Dell PowerScale Prerequisites

Last Updated

24 June 2026

OneFS Version Requirements:
1. For SMB workloads using CEE with RabbitMQ, the minimum required version of OneFS is v8.1.0.x.
2. For SMB workloads using syslog, the minimum required version of OneFS is v9.5.0.x. PeerSync is not supported for SMB workloads using syslog.
3. For NFS and multi-protocol workloads using syslog, the minimum required version of OneFS is v9.5.0.x. PeerSync is not supported for NFS or multi-protocol workloads. CEE with RabbitMQ is not supported for NFS or multi-protocol workloads.
Any server that will be interfacing with a PowerScale cluster through a Peer Agent or PeerSync must reside within the same domain, the same network segment, and the same subnet as the cluster. Specifically, this connection should be established on OneFS's "external" network, not the internal one. Additionally, the network connection between OneFS and the Agent or PeerSync must operate at speeds of at least 1 Gbit/sec with sub-millisecond latency.
Time Synchronization: The server hosting the Peer Agent or PeerSync as well as the PowerScale cluster must synchronize their system clocks with the same private or public Network Time Protocol (NTP) service. If you are using virtual machines, ensure that time synchronization between the VM and the hypervisor host is disabled so that the VMs rely solely on NTP for timekeeping.
Server OS Version Requirements:
1. For SMB workloads, the minimum version of Windows required for PowerScale support with the Peer Agent or PeerSync is Windows Server 2016.
2. For NFS and multi-protocol workloads, the Peer Agent must be installed on Ubuntu Server 22.04 operating system or later, Red Hat Enterprise Linux v9.x or later, or Rocky Linux v9.x or later. PeerSync is not supported for NFS or multi-protocol workloads.
The server hosting the Peer Agent or PeerSync must not run any other products based on the Common Event Enabler (CEE) framework or syslog from Peer Software or any other vendor. In addition, no other Peer Software components can be run on this server (such as Peer Management Center).
Messaging Infrastructure Restrictions:
1. For environments using CEE with RabbitMQ, no other CEE-based applications can utilize the CEE framework on the PowerScale cluster. This restriction does not apply to environments using syslog.
2. For environments using syslog, any other audit vendors utilizing syslog with OneFS must employ TLS for secure communication.
Authentication Requirement for OneFS v9.2 and later: Basic Authentication must be enabled on the cluster. To do so, run the following console/SSH command:
CODE
```
isi_gconfig -t web-config auth_basic=true
```
When connecting a Peer Agent or PeerSync to an access zone other than the default System zone, each node in the cluster must possess an accessible IP address within the IP range associated with the intended access zone.
The PowerScale cluster's Management IP must be within the System access zone.
Privileges and Permissions for SMB Workloads:
1. The service account for Peer Agent or PeerSync must have local administrator privileges on the Windows Server where the Peer Agent or PeerSync will be hosted.
2. Share-level security settings vary depending on the version of PeerGFS being used.
  1. For customers running PeerGFS v6.4 and above, a role with Backup Operator privileges is required.
    To create this role and add the Peer Agent service account to the it, run the following console/SSH commands:
    CODE
```
isi auth roles create --name=PeerAgent --description="Role for Peer Agent Data Access" --zone=<Access Zone Name>
isi auth roles modify PeerAgent --add-priv-read=ISI_PRIV_IFS_BACKUP --zone=<Access Zone Name>
isi auth roles modify PeerAgent --add-priv-read= ISI_PRIV_IFS_RESTORE --zone=<Access Zone Name>
isi auth roles modify PeerAgent --add-user=<Domain Name\\User Name> --zone=<Access Zone Name>
```
    The service account for the Peer Agent must also have full access to all shares that it will be monitoring.
    To add a new account permission with full, non-root access to a share, run the following console/SSH command:
    CODE
```
isi smb shares permission create <Share Name> <User Name @ Domain Name> --permission full
```
    To change an existing account permission on a share to full, non-root access, run the following console/SSH command:
    CODE
```
isi smb shares permission modify <Share Name> <User Name @ Domain Name> --permission full
```
  2. For customers running PeerSync or versions of PeerGFS prior to v6.4, the service account for Peer Agent or PeerSync must be granted root access to all shares that it will be monitoring.
    To add a new account permission with root access to a share, run the following console/SSH command:
    CODE
```
isi smb shares permission create <Share Name> <User Name @ Domain Name> --run-as-root
```
    To change an existing account permission on a share to root access, run the following console/SSH command:
    CODE
```
isi smb shares permission modify <Share Name> <User Name @ Domain Name> --run-as-root
```
3. The service account for Peer Agent or PeerSync must be included as a local administrator on the PowerScale cluster.
  To add an account to the local administrators group on the cluster, run the following console/SSH command:
  CODE
```
isi auth groups modify --group=administrators --add-user=<Domain Name>\\<User name>
```
Privileges and Permissions for NFS Workloads:
1. The Peer Agent server IP needs to be granted read/write and root access to the exports that this Agent will be monitoring.
2. NFSv4 ACL support requires:
  1. Name Mapping to be enabled.
  2. The Peer Agent server to be in the same DNS domain as its associated PowerScale cluster.
Privileges and Permissions for Multi-Protocol Workloads:
1. When replicating Windows-style or Mixed permissions, share-level security settings vary depending on the version of PeerGFS being used.
  1. For customers running PeerGFS v6.4 and above, a role with Backup Operator privileges is required.
    To create this role and add the domain account used by the Peer Agent’s Samba connection to it, run the following console/SSH commands:
    CODE
```
isi auth roles create --name=PeerAgent --description="Role for Peer Agent Data Access" --zone=<Access Zone Name>
isi auth roles modify PeerAgent --add-priv-read=ISI_PRIV_IFS_BACKUP --zone=<Access Zone Name>
isi auth roles modify PeerAgent --add-priv-read= ISI_PRIV_IFS_RESTORE --zone=<Access Zone Name>
isi auth roles modify PeerAgent --add-user=<Domain Name\\User Name> --zone=<Access Zone Name>
```
    The domain account used by the Peer Agent’s Samba connection must also have full access to all shares that it will be monitoring.
    To add a new account permission with full, non-root access to a share, run the following console/SSH command:
    CODE
```
isi smb shares permission create <Share Name> <User Name @ Domain Name> --permission full
```
    To change an existing account permission on a share to full, non-root access, run the following console/SSH command:
    CODE
```
isi smb shares permission modify <Share Name> <User Name @ Domain Name> --permission full
```
  2. For customers running PeerSync or versions of PeerGFS prior to v6.4, the domain account used by the Samba connection of the Peer Agent must be granted root access to the shares that it will be monitoring.
    To add a new account permission with root access to a share, run the following console/SSH command:
    CODE
```
isi smb shares permission create <Share Name> <User Name @ Domain Name> --run-as-root
```
    To change an existing account permission on a share to root access, run the following console/SSH command:
    CODE
```
isi smb shares permission modify <Share Name> <User Name @ Domain Name> --run-as-root
```
2. When replicating Windows-style or Mixed permissions, the domain account used by the Samba connection of the Peer Agent must be included as a local administrator on the PowerScale cluster.
  To add an account to the local administrators group on the cluster, run the following console/SSH command:
  CODE
```
isi auth groups modify --group=administrators --add-user=<Domain Name>\\<User Name>
```
3. The Peer Agent server IP needs to be granted read/write and root access to the exports that this Agent will be monitoring.
4. When replicating Linux-style or Mixed permissions, NFSv4 ACL support requires:
  1. Name Mapping to be enabled.
  2. The Peer Agent server to be in the same DNS domain as its associated PowerScale cluster.
The use of NFS aliases is currently not supported.
API Account Requirements for PeerSync ONLY: To connect PeerSync to an access zone other than the default System zone, an API user account in OneFS is necessary. This API account must have ZoneAdmin privileges within the intended access zone. It's essential to note that the default root and admin accounts are not automatically granted these privileges when an access zone is created.

Starting in v6.1, PeerGFS no longer has this requirement.

To grant ZoneAdmin privileges to a user within a specific access zone, run the following console/ssh command:
CODE
```
isi auth roles modify ZoneAdmin --zone <Access Zone Name> --add-user=<API User Name>
```
No firewalls (software or hardware) should be enabled between the server hosting Peer Agent or PeerSync and the PowerScale cluster. If firewalls cannot be disabled, review the Firewall Requirements guide for details on the specific ports that must be opened.

Known Limitations

When using PowerScale OneFS v9.5+ with syslog, MED pattern matching is not fully functional due to a limitation in OneFS. We are currently investigating this with Dell.

Known Limitations

Related articles