Dell PowerScale Prerequisites

Last Updated

18 February 2025

OneFS Version Requirements:
1. For SMB workloads using CEE and RabbitMQ, the minimum required version of OneFS is v8.1.0.x.
2. For SMB workloads using syslog, the minimum required version of OneFS is v9.5.0.x. PeerSync is not supported for SMB workloads using syslog.
3. For NFS and multi-protocol workloads using syslog, the minimum required version of OneFS is v9.5.0.x. PeerSync is not supported for NFS or multi-protocol workloads. CEE and RabbitMQ are not supported for NFS or multi-protocol workloads.
Any server that will be interfacing with a PowerScale cluster through a Peer Agent or PeerSync must reside within the same domain, share the same network segment, and belong to the same subnet as the cluster. Specifically, this connection should be established on OneFS's "external" network, not the internal one. Additionally, the network connection between OneFS and the Agent or PeerSync must operate at speeds of at least 1 Gbit/sec with sub-millisecond latency.
Time Synchronization: The server hosting the Peer Agent or PeerSync as well as the PowerScale cluster must synchronize their system clocks with the same private or public Network Time Protocol (NTP) service. If you are using virtual machines, ensure that time synchronization between the VM and the hypervisor host is disabled to ensure that the VMs rely solely on NTP for timekeeping.
Server OS Version Requirements:
1. For SMB workloads, the minimum version of Windows required for PowerScale support with the Peer Agent or PeerSync is Windows Server 2016.
2. For NFS and multi-protocol workloads, the Peer Agent must be installed on Ubuntu Server 22.04 operating system or later, Red Hat Enterprise Linux v9.x or later or Rocky Linux v9.x or later. PeerSync is not supported for NFS or multi-protocol workloads.
The server hosting the Peer Agent or PeerSync should not run any other products based on the Common Event Enabler (CEE) framework or syslog from Peer Software or any other vendor. In addition, no other Peer Software products can be run on this server (such as Peer Management Center or Peer Management Broker).
Messaging Infrastructure Restrictions:
1. For environments using CEE and RabbitMQ, no other CEE-based applications can utilize the CEE framework on the PowerScale cluster. This restriction does not apply to environments using syslog.
2. For environments using syslog, any other audit vendors utilizing syslog with OneFS must employ TLS for secure communication.
Authentication Requirement for OneFS v9.2 and later: Basic Authentication must be enabled on the cluster. To do so, run the following console/SSH command:
CODE
```
isi_gconfig -t web-config auth_basic=true
```
When connecting a Peer Agent or PeerSync to an access zone other than the default System zone, each node in the cluster must possess an accessible IP address within the IP range associated with the intended access zone.
The PowerScale cluster's Management IP must be within the System access zone.
Privileges and Permissions for SMB Workloads:
1. The service account for Peer Agent or PeerSync must have local administrator privileges on the Windows Server where the Peer Agent or PeerSync will be hosted.
2. The service account for Peer Agent or PeerSync must be granted root access to all shares, both source and target, that the Peer Agent or PeerSync will connect to.
  To add a new account permission with root access to a share, run the following console/SSH command:
  CODE
```
isi smb shares permission create <Share Name> <User Name @ Domain Name> --run-as-root
```
  To change an existing account permission on a share to root access, run the following console/SSH command:
  CODE
```
isi smb shares permission modify <Share Name> <User Name @ Domain Name> --run-as-root
```
3. The service account for Peer Agent or PeerSync must be included as a local administrator on the PowerScale cluster.
  To add an account to the local administrators group on the cluster, run the following console/SSH command:
  CODE
```
isi auth groups modify --group=administrators --add-user=<User Domain>\\<User name>
```
Privileges and Permissions for NFS Workloads:
1. The Peer Agent server IP needs to be granted read/write and root access to the exports that this Agent will be monitoring.
2. NFSv4 ACL support requires:
  1. Name Mapping to be enabled.
  2. The Peer Agent server to be in the same DNS domain as its associated PowerScale cluster.
Privileges and Permissions for Multi-Protocol Workloads:
1. When replicating Windows-style or Mixed permissions, the domain account used by the Samba connection of the Peer Agent must be granted root access to the shares that it will be monitoring.
  To add a new account permission with root access to a share, run the following console/SSH command:
  CODE
```
isi smb shares permission create <Share Name> <User Name @ Domain Name> --run-as-root
```
  To change an existing account permission on a share to root access, run the following console/SSH command:
  CODE
```
isi smb shares permission modify <Share Name> <User Name @ Domain Name> --run-as-root
```
2. When replicating Windows-style or Mixed permissions, the domain account used by the Samba connection of the Peer Agent must be included as a local administrator on the PowerScale cluster.
  To add an account to the local administrators group on the cluster, run the following console/SSH command:
  CODE
```
isi auth groups modify --group=administrators --add-user=<User Domain>\\<User name>
```
3. The Peer Agent server IP needs to be granted read/write and root access to the exports that this Agent will be monitoring.
4. When replication Linux-style or Mixed permissions, NFSv4 ACL support requires:
  1. Name Mapping to be enabled.
  2. The Peer Agent server to be in the same DNS domain as its associated PowerScale cluster.
The use of NFS aliases is currently not supported.
API Account Requirements for PeerSync ONLY: To connect PeerSync to an access zone other than the default System zone, an API user account in OneFS is necessary. This API account must have ZoneAdmin privileges within the intended access zone. It's essential to note that the default root and admin accounts are not automatically granted these privileges when an access zone is created.

Starting in v6.1, PeerGFS no longer has this requirement.

To grant ZoneAdmin privileges to a user within a specific access zone, run the following console/ssh command:
CODE
```
isi auth roles modify ZoneAdmin --zone <Zone Name> --add-user=<API User Name>
```
DNS must be able to resolve the Fully Qualified Domain Name (FQDN) of the server that will host Peer Agent or PeerSync. Both forward and reverse lookups must successfully resolve.
No firewalls (software or hardware) should be enabled between the server hosting Peer Agent or PeerSync and the PowerScale cluster.

Known Limitations

When using PowerScale OneFS v9.5+ with syslog, MED pattern matching is not fully functional due to a limitation in OneFS. We are currently investigating this with Dell.

Known Limitations

Related articles