Data Governance Edition uses the NetApp Data ONTAP file screening policy (FPolicy) to track activities on the filer. This policy allows third-party file screening software to interact with the NetApp filer.
Understanding the following aspects of the deployment process are key to ensuring a successful deployment of NetApp managed hosts:
The service account for the remote agent responsible for scanning the NetApp filer must meet the following minimum permissions:
- Log On as a Service local user rights on the agent computer. (This is automatically granted when the agent is deployed.)
- Must be a member of the local Administrators group on the NetApp filer.
- Must have permissions to access the folders being scanned.
NetApp filers are added to a Data Governance Edition deployment as managed hosts with remote agents. When selecting an agent for scanning a NetApp filer, take the following into consideration:
FPolicy is required for Data Governance Edition to capture real-time security updates and to collect resource activity. In order to use FPolicy on NetApp 7-Mode managed hosts, CIFS file system protocol must be enabled.
When adding a NetApp 7-Mode managed host, you can use one of the following for FPolicy deployment:
- automatic FPolicy deployment
- use a pre-created FPolicy
However, for NetApp Cluster Mode managed hosts, FPolicy deployment is always automatic.
Using automatic FPolicy deployment for NetApp 7-Mode
When you add a NetApp managed host, an FPolicy is created if either of the following managed host settings are enabled:
- Collect activity for real-time security updates on the Security Scanning page
- Collect and aggregate events on the Resource Activity page
When you deploy an agent, an empty FPolicy (with no monitored operations) is created by the Data Governance server (performed as the service account for the domain). When the agent starts, it registers with the FPolicy as an FPolicy Server. At the point of registration, the agent will register the operations it will monitor.
Note: If another agent is added to the managed host to index a separate root on the NetApp device, a new FPolicy will be created (named after the new agent ID).
- is created using the credentials of the domain service account.
- is named after the agent ID (that is, DGE_ <DeploymentName>_<FQDN of managed host>).
- is configured to use the version 2 interface.
- includes cifs_set_attr information, which allows Data Governance Edition to receive notification of security changes.
- sets the cifs_setattr option to on (defaults to off in FPolicy).
Note: To view all the existing FPolicies on a NetApp device, establish a Telnet or SSH connection to the filer device, log in and type the following at the OnTap command line: “fpolicy”.
Note: When you remove an agent, the FPolicy is deleted.
Using a pre-created FPolicy on a NetApp 7-Mode filer
Data Governance Edition can be configured to connect to a pre-created FPolicy. The following steps are required to configure Data Governance Edition to use a manually created FPolicy instead of automatic deployment:
- Enable CIFS FPolicy on NetApp filer
- Create FPolicy on the filer
- Configure the Data Governance server and agent
To enable CIFS FPolicy on a NetApp filer
- Run options FPolicy.enable on
To create FPolicy on the filer
- fpolicy create <PolicyName> Screen
- fpolicy enable <PolicyName>
To configure the Data Governance server and agent
Configure the Data Governance server to prevent the creation of FPolicy on the required NetApp filer:
- Create the following registry key: “HKEY_LOCAL_MACHINE\SOFTWARE\One Identity\Broadway\Server\ManualFPolicyCreation”.
- Add a string value with the fully qualified domain name of the NetApp filer.
In the Manager, deploy a NetApp managed host.
Note: Ensure that the registry key has been created on the server before deploying the agent.
- Configure the NetApp agent to use the manually pre-created FPolicy.
- Stop the agent service.
Locate the following configuration setting in the %Program Files%\One Identity\One Identity Manager Data Governance Edition\Agent Services\DataGovernance.Agent.exe.config file.
- Add a string value with the FPolicy name you want the specified agent to register with.
- Save the configuration file.
- Restart the agent.
FPolicy deployment for NetApp Cluster Mode
FPolicy deployment for NetApp Cluster Mode is always automatic and is done by the agent at run time because of the use of dynamic ports. The FPolicy will be deleted when the agent stops. You cannot specify a pre-created FPolicy.