Replication from a non-SnapLock source consistency group to a SnapLock for SnapVault destination consistency group

You can replicate from a non-SnapLock source consistency group to a SnapLock for SnapVault destination consistency group. SnapLock for SnapVault protects the replicated consistency groups from accidental or malicious deletion.

Object limits for SnapMirror active sync for NAS

SnapMirror active sync for NAS increases the number of volumes supported to 600 for AFX platforms (4 x 4).

Learn about SnapMirror synchronous disaster recovery

SnapMirror synchronous increases the number of replication operations to 600 for AFX platforms.

Enhanced SVM disaster recovery

ONTAP 9.20.1 enhances SVM disaster recovery by allowing selected volume modify attributes on SVM-DR destination volumes using standard admin privilege volume modify workflows, reducing the need for Support-assisted procedures. The release also extends opt-in SVM-DR quick resync support to FlexGroup constituents, helping large FlexGroup-bearing SVMs to return to a protected state faster after DR rehearsal, resync, or flip-resync workflows.

SnapMirror cloud in-place restore to original source volume

SnapMirror cloud supports in-place restore operations for FlexVol volumes, enabling you to perform a cloud snapshot restore operation directly back to the original source volume. ONTAP selects the latest common snapshot and performs an incremental transfer, reducing restore time.

Implement support for NormaliseNameInfo in NetApp ONTAP SMB protocol to ensure compatibility and performance with Windows clients

Windows clients can retrieve canonical file and directory names in a single request, reducing file-open latency and improving SMB compatibility for enterprise desktops, applications, and file servers. ONTAP automatically returns canonical paths for open files and directories, avoiding per-component lookups on Windows 11 24H2 and later clients without additional configuration.

Support for auto UNMAP with VAAI-NAS to enable space reclamation

ONTAP supports automatic space reclamation for NFS datastores through the NetApp NFS Plug-in for VMware VAAI. This helps reclaim space from thin-provisioned VMDK block ranges when VMware ESXi 9.0 or later hosts issue UNMAP operations.

Maximum directory size for ONTAP FlexVol volumes

ONTAP improves performance for very large directories containing up to approximately 25 million files by qualifying directory sizes up to 4GB. Customers running workloads that generate extremely high file counts in a single directory, such as AI training, can benefit by avoiding the performance penalties previously seen with large directories. It also improves resiliency by ensuring directories stay fully indexed after a data protection failover, so replicated copies perform well even when a SnapMirror relationship is broken. This feature is available with AFX storage systems and can be enabled on each volume as needed.

Automatic SID-to-UNIX ID conversion support

ONTAP introduces automatic SID-to-UNIX ID conversion support for LDAP-connected SVMs to generate and reverse POSIX UIDs/GIDs from Windows SIDs. This eliminates the need to manually maintain uidNumber/gidNumber attributes in Active Directory, reducing management overhead and helping ensure consistent file access across NFS and SMB. This industry-aligned feature is especially valuable for customers migrating large networks from SSSD-based NAS platforms and who want to preserve identity mapping consistency. The feature is disabled by default and configured per SVM.

FPolicy extends to NFS 4.2 to bring file activity monitoring and policy enforcement to the latest NFS protocol version supported by ONTAP. FPolicy monitors NFSv4.2 file access events to support audit, compliance, and cyber resilience use cases. Advanced security attribute monitoring provides stronger data protection and classification. Labeled NFS support enables policy-driven responses to security label changes for compliance-sensitive and classified data environments. Use this feature to strengthen audit, compliance, and ransomware protection.

FPolicy provides security monitoring for S3 object workflows. This provides a unified FPolicy framework for file and object storage, simplifying security operations for hybrid data environments. FPolicy for S3 objects provides object lifecycle visibility to monitor object create, delete, and metadata tag changes for security, compliance, and audit requirements. This feature provides non-disruptive monitoring without impacting performance.

Flexible S3 bucket sizing

ONTAP supports a configurable default size for new S3 buckets. This helps reduce manual resizing when applications create buckets through the S3 API without specifying capacity. If no default size is configured, bucket creation behavior remains unchanged.

Allow OnTAP S3 NAS Buckets on FlexCache with FlexVol origin

S3 NAS buckets on FlexCache volumes with FlexVol origins are supported beginning with ONTAP 9.20.1. Single-object S3 operations (PUT, GET, DELETE, HEAD, LIST) are supported. Multipart uploads are not supported because the underlying FlexVol volumes do not support Granular Data Distribution.

Support COPY Object for S3 NAS buckets on FC vols with FG origin

Beginning with ONTAP 9.20.1, S3 NAS buckets on FlexCache volumes support server-side object copy operations using the S3 CopyObject and UploadPartCopy APIs. You can copy objects within the same FlexCache NAS bucket or from an S3 NAS bucket backed by a FlexGroup volume to a FlexCache NAS bucket.

Initial S3 Checksum support

ONTAP S3 supports AWS-compatible CRC-64NVME checksums for S3 NAS buckets. When an S3 client supplies checksum information for supported upload and multipart operations, ONTAP validates and stores the checksum and returns checksum information for supported GET and HEAD requests.

Support for improved performance after migrating data from an AFF or FAS system to an AFX system

Beginning with ONTAP 9.20.1, ONTAP reduces additional read latency and CPU usage that can occur after data is migrated from an AFF or FAS system to an AFX system.

Enhanced controls for ARP/AI snapshot response policies

You can configure the ARP/AI snapshot response policy at the SVM or volume level to control whether ARP/AI creates snapshots when it detects abnormal activity. Three policies are available: alert-with-proactive-and-periodic-snapshot (default, preserves existing behavior), alert-with-proactive-snapshot (attack snapshots only, no periodic snapshots), and alert-only (alerts and event logs only, no snapshots created). After an upgrade to 9.20.1, the default periodic snapshot maximum count changes from 6 to 2, and the default retention period changes from 12 to 7 hours, unless those node-level options were previously modified. Refer to Enhanced controls for ARP/AI snapshot response policies for more information.

Key management workflow improvements for data SVMs

When you enable an external key manager on a data SVM, ONTAP can automatically migrate that SVM's volume encryption keys from the admin-scope key manager to the new data-SVM key manager. This simplifies the transition to external key management and removes the need for a separate manual migration step in the standard workflow.

Support for IdP, AD, and LDAP groups as MAV approvers

MAV approval groups can include identity provider (IdP), Active Directory (AD), and LDAP (nsswitch) groups as approvers, in addition to individual administrators. Supported group types include Entra ID, ADFS, AD domain groups, and LDAP groups. Adding or removing users in the IdP, AD, or LDAP directory does not require any changes to the MAV configuration. Changes to a user's group membership take effect after re-authentication at the user's next login. You can use the security multi-admin-verify registered-operations show command to display all MAV-protectable operations available on the current cluster.

SNMPv3 SHA-512 authentication support

ONTAP supports SHA-512 authentication for SNMPv3 users. This enhancement lets you use stronger SNMPv3 authentication for external SNMP clients and for switch monitoring, including switches that require SHA-512 authentication. For more information, see Configure SNMPv3 users in an ONTAP cluster and Configure SNMPv3 for Ethernet switch health monitoring.

Refer to Configure SNMPv3 for Ethernet switch health monitoring for more information.

Automatic Dedupe Scheduler (ADS) Optimization

ONTAP improves ADS (Automatic Dedupe Scheduler) performance, allowing more concurrent dedupe sessions per node as well as smarter and more targeted throttling to better balance client I/O. Dedupe activity on DP volumes (from SnapMirror transfers) and Global Dedupe sessions is managed alongside regular volume dedupe which reduces contention and metadata growth. You can benefit from storage efficiency savings, especially under mixed workloads, with no configuration changes required. This feature is enabled by default and is available on AFX storage systems.

AFX 32-node enterprise support

You can deploy ONTAP AFX clusters at full 32-node scale with complete enterprise feature support, matching the capabilities previously available only with smaller AFX deployments. This enables enterprise customers, specifically those running AI/ML training and data pipelines, to build larger and more dense storage clusters without sacrificing enterprise data services such as tiering, data protection, snapshots, and resiliency. Full NAS and object protocol support—​including NFS, SMB, S3, FlexGroup, and FlexCache—​has been validated at this scale, along with HA and recovery workflows, to ensure reliable operation as your AFX deployments grow.

FabricPool tiering

FabricPool is an ONTAP feature that moves data between a high-performance local tier and lower-cost remote cloud or capacity tier based on the data's activity. FabricPool has been formally extended to the AFX storage system beginning with ONTAP 9.20.1 and also available with 9.19.1 P3. It enables a much larger data scale to support data-heavy workloads. Although the AFX implementation introduces several architectural changes, the core characteristics of the ONTAP feature remain the same.

FSA - Accurate Directory Access Times

File System Analytics scans and System Manager File System Explorer browsing preserve directory access-time (atime) metadata. This helps maintain accurate atime values for archival, tiering, compliance, and data lifecycle workflows.

FlexCache Volume Metrics

FlexCache volume metrics report the amount of data and metadata exchanged between a FlexCache volume and its origin volume. Two new properties have been added to the existing ONTAP REST volume statistics and metrics endpoints that provide visibility into FlexCache-to-origin and origin-to-FlexCache data transfer. The counters are collected automatically with no configuration required; they are helpful for capacity planning, performance analysis, network troubleshooting, and chargeback analytics. This feature requires ONTAP 9.20 or later on both the FlexCache and origin nodes. Refer to the ONTAP automation documentation for more information.

Intra-cluster rebalancing

ONTAP introduces two new Balanced Placement capabilities to help keep clusters performing optimally, with minimal administrative effort, as your workloads and cluster capacity evolve. Provisioning-time placement control allows customers to indicate whether performance or space requirements should be prioritized when a new volume is placed through the REST API. Space Performance Rebalance (SPR) is a background process that continuously looks for developing performance hot spots or aggregate space pressure across the cluster. Depending on the configured mode, SPR either recommends corrective volume moves through EMS notifications or automatically performs the moves using standard and non-disruptive ONTAP volume move operations. Refer to the ONTAP automation documentation for more information.

Support for deleting ONTAP S3 buckets that contain objects

Administrators can schedule bucket deletion of buckets containing objects when using a configurable retention-based recovery window. This enables bucket recovery before the retention window expires. This feature reduces expiration backlog and makes capacity reusable faster for high-churn workloads.

Support SVM migration of S3 NAS buckets

ONTAP 9.20.1 supports SVM migration for SVMs that host S3 NAS buckets on FlexVol volumes, allowing administrators to migrate SVMs without first removing S3 NAS configuration.

Calculate reclaimable space on FlexGroup volumes

ONTAP supports calculating reclaimable space before deleting snapshots on FlexGroup volumes.

Performance enhancement for asynchronous deletion

ONTAP enhances asynchronous deletion performance and accelerates space reclamation for NAS/SMB clients. Contact your NetApp representative for details.

Auto provisioning high performance FlexGroup volumes

ONTAP simplifies FlexGroup provisioning with storage profiles that let customers choose a balanced or high-performance data container for their workloads, reducing the need for administrators to manually configure and size constituent volumes to meet performance requirements.

NVFAIL support with FlexCache

You can create FlexCache relationships with NVFAIL-enabled origins. You can also enable NVFAIL on cache volumes, independent of origin volumes. On origin or cache volumes where NVFAIL has occurred, ONTAP blocks data reads or mutations while preserving write-back of modified cached data, and normal I/O resumes after recovery.

Support for certificate and user password expiration alerts

System Manager displays a dashboard health alert 30 days before a cluster or storage virtual machine (SVM) certificate expires and updates it daily with the days remaining before expiration.

Also, if the role associated with a user account is configured for password expiry alerts, the user receives a top-of-page banner alert in System Manager immediately after logging in, beginning 14 days before the password expires. The alert is updated each time the user logs in to show the number of days remaining until the password expires. You can configure expiry alerts when you add or edit an administrator role.

Support for additional AutoSupport alerts

System Manager displays new AutoSupport alerts that can help you address AutoSupport configuration issues.