Skip to main content

Enable ONTAP ARP/AI by default in new volumes

Contributors netapp-dbagwell
PDFs

Beginning with ONTAP 9.16.1, you can configure storage VMs (SVMs) so that new volumes are enabled by default with Autonomous Ransomware Protection with AI (ARP/AI). Beginning with ONTAP 9.18.1, ARP/AI is enabled automatically at the cluster level for supported systems after a 12-hour grace period. Use this procedure when you need to enable ARP/AI by default for new volumes at the SVM level rather than cluster level.

For ONTAP 9.17.1 and earlier, configuration at the SVM level is the only way to enable ARP by default on new volumes.

Note If you are running ONTAP 9.15.1 or earlier, see Enable ARP by default in new volumes.
Note For ONTAP 9.13.1 to 9.17.1, FlexGroup volumes use the earlier ARP model and require a learning period. See Enable ARP by default in new volumes.
About this task

On systems where ARP/AI is not automatically enabled at the cluster level, new volumes are created with ARP/AI functionality disabled by default. You must enable ARP/AI and configure it to be on by default for new volumes created in the SVM.

Existing volumes without ARP/AI enabled will not change ARP/AI enablement status automatically when you change the SVM default. The SVM setting described in this procedure only affects new volumes. Learn how to enable ARP/AI for existing volumes.

After you enable Autonomous Ransomware Protection, it might enter a transitional period depending on your environment and ONTAP version:

Volume type ONTAP version Behavior after enablement

NAS FlexGroup

ONTAP 9.18.1 and later

ARP/AI is active immediately with no learning period

ONTAP 9.13.1 to 9.17.1

ARP starts in learning mode for 30 days

NAS FlexVol

ONTAP 9.16.1 and later

ARP/AI is active immediately with no learning period

ONTAP 9.10.1 to 9.15.1

ARP starts in learning mode for 30 days

SAN volumes

ONTAP 9.17.1 and later

ARP/AI is active immediately, initiating an evaluation period to establish a suitable alert threshold before transitioning from an initial conservative threshold.
Before you begin

Before enabling ARP/AI by default, ensure your environment has the following:

NAS-specific requirements

  • A storage VM (SVM) with NFS or SMB (or both) protocol enabled.

  • An active junction path for the volume.

SAN-specific requirements

  • A storage VM (SVM) with iSCSI, FC, or NVMe protocol enabled.

General requirements
Steps

You can use System Manager or the ONTAP CLI to enable ARP/AI by default for new volumes at the SVM level.

System Manager

  1. Select Storage or Cluster (depending on your environment), select Storage VMs, and select the storage VM that will contain volumes you want to protect with ARP/AI.

  2. Navigate to the Settings tab. Under Security, locate the Anti-ransomware tile then select Edit icon.

  3. Check the box to enable anti-ransomware (ARP/AI). Check the additional box to enable ARP/AI on all eligible volumes in the storage VM.

    Note ARP/AI enters active mode immediately; no learning period is required.
CLI
Modify an existing SVM to enable ARP/AI by default in new volumes
vserver modify -vserver <svm_name> -anti-ransomware-default-volume-state enabled
Create a new SVM with ARP/AI enabled by default for new volumes
vserver create -vserver <svm_name> -anti-ransomware-default-volume-state enabled
Verify the ARP/AI state
security anti-ransomware volume show
Related information