Skip to main content

Enable ONTAP ARP/AI on a volume

Contributors netapp-dbagwell
PDFs

Beginning with ONTAP 9.16.1, you can enable Autonomous Ransomware Protection with AI (ARP/AI) on an existing volume or create a new volume with ARP/AI enabled. ARP/AI is immediately active with no learning period required.

Note If you are running ONTAP 9.15.1 or earlier, see Enable ARP on a volume.
About this task

ARP/AI is the current ransomware protection model for ONTAP 9.16.1 and later. To enable ARP/AI, follow the procedure that matches your environment after you ensure that your environment meets the requirements:

After you enable Autonomous Ransomware Protection, it might enter a transitional period depending on your environment and ONTAP version:

Volume type ONTAP version Behavior after enablement

NAS FlexGroup

ONTAP 9.18.1 and later

ARP/AI is active immediately with no learning period

ONTAP 9.13.1 to 9.17.1

ARP starts in learning mode for 30 days

NAS FlexVol

ONTAP 9.16.1 and later

ARP/AI is active immediately with no learning period

ONTAP 9.10.1 to 9.15.1

ARP starts in learning mode for 30 days

SAN volumes

ONTAP 9.17.1 and later

ARP/AI is active immediately, initiating an evaluation period to establish a suitable alert threshold before transitioning from an initial conservative threshold.
Before you begin

Before enabling ARP/AI, ensure your environment has the following:

NAS-specific requirements

  • A storage VM (SVM) with NFS or SMB (or both) protocol enabled.

  • NAS workload with clients configured.

  • An active junction path for the volume.

SAN-specific requirements

  • A storage VM (SVM) with iSCSI, FC, or NVMe protocol enabled.

  • SAN workload with clients configured.

General requirements

Enable ARP/AI on NAS FlexVol volumes

Beginning with ONTAP 9.16.1, ARP/AI is active immediately after enablement for NAS FlexVol volumes.

System Manager

  1. Select Storage > Volumes, then select the volume you want to protect.

  2. In the Security tab of the Volumes overview, select Status to switch from Disabled to Enabled.

  3. Verify the ARP/AI state of the volume in the Anti-ransomware box.

    To display ARP/AI status for all volumes: In the Volumes pane, select Show/Hide then ensure that Anti-ransomware status is checked.

CLI

Enable ARP/AI on an existing volume:

security anti-ransomware volume enable -volume <vol_name> -vserver <svm_name>

Create a new volume with ARP/AI enabled:

volume create -volume <vol_name> -vserver <svm_name> -aggregate <aggr_name> -size <nn> -anti-ransomware-state enabled -junction-path </path_name>

Verify the ARP/AI state:

security anti-ransomware volume show

Learn more about security anti-ransomware volume show in the ONTAP command reference.

Enable ARP/AI on NAS FlexGroup volumes

Beginning with ONTAP 9.18.1, ARP/AI is active immediately after enablement for FlexGroup volumes.

Note For ONTAP 9.13.1 to 9.17.1, FlexGroup volumes use the earlier ARP model and require a learning period. See Enable ARP on NAS FlexGroup volumes.
System Manager

  1. Select Storage > Volumes, then select the FlexGroup volume you want to protect.

  2. In the Security tab of the Volumes overview, select Status to switch from Disabled to Enabled.

  3. Verify the ARP/AI state of the volume in the Anti-ransomware box.

    To display ARP/AI status for all volumes: In the Volumes pane, select Show/Hide then ensure that Anti-ransomware status is checked.

CLI

Enable ARP/AI on an existing FlexGroup volume:

security anti-ransomware volume enable -volume <vol_name> -vserver <svm_name>

Create a new FlexGroup volume with ARP/AI enabled:

volume create -volume <vol_name> -vserver <svm_name> -aggr-list <aggregate name> -aggr-list-multiplier <integer> -size <nn> -anti-ransomware-state enabled -junction-path </path_name>

Verify the ARP/AI state:

security anti-ransomware volume show

Enable ARP/AI on SAN volumes

Beginning with ONTAP 9.17.1, you can enable ARP/AI on SAN volumes. ARP/AI is automatically active immediately after enablement and begins monitoring and protecting SAN volumes during the entropy evaluation period while simultaneously determining if workloads are suitable for ARP/AI and setting an optimal encryption threshold for detection.

System Manager

  1. Select Storage > Volumes, then select the SAN volume you want to protect.

  2. In the Security tab of the Volumes overview, select Status to switch from Disabled to Enabled.

  3. ARP/AI automatically enters the evaluation period.

  4. Verify the ARP/AI state and evaluation status in the Anti-ransomware box.

    To display ARP/AI status for all volumes: In the Volumes pane, select Show/Hide then ensure that Anti-ransomware status is checked.

CLI

Enable ARP/AI on an existing SAN volume:

security anti-ransomware volume enable -volume <vol_name> -vserver <svm_name>

Create a new SAN volume with ARP/AI enabled:

volume create -volume <vol_name> -vserver <svm_name> -aggregate <aggr_name> -size <nn> -anti-ransomware-state enabled

Verify the ARP/AI state and evaluation status:

security anti-ransomware volume show

Check the Block device detection status field to monitor the evaluation period progress. Learn more about security anti-ransomware volume show in the ONTAP command reference.