SnapMirror cloud support for in-place restore to original source volume

SnapMirror cloud supports in-place restore operations for FlexVol volumes, enabling you to perform a cloud snapshot restore operation directly back to the original source volume. ONTAP selects the latest common snapshot and performs an incremental transfer, reducing restore time.

Increased SnapMirror active sync object limits

SnapMirror active sync increases the number of volumes supported per HA pair to 600 for SAN and NAS configurations.

Tamperproof snapshot support with SnapMirror active sync NAS

ONTAP adds support for tamperproof snapshots with SnapMirror active sync NAS FlexVol volumes. This enhancement lets customers combine SnapMirror active sync NAS availability with immutable snapshot protection.

Enhanced SVM disaster recovery

ONTAP enhances SVM disaster recovery by allowing selected volume modify attributes on SVM-DR destination volumes using standard admin privilege volume modify workflows, reducing the need for Support-assisted procedures.

ONTAP also extends opt-in SVM-DR Quick Resync support to FlexGroup constituents, helping large FlexGroup-bearing SVMs to return to a protected state faster after DR rehearsal, resync, or flip-resync workflows.

For more information, see Resynchronize the data on an ONTAP SnapMirror destination SVM.

Backend support for SnapMirror replication over FC

You can configure backend SnapMirror asynchronous replication and SnapLock for SnapVault over existing Fibre Channel (FC) fabrics.

This allows replication traffic to travel entirely within existing SAN infrastructure. Prior to ONTAP 9.20.1, traffic for these replication relationships is carried exclusively over the intercluster IP network.

Replication from a non-SnapLock source consistency group to a SnapLock for SnapVault destination consistency group

You can replicate from a non-SnapLock source consistency group to a SnapLock for SnapVault destination consistency group. SnapLock for SnapVault protects the replicated consistency groups from accidental or malicious deletion.

FC-SP-3 authentication and encryption with Broadcom secure HBAs

ONTAP supports Fibre Channel Security Protocol 3 (FC-SP-3) authentication and encryption on Broadcom secure HBAs with AFF and FAS systems. FC-SP-3 support enables hardware-level end-to-end encryption and device authentication to protect data in flight between FC and NVMe/FC SAN hosts and ONTAP storage systems while aligning with T11 Fibre Channel security standards.

Encryption is offloaded, so there is no performance impact on your storage system.

FPolicy support for NFS 4.2

FPolicy extends file access monitoring to NFSv4.2, enabling audit, compliance, and cyber resilience workflows for environments using the latest NFS protocol version. FPolicy generates notifications for NFSv4.2 file operations, including extended attribute writes (SETXATTR, REMOVEXATTR) and security label changes via SETATTR/GETATTR. NFSv4.2 notifications require an external engine configured with the protobuf format.

Fpolicy support for S3 object storage

FPolicy provides security monitoring for S3 object workflows. This provides a unified FPolicy framework for file and object storage, simplifying security operations for hybrid data environments. FPolicy for S3 objects provides object lifecycle visibility to monitor object create, delete, and metadata tag changes for security, compliance, and audit requirements. This feature provides non-disruptive monitoring without impacting performance.

SMB normalized name query support for Windows clients

Windows clients can retrieve canonical file and directory names in a single request, reducing file-open latency and improving SMB compatibility for enterprise desktops, applications, and file servers. ONTAP automatically returns canonical paths for open files and directories, avoiding per-component lookups on Windows 11 24H2 and later clients without additional configuration.

Automatic space reclamation for VMware NFS datastores

ONTAP supports automatic space reclamation for NFS datastores through the NetApp NFS Plug-in for VMware VAAI. This helps reclaim space from thin-provisioned VMDK block ranges when VMware ESXi 9.0 or later hosts issue UNMAP operations.

Maximum directory size for ONTAP FlexVol volumes

ONTAP improves performance for very large directories containing up to approximately 25 million files by qualifying directory sizes up to 4GB. Customers running workloads that generate extremely high file counts in a single directory, such as AI training, can benefit by avoiding the performance penalties previously seen with large directories. It also improves resiliency by ensuring directories stay fully indexed after a data protection failover, so replicated copies perform well even when a SnapMirror relationship is broken. This feature is available with AFF and FAS storage systems including MetroCluster deployments; it can be enabled on each volume as needed.

Automatic SID-to-UNIX ID conversion support

ONTAP introduces automatic SID-to-UNIX ID conversion support for LDAP-connected SVMs to generate and reverse POSIX UIDs/GIDs from Windows SIDs. This eliminates the need to manually maintain uidNumber/gidNumber attributes in Active Directory, reducing management overhead and helping ensure consistent file access across NFS and SMB. This industry-aligned feature is especially valuable for customers migrating large networks from SSSD-based NAS platforms and who want to preserve identity mapping consistency. The feature is disabled by default and configured per SVM.

Increased SCSI persistent reservation registration scale

The maximum supported number of SCSI-3 persistent reservation registrations per LUN increases from 182 to 256. This helps larger clustered SAN environments, such as VMware guest clustering and Windows Server Failover Clustering, support more host registrations on shared LUNs without changing persistent reservation administration workflows.

SAN copy offload performance improvements

ONTAP improves SAN copy offload performance for eligible NVMe and SCSI copy workloads. Contact your NetApp representative for details.

Support for non-disruptive storage VM migration from ASA r2 systems to ASA or AFF systems

You can non-disruptively migrate a storage virtual machine (SVM) from a 2-node ASA r2 cluster to a 2-node ASA or a 2-node AFF cluster. Existing host mappings and storage unit configurations for LUNs and namespaces are maintained during migration, reducing operational effort and risk.

MetroCluster support for SnapMirror S3

You can create SnapMirror S3 relationships in a MetroCluster configuration that remain available and resume from the active site across switchover and switchback.

MetroCluster support for ONTAP S3 bucket lifecycle management

You can create ONTAP S3 bucket lifecycle management rules for native S3 buckets in a MetroCluster configuration.

Flexible S3 bucket sizing

ONTAP supports a configurable default size for new S3 buckets. This helps reduce manual resizing when applications create buckets through the S3 API without specifying capacity. If no default size is configured, bucket creation behavior remains unchanged.

S3 NAS buckets on FlexCache volumes with FlexVol origins

S3 NAS buckets are supported on FlexCache volumes with FlexVol origins. Single-object S3 operations (PUT, GET, DELETE, HEAD, LIST) are supported. Multipart uploads are not supported because the underlying FlexVol volumes do not support Granular Data Distribution.

S3 server-side copy support for NAS buckets on FlexCache volumes

S3 NAS buckets on FlexCache volumes support server-side object copy operations using the S3 CopyObject and UploadPartCopy APIs. You can copy objects within the same FlexCache NAS bucket or from an S3 NAS bucket backed by a FlexGroup volume to a FlexCache NAS bucket.

ONTAP S3 flexible checksum support

ONTAP S3 supports AWS-compatible CRC-64NVME checksums for S3 NAS buckets. When an S3 client supplies checksum information for supported upload and multipart operations, ONTAP validates and stores the checksum and returns checksum information for supported GET and HEAD requests.

Apache fair queueing for management connection floods and precluster enhancements

ONTAP introduces opt-in, default-off, source-IP fair queueing on the management web server to help maintain access to REST, System Manager, and ONTAPI during management connection floods. ONTAP also supports image installation through a precluster-only REST API and enhances Dynamic Host Configuration Protocol (DHCP) handling so the precluster node-management LIF remains available through lease renewals and IP address changes while the node awaits cluster setup.

Enhanced controls for ARP/AI snapshot response policies

You can configure the ARP/AI snapshot response policy at the SVM or volume level to control whether ARP/AI creates snapshots when it detects abnormal activity. Three policies are available: alert-with-proactive-and-periodic-snapshot (default, preserves existing behavior), alert-with-proactive-snapshot (attack snapshots only, no periodic snapshots), and alert-only (alerts and event logs only, no snapshots created). After an upgrade to 9.20.1, the default periodic snapshot maximum count changes from 6 to 2, and the default retention period changes from 12 to 7 hours, unless those node-level options were previously modified.

Key management workflow improvements for data SVMs

When you enable an external key manager on a data SVM, ONTAP can automatically migrate that SVM's volume encryption keys from the admin-scope key manager to the new data-SVM key manager. This simplifies the transition to external key management and removes the need for a separate manual migration step in the standard workflow.

Support for IdP, AD, and LDAP groups as MAV approvers

MAV approval groups can include identity provider (IdP), Active Directory (AD), and LDAP (nsswitch) groups as approvers, in addition to individual administrators. Supported group types include Entra ID, ADFS, AD domain groups, and LDAP groups. Adding or removing users in the IdP, AD, or LDAP directory does not require any changes to the MAV configuration. Changes to a user's group membership take effect after re-authentication at the user's next login. You can use the security multi-admin-verify registered-operations show command to display all MAV-protectable operations available on the current cluster.

SNMPv3 SHA-512 authentication support

ONTAP supports SHA-512 authentication for SNMPv3 users. This enhancement lets you use stronger SNMPv3 authentication for external SNMP clients and for switch monitoring, including switches that require SHA-512 authentication. For more information, see Configure SNMPv3 users in an ONTAP cluster and Configure SNMPv3 for Ethernet switch health monitoring.

For more information, see Configure SNMPv3 for Ethernet switch health monitoring.

Simplified reporting of storage efficiency data reduction rates

The storage efficiency data reduction rate (DRR) provides a more precise assessment of ONTAP storage efficiency space savings by including only reducible data. In ONTAP 9.19.1 and earlier, the DRR includes both reducible and non-reducible data.

Improved performance after migrating volumes from non-QAT systems to QAT systems

ONTAP reduces additional read latency and CPU usage that can occur after volumes are migrated from systems that do not support QuickAssist Technology (QAT) to systems that do.

Automatic Dedupe Scheduler (ADS) Optimization

ONTAP improves ADS (Automatic Dedupe Scheduler) performance, allowing more concurrent dedupe sessions per node as well as smarter and more targeted throttling to better balance client I/O. Dedupe activity on DP volumes (from SnapMirror transfers) and Global Dedupe sessions is managed alongside regular volume dedupe which reduces contention and metadata growth. You can benefit from storage efficiency savings, especially under mixed workloads, with no configuration changes required. This feature is enabled by default and is available on AFF storage systems.

Support for deleting ONTAP S3 buckets that contain objects

Administrators can schedule deletion of buckets containing objects when using a configurable retention-based recovery window. This enables bucket recovery before the retention window expires. The feature reduces expiration backlog and makes capacity reusable faster for high-churn workloads.

FlexCache sizing limits increase

The number of FlexCache volumes supported increases to 2500 per node and 5000 per HA pair when using one constituent per volume.

The number of FlexCache volumes you can create from an origin volume increases to 200, and the number of writeback caches per origin increases to 50.

NVFail support with FlexCache

You can create FlexCache relationships with NVFAIL-enabled origins. You can also enable NVFAIL on cache volumes, independent of origin volumes. On origin or cache volumes where NVFAIL has occurred, ONTAP blocks data reads or mutations while preserving write-back of modified cached data, and normal I/O resumes after recovery.

Performance enhancement for asynchronous deletion

ONTAP enhances asynchronous deletion performance and accelerates space reclamation for NAS/SMB clients. Contact your NetApp representative for details.

Support for calculating reclaimable space on FlexGroup volumes

ONTAP supports recalculating reclaimable space before deleting snapshot on FlexGroup volumes.

Auto provisioning high performance FlexGroup volumes

ONTAP simplifies FlexGroup provisioning with storage profiles that let customers choose a balanced or high-performance data container for their workloads, reducing the need for administrators to manually configure and to size constituent volumes to meet performance requirements.

SMB Multichannel support with advanced capacity rebalancing

ONTAP supports using SMB Multichannel when advanced capacity balancing is enabled on FlexGroup volumes.

SVM migration support for S3 NAS buckets

ONTAP supports SVM migration for SVMs that host S3 NAS buckets on FlexVol volumes, allowing administrators to migrate SVMs without first removing S3 NAS configuration.

File System Analytics access-time preservation

File System Analytics scans and System Manager File System Explorer browsing preserve directory access-time (atime) metadata. This helps maintain accurate atime values for archival, tiering, compliance, and data lifecycle workflows.

MetroCluster IP support for ONTAP SVM capacity limits

You can configure storage limits for SVMs that are part of a MetroCluster IP configuration.

FlexCache Volume Metrics

FlexCache volume metrics report the amount of data and metadata exchanged between a FlexCache volume and its origin volume. Two new properties have been added to the existing ONTAP REST volume statistics and metrics endpoints that provide visibility into FlexCache-to-origin and origin-to-FlexCache data transfer. The counters are collected automatically with no configuration required; they are helpful for capacity planning, performance analysis, network troubleshooting, and chargeback analytics. This feature requires ONTAP 9.20 or later on both the FlexCache and origin nodes. Refer to the ONTAP automation documentation for more information.

Intra-cluster rebalancing

ONTAP introduces two new Balanced Placement capabilities to help keep clusters performing optimally, with minimal administrative effort, as your workloads and cluster capacity evolve. Provisioning-time placement control allows customers to indicate whether performance or space requirements should be prioritized when a new volume is placed through the REST API. Space Performance Rebalance (SPR) is a background process that continuously looks for developing performance hot spots or aggregate space pressure across the cluster. Depending on the configured mode, SPR either recommends corrective volume moves through EMS notifications or automatically performs the moves using standard and non-disruptive ONTAP volume move operations. Refer to the ONTAP automation documentation for more information.

Improved certificate and user password expiration alerts

System Manager displays a dashboard health alert 30 days before a cluster or storage virtual machine (SVM) certificate expires and updates it daily with the days remaining before expiration. Cluster settings can also be configured for local users to receive a top-of-page banner after logging in, beginning 14 days before their password expires.

Improved AutoSupport alerts

System Manager displays new AutoSupport alerts that can help you address AutoSupport configuration issues.