Accelerate with IBM Storage: Spectrum Virtualize 8.4 Technical Update - Byron Grossnickle Spectrum Virtualize/FlashSystem SME IBM Advanced ...

Page created by Katherine Newton
 
CONTINUE READING
Accelerate with IBM Storage: Spectrum Virtualize 8.4 Technical Update - Byron Grossnickle Spectrum Virtualize/FlashSystem SME IBM Advanced ...
Accelerate with IBM Storage: Spectrum Virtualize 8.4 Technical Update
Byron Grossnickle
Spectrum Virtualize/FlashSystem SME
IBM Advanced Technology Group
byrongro@us.ibm.com

© Copyright IBM Corporation 2021
Accelerate with IBM Storage: Spectrum Virtualize 8.4 Technical Update - Byron Grossnickle Spectrum Virtualize/FlashSystem SME IBM Advanced ...
Accelerate with IBM Storage Technical Webinar Series

Advanced Technology Group – Storage experts cover a variety of technical topics.

Audience: Clients who have or are considering acquiring IBM Storage solutions. Business Partners and IBMers are also welcome.

To automatically receive announcements of upcoming Accelerate with IBM Storage webinars, Clients, Business Partners and IBMers are
welcome to send an email request to accelerate-join@hursley.ibm.com.

Accelerate with IBM Storage Support Site:                               ATG – Storage Media Center Channel:
https://www.ibm.com/support/pages/node/1125513                          https://ibm.biz/BdfEgQ

2021 Upcoming Webinars:
April 6 – Four Things You Probably Don’t Know That TDMF (Transparent Data Migration Facility) Can Do
      Register Here: https://ibm.biz/BdfidP

April 15 – IBM Cloud Object Storage Level 301
      Register Here: https://ibm.biz/BdfiXB

April 22 – Spectrum Scale and QRadar - A winning combination that helps reduce the impact of security incidents on business data
      Register Here: https://ibm.biz/BdfZUR

April 29 – A Day in the Life of a Storage Insights Administrator
      Register Here: https://ibm.biz/BdfZQE

  © Copyright IBM Corporation 2021
Accelerate with IBM Storage: Spectrum Virtualize 8.4 Technical Update - Byron Grossnickle Spectrum Virtualize/FlashSystem SME IBM Advanced ...
Accelerate with IBM Storage Technical Webinar Series - Survey

Please take a moment to share your feedback with our team!

You can access this 5-question survey via Menti.com with code 15 75 27 5 or

Direct link https://www.menti.com/mkg7a2x6q8

Or

QR Code

 © Copyright IBM Corporation 2021
Accelerate with IBM Storage: Spectrum Virtualize 8.4 Technical Update - Byron Grossnickle Spectrum Virtualize/FlashSystem SME IBM Advanced ...
•       Release Schedule
Agenda                              •       Three Site Metro/Global Mirror with HyperSwap
                                    •       Data Reduction Pool (DRP) Updates
                                    •       Distributed RAID 1 (DRAID1)
                                        •    DRAID Enhancements
                                    •       Security Updates
                                    •       GUI Updates
                                    •       Miscellaneous Topics

                                                                                            4
 © Copyright IBM Corporation 2021
Accelerate with IBM Storage: Spectrum Virtualize 8.4 Technical Update - Byron Grossnickle Spectrum Virtualize/FlashSystem SME IBM Advanced ...
Release Schedule

8.4.0.0 eGA – 11/13/2020

8.4.0.2 eGA – 02/19/2021

8.4.0.2 pGA – 02/19/2021
  • FlashSystem 5015
  • FlashSystem 5035
  • FlashSystem 5200

                           5
Accelerate with IBM Storage: Spectrum Virtualize 8.4 Technical Update - Byron Grossnickle Spectrum Virtualize/FlashSystem SME IBM Advanced ...
Three Site Metro/Global Mirror with HyperSwap

  © Copyright IBM Corporation 2021
Accelerate with IBM Storage: Spectrum Virtualize 8.4 Technical Update - Byron Grossnickle Spectrum Virtualize/FlashSystem SME IBM Advanced ...
Original 3 Site Design(Still Valid) – Delivered in 8.3.1

                                      Site 1 - Master                                                        Site 2 - AuxNear
                                      Single System                        Metro Mirror                        Single System
                                                                           Relationship

                                                  Access                                                  Access
                                                   Point                                                  Point

                    First GM relationship performs         Global Mirror                  Global Mirror            Second GM relationship shadows
                    incremental cycles using                                                                       operation of first and is able to
                    FlashCopy into GM to send deltas                   DR Volume                                   restart a cycle if it is interrupted
                    to DR                                                                   Site 3 - AuxFar
                                                                                            Single System

Note: With 8.4 this model goes GA                                                                                    Note: Links to the AuxFar site
and no longer requires a SCORE                                         Access Points                                 MUST be FC based
(RPQ)
                                                                                                                                                          7
   © Copyright IBM Corporation 2021
Accelerate with IBM Storage: Spectrum Virtualize 8.4 Technical Update - Byron Grossnickle Spectrum Virtualize/FlashSystem SME IBM Advanced ...
3 Site HyperSwap Overview

                                    •   Note: Assume dual fabrics where “fabric” is mentioned
                                    •   Note: With HyperSwap a FC or IP partnership can be used to the Auxfar site. For normal Metro/Global mirror a   8
 © Copyright IBM Corporation 2021       FC partnership MUST be used
Accelerate with IBM Storage: Spectrum Virtualize 8.4 Technical Update - Byron Grossnickle Spectrum Virtualize/FlashSystem SME IBM Advanced ...
3 Site HyperSwap Overview Continued

                                      9
 © Copyright IBM Corporation 2021
Accelerate with IBM Storage: Spectrum Virtualize 8.4 Technical Update - Byron Grossnickle Spectrum Virtualize/FlashSystem SME IBM Advanced ...
3 Site HyperSwap Overview

•     Active – Active Relationship capability with ability to asynchronously copy data to DR (Auxiliary Far)
      site
•     Zero RTO / RPO across HyperSwap sites and minimum RPO of 10 min on far site (5 minutes cycle
      time)
•     Automatic coordinated replication to DR (Auxiliary Far) site using external Orchestrator.
•     Ability to convert existing HyperSwap configuration to 3-site configuration
•     Stateless and Fault Tolerant Orchestrator architecture for managing 3 site replication.
•     Protocol agnostic architecture – Can use FC OR IP for all or part of the solution
•      Limits for HyperSwap(1250 vols (8.3.1) -> 2000 vols (8.4)) and as per standard GMCV
      implementations

                                                                                                               10
    © Copyright IBM Corporation 2021
3 Site HyperSwap Terminology

• 3 site consistency group states:
 •       3 site consistent : A consistent copy is available on far site
 •       3 site inconsistent : Far site does not have consistent image
 •       2 site periodic: Indicates one of near site is not part of 3 site replication
 •       Stopped: Indicates data cycle is stopped
 •       Partial: Indicates that all relationship in consistency group are not converted to 3 site

                                                                                                     11
 © Copyright IBM Corporation 2021
3 Site HyperSwap Use Cases

•       Regulatory Compliance
    •       Need to maintain 3+ copies of production data
•       High Availability during Disaster (Site Failures)
    •       Ensuring availability of minimum 2 copies of data at all times
•       High Availability during Maintenance
    •       Ensuring availability of minimum 2 copies of data during maintenance
•       High Availability during Link Failure
    •       Ensuring availability of minimum 2 copies of data during link failures
•       Site Migration
    •       HyperSwap Cluster migration from one location to another using FAR site
•       Load Balancing
    •       Load balancing between sites for periodic replication source

                                                                                      12
    © Copyright IBM Corporation 2021
DRP Updates

 © Copyright IBM Corporation 2021
• Uses DRP’s internal deduplication
Redirect-on-write for DRP snapshots                   referencing capabilities to reduce
                                                      overheads by creating references instead of
                                                      copying the data

                                                    • Adds a redirect-on-write (RoW) alternative
                                                      to the existing copy-on-write (CoW)
                                                      capabilities

•   Also known as Flash Optimized Snapshots (FOS)   • Source and Target MUST:
                                                      • Be deduplicated
•   Reduced backend I/O amplification for
    snapshots                                         • Reside in the same DRP pool
                                                      • Reside in the same I/O Group
•   Better deduplication ratio for snapshots        • Volume cannot be mirrored (VDisk mirroring)

                                                    • Automatic mode selection (RoW/CoW) based on the
                                                      conditions above (Note: no way to verify)
                                                                                                        14
    © Copyright IBM Corporation 2021
Redirect On Write Snapshots for DRP – AKA Flash Optimized Snapshots

                                              host write

                                      FC
                                                 read grain on source                     write grain data to                        write new host data
                                                       volume                                   target
                                      …

                          Before
                            RoW      DRP                    read source grain   read grain data           read target grain   write grain data   write new host data
                                                               metadata                                      metadata

                                      …

                                    Backend

                                              host write

                                      FC
                                                 copy grain command                        write new host data

                                      …

                           With
                           RoW       DRP                    read source grain      create                 write new host data
                                                               metadata         deduplication
                                                                                    links
                                      …

                                    Backend

 © Copyright IBM Corporation 2021
Child Pools in a Data Reduction Pool

•       New pool type, child_quotaless
    •       Child pools in a standard pool continue to function the same
•       Child pool consumes parent’s free capacity as volumes are created
    •       No way to set quota
•       Child pool shares parent pool’s encryption key
    •       In a standard pool, for externally encrypted storage, the keys for child and parent could be different
•       Cannot set a separate space warning level. Warning alert is at parent level
•       Child Pools allow Object Based Access Control to be used with a DRP
    •       vVols are not supported yet
•       Same rules for volume creation as parent DRPs (data reduction, fully allocated, compressed,
        deduplicated volumes)
•       Child and parent DRPs share data disks
•       Garbage collection works across parent and child pools

                                                                                                                     16
    © Copyright IBM Corporation 2021
Migration within a DRP (migratevdisk)

•       All volumes can be migrated between parent and child DRPs, and between child DRPs
•       Volumes can only be migrated from a child DRP to and from its parent, or child pools in the same
        parent
    •       addvdiskcopy can be used to get between DRP pools
•       Volumes can be migrated between encrypted data reduction parent and child pools, as they share an
        encryption key.

         Note: Volume copy (VDisk mirroring) can be used for other types of data movement                   17
    © Copyright IBM Corporation 2021
Distributed RAID 1 (DRAID1)

 © Copyright IBM Corporation 2021
What Is DRAID-1?

 • DRAID-1 is a distributed mirrored based RAID configuration
       – Logical mirror and rebuild area distributed over all member drives
 • Supports all DRAID-5 and 6 features
 • Minimum 2 drive configuration and maximum of 16 drives
      – Not available for FCM-XL (38.4TB) modules

                                                                              19
 © Copyright IBM Corporation 2021
DRAID1 - Purpose

•       Extremely high I/O performance
    •       All drives participate in I/O
    •       Optimized I/O path for multi-core CPUs
•       Extremely fast rebuild on small arrays to a distributed rebuild area
    •       All drives participate in rebuild
•       High performance solution for small SCM/flash arrays
•       Entry point for FCM based FlashSystem
    •       2 large (19.2TB) FCM2/FCM2.1 drives or 2 SCM drives

                                                                               20
    © Copyright IBM Corporation 2021
DRAID1 – Configuration Considerations

•       2 member drives per array (0 rebuild area)
    •       SSDs - including SAS flash drives, NVMe flash drives, NVMe FCMs
    •       SCMs - up to 8 TB for each member drive
•       3 - 16 member drives per array (1 rebuild area)
    •       Same as 2 member drive arrays
    •       HDDs (spinning disks) - up to 8 TB for each member drive
•       System recommendation is to create DRAID-1 in arrays up to 6 drives
    •       GUI will allow creation only up to 6 drives
        •        Can go to the max from the CLI
•       Minimum extent size: 1024 MB
    •       Note: This is the first DRAID type with a minimum extent size
•       Stripe width (width of a single unit of redundancy) – 2
•       Strip size: 256 KB Only

                                                                              21
    © Copyright IBM Corporation 2021
DRAID-1 Configuration - Rebuild

 • Rebuild operation starts when one of the array
     drives fails and the rebuild area is available
      – If rebuild area is not available, array state will
           change to degraded

 • All array drives participate in the rebuild
      – No bottlenecks

                                                             Note: Diagram is logical only. Rebuild area spread across all drives

                                                                                                                                    22
  © Copyright IBM Corporation 2021
DRAID-1 Configuration – Rebuild-in-Place (a new capability)

 • DRAID-1 is the only distributed array that can be configured without a rebuild area.
     – Minimum configuration of two drives

 • When a drive is failed and replaced, the rebuild-in-place process starts to mirror the
    data.
     – Multithreaded operation (faster compared to TRAID)

                                                                                            23
  © Copyright IBM Corporation 2021
Degraded Copyback Problem – Solved in 8.4.0.2

• Problem                                                        • Solution
• This situation occurs in a DRAID5/6 array when                 • Rebuild in Place – Introduced with the release
    there is a drive failure with no spare areas                     of DRAID1
    available before a copyback (which is using the                •   The copyback will pause
    spare area) gets done processing.                              •   The second drive that had failed (and been
  •       In that situation, there is a copyback going on that         replaced) will be rebuilt in place to restore
          is reliant on data being reconstructed from parity.          redundancy quickly
          This significantly slows down the copyback               •   The copyback will be continued in a non-degraded
  •       Little or no redundancy and even if the failed drive         mode
          is replaced a spare out cannot occur until the
          copyback in process finishes.

                                                                                                                          24
  © Copyright IBM Corporation 2021
DRAID1 – Supported Platforms

•       Released Platforms
    •       FlashSystem 9200 (AG8/UG8)
    •       FlashSystem 7200 (824/U7C)
    •       FlashSystem 5015, 5035, 5200 – (DRAID only)
•       All New Future Platforms
    •       DRAID only
    •       TRAID 1/0/10 will not be supported on any new platform

                                                                     25
    © Copyright IBM Corporation 2021
Distributed RAID Planning

                                     26
  © Copyright IBM Corporation 2021
Distributed RAID Planning – Continued

                                        27
  © Copyright IBM Corporation 2021
DRAID1 – Performance: System Details

•       FlashSystem 5100 (yes, we know it’s not supported in the field)
    •       8 x 32 Gb ports connected via 32 Gb FC switch
    •       64 x 32 GB VDISKs
    •       Samsung 2 TB NVMe drives
        •        TRAID-1 with 2 drives using 80% physical capacity
        •        DRAID-1 with 2 drives using 80% physical capacity

                                                                          28
    © Copyright IBM Corporation 2021
DRAID1 Performance Graph

                                                                                                                      29
 © Copyright IBM Corporation 2021   Note: The performance difference is due to the muti-threading of the DRAID code
DRAID1 Performance Graph

                                                                                                    30
 © Copyright IBM Corporation 2021   Note: The write performance bottleneck now becomes the drives
DRAID Rebuild Rates

•       FCMs
    •       DRAID1/5/6 – Rebuild target is 5.1 TB/hr
•       Industry Standard NVMe Drives
    •       DRAID1/5/6 – Rebuild target is 2.5 TB/hr for one rebuild area, 5 TB for 2 concurrent rebuilds

                                       Note: More parameters are included in the equation to calculate the rebuild rate and in some cases,
                                       depending on stripe width, the rebuild rate for an array with FCM/NVME members can be set to 3.7      31
    © Copyright IBM Corporation 2021
                                       TB/hr
128 KB Strip Size Removal

•       Removes the ability to create new DRAID (1/5/6) arrays with 128 KB strip size
    •       CCU for arrays with 128 KB strip size is supported
    •       T4 recovery for arrays with 128 KB strip size is supported
    •       DRAID-1 with 128 KB strip size is not supported at all
    •       Removed from both GUI and CLI

•       Reasons are:
    •       Little benefit of 128 KB strip size in today's operating environment
    •       Part of the "Do No Harm" drive, reduces configuration complexity in field

                                                                                        32
    © Copyright IBM Corporation 2021
© Copyright IBM Corporation 2021
•       Choice of local or remote authentication (or use
Prior to 8.4                                 both)
                                     •       The remote authentication admin can set
                                             password and account policies, and
                                             authentication policies
                                     •       No policy options for local accounts.
                                         •     Minimum password length always 6
                                         •     The only customisable option was the session timeout
                                               when using GUI

                                                                                                      34
  © Copyright IBM Corporation 2021
• For local accounts
Clients want …                         •   To set their own password policy e.g. 15 characters
                                           minimum, must include 1 number and 1 special
                                           character.
                                       •   More control over account locking.
                                       •   IBM to meet competitive/existing password policy
                                           options
                                       •   A way to disable the superuser account (and use
                                           LDAP authentication only).

                                                                                                 35
  © Copyright IBM Corporation 2021
• A new set of options to allow a security admin to
What IBM is Delivering for Local Accounts     create policies for passwords, account lockout,
                                              session timeout.
                                            • Create a single system-wide policy that applies to
                                              all local accounts (session timeouts also apply to
                                              remote accounts).

                                                                                                   36
  © Copyright IBM Corporation 2021
•       Customizable
Local Password Creation Options              • Minimum password length (6 – 64 characters)
                                             • Minimum number of upper-case characters (1 – 3)
                                             • Minimum number of lower-case characters (1 – 3)
                                             • Minimum number of special characters (1 – 3)
                                             • Minimum number of digits (1 – 3)

                                     •       A new policy does not apply retroactively to existing
                                             passwords
                                         •      However all passwords can be invalidated forcing users to
                                                change their passwords
                                     •       Any new passwords must meet the current policy
                                             setting.

                                                                                                     37
  © Copyright IBM Corporation 2021
•       Password History checking can be enabled.
Password Creation Rules                 •     0 – 10 previous passwords can be checked.
                                    •       Stores the previous password hashes only (i.e.
                                            no plaintext).
                                    •       0 = compare the current password only.
                                    •       10 = check that the new password does not
                                            match the current password or the 10
                                            passwords used prior to the current password.
                                    •       The minimum required password age can be set
                                            (0 – 365 days). A minimum age of 1 means that
                                            a user can only change password once per day.
                                            (which prevents a user from cycling through the
                                            history.)
                                    •       The history is not checked when a security
                                            admin changes another user’s password.
                                    •       Not supported on FlashSystem 5010(E).
                                        •     Memory constraints

                                                                                          38
 © Copyright IBM Corporation 2021
•       Passwords can be set to expire after 0 – 365
Password Expiry                             days.
                                    •       All existing passwords will be set to expire in X
                                            days when the setting is first enabled.
                                    •       A user with an expired password can log into
                                            the system, but will have monitor privilege only
                                        •     When they change the password the previous
                                              privileges will be restored
                                    •       An expiry warning can be enabled (0 – 30 days)
                                            which will warn the user on login that their
                                            password will expire in X days. (Only on the CLI
                                            in 8.4)

                                                                                                39
 © Copyright IBM Corporation 2021
•       The security admin can force a user to change
                                            their password at any time. The password will
Requiring Password Change                   expire immediately. (CLI – individual users, GUI
                                            – button to reset all user password)
                                        •     Can be used when creating a new user to require a
                                              password change on first login.
                                        •     Can be used after changing password policy
                                              settings.

                                                                                                  40
 © Copyright IBM Corporation 2021
Manual Account Locking - CLI Only

                                     • The security admin can manually lock and unlock user accounts:
                                      • svctask chuser -lock bill
                                      • svctask chuser -unlock ted

                                     • A locked account is not allowed to log in to the system.

                                                                                                        41
  © Copyright IBM Corporation 2021
•       Set the maximum number of failed login
Automatic Account Locking                   attempts (0 – 10)
                                        •     The counter is reset on a successful login
                                    •       Set the length of time a user will be locked out
                                            of the system (0 – 10080 minutes (which is 7
                                            days), 0 = indefinite)

                                                                                               42
 © Copyright IBM Corporation 2021
• Feature available on platforms with a dedicated
                                       techport (i.e. not FlashSystem 5010(E), 5030(E)
Disabling Superuser                    or Spectrum Virtualize for Public Cloud).
                                     • Explicit option to enable superuser locking
                                       •   svctask chsecurity -superuserlocking enable
                                       •   svctask chuser -lock superuser

                                     • Use case: Some enterprises have policies that all
                                       systems should use remote auth.
                                     • Configure remote auth, create a remote security
                                       admin, disable superuser (now no local accounts
                                       can log in to the system).
                                     • The superuser account is still required for satask
                                       actions and recovery actions e.g. T3/T4 recovery.
                                       Automatically unlocked for recovery and must be
                                       manually relocked afterwards.

                                                                                            43
  © Copyright IBM Corporation 2021
Configurable Session timeouts

                                     CLI timeout   5 – 240 minutes

                                     GUI timeout   5 – 240 minutes

                                                                     44
  © Copyright IBM Corporation 2021
Default Policy Settings – New 8.4 Cluster

       • >svcinfo lssecurity                          check_password_history no
       • sslprotocol 3                                max_password_history 6
       • sshprotocol 1
                                                      min_password_age_days 1
       • gui_timeout_mins 30
                                                      password_expiry_days 0
       • cli_timeout_mins 15
       • min_password_length 8                        expiry_warning_days 14
       • password_special_chars 0                     superuser_locking disabled
       • password_upper_case 0                        max_failed_login_attempts 0
       • password_lower_case 0
                                                      lockout_period_mins 10
       • password_digits 0

                                                                                    45
       Note: svctask chsecurity will change options
 © Copyright IBM Corporation 2021
Default Policy Settings - Upgrade to 8.4

      • >svcinfo lssecurity                           check_password_history no
      • sslprotocol 3                                 max_password_history 6
      • sshprotocol 1
                                                      min_password_age_days 1
      • gui_timeout_mins 120
                                                      password_expiry_days 0
      • cli_timeout_mins 60
      • min_password_length 6                         expiry_warning_days 14
      • password_special_chars 0                      superuser_locking disabled
      • password_upper_case 0                         max_failed_login_attempts 0
      • password_lower_case 0
                                                      lockout_period_mins 10
      • password_digits 0

                                                                                    46
       Note: svctask chsecurity will change options
 © Copyright IBM Corporation 2021
GUI View – Password Creation Options

                                       47
   © Copyright IBM Corporation 2021
GUI View – Password Expiration and Account Lockout

                                                     48
   © Copyright IBM Corporation 2021
GUI View – Inactivity Logout

                                      49
   © Copyright IBM Corporation 2021
GUI View – Create a New User or Change Password

                                                  50
 © Copyright IBM Corporation 2021
HTTP proxy server for CloudCallhome and SRA Log Upload

Use a Customer proxy server to send IBM support data:
  •        CloudCallhome events and inventories
  •        Upload support logs i.e dumps and snaps

                                    Benefits of using a proxy

                                    1. Improved Security

                                    •   Fine grained authentication to use proxy

                                    •   Cluster IP not disclosed in Internet traffic - proxy can generate IPs

                                    •   Latest OS patches applied to proxy benefits security of all clusters

                                    2. Auditing

                                    • History trail of support data sent

                                    • Police traffic by inspecting contents
                                                                                                                51
 © Copyright IBM Corporation 2020   3. Reduced configuration for network administrators
Cloud Call Home (8.2 / 8.3)

                                                          Four outbound firewall rules need to be created
                                   Internet
                                                          per cluster
                                                          •   esupport.ibm.com
                                                          •   192.42.54.189
                                                          •   192.42.56.189
                                                          •   192.42.60.189
                                   Firewall
                                                          Network administrators resent giving a Cluster
                                                          direct internet access

                                                          Data sent using https to esupport.ibm.com or to
                                                          IP. Cluster trusts esupport via certificate.

                                                          Customer cannot monitor what data is being
                                                          sent to IBM support; an issue for security
                Cluster A                     Cluster B   sensitive customer

© Copyright IBM Corporation 2020                                                                            52
Cloud Call Home via Customer Proxy (8.4)

                                                          Just one firewall rule for the proxy, to
                                   Internet
                                                          • esupport.ibm.com

                                                          Each cluster needs DNS configured
                                                          Proxy URL entry via name, not IPv4/IPv6

                                   Firewall               Proxy controls access out to Internet
                                                          1. Username / password
                                                          2. Proxy certificate
                                                          3. Open – no restriction
                                   Customer
                                    Proxy                 Customers can audit data sent to support by
                                                          installing a certificate and using an Intercepting
                                                          Proxy

                Cluster A                     Cluster B

© Copyright IBM Corporation 2020
                                                                                                               53
Cloud Call Home via Customer Proxy (8.4)
mkproxy -url http://proxy -port 8080 -username me –password secret
                                       HTTP connection over trusted internal network to Proxy
                                           Proxy                Firewall              Internet
                                                                                                              IBM
        Cluster
                                                                                                            esupport
                                                            Secure HTTPS connection tunneled via Proxy                   SUPPORTED

mkproxy -url http://proxy -port 8080 -username me –password secret –sslcert /upgrade/proxy-cert.pem
                                       Intercepting             Firewall              Internet
                                           Proxy                                                              IBM
        Cluster
                                                                                                            esupport

                                                             Secure HTTPS connection intercepted by Proxy
                                                             Proxy can inspect/log information being sent
                                             Log
                                                                                                                          SUPPORTED

mkproxy -url https://proxy -port 8080 -username me –password secret –sslcert /upgrade/proxy-cert.pem
                                       Secure HTTPS connection to Proxy
                                           Proxy                Firewall              Internet
                                                                                                              IBM
        Cluster                                                                                                                   54
                                                                                                            esupport
    © Copyright IBM Corporation 2020
                                                                                                                       NOT SUPPORTED
Secure Data Deletion

• Previously                                                 • Now
• The user could perform a chdrive -task format              • Uses the new NVMe Sanitize command to
                                                       securely erase all user data
  •       Not clear to the user that this would also be a    •   User initiated via chdrive -erase 
          secure erase
                                                             •   Progress can be monitored via lsdriveprogress
  •       Relied on a NVMe format flag to ask for a secure
          format                                             •   Performs both a crypto erase and a block erase
                                                                 if available, followed by a TCG revert and NVMe
  •       Drive was able to downgrade a user data erase to
          a crypto erase                                         format

                                                                                                                   55
  © Copyright IBM Corporation 2021
Secure Data Deletion

Caveats                                       • Adds the following events
• If a drive does not support sanitize we     • 090032 – NVMe drive secure erase failed
  continue with a TCG revert and NVMe         • 989011 – NVMe drive secure erase started
  format                                      • 989012 – NVMe drive secure erase
• If the sanitize fails, we continue, again     successfully completed
  with the TCG revert and NVMe                •
  format.
• Optane drive current FW contains a
                                              • Additionally, the following event was
  bug that often causes sanitize failures       added
                                              • 989013 – NVMe drive format successfully
                                                completed

                                                                                           56
 © Copyright IBM Corporation 2021
© Copyright IBM Corporation 2021
Syslog Servers

                                    58
 © Copyright IBM Corporation 2021
Create Host Dialog

                                    59
 © Copyright IBM Corporation 2021
Modernized Add Storage to Pool Experience

                                            60
 © Copyright IBM Corporation 2021
New Remote Copy Experience (2-site)

                                      61
 © Copyright IBM Corporation 2021
New Remote Copy Experience (2-site)

                                      62
 © Copyright IBM Corporation 2021
Suggested Task Notifications

                                    63
 © Copyright IBM Corporation 2021
© Copyright IBM Corporation 2021
New Remote Copy Experience (3 –site)

                                       65
  © Copyright IBM Corporation 2021
Configure 3-site partnership

                                     66
  © Copyright IBM Corporation 2021
Populating a 3-site partnership

                                     67
  © Copyright IBM Corporation 2021
3-site for HyperSwap Volumes

                                    68
 © Copyright IBM Corporation 2021
3-site Partnership Panel

                                     69
  © Copyright IBM Corporation 2021
3-site Partnership Consistency Group Actions

                                               70
  © Copyright IBM Corporation 2021
3-site Consistency Group Detail View

                                       71
  © Copyright IBM Corporation 2021
© Copyright IBM Corporation 2021
Comprestimator always on                          Up-to-date compression estimation over
                                                  the entire cluster
                                                  Runs every 12 hours

                                                  Displayed in GUI and Storage Insights

•   Helps drive adoption of data reduction
    technology by showing its potential
•   Can be monitored over time to identify good
    candidates for compression or I/O pattern
    changes

                                                                                           73
8.4.0 Minor Enhancements   • lsportstats and utilportstats

                               • lsportstats –node  []

                               • greps the port error counters and SFP stats
                                 from the node statistic file.

                               • utilportststs can be installed on any old
                                 version in the field.

                           • chenclosureslot now supports power control to
                             recover offline drives

                           • Changes to memory upgrade procedures
                               • attempting a memory upgrade now requires
                                  removing, rebooting and re-adding the node
                               • chnodehw only applies to adapters

                                                                               74
Terminal Software Releases   • Storwize V5000 G2 – 2077/2078 Models V5010
                               (112/124), V5020 (212/224)

                                 • 8.2.1.x

                             • Storwize V5000 G2 – 2077/2078 Models V5030
                               (312/324)

                                 • 8.3.1.x

                             • V9000 - 9846/9848 Models AC2/AE2

                                 • 8.2.1.x

                             • V9000 - 9846/9848 Models AC3/AE3

                                 • 8.3.1.x

                              Note: All 5000 MTMs (except G1) other than those listed
                              above are supported on 8.4                                75
Updates to Max Config Limits

                                                      Double FlashCopy Mappings limits on all platforms
                        Previously (8.3.1)   8.4.0
                                                      Hyperswap volume limit increased to 2000 on
vdisk                         10,000         10,000
                                                      FlashSystem 7200, 9100, 9200, Storwize V7000
Host-mappable volumes         10,000         10,000   Gen3 and SVC
FlashCopy Mappings            5,000          10,000

Async num volumes             5,000          5,000

Async max capacity            720TB          720TB

HA num volumes                1250           2,000

HA max capacity               720TB          720TB

HA + 3 site volumes           1,250          2,000

                                                                                                      76
8.4.0 Mirrored VDisk Fast   • Creating a Mirrored VDisk

Format Enhancements             • Fully allocated copies always do fast format on
                                  expanded regions; eliminate need to
                                  resynchronize after format
                            • Expanding a Mirrored VDisk
                                • Fully allocated copies always do fast format on
                                  expanded regions; eliminate need for offline
                                  format
                                • New capacity is available immediately
                            • Expanding or shrinking a VDisk when fast format is
                              ongoing
                                • Supported in all cases; remove need to wait for
                                  fast format to complete before changing VDisk
                                  capacity to allow for better
                                  automation/orchestration integration
                            • Expanding a mirrored volume in an ESC with remote
                              mirror enabled
                                • No change volumes can be configured

                                                                                    77
8.4.0 FC-NVMe-oF   • Host attachment with FC-NVMe is supported for
                     HyperSwap systems
Enhancements       • Expanding FC-NVMe host operating systems
                     support matrix:
                       • VMWare ESXi 7.0
                       • AIX 7.2 7200-04-01
                       • Windows 2012 R2
                       • Windows 2016
                       • Windows 2019
                   • Expanding FC-NVMe host adapter support
                     matrix:
                       • QLogic 2690 Series
                       • QLogic 2770 Series

                                                                     78
SCM Restrictions Lifted

• Drive slots no longer policed
• Up to 12 SCM drives now supported
• DRAID1 recommended for best performance

                                            Samsung Z-SSD   Intel Optane

                                                                           79
  © Copyright IBM Corporation 2021
DNS for LDAP and NTP

       • Full DNS length i.e. 256 characters, is supported.
       • DNS server must be present to use DNS, and cannot be removed if it is used by NTP or LDAP
       • The failure of the LDAP or NTP server is reported in the eventlog.

        Service                                  8.4.0.0 DNS Support
        LDAP                                     Supported
        Ping                                     Supported
        NTP                                      Supported
        Syslog                                   DNS name limited to 40 characters, 256 Planned

        HTTP Proxy (see security section)        Supported

                                   Note: More items will be configured for DNS in the future         80
© Copyright IBM Corporation 2021
Monitor Access for Data Collector

•       Prior to 8.3.1.2 Spectrum Control/Spectrum Insights required administrator access to function.
•       With code level 8.3.1.2 and Spectrum Control 5.3.7 the data collector userid can have monitor privileges if
        stats collection is turned on in the cluster
    •        If not, Insights/Control will give a message stating that stats are not turned on
    •        svctask startstats -interval 5 can be run by an administrator to turn on stats collection on the cluster

    © Copyright IBM Corporation 2021                                                                                    81
Entry Enterprise            Midrange           High-End        Hybrid
IBM                                                   Enterprise         Enterprise      Cloud
FlashSystem                  ALL NEW
Family
8.4.0.2

Storage made
simple for
                                                                      FlashSystem 9200
hybrid cloud                                                              and 9200R
                                                 FlashSystem 7200
                          FlashSystem 5200
Watch the demo
ibm.biz/flashsystemdemo
                          FlashSystem 5035
                          FlashSystem 5015               IBM Spectrum Virtualize
                                                  Consistent software capabilities
                                                       IBM Storage Insights                       82
                                 IBM and BP Only Until Announce
83
© Copyright IBM Corporation 2021
You can also read