Skip to main content

Enable ONTAP ARP on a volume

Contributors netapp-dbagwell
PDFs

Beginning with ONTAP 9.10.1, you can enable Autonomous Ransomware Protection (ARP) on existing NAS volumes or create new volumes with ARP enabled.

Note If you are running ONTAP 9.16.1 or later, see Enable ARP/AI on a volume.
About this task

ARP for NAS workloads (ONTAP 9.10.1 to 9.15.1) starts in learning mode (dry-run state). The system analyzes the workload to characterize normal behavior before switching to active mode for threat detection. Beginning in active mode before the learning period completes can lead to excessive false positive reports.

For ONTAP 9.10.1 to 9.12.1, it is recommended that you let ARP run in learning mode for a minimum of 30 days. Beginning with ONTAP 9.13.1, ARP automatically determines the optimal learning period interval and automates the switch, which might occur before 30 days.

ARP is not supported on SAN volumes in ONTAP 9.10.1 to 9.15.1. See ARP supported configurations.

Note In existing volumes, learning and active modes only apply to newly written data, not to already existing data in the volume. The existing data is not scanned and analyzed, because the characteristics of earlier normal data traffic are assumed based on the new data after the volume is enabled for ARP.

After you enable Autonomous Ransomware Protection, it might enter a transitional period depending on your environment and ONTAP version:

Volume type ONTAP version Behavior after enablement

NAS FlexGroup

ONTAP 9.18.1 and later

ARP/AI is active immediately with no learning period

ONTAP 9.13.1 to 9.17.1

ARP starts in learning mode for 30 days

NAS FlexVol

ONTAP 9.16.1 and later

ARP/AI is active immediately with no learning period

ONTAP 9.10.1 to 9.15.1

ARP starts in learning mode for 30 days

SAN volumes

ONTAP 9.17.1 and later

ARP/AI is active immediately, initiating an evaluation period to establish a suitable alert threshold before transitioning from an initial conservative threshold.
Before you begin

  • A storage VM (SVM) with NFS or SMB (or both) protocol enabled.

  • NAS workload with clients configured.

  • An active junction path for the volume.

  • The correct license for your ONTAP version.

  • (Recommended) Multi-admin verification (MAV) enabled (ONTAP 9.13.1 and later). See Enable multi-admin verification.

Enable ARP on NAS FlexVol volumes

You can enable ARP on NAS FlexVol volumes using System Manager or the ONTAP CLI.

System Manager

  1. Select Storage > Volumes, then select the volume you want to protect.

  2. In the Security tab of the Volumes overview, select Status to switch from Disabled to Enabled.

  3. Select Enabled in learning-mode in the Anti-ransomware box.

    Note You can disable automatic learning to active mode transitions on the associated storage VM if you want to control the learning to active mode transition manually.
    Note In existing volumes, learning and active modes only apply to newly written data, not to already existing data in the volume. The existing data is not scanned and analyzed, because the characteristics of earlier normal data traffic are assumed based on the new data after the volume is enabled for ARP.

  4. Verify the ARP state of the volume in the Anti-ransomware box.

    To display ARP status for all volumes: In the Volumes pane, select Show/Hide then ensure that Anti-ransomware status is checked.

CLI

Enable ARP on an existing volume (in learning mode):

security anti-ransomware volume dry-run -volume <vol_name> -vserver <svm_name>

Learn more about security anti-ransomware volume dry-run in the ONTAP command reference.

Create a new volume with ARP enabled (in learning mode):

volume create -volume <vol_name> -vserver <svm_name> -aggregate <aggr_name> -size <nn> -anti-ransomware-state dry-run -junction-path </path_name>

Disable automatic switching from learning to active mode (optional):

If you are running ONTAP 9.13.1 through 9.15.1 and want to manually control the switch from learning to active mode for all volumes associated with an SVM:

vserver modify <svm_name> -anti-ransomware-auto-switch-from-learning-to-enabled false

Verify the ARP state:

security anti-ransomware volume show

Enable ARP on NAS FlexGroup volumes

ARP support for NAS FlexGroup volumes is available beginning with ONTAP 9.13.1.

Note FlexGroup volumes in ONTAP 9.13.1 to 9.17.1 use the original ARP model with learning mode, not ARP/AI. ARP/AI with immediate active mode for FlexGroup volumes requires ONTAP 9.18.1. See Enable ARP/AI on a volume.
System Manager

  1. Select Storage > Volumes, then select the FlexGroup volume you want to protect.

  2. In the Security tab of the Volumes overview, select Status to switch from Disabled to Enabled.

  3. Select Enabled in learning-mode in the Anti-ransomware box.

    Note You can disable automatic learning to active mode transitions if you want to control the learning to active mode transition manually.

  4. Verify the ARP state of the volume in the Anti-ransomware box.

CLI

Enable ARP on an existing FlexGroup volume (in learning mode):

security anti-ransomware volume dry-run -volume <vol_name> -vserver <svm_name>

Create a new FlexGroup volume with ARP enabled (in learning mode):

volume create -volume <vol_name> -vserver <svm_name> -aggr-list <aggregate name> -aggr-list-multiplier <integer> -size <nn> -anti-ransomware-state dry-run -junction-path </path_name>

Verify the ARP state:

security anti-ransomware volume show
Related information