Deploy the NetApp Console agent in restricted mode in Azure
Suggest changes
PDFs
Deploy the Console agent in restricted mode so that you can use the NetApp Console with limited outbound connectivity. To get started, install the Console agent, set up the Console by accessing the user interface that's running on the Console agent, and then provide the cloud permissions that you previously set up.
Step 1: Prepare cloud permissions
Step 2: Prepare network access
Allow the following outbound endpoints so the Console agent can manage Azure resources and access NetApp Console services.
Azure endpoints
Allow the endpoints that apply to your Azure region: public, Government, or China.
| Endpoints | Purpose |
|---|---|
|
To manage resources in Azure public regions. |
|
To manage resources in Azure Government regions. |
|
To manage resources in Azure China regions. |
NetApp Console endpoints
Allow the shared endpoints for NetApp Support, Console features, and Console agent deployment and upgrades.
| Endpoints | Purpose |
|---|---|
|
To obtain licensing information and to send AutoSupport messages to NetApp Support. |
|
To update NetApp Support Site (NSS) credentials or to add new NSS credentials to the NetApp Console. |
|
To obtain licensing information and to send AutoSupport messages to NetApp Support as well as to receive software updates for Cloud Volumes ONTAP. |
|
To provide features and services within the NetApp Console. |
For non-Government regions, use the following endpoints:
For Government regions, use the following endpoint instead:
|
To obtain images for Console agent deployment and upgrades. |
For browser access and other networking requirements, see Prepare network access for restricted mode.
Step 3: Deploy the NetApp Console in restricted mode in Azure
How you deploy the Console agent depends on whether you use the Azure Marketplace or manually install on a Linux host in your Azure environment.
Install NetApp Console restricted mode from the Azure Marketplace
You should have the following:
-
A VNet and subnet that meets networking requirements.
-
An Azure custom role that includes the required permissions for the Console agent.
-
Go to the NetApp Console agent VM page in the Azure Marketplace.
-
Select Get it now and then select Continue.
-
From the Azure portal, select Create and follow the steps to configure the virtual machine.
Note the following as you configure the VM:
-
VM size: Choose a VM size that meets CPU and RAM requirements. We recommend Standard_D8s_v3.
-
Disks: The Console agent can perform optimally with either HDD or SSD disks.
-
Public IP: To use a public IP address with the Console agent VM, select a Basic SKU.
If you use a Standard SKU IP address instead, then the Console uses the private IP address of the Console agent, instead of the public IP. If the machine you use to access the Console cannot reach the private IP address, the Console does not work.
-
Network security group: The Console agent requires inbound connections using SSH, HTTP, and HTTPS.
-
Identity: Under Management, select Enable system assigned managed identity.
A managed identity lets the Console agent VM identify itself to Microsoft Entra ID without credentials. Learn more about managed identities for Azure resources.
-
-
On the Review + create page, review your selections and select Create to start the deployment.
Azure deploys the virtual machine with the specified settings. The virtual machine and Console agent software should be running in approximately five minutes.
Set up the NetApp Console.
Manually install NetApp Console restricted mode in Azure
For manual installation steps, see Manually install the Console agent in restricted mode.
Step 4: Set up NetApp Console
When you access the console for the first time, you are prompted to choose an organization for the Console agent and need to enable restricted mode.
The person who sets up the Console agent must log in to the Console using a login that doesn't already belong to a Console organization.
If your login is associated with another organization, you need to sign up with a new login. Otherwise, you do not see the option to enable restricted mode on the setup screen.
-
Open a web browser from a host that has a connection to the Console agent instance and enter the following URL of the Console agent you installed.
-
Sign up or log in to the NetApp Console.
-
After you're logged in, set up the Console:
-
Enter a name for the Console agent.
-
Enter a name for a new Console organization.
-
Select Are you running in a secured environment?
-
Select Enable restricted mode on this account.
Note that you can't change this setting after the account is created. You can't enable restricted mode later and you can't disable it later.
If you deployed the Console agent in a Government region, the checkbox is already enabled and can't be changed. This is because restricted mode is the only mode supported in Government regions.
-
Select Let's start.
-
The Console agent is now installed and set up with your Console organization. All users need to access the Console using the IP address of the Console agent instance.
Provide the Console with the permissions that you previously set up.
Step 5: Provide permissions to the Console agent
If you installed the Console agent from the Azure Marketplace or manually, you need to give the permissions you set up earlier.
You can grant permissions to the Console agent either by assigning an Azure role or by providing the credentials for an Azure service principal.
Go to the Azure portal and assign the Azure custom role to the Console agent virtual machine for one or more subscriptions.
-
From the Azure Portal, open the Subscriptions service and select your subscription.
It's important to assign the role from the Subscriptions service because this specifies the scope of the role assignment at the subscription level. The scope defines the set of resources that the access applies to. If you specify a scope at a different level (for example, at the virtual machine level), your ability to complete actions from within the NetApp Console will be affected.
-
Select Access control (IAM) > Add > Add role assignment.
-
In the Role tab, select the Console Operator role and select Next.
Console Operator is the default name provided in the policy. If you chose a different name for the role, then select that name instead. -
In the Members tab, complete the following steps:
-
Assign access to a Managed identity.
-
Select Select members, select the subscription in which the Console agent virtual machine was created, under Managed identity, choose Virtual machine, and then select the Console agent virtual machine.
-
Select Select.
-
Select Next.
-
Select Review + assign.
-
If you want to manage resources in additional Azure subscriptions, switch to that subscription and then repeat these steps.
-
Provide the NetApp Console with the credentials for the Azure service principal that you previously set up.
-
Select Administration > Credentials.
-
Select Add Credentials and follow the steps in the wizard.
-
Credentials Location: Select Microsoft Azure > Agent.
-
Define Credentials: Enter information about the Microsoft Entra service principal that grants the required permissions:
-
Application (client) ID
-
Directory (tenant) ID
-
Client Secret
-
-
Marketplace Subscription: Associate a Marketplace subscription with these credentials by subscribing now or by selecting an existing subscription.
-
Review: Confirm the details about the new credentials and select Add.
-
The NetApp Console now has the permissions that it needs to perform actions in Azure on your behalf.