Skip to main content

Enable ONTAP ARP by default in new volumes

Contributors netapp-dbagwell
PDFs

Beginning with ONTAP 9.10.1, you can configure storage VMs (SVMs) so that new NAS volumes are enabled by default with Autonomous Ransomware Protection (ARP) in learning mode. You can modify this setting using System Manager or the ONTAP CLI.

Note If you are running ONTAP 9.16.1 or later, see Enable ARP/AI by default in new volumes.
Note For ONTAP 9.13.1 to 9.17.1, FlexGroup volumes use the earlier ARP model and require a learning period. Use this procedure for FlexGroup volumes running ONTAP 9.17.1 and earlier.
About this task

By default, new volumes are created with ARP disabled. When you enable ARP by default on an SVM, new volumes created in that SVM automatically start in ARP learning mode (dry-run state). Existing volumes without ARP enabled will not change ARP enablement status when you change the SVM default.

Beginning with ONTAP 9.13.1, adaptive learning is enabled by default, which means ARP automatically switches from learning mode to active mode after determining that the learning period is sufficient. You can disable this automatic switch to manually control the transition.

After you enable Autonomous Ransomware Protection, it might enter a transitional period depending on your environment and ONTAP version:

Volume type ONTAP version Behavior after enablement

NAS FlexGroup

ONTAP 9.18.1 and later

ARP/AI is active immediately with no learning period

ONTAP 9.13.1 to 9.17.1

ARP starts in learning mode for 30 days

NAS FlexVol

ONTAP 9.16.1 and later

ARP/AI is active immediately with no learning period

ONTAP 9.10.1 to 9.15.1

ARP starts in learning mode for 30 days

SAN volumes

ONTAP 9.17.1 and later

ARP/AI is active immediately, initiating an evaluation period to establish a suitable alert threshold before transitioning from an initial conservative threshold.
Before you begin
Steps

You can use System Manager or the ONTAP CLI to enable ARP by default for new volumes at the SVM level.

System Manager

  1. Select Storage VMs, then select the storage VM that will contain volumes you want to protect with ARP.

  2. Navigate to the Settings tab. Under Security, locate the Anti-ransomware tile then select Edit icon.

  3. Check the box to enable anti-ransomware (ARP). Check the additional box to enable ARP on all eligible volumes in the storage VM.

  4. Select Switch automatically from learning to active mode after sufficient learning to allow ARP to determine the optimal learning period and automate the switch to active mode (ONTAP 9.13.1 and later).

CLI

Modify an existing SVM to enable ARP by default in learning mode for new volumes:

vserver modify -vserver <svm_name> -anti-ransomware-default-volume-state dry-run

Create a new SVM with ARP enabled by default (in learning mode) for new volumes:

vserver create -vserver <svm_name> -anti-ransomware-default-volume-state dry-run

Disable automatic learning to active mode transition (optional):

If you are running ONTAP 9.13.1 through 9.15.1 and want to manually control the switch from learning to active mode for all volumes associated with the SVM:

vserver modify -vserver <svm_name> -anti-ransomware-auto-switch-from-learning-to-enabled false

Verify the ARP state:

security anti-ransomware volume show
Related information