Storage admin, or Super admin. The default role is Storage admin. 4. Click Save. Figure 3-28 Setting up external groups. 23

34 Added external groups can be deleted by mousing over the group display name or role and clicking delete group. Figure 3-29 Setting up external groups. Note: Before setting up external groups, you first need to enable directory services to simplify user account management. For more details, refer to Configuring Directory services on page 28. Changing your password The local password is used to reset the login privileges for managing the datastore. Click Change your password to access the Local password view. For more details, refer to Configuring Local password on page 36. Figure 3-30 Changing your password. 24

35 Configuring Certificates Certificates are supported in PEM (Privacy-Enhanced Electronic Mail) format, and can only be used in conjunction with Directory Services (TLS enabled). Only one host certificate can be uploaded. If an additional host certificate is uploaded, the previous host certificate will be replaced. When a custom host certificate is removed, the system default certificate is restored. Figure 3-31 Configure Certificates. Uploading Host Certificates To upload host certificates: 1. Click more and select Certificates. 2. Click Upload. 3. Enter the contents of the certificate file in the pop-up dialog. If you have a chained certificate, please place the host certificate before the intermediate certificate. 4. Click Save. Figure 3-32 Configure Certificates. 25

36 You have the option to: Click view thumbprint to view the certificate signature for verification. Click delete to remove the certificate. Figure 3-33 Configure Certificates. Uploading CA Certificates To upload CA certificates: 1. Click Upload. 2. Enter the contents of the trusted certificate file in the pop-up dialog. 3. Click Save. Figure 3-34 Configure Certificates. 26

37 Configuring Date and time The time zone and NTP information is stored here. You can use an IP address to avoid being affected by DNS failures, or you can use a fully qualified domain name. Figure 3-35 Configuring Date and time. To set the time zone and NTP information: 1. Click more and select Date and time. 2. Click the Time zone arrow and select the appropriate option. 3. Enter the Primary NTP. 4. Enter the Secondary NTP. To manually set the clock: 1. Click the Set the clock manually text link. 2. Click the Time arrow and specify the current time. 3. Click the Date option and specify the current date. 4. Click Save. Figure 3-36 Set the clock manually. Note: Setting the clock manually is not recommended. 27

38 Configuring Directory services You can simplify user account management by setting up directory services and adding one or more groups from the configured Active Directory domain. Figure 3-37 Configure Directory services. Directory services displays the configuration parameters for joining an Active Directory domain. As with any Active Directory domain member, the provided user credentials are only used once. These credentials will need sufficient privileges in the domain. Configuring for Active Directory Protocol The Domain name must be a complete DNS Domain name and not the machine s hostname or a NetBIOS domain name. To add one or more groups from the configured Active Directory domain: 1. Click more and select Directory Services. The Disabled option is selected by default. 2. Select the AD (Active Directory) option. 3. Enter the Domain name. 4. Enter the Username. 5. Enter the Password. Figure 3-38 Configure Directory services. 6. Click Domain Controllers. By default, the Domain Controller is set to Auto discover. 7. Optional: Select the Override option. 8. Enter one or more domain controllers (separated by a comma). 28

39 9. Click Save. The Settings window will automatically close. Figure 3-39 Configure Directory services. 10. Reopen the Directory Services window and click Verify saved domain join to validate the entered information. To continue, please refer to Setting up external groups on page 23. Figure 3-40 Verify the state of the Active Directory domain join. Note: If an Active Directory user is a member of two groups and each group is assigned a separate role, the least restrictive, most permissive set of privileges is applied. Configuring for Lightweight Directory Access Protocol The LDAP authentication driver is able to authenticate users against a variety of LDAP Directory Service Agents (DSAs) and LDAP schemas. Supported DSAs include: Microsoft Active Directory, OpenLDAP, and FreeIPA - namely the 389ds LDAP server. FreeIPA is also part of Red Hat Identity Services. A DSA is essentially the LDAP server implementation. An LDAP schema is the set of attributes around which an object such as a user account is defined. On top of the list of supported DSAs, other DSAs also work. Supported user account schemas include: Active Directory Users and Groups, FreeIPA Users and Groups and RFC2307 Users and Groups. 29

40 These schemas are independent of the DSA. It is possible to authenticate users using an RFC2307 schema, for example, with a FreeIPA or Microsoft Active Directory schema in cases where that might be necessary. The most common cases are automatically detected. It is generally not necessary to specify the schema and other LDAP parameters. The option, however, is available for environments that require more flexibility. LDAP Configuration Parameters In the majority of cases, simply providing a domain name and a username and password for a service account should suffice. In environments where more flexibility is required, other parameters may be specified. Base DN. The portion of the LDAP tree that searches for user and group accounts will be limited too. In cases of Active Directory and interdomain trusts, this may not apply to other domains. When not specified, a rootdse lookup is performed and the default- NamingContext attribute is used. Servers. A list of LDAP servers may be provided if necessary. If it is not provided, a DNS- SD lookup is performed to find a list of servers. Schema. Any of the supported schema types may be selected. If not provided, a few basic queries are performed to detect the most appropriate schema. Where multiple schemas are detected, they re used in the following order of precedence: Active Directory, FreeIPA and OpenLDAP. TLS. Where a given site requires encryption of LDAP traffic, a number of TLS/SSL options are available: DISABLED: No TLS will be attempted. PREFERRED: TLS will be attempted, but if certificate verification fails, operations continue. REQUIRED: TLS will be performed. A signed certificate must be provided and at least one CA certificate should be provided to verify the LDAP server s certificate. To add one or more groups from the configured Active Directory domain: 1. Click more and select Directory Services. The Disabled option is selected by default. 2. Select the LDAP (Lightweight Directory Access Protocol) option. 3. Enter the Domain name. 4. Enter the Username. 5. Enter the Password. Figure 3-41 Configure Directory services. 30

41 6. Click Overrides. By default, the Base DN and Servers options are set to Auto discover. 7. Optional: Select the Base DN: Override option and enter one or more domain names (separated by a comma). 8. Optional: Select the Servers: Override option and enter one or more domain names (separated by a comma). 9. If you have chosen an override option, select a Schema option. 10. Select a TLS option. 11. Click Test entered configuration to validate the entered information. Figure 3-42 Test entered LDAP configuration. 12. Click Save. To continue, please refer to Setting up external groups on page 23. Figure 3-43 Test entered LDAP configuration. 31

42 Configuring Hyper-V shares You can delete Hyper-V shares and/or remove user shared permission levels in the Hyper-V shares view. Figure 3-44 Configuring Hyper-V shares. To manage Hyper-V shares: 1. Click more and select Hyper-V shares. 2. Click the Share option and select the desired Hyper-V share. You can delete the share or delete permission levels for users. Figure 3-45 Configuring Hyper-V shares. 32

43 You have the option to: Click the delete share link to remove the share entirely. Click the delete link to remove permission levels. Figure 3-46 Configuring Hyper-V shares. 3. Click Save. Configuring LACP Link Aggregation Control Protocol (LACP) provides a method to control the bundling of several physical ports together to form a single logical channel. The VMstore supports static and dynamic link aggregation on all ports. The default configuration is disabled or static link aggregation. Optionally, you may enable dynamic link aggregation - which uses LACP to create an active-active link aggregation where both Ethernet ports are in a bond and active at the same time. Figure 3-47 Configuring LACP To set up LACP: 1. Click more and select LACP. 2. For the Admin network, Data network, and Replication network settings: Select disabled for static link aggregation. 33

44 Select enabled for dynamic link aggregation. 3. Click Save. Note: If you enable the LACP link aggregation, configure the link aggregation groups for the switch ports the VMstore is connected too. You must configure one group for each controller and each bond. For example, if you only enable the data network then you will need to configure two aggregation groups. Data network ports from controller A will need to be in one group and data network ports from controller B will be in the other group. Admin, data and replication networks must be in different aggregation groups. Configuring Licenses The Licenses view is for automatically add/removing feature licenses to your VMstore. Figure 3-48 Configuring Licenses. To add a license: 1. Click more and select Licenses. 2. Enter a license key in the Add new license field. All valid licenses are added automatically. Note: Added license are displayed in the Installed Licenses section. To add more or remove feature licenses, use the and options. 34

45 Adding an Encryption License Hardware encryption enables you to encode the HDD and SSD disks on your VMstore with an encryption key. If installing a UPG-License on an existing system, you must first add the encryption license before enabling encryption. Figure 3-49 Adding an encryption license. To add an encryption license, enter the license key in the Add new license field. All valid licenses are added automatically. The added license will be displayed in the Installed Licenses section. The enabling option is automatically displayed in a pop-up window. Warning: Encryption is not yet enabled. Once enabled, you cannot reverse the action. Data on the disk will be permanently encrypted. Refer to Hardware Encryption to verify the encryption process. Enabling Encryption If your system has a pre-installed UPG-License, you only need to enable encryption. Figure 3-50 Enabling encryption. 35

46 To enable encryption, click Encrypt now. Note: You will receive two alerts: the first alert confirms that encryption enabling has started, and the second confirms encryption has been enabled and successfully completed. To further verify that encryption has been successfully completed, refer to Encrypting Hardware on page 90. Configuring Local password The Local password view is used to reset the login privileges for the Super admin user. The VMstore can only have one Super admin user. Figure 3-51 Configuring Local passwords. Passwords must adhere to the following criteria: Be between 8 and 40 characters in length. Contain at least one lower case and one upper case character. Contain at least one digit and one special character: [ # $ %!. - ]. Must not be same as the previous password. To reset the password used for managing the datastore: 1. Click more and select Local password. 2. Enter the Current password. 3. Enter a New password. 4. Re-enter the new password in the Confirm password field. 5. Click Save. Note: If a local user (or non-admin) enters invalid credentials more than five times within a span of 15 minutes, then that local user account will be disabled. The user must reach out to another Super admin user to re-enable the account and reset the password. 36

47 Configuring SNMP Simple Network Management Protocol (SNMP) is an Internet-standard protocol for managing devices on IP networks. Figure 3-52 Configuring SNMP. To set up SNMP information: 1. Click more and select SNMP. 2. Enter an IP address or server name in the Send traps to field. 3. Enter a name in the Security user name field. 4. Click Authentication and select the appropriate option. 5. Enter the Authentication password. 6. Click Privacy and select the appropriate option. 7. Enter the Privacy password. 8. Click the Test SNMP text link. If connectivity is successful, OK is displayed. 9. Click Save. Accessing SNMP MIB files To download a current SNMP MIB file: 1. Go to the Tintri Support Portal. 2. Click Download and select the Releases tab. 3. Click More info... in the appropriate Tintri OS release section. 4. Right-click MIB file and save to your local machine. 37

48 Configuring Replication You can set up the VMstore to automatically replicate VMs from your system to other VMstores by specifying the replication destination, authentication passphrase, and an outgoing replication IP address. To add or remove additional replication destinations, use the and options. Figure 3-53 Configuring Replication. Setting up a destination When you edit the local replication key, remember to update the key to any VMstore systems that are pointing to your local VMstore as a destination. For more information, refer to: Rotating keys on page 41. Figure 3-54 Setting up a destination. To add a destination VMstore: 1. Click more and select Replication. 2. Specify the IP address or host name of the destination system in the Replicate to field. The display name is auto-filled. 3. Customize the Display name of the destination system (Optional). 4. Enter the Destination passphrase. Copy the passphrase value from the Destination 38

49 passphrase field in the destination system. 5. Click Replication IP and select the appropriate IP address destination. Note: The Local listening port is leveraged over from the Change how VMs replicate section. For more information, refer to: Pausing replication on page 42. Creating a new replication IP To set up a new replication IP address: 1. Click Replication IP and select Create New Enter the Source IP (Required) in the Create replication IP pop-up window. 3. Enter the Netmask (Required). 4. Enter the Gateway. 5. Enter the VLAN id. 6. Select the Physical Adaptor: admin network or, data network option (or select the replication network option if you have installed a 1GbE NIC card on your VMstore). 7. Click Save. Figure 3-55 Creating a new replication IP. Assigning an IP to a replication card If you have installed a 1GbE NIC card on your VMstore appliance, a one-time Assign IP to replication card text link is displayed. Figure 3-56 Assign an IP to a replication card. 39

50 To assign an IP to a replication card: 1. Click Assign IP to replication card. 2. Enter the Source IP (Required) in the Create replication IP pop-up window. 3. Enter the Netmask (Required). 4. Enter the Gateway. 5. Enter the VLAN id. 6. Click Physical adapter and select replication network. 7. Click Save. Figure 3-57 Assign an IP to a replication card. Setting up throttle throughput Bandwidth throttling is used to regulate network traffic and minimize bandwidth congestion. You can limit the throughput used by replication so that it does not interfere with daytime production traffic. Figure 3-58 Setting up throttle throughput. To set up the throttle: 1. Select the Throttle throughput option. The Business hours and Other hours fields are displayed. 2. Specify the maximum throughput for replication during slow, daytime traffic. 3. Specify the maximum throughput allowed for replication during night time traffic. 40

51 4. Click the Business hours text link and specify the time range and days of the week in the pop-up dialog. Figure 3-59 Setting up throttle throughput. Rotating keys Whenever you change the local passphrase of a system, be sure to update corresponding replication source. The Destination passphrase on the source must match Local passphrase on the destination. For key rotation, be sure to access and update both replication keys. Figure 3-60 Rotating keys. To update shared-key authentication: 1. Access the Replication settings on your local system. 2. Click edit and enter a new local passphrase on your local system. 3. Click Save. 4. Access the Replication settings on your destination system. 5. Enter the same replication key in the Destination passphrase field. 6. Click Save. 41

52 Pausing replication If you want to temporarily stop all replication traffic to give way to production traffic, you have the option to pause all replication from your local system. Figure 3-61 Pausing replication. To pause or resume all replication traffic: 1. Click more options. 2. Select Paused to stop all incoming and outgoing replication, or select Running to resume all incoming and outgoing replication. 3. Enter the Local listening port (Default: 1304) Replication uses port 1304 for servicing incoming replication traffic. Note: The Local listening port is populated over to the Replication paths section. For more information, refer to: Setting up a destination on page 38. Upgrading Tintri OS Software You can check for software upgrade packages on the Tintri Support Portal, manually upload a package to your VMstore, and perform a system upgrade. Figure 3-62 Configuring Upgrade. 42

53 To download a package: 1. Click more and select Upgrade. 2. Click the support.tintri.com text link to check for available packages. 3. Download the appropriate package to your local machine. Figure 3-63 Configuring Upgrade. To upload a package and upgrade your VMstore: 1. Click Upload. 2. Browse and select the package in the dialog window. The upload process is displayed in a status bar. Once the package has been uploaded, the package version number is displayed in the Upgrade to... button. Figure 3-64 Configuring Upgrade. 43