Skip to main content

Switch to active mode in ONTAP ARP after a learning period

Contributors netapp-dbagwell
PDFs

For NAS environments, manually or automatically switch an ARP-enabled volume from learning mode to active mode. You need to switch modes if you are using ARP with ONTAP 9.10.1 to 9.15.1 or if ARP is running on FlexGroup volumes in ONTAP 9.13.1 to 9.17.1.

Note ARP/AI (ONTAP 9.16.1 and later) does not require a learning period. ARP/AI protection becomes active immediately on FlexVol volumes. For FlexGroup volumes, ARP/AI requires ONTAP 9.18.1. There is no equivalent switch-mode procedure for ARP/AI. If you are running ONTAP 9.16.1 or later, see Learn about Autonomous Ransomware Protection.

After ARP has completed a learning mode run of a recommended minimum of 30 days, you can manually switch to active mode. Beginning with ONTAP 9.13.1, ARP automatically determines the optimal learning period interval and automates the switch, which might occur before 30 days.

Note In existing volumes, learning and active modes only apply to newly written data, not to already existing data in the volume. The existing data is not scanned and analyzed, because the characteristics of earlier normal data traffic are assumed based on the new data after the volume is enabled for ARP.

Manually switch to active mode after a learning period

For ONTAP 9.10.1 to 9.15.1 (and FlexGroup volumes in ONTAP 9.13.1 to 9.17.1), you can manually transition from ARP learning mode to active mode using System Manager or the ONTAP CLI after the learning period is complete.

Example 1. Steps
System Manager

  1. Select Storage > Volumes and then select the volume that is ready for active mode.

  2. In the Security tab of the Volumes overview, select Switch to active mode in the Anti-ransomware box.

  3. Verify the ARP state of the volume in the Anti-ransomware box.

CLI

  1. Switch the protected volume to active mode:

    security anti-ransomware volume enable -volume <vol_name> -vserver <svm_name>

    You can also switch to active mode with the volume modify command:

    volume modify -volume <vol_name> -vserver <svm_name> -anti-ransomware-state enabled

  2. Verify the ARP state of the volume:

    security anti-ransomware volume show

Automatic switching from learning mode to active mode

Beginning with ONTAP 9.13.1, adaptive learning has been added to ARP analytics and the switch from learning mode to active mode is done automatically. The autonomous decision by ARP to automatically switch from learning mode to active mode is based on the configuration settings of the following options:

 -anti-ransomware-auto-switch-minimum-incoming-data-percent
 -anti-ransomware-auto-switch-duration-without-new-file-extension
 -anti-ransomware-auto-switch-minimum-learning-period
 -anti-ransomware-auto-switch-minimum-file-count
 -anti-ransomware-auto-switch-minimum-file-extension

If auto-switch is enabled, the volume will switch to active mode automatically after a maximum of 30 days, even if all conditions are not met. This 30-day limit is fixed and cannot be changed.

You can disable the automatic switch from learning to active mode for all volumes in an SVM if you prefer to control the transition manually:

vserver modify <svm_name> -anti-ransomware-auto-switch-from-learning-to-enabled false

For more information on ARP configuration options, including default values, see the ONTAP command reference.

Related information